Dashboard

Your own avatars at a glance: a family summary, then one compact tile per avatar that opens into its agent card with its status, skill levels, quests, wealth and gear, and the scripts it wrote (its skills). It is personal: you only ever see your own avatars, nobody else's, and nobody else sees yours. Only signed-in people can open it; there is no public version, and it is read-only.

Environment	Page
TEST	test.autorune.xyz/dashboard (sign-in required)

It replaces the skill dashboard: the old /skill-dashboard address no longer exists (it opens the app's home, with no redirect), and neither does the former skill market.

Who can see it

• You, signed in, and only your own avatars. Signed out, the page shows the normal sign-in screen; after signing in with Discord you land back on the dashboard. The API behind it answers 401 without a session and returns only your own avatars and their rows: no other family, no family names, no Discord usernames, no game account names.
• Never agents. Your avatars don't see this page: their wealth stays with you, and a private script stays private from its siblings exactly as before (an avatar only sees its siblings' shared skills, through its skill library: Skills and learning). The sandbox gate forwards nothing but the public hiscores, and refuses the dashboard's addresses (and the old skill dashboard's and skill market's names, in any case, separator or encoding) with 403. See Security and privacy.

Using the page

The page opens with a one-line reminder (only you see this page; agents never do) and a Back to AutoRune link. It is built for phones (from 360 px wide, safe areas respected) and scrolls on its own. The app's settings link to it (the Dashboard icon next to 📜 avatar logs and 🏆 hiscores).

Family summary at the top: how many of your avatars are running and stopped, their combined wealth (est. when any is estimated), their total quest points and how many family skills they share.

Under it, your family sharing bar (how many runs and what score a script with the @skill header needs to be shared with your other avatars) and the Eager family sharing switch (5 runs and 600 standard, 3 and 500 eager; details). It is an account preference: it follows you to every device, and the bar and the private scripts' progress lines follow it at once. With it on, a short note says your avatars hear that you want proven routines shared (what to share stays their choice).

Sort: Running (the default: running avatars first, then by name), Name, Level (total level, highest first) or Wealth (highest first). An avatar without the number sorts last.

One tile per avatar, closed, so four or five avatars fit on one phone screen (and fifteen stay a short scroll): a status dot, the name, its wealth (* when estimated), the short status (Running · Fletching longbows, Stopped · AI provider rejected the key), and its total level, combat level, quest points and number of 👪 family scripts. An avatar that has never been in the game says Not in the game yet.

Tap a tile (or focus it and press Enter or Space: tiles are buttons) to open its full agent card below the tile; tap again to close it. One card is open at a time: opening another closes the first. The open avatar is named in the address, for example /dashboard#bowmaker (its name in lowercase, spaces as dashes), so a link or bookmark opens that avatar's card directly. A card's contents are only built when it is opened, so the page stays quick with many avatars.

On tablets and desktops the tiles form a grid of two or three columns; an open card spans the whole width, and the tiles after it fill the row it left.

An agent card

Top: the tile itself (name, status, levels, quest points, wealth), then when the numbers are from: Live while it is in the game, otherwise Last seen and the time of its last game save, and its quest points of the world's total. An avatar that has never been in the game says Not in the game yet and shows no stats.

Wealth: coins plus items (est. / * when some item never sold on the Grand Exchange), with coins and items apart.

Skill levels: every game skill with its level (the XP on hover).

Worn: the items it wears.

Behind a tap:

• Quests: how many of the world's quests it completed, and the list with each quest's points.
• Backpack: what it carries.
• Scripts: the scripts it wrote, which AutoRune calls skills. Each shows its name, a 👪 Family tag once it is shared with your other avatars (🔒 otherwise), its version (v3 · 2 versions), its score 0–1000 (green from 700, yellow from 400) and its runs and ok runs. A private script also shows its way to being shared, for example @skill header · 3/5 runs · score 540/600 · shared once it qualifies, @skill header · qualifies: shared at its avatar's next turn, or No @skill header: stays private. A family skill shows the version its siblings get (the newest shared version that proved itself). Tap a script for what it does (the goal from its @skill header as plain text: secrets, code, paths and links removed, at most 300 characters) and View code.

View code (your scripts only, family and private alike): loaded when you open it, the current version first, another one from the version list. Plain text in a monospace box that scrolls sideways inside itself, with Copy and Download (saves the version shown as <name>-v<version>.ts, made in the browser from the same response: no download link or endpoint).

Where the numbers come from

What	Running avatar	Stopped avatar
Skill levels, total and combat level	live: the game state the gateway holds for it (read-only, the same frame the runner reads)	its last game save
Worn items, backpack	live	last game save
Quests and quest points	last game save	last game save
Wealth	last game save, valued like the wealth board	the same
Status	the app's own state	the same, with the reason it stopped

The game saves an avatar when it logs out, every 15 minutes while it plays, and at Grand Exchange trades, so a running avatar's quests and wealth can be up to about 15 minutes old: the open card says Quests and wealth as of the last game save and the time. If the live game state can't be read, a running avatar's card falls back to its last save and says Last saved.

Quests are read from the quest progress in the save, by the game's own quest point rules (the same ones the game uses to count your quest points), so the points always match what the avatar sees in its quest list. Wealth is the same figure as on the hiscores' wealth board: coins plus every item in the bank, backpack, worn and in Grand Exchange offers, each at its last Grand Exchange sale price (an item never sold there at its shop value, and marked est.). Nothing new is stored for the dashboard: everything is read when you open it.

What it never shows

• anything of another account: avatars, stats, wealth, scripts, family names, Discord usernames;
• your avatars' game account names, execute_code snippets and lab logs;
• internal ids other than your own avatars' and scripts', emails, file paths.

The dashboard itself never carries code: its schema is strict and a test asserts that no script or code field ever appears in it. Code only comes through its own request, for you.

The API

GET /dashboard with the app's normal session (Bearer access token), read-only:

• 401 without a session; rate-limited per user (429 with Retry-After); cached per user for 30 seconds; private, no-store;
• only your own avatars and rows (the sources read that owner's rows alone, and the route filters again);
• response: agents[] (id, name, status, activity, stop, stats, scripts) and bar (minUses, minScore, eager: your sharing bar). stats is null before the avatar's first time in the game, else live, liveAt, savedAt, skills[] (id, name, level, xp), totalLevel, combatLevel, quests (points, maxPoints, completed[] with name and points, total; null if the world's quest list can't be read), wealth (total, coins, items, estimated), equipment[] and inventory[] (name, count). A script: id, kind (family or private), name, description, version, versions, score, runs, ok, lastUsed, headed (its avatar gave it the @skill header).

GET /dashboard/scripts/:id/code (optionally ?version=N), same session, read-only:

• returns name, version, versions and script for one of your own scripts: a family skill (its shared versions) or a private script (any of its versions);
• anyone else, an unknown id or version, a family skill's private draft: 404 (never 403, so it doesn't confirm that a script exists); 401 without a session; rate-limited per user;
• the script was scrubbed of secrets when it was recorded and is scrubbed again on the way out (your avatars' passwords, credential-looking lines); never cached by the browser (private, no-store), never reachable by agents.

The old /skill-dashboard and /skill-market API routes are removed. The operator console's skills view (/admin/skills) is unchanged.