Konglo OS

A private family-office operating system.

One real-time, iOS-flavored workspace that unifies a family's entire wealth — businesses, cash, markets, property, succession, philanthropy, health and staff — behind server-enforced role-based access and a deferential AI ajudan (aide).

Live demo · Features · Architecture · AI roadmap · Quickstart

What it is. Most wealth dashboards are cloud SaaS you must trust with your most sensitive data. Konglo OS is the opposite: a self-hostable, single-tenant OS where the data lives on your infrastructure, access is enforced on the server (not hidden in the UI), and the succession plan is principal-only by construction. The seed data here is a fictional conglomerate — a capability showcase, not a real family's books.

---

📸 Screenshots

Dark-luxury, iOS-flavored. Captured live from the demo (sign in as "Lihat demo langsung" for read-only mock data — a fictional conglomerate).

Landing — cinematic marketing page	Beranda — AI launcher + today's signals
Portofolio Bisnis — subsidiaries, holding map, live P&L	Investasi Pasar — performance, allocation, holdings
Relasi & Jaringan — VIP contacts, follow-ups, meeting log	Login — Google · Password · Anonymous demo

_{The shell is fully responsive — on phones it collapses to a native-iOS layout (fixed-viewport scroll, 5-slot dock with a center Asisten button).}

---

✨ Features

Eleven wealth domains plus a data studio, an AI assistant, and analytics — each a self-contained vertical slice.

Domain	What it does
Beranda	Home dashboard — real-time net-worth headline, portfolio allocation, today's rule-based signals
Portofolio Bisnis	Subsidiary / operating-company registry (revenue, margin, ownership, trend, governance)
Kekayaan & Kas	Wealth & liquidity — cash flow, accounts, net-worth figures
Investasi Pasar	Market holdings (stocks, bonds, instruments) with weights, sectors, sparklines
Properti & Aset	Estate registry — real estate, vehicles, valuables with status & maintenance
Keluarga & Warisan	Family, trust & succession plan (heirs / ahli waris, readiness, mandates) — principal-only
Filantropi	Foundation programs / grants plus measured cross-program impact
Kesehatan	Concierge medical team, appointment schedule, daily health programs
Gaya Hidup	Lifestyle events + a concierge (jet / yacht / resto / tickets) request desk
Relasi & Jaringan	VIP contact directory, tiered by category and relationship warmth
Keamanan & Staf	Staff roster, per-property security zones, CCTV / gate / patrol / panic metrics
Studio Data	Notion-style generic CRUD over every business table — column validators, select options, optimistic-concurrency edits
Asisten	AI chat aide, opened from the launcher search and the mobile dock's center button
Pengaturan	Data management (load / replace / clear sample data), full-dataset version history, owner honorific (Tuan / Nyonya)
Admin & Akses	User & role management (grant / revoke principal / cfo / staf)

Plus: theme presets (light / dark / system + per-preset radius), first-run onboarding, cookieless privacy-preserving analytics, and a read-only demo mode backed by in-code mock data that never touches real records.

Feature domains at a glance

mindmap
  root((Konglo OS))
    Wealth
      Beranda / net worth
      Kekayaan & Kas
      Investasi Pasar
    Business
      Portofolio Bisnis
      Studio Data (CRUD)
    Estate
      Properti & Aset
      Keluarga & Warisan
    People
      Relasi & Jaringan
      Kesehatan
      Keamanan & Staf
      Filantropi
    Platform
      Asisten (AI)
      Analytics
      Theme presets
      RBAC & Admin

Loading

---

🏗 Architecture

Next.js 16 App Router with proxy.ts (not middleware.ts) as the route gate, talking to a reactive Convex backend over a websocket. Every server function is auth-gated; the AI path and analytics are isolated.

flowchart TD
    U([Browser]) -->|HTTPS| P[Next.js 16 App Router<br/>proxy.ts — session + route gate]
    P -->|/ · /login — public| M[Marketing + Auth]
    P -->|/os/* — authed| S[OS Shell<br/>vertical-slice screens · registry.tsx]
    M -->|signIn| A["@convex-dev/auth<br/>Password · Anonymous · Google"]
    S -->|useQuery / useMutation<br/>reactive WebSocket| C{{Convex<br/>DB + functions}}
    A --> C
    C -->|requireUser · requireAdmin · requirePrincipal| DB[(Tables + roles)]
    S -.->|Asisten prompt| AI["aiChat action ·use node·<br/>chatGuard: role + rate-limit"]
    AI -->|Vercel AI SDK| ANT([Anthropic API])
    P -->|/api/analytics| AN[Cookieless pageview<br/>geoip-lite → geo, IP discarded]
    AN --> C

Loading

Request flow. proxy.ts runs on every non-static request: it serves /api/auth, refreshes the session cookie, then gates routes — / and /login are public, /os/* requires a session (else redirect to /login). The shell lazily code-splits each menu slug to a client screen. Client components call Convex via React hooks; every public function validates its args with v.* and calls requireUser / requireAdmin / requirePrincipal before touching data. rbac.me resolves the caller's role and flags anonymous demo sessions. The Asisten action authenticates first, then a chatGuard mutation (role check + per-user rate limit) runs before calling Anthropic.

---

🔐 Roles (RBAC)

Access is enforced server-side in every Convex function — the UI merely reflects what the server already permits. SSOT: lib/roles.ts + convex/_shared/auth.ts.

Capability	principal (owner)	cfo (ajudan)	staf	demo / anon
Beranda, business & wealth screens	✅	✅	—	read-only mock
Studio Data CRUD (business tables)	✅	✅	—	—
Keluarga & Warisan (succession / heirs)	✅	🚫 hidden + blocked	—	—
Security & staff (Keamanan)	✅	—	✅	—
Settings, data management, version history	✅	—	—	—
Admin — grant / revoke roles	✅	—	—	—

SEC-001. cfo is deliberately the business-table DB admin via Studio Data — but heirs carries a sensitivity: "principal" flag, so the generic CRUD layer also calls requirePrincipal for it. The admin surface is not a back door into the estate plan. Covered by tests/convex/authz.test.ts.

---

🤖 AI integration & roadmap

The Asisten is a deferential Indonesian aide that addresses the owner by their chosen honorific (Tuan / Nyonya) and frames answers around the family's holdings.

Shipped today

• Persistent Asisten threads — Convex stores user/assistant turns per owner, restores recent history, and lets the UI create or switch conversations. History is server-owned; the browser no longer sends an authoritative transcript.
• Grounded tool-calling — Anthropic must choose one bounded server tool before it answers. Live subsidiary/holding/property or Studio Data reads are re-authorized in Convex, and grounded answers carry a Sumber: footer instead of inventing figures.
• True streaming — /api/ai/stream proxies Anthropic SSE through a Convex HTTP action; the Asisten renders text deltas as they arrive and persists the completed turn afterwards.
• Proactive signals + guarded natural-language edits — deterministic concentration, margin, control and trend rules surface live risks. An edit request produces a validated Studio Data proposal; nothing is written until the user presses Konfirmasi perubahan, then the existing RBAC + optimistic-version updateRow mutation performs the write.
• External MCP — /mcp exposes three read-only tools (group_snapshot, proactive_insights, studio_rows). Principal-only tokens are random, shown once, stored only as SHA-256 digests and independently revocable.
• Security gate — the existing chatGuard still rejects role-less callers and applies the per-user rate-limit bucket (~30 replies / 10 min). Tool reads and confirmed writes also pass through their own role/table guards.

AI backlog

• Persistent threads and follow-ups.
• Tool-calling / live-data grounding with source attribution.
• Streaming responses.
• Proactive insights + confirm-before-write Studio Data edits.
• MCP server for external assistants.

---

🧱 Tech stack

• Next.js 16 (App Router, proxy.ts), React 19
• Tailwind CSS v4 via @tailwindcss/postcss — no tailwind.config; @theme tokens in app/globals.css
• Convex — reactive DB + queries / mutations / actions (_generated committed)
• @convex-dev/auth — Password + Anonymous + env-gated Google OAuth; @convex-dev/rate-limiter
• Vercel AI SDK + @ai-sdk/anthropic for the Asisten
• radix-ui + shadcn-style primitives, lucide-react, next-themes + vendored tweakcn presets
• TypeScript 5 (strict), pnpm, Vitest 3 (jsdom + convex-test) and Playwright e2e
• Ships as a standalone Docker image (output: "standalone") — deploy anywhere

---

🚀 Quickstart

pnpm install
npx convex dev --once --local     # bootstrap a local Convex + generate types
pnpm dev                          # http://localhost:3000

Copy .env.example → .env.local and set your Convex URLs. For production, pass NEXT_PUBLIC_CONVEX_URL / NEXT_PUBLIC_CONVEX_SITE_URL as build args (they're baked into the client bundle) and set your owner email via PRINCIPAL_EMAIL. Google OAuth is optional and env-gated. See CONTRIBUTING.md for the commit gate and deploy notes.

Seed accounts

The seed creates [email protected] (principal) and [email protected] (cfo); the password is supplied at seed time via env, never committed. DEMO_MODE=1 renders a quick-login on /login — handy for a public showcase, but it publishes the demo password, so keep it off for any real tenant.

---

🗂 Project structure

app/                      Next routes — /, /login, /os, /pendekatan, /api/*
proxy.ts                  session refresh + route gating (not middleware.ts)
frontend/
  slices/<slug>/          one feature per folder — registry.tsx + menu.ts SSOT
  shared/                 cross-slice UI barrel (@/frontend/shared)
convex/
  features/<slug>/        schema.ts + queries.ts + mutations.ts per feature
  _shared/                requireUser / requireAdmin / requirePrincipal, db helpers
  schema.ts               table definitions
lib/                      roles.ts (RBAC SSOT) · format.ts (id-ID Rupiah) · utils.ts
tests/                    vitest — lib, jsdom components, convex-test (RBAC / authz)

---

🧪 Testing

pnpm test           # full vitest run (lib + jsdom components + convex)
pnpm test:convex    # convex-test suite only (queries / mutations / RBAC)

---

📬 Contact

Questions, a live walkthrough, or an engagement — reach out: [email protected].

📄 License

MIT © rahmanef63. The code is yours to use, fork and adapt. It ships with fictional showcase data only — no real family's records are included.