@@ -1,2 +1,7 @@
-VITE_API_URL = "https://corespan.ddnsgeek.com:8443"
-BROWSER=chrome
+# Backend API origin. Required — the dev server throws on startup if unset.
+# Point this at wherever your aistudio-server instance is reachable.
+VITE_API_URL="http://localhost:8002"
+
+# Optional: browser to open when the dev server starts (chrome, firefox,
+# safari, or a path to a binary). Leave unset to use the system default.
+BROWSER=chrome
@@ -23,16 +23,19 @@ client, UI primitives, chart wrappers — lives locally under `src/shared/`.
 
 ---
 
-## Shared Packages
+## Shared Code
 
-This app consumes the workspace packages via `workspace:*` and path aliases
-(wired in `vite.config.ts` + `tsconfig*.json`):
+There are no workspace packages and no private registry — every dependency in
+`package.json` is public on npm, so a clean `pnpm install` is all a fresh
+checkout needs.
 
-- `@corespan/ui` — shared components (peer deps only — this app provides Mantine/React/etc.)
-- `@corespan/api` — zero-dep HTTP client (`createApiClient`)
-- `@corespan/utils` — zero-dep helpers
+Shared code lives under `src/shared/` and is imported through the single `@`
+alias (`@` → `src`, wired in `vite.config.ts` + `tsconfig*.json`):
 
-Never import across workspace boundaries with relative paths — always use the `@corespan/` alias.
+- `@/shared/api` — HTTP client (`baseClient`), `API_ORIGIN`, TanStack `queryClient`
+- `@/shared/ui` — local primitives: `CoreChart`, `CoreTable`, `CoreForm`, `CoreIcon`
+
+Prefer the `@` alias over deep relative paths (`../../../shared/...`).
 
 ---
 
@@ -41,14 +44,24 @@ Never import across workspace boundaries with relative paths — always use the
 ```
 src/
 ├── app/
-│   └── App.tsx              # Mantine + QueryClient providers
+│   ├── App.tsx              # Mantine + QueryClient providers
+│   ├── constants.ts
+│   └── layout/              # AppLayout, AppFooter, PageShell
 ├── features/
-│   └── benchmarks/
-│       └── Benchmarks.tsx   # Starter page
+│   ├── about/               # AboutUs page + components
+│   └── benchmarks/          # The main feature
+│       ├── Benchmarks.tsx
+│       ├── components/      # Tables, charts, modals, log streams
+│       ├── data/            # Query keys, services
+│       ├── lib/             # Pure helpers (maskIp, toBenchmarkRows, ...)
+│       └── store/           # Zustand stores (useJupyterRunStore, ...)
 ├── shared/
-│   └── api/
-│       ├── baseClient.ts    # Single createApiClient instance — never create a second
-│       └── queryClient.ts   # TanStack QueryClient config
+│   ├── api/
+│   │   ├── baseClient.ts    # Single createApiClient instance — never create a second
+│   │   ├── config.ts        # API_ORIGIN, resolved from VITE_API_URL
+│   │   ├── core/            # Client, middleware, error types
+│   │   └── queryClient.ts   # TanStack QueryClient config
+│   └── ui/                  # CoreChart, CoreTable, CoreForm, CoreIcon
 ├── index.css
 └── main.tsx                 # React 19 StrictMode entry point
 ```
@@ -64,6 +77,11 @@ import it — never instantiate a second client.
 
 ## Development Proxy
 
-The Vite config has no backend proxy yet. When the app needs to call the backend,
-add a proxy block mirroring `apps/composer/vite.config.ts` and document the required
-`.env` vars here (see `.env.example`).
+`vite.config.ts` proxies two paths to `VITE_API_URL`:
+
+- `/api` — the versioned API namespace
+- `/health` — the backend's health probe, which sits at the root rather than
+  under `/api/v1` and so needs its own entry
+
+`VITE_API_URL` is **required** — the dev server throws on startup without it.
+Copy `.env.example` to `.env` and point it at your backend.
@@ -1653,6 +1653,8 @@ Licence: (MIT OR CC0-1.0)
 Author:  Sindre Sorhus
 Source:  https://github.com/sindresorhus/type-fest#readme
 
+    ── license-cc0 ──
+
     Creative Commons Legal Code
 
     CC0 1.0 Universal
@@ -1775,6 +1777,18 @@ Source:  https://github.com/sindresorhus/type-fest#readme
         party to this document and has no duty or obligation with respect to
         this CC0 or use of the Work.
 
+    ── license-mit ──
+
+    MIT License
+
+    Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 ------------------------------------------------------------------------
 
 use-callback-ref@1.3.3
 
@@ -9,7 +9,7 @@
  * Usage:  pnpm compliance
  */
 
-import { execFileSync } from 'node:child_process'
+import { execFileSync, execSync } from 'node:child_process'
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -242,11 +242,16 @@ section('Build output')
     }
   } else {
     try {
-      execFileSync('pnpm', ['build'], {
+      const buildOptions = {
         cwd: APP,
         stdio: 'inherit',
         env: { ...process.env, VITE_API_URL: process.env.VITE_API_URL || 'https://example.invalid' },
-      })
+      }
+      // `pnpm` is a .cmd on Windows and Node refuses to spawn one without a
+      // shell — see the longer note on runPnpm in
+      // generate-third-party-notices.mjs.
+      if (process.platform === 'win32') execSync('pnpm build', buildOptions)
+      else execFileSync('pnpm', ['build'], buildOptions)
     } catch {
       fail('build failed')
     }
 
@@ -50,7 +50,7 @@
  *   node scripts/generate-third-party-notices.mjs --check   # CI: fail if stale
  */
 
-import { execFileSync } from 'node:child_process'
+import { execFileSync, execSync } from 'node:child_process'
 import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -77,6 +77,27 @@ const CHECK = process.argv.includes('--check')
  */
 const normalise = (text) => text.replace(/\r\n?/g, '\n').replace(/[ \t]+$/gm, '')
 
+/**
+ * Run pnpm and capture its output, on Windows as well as POSIX.
+ *
+ * `pnpm` on PATH is a shim: an extensionless script on POSIX, `pnpm.cmd` on
+ * Windows. Since Node 20.12 (the CVE-2024-27980 fix) spawning a `.cmd` without
+ * a shell is refused, so `execFileSync('pnpm', ...)` failed here with ENOENT —
+ * which the catch below reported as "run `pnpm install` first", sending anyone
+ * who hit it after an install that had worked fine.
+ *
+ * Windows therefore needs a shell. Passing an args array *and* `shell: true`
+ * concatenates them unescaped and warns (DEP0190), so the command is built as
+ * one string instead. Every argument here is a literal — nothing is
+ * interpolated from the environment or the lockfile — so there is nothing for
+ * cmd.exe to misparse. POSIX keeps the no-shell path, which is what CI runs.
+ */
+function runPnpm(args, options) {
+  return process.platform === 'win32'
+    ? execSync(`pnpm ${args.join(' ')}`, options)
+    : execFileSync('pnpm', args, options)
+}
+
 /** Filenames that hold a licence text, in order of preference. */
 const LICENCE_FILENAMES = [
   'LICENSE',
@@ -107,7 +128,7 @@ function readProductionPackages() {
   // licence text can be read rather than guessed from an SPDX string.
   let raw
   try {
-    raw = execFileSync('pnpm', ['licenses', 'list', '--prod', '--json'], {
+    raw = runPnpm(['licenses', 'list', '--prod', '--json'], {
       cwd: ROOT,
       encoding: 'utf8',
       maxBuffer: 64 * 1024 * 1024,
@@ -141,26 +162,64 @@ function readProductionPackages() {
   return packages
 }
 
+/**
+ * Read the licence text a package ships on disk.
+ *
+ * Every filename decision below goes through one `readdirSync` listing rather
+ * than `existsSync` probes. That is deliberate, and it is the fix for a bug
+ * that only appeared once this script was first run on Windows:
+ *
+ *   NTFS is case-insensitive, so `existsSync('.../LICENSE-MIT')` returns true
+ *   for a file actually named `license-mit`. `type-fest` is dual `MIT OR
+ *   CC0-1.0` and ships both `license-mit` and `license-cc0`. On Linux the
+ *   preference list missed both and the fallback picked CC0; on Windows
+ *   `LICENSE-MIT` matched case-insensitively and won. Same commit, same
+ *   lockfile, 120 lines of difference — and `--check` called the committed
+ *   artifact stale on a clean checkout.
+ *
+ * Matching against the real listing makes the preference list mean what it
+ * says on both platforms. `readdirSync` order is filesystem-defined, so the
+ * fallback sorts before choosing; without that the output would still depend
+ * on the machine that produced it.
+ */
 function readLicenceText(pkgPath) {
   if (!existsSync(pkgPath)) return null
 
-  for (const filename of LICENCE_FILENAMES) {
-    const candidate = join(pkgPath, filename)
-    if (existsSync(candidate)) {
-      try {
-        return normalise(readFileSync(candidate, 'utf8')).trim()
-      } catch {
-        /* fall through to the next candidate */
-      }
+  let entries
+  try {
+    entries = readdirSync(pkgPath)
+  } catch {
+    return null // unreadable directory — reported as missing below
+  }
+
+  const read = (filename) => {
+    try {
+      return normalise(readFileSync(join(pkgPath, filename), 'utf8')).trim()
+    } catch {
+      return null
     }
   }
 
+  for (const filename of LICENCE_FILENAMES) {
+    if (!entries.includes(filename)) continue
+    const text = read(filename)
+    if (text) return text
+  }
+
   // Some packages name the file unpredictably (LICENSE-APACHE, COPYING, ...).
-  try {
-    const match = readdirSync(pkgPath).find((f) => /^(licen[cs]e|copying)/i.test(f))
-    if (match) return normalise(readFileSync(join(pkgPath, match), 'utf8')).trim()
-  } catch {
-    /* unreadable directory — reported as missing below */
+  // A package that ships more than one is telling us something — usually that
+  // it is dual-licensed — so reproduce all of them, labelled, rather than
+  // picking one and discarding the choice the manifest advertises.
+  const matches = entries.filter((f) => /^(licen[cs]e|copying)/i.test(f)).sort()
+
+  if (matches.length === 1) return read(matches[0])
+
+  if (matches.length > 1) {
+    const texts = matches
+      .map((f) => ({ f, text: read(f) }))
+      .filter(({ text }) => text)
+      .map(({ f, text }) => `── ${f} ──\n\n${text}`)
+    if (texts.length) return texts.join('\n\n')
   }
 
   return null
 
@@ -276,7 +276,7 @@ export const StartBenchmarkModal = ({ opened, onClose }: StartBenchmarkModalProp
                   <Paper withBorder radius="md" p="lg" shadow="xs">
                     <Autocomplete
                       label="Node IP"
-                      placeholder="Type or paste a machine IP (e.g. 10.6.12.22)"
+                      placeholder="Type or paste a machine IP (e.g. 10.0.0.12)"
                       description={
                         nodes.data && nodes.data.length > 0
                           ? 'Previously used machines appear as suggestions'
 
@@ -36,7 +36,7 @@ export const toNamedOptions = (raw: unknown): ComboboxData => toOptions(raw)
 
 /**
  * Normalize /nodes into Machine IP options. Value is the node's IP; label adds
- * the hostname/name when present (e.g. "10.6.82.45 (bench-01)").
+ * the hostname/name when present (e.g. "192.0.2.45 (bench-01)").
  */
 export const toNodeOptions = (raw: unknown): ComboboxData =>
   unwrap(raw)
 
@@ -1,11 +1,14 @@
 // Masks the host-identifying half of every IPv4 address found in a string —
 // keeps the first two octets (useful for spotting which subnet/rack a machine
-// is on) and replaces the last two with a bullet, e.g. "10.6.82.45" becomes
-// "10.6.•.•". Regex-based so it works equally on a bare IP ("10.6.82.45"), a
+// is on) and replaces the last two with a bullet, e.g. "192.0.2.45" becomes
+// "192.0.•.•". Regex-based so it works equally on a bare IP ("192.0.2.45"), a
 // comma-joined list of them (`machineIp` — see `toBenchmarkRows.ts`), or an
 // IP embedded in a longer string like a notebook URL
-// ("http://10.6.82.45:8888/lab" -> "http://10.6.•.•:8888/lab"). Strings with
+// ("http://192.0.2.45:8888/lab" -> "http://192.0.•.•:8888/lab"). Strings with
 // no IPv4-shaped substring (hostnames, "—", "") pass through unchanged.
+//
+// Addresses in these comments are from 192.0.2.0/24, the RFC 5737
+// documentation range, so no real host is named in a public repository.
 const IPV4_PATTERN = /\b(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\b/g
 
 export const maskIp = (value: string | null | undefined): string => {
 
@@ -6,9 +6,10 @@ import type { JupyterRun, JupyterRunStore } from '../types'
 
 // The notebook URL isn't in the launch response — it arrives later in the log
 // stream on the definitive ready line, e.g.
-// "✓ Jupyter Lab running at: http://10.6.12.22:8899/lab". Match only that line
-// (not any stray "running at" log) so the URL — and the Open button — surface
-// exactly when Jupyter is actually ready.
+// "✓ Jupyter Lab running at: http://192.0.2.22:8899/lab" (a RFC 5737
+// documentation address, not a real host). Match only that line — not any
+// stray "running at" log — so the URL, and the Open button, surface exactly
+// when Jupyter is actually ready.
 const extractUrlFromLog = (line: string): string | null => {
   const match = line.match(/jupyter\s*lab\s+running at:?\s*(https?:\/\/\S+)/i)
   return match ? match[1].replace(/[.,)]+$/, '') : null