@crewhaus/hangar-ui 0.6.0 → 0.8.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,9 @@
+CrewHaus Factory
+Copyright 2026 Max Meier
+
+This product includes software developed by Max Meier
+(operating as StudioMax — https://studiomax.io) and contributors.
+
+The CrewHaus name and logo are trademarks of Max Meier. See
+https://github.com/crewhaus/factory/blob/main/TRADEMARK.md for the
+use-of-marks policy.

package/README.md

@@ -125,7 +125,10 @@ eight new harness tabs and three new fleet screens:
 - **Memory** (`#/h/<id>/memory`) gains the fabric's write side — facts with
   forget/sweep (tombstones, never a delete), continuity trash + restore, the
   wiki editor with `expectedVersion` and its stale retry, watch-me analytics,
-  reports, intents and the synthesize review.
+  reports, intents and the synthesize review. A plan step or goal proven by
+  assertion under `continuity.proof: off` shows as an amber
+  `proven (unverified)`, with the refs it cited in its tooltip, never as a
+  green proven.
 - **Datasets** (`#/h/<id>/data`), **Feedback** (`#/h/<id>/feedback`) and the
   eval lab inside **Evals** cover the quality loops: registry + hygiene +
   growth, the fewshot/faq/lessons/advice feeds, and the matrix / trends /

package/assets/js/dom.js

@@ -142,21 +142,64 @@ export function toast(message, kind = "error") {
   return node;
 }
 
-/** Click-to-copy button (clipboard API; silently no-ops when unavailable). */
-export function copyBtn(value, label = "copy") {
-  const btn = el("button", { class: "btn btn-ghost btn-copy", type: "button", text: label });
-  btn.addEventListener("click", async () => {
+/**
+ * Copy `text`, falling back to the old selection trick.
+ *
+ * `navigator.clipboard` is a secure-context API. `127.0.0.1` counts as
+ * secure, so on the loopback console it always works — and over
+ * `http://192.168.x.x`, which is what `crewhaus hangar --lan` serves, the
+ * whole object is `undefined` and every copy button in the console reads
+ * "copy failed". That is invisible until someone opens the console from a
+ * phone, which is exactly who cannot retype a harness directory by hand.
+ *
+ * The fallback is `document.execCommand("copy")` over a throwaway textarea:
+ * deprecated, still implemented everywhere, and not gated on a secure
+ * context. The textarea is positioned off-screen rather than hidden because
+ * a `display: none` element cannot hold a selection.
+ */
+async function writeClipboard(text) {
+  if (navigator.clipboard !== undefined) {
     try {
-      await navigator.clipboard.writeText(value);
-      btn.textContent = "copied";
-      btn.classList.add("ok");
-      setTimeout(() => {
-        btn.textContent = label;
-        btn.classList.remove("ok");
-      }, 1200);
+      await navigator.clipboard.writeText(text);
+      return true;
     } catch {
-      btn.textContent = "copy failed";
+      // Permission refused, or a non-secure context that still exposes the
+      // object. Fall through rather than giving up.
     }
+  }
+  const scratch = el("textarea");
+  scratch.value = text;
+  scratch.setAttribute("readonly", "readonly");
+  scratch.setAttribute("aria-hidden", "true");
+  // Off-screen rather than hidden: a `display: none` element cannot hold a
+  // selection, and `opacity: 0` alone would still scroll the page.
+  scratch.style.position = "fixed";
+  scratch.style.top = "-1000px";
+  scratch.style.opacity = "0";
+  document.body.appendChild(scratch);
+  try {
+    scratch.select();
+    scratch.setSelectionRange(0, text.length);
+    return document.execCommand("copy");
+  } catch {
+    return false;
+  } finally {
+    scratch.remove();
+  }
+}
+
+/** Click-to-copy button. Works on the loopback console and over a LAN
+ *  address alike — see {@link writeClipboard}. */
+export function copyBtn(value, label = "copy") {
+  const btn = el("button", { class: "btn btn-ghost btn-copy", type: "button", text: label });
+  btn.addEventListener("click", async () => {
+    const copied = await writeClipboard(value);
+    btn.textContent = copied ? "copied" : "copy failed";
+    if (copied) btn.classList.add("ok");
+    setTimeout(() => {
+      btn.textContent = label;
+      btn.classList.remove("ok");
+    }, 1200);
   });
   return btn;
 }

package/assets/js/markdown.js

@@ -47,11 +47,26 @@ export function parseInline(src) {
   return spans;
 }
 
-const HEADING_RE = /^(#{1,6})\s+(.*)$/;
-const UL_ITEM_RE = /^\s*[-*]\s+(.*)$/;
-const OL_ITEM_RE = /^\s*\d+[.)]\s+(.*)$/;
+// Each block pattern reads only its marker and the blanks after it; the rest
+// of the line is the text. A line can still hold a break the split on "\n"
+// leaves (\r, U+2028, U+2029), and such a line is not a block: a trailing
+// `(.*)$` refused it by giving the blanks back one at a time and reading the
+// rest again after each, quadratic in the blanks, on agent-written memory and
+// feedback text in the operator's tab. The rest is now checked once.
+const HEADING_RE = /^(#{1,6})\s+/;
+const UL_ITEM_RE = /^\s*[-*]\s+/;
+const OL_ITEM_RE = /^\s*\d+[.)]\s+/;
+const LINE_BREAK_RE = /[\n\r\u2028\u2029]/;
 const FENCE_RE = /^```/;
 
+/** `head`'s match and the rest of the line after it; null when it does not match or the rest holds a break. */
+function blockAt(line, head) {
+  const match = line.match(head);
+  if (match === null) return null;
+  const rest = line.slice(match[0].length);
+  return LINE_BREAK_RE.test(rest) ? null : { match, rest };
+}
+
 /**
  * Parse a markdown source string into a flat list of block tokens:
  *   { type: "heading", level, spans }
@@ -93,20 +108,24 @@ export function parseMarkdown(src) {
       blocks.push({ type: "code", text: body.join("\n") });
       continue;
     }
-    const heading = line.match(HEADING_RE);
+    const heading = blockAt(line, HEADING_RE);
     if (heading) {
       flushPara();
       flushList();
-      blocks.push({ type: "heading", level: heading[1].length, spans: parseInline(heading[2]) });
+      blocks.push({
+        type: "heading",
+        level: heading.match[1].length,
+        spans: parseInline(heading.rest),
+      });
       i += 1;
       continue;
     }
-    const ul = line.match(UL_ITEM_RE);
-    const ol = ul === null ? line.match(OL_ITEM_RE) : null;
+    const ul = blockAt(line, UL_ITEM_RE);
+    const ol = ul === null ? blockAt(line, OL_ITEM_RE) : null;
     if (ul || ol) {
       flushPara();
       const ordered = ol !== null;
-      const item = parseInline((ul ?? ol)[1]);
+      const item = parseInline((ul ?? ol).rest);
       if (list === null || list.ordered !== ordered) {
         flushList();
         list = { type: "list", ordered, items: [] };

package/assets/js/views/channels.js

@@ -28,6 +28,51 @@ import { api } from "../api.js";
 import { clear, collapsible, dot, el, jsonPre, numberedCode, skeleton, toast } from "../dom.js";
 import { m3, m3Card, m3Empty } from "./creds.js";
 
+/**
+ * True when `hostname` names this machine — the browser-side half of the
+ * CLI's `isLoopbackHost`, deliberately re-implemented rather than imported:
+ * the console's JS is hand-written browser ES modules with no build step and
+ * no imports out of `assets/`.
+ *
+ * `location.hostname` hands IPv6 literals over WITHOUT their brackets, so
+ * `::1` arrives bare; both spellings are accepted. An empty hostname (a
+ * `file://` document) is NOT loopback — falling through to the honest note
+ * is the safe direction to be wrong in.
+ */
+export function isLoopbackHostname(hostname) {
+  const host = typeof hostname === "string" ? hostname.trim().toLowerCase() : "";
+  if (host === "") return false;
+  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  if (bare === "localhost") return true;
+  if (bare === "::1" || bare === "0:0:0:0:0:0:0:1") return true;
+  // The whole of 127.0.0.0/8 — a daemon on 127.0.0.2 is every bit as local.
+  const octets = bare.split(".");
+  if (octets.length !== 4) return false;
+  if (!octets.every((o) => /^\d{1,3}$/.test(o) && Number(o) <= 255)) return false;
+  return octets[0] === "127";
+}
+
+/**
+ * Whether to OFFER the daemon's dashboard as a link, or just name it.
+ *
+ * The daemon's control-UI port is loopback by design — `service-setup`
+ * never tunnels it and it carries no auth — so the address the server sends
+ * is only usable by a browser sitting at that machine. Since
+ * `crewhaus hangar --lan` puts this console on a phone, "usable" is now a
+ * question with two answers, and only the browser can tell which: it knows
+ * the host it reached the console on.
+ *
+ * A link that quietly goes nowhere is worse than a line of text that says
+ * where the thing is, so a remote viewer gets the address and the reason
+ * instead of a dead anchor.
+ */
+export function dashboardReach(dashboardUrl, viewerHostname) {
+  if (typeof dashboardUrl !== "string" || dashboardUrl === "") return null;
+  return isLoopbackHostname(viewerHostname)
+    ? { reachable: true, url: dashboardUrl }
+    : { reachable: false, url: dashboardUrl };
+}
+
 export async function renderChannels(root, ctx) {
   clear(root).appendChild(skeleton(5));
   const [channelsAnswer, gatewayAnswer] = await Promise.all([
@@ -431,16 +476,28 @@ function gatewayCard(body) {
         : null,
     ]),
   ];
-  if (typeof body.dashboardUrl === "string") {
+  const reach = dashboardReach(body.dashboardUrl, window.location.hostname);
+  if (reach !== null) {
     nodes.push(
-      el("p", null, [
-        el("a", {
-          href: body.dashboardUrl,
-          target: "_blank",
-          rel: "noreferrer",
-          text: "open the daemon's own dashboard",
-        }),
-      ]),
+      el(
+        "p",
+        null,
+        reach.reachable
+          ? [
+              el("a", {
+                href: reach.url,
+                target: "_blank",
+                rel: "noreferrer",
+                text: "open the daemon's own dashboard",
+              }),
+            ]
+          : [
+              el("span", {
+                class: "muted",
+                text: `the daemon's own dashboard is at ${reach.url} — it binds loopback and is not tunnelled, so it opens only from the machine running the daemon, not from here`,
+              }),
+            ],
+      ),
     );
   }
   if (body.status !== null && body.status !== undefined) {

package/assets/js/views/memory-fabric.js

@@ -755,7 +755,7 @@ function plansCard(data, ctx) {
                 { class: "check-list" },
                 (Array.isArray(plan.steps) ? plan.steps : []).map((step) =>
                   el("li", null, [
-                    dot(ladderTone(step.status), String(step.status ?? "")),
+                    ladderDot(step),
                     el("span", { text: ` ${String(step.text ?? "")}` }),
                     ...(Array.isArray(step.proofs) ? step.proofs : []).map((proof) =>
                       el("a", {
@@ -782,6 +782,43 @@ function ladderTone(status) {
   return "off";
 }
 
+/**
+ * How a plan step's or goal's ladder status reads (design/0.8.0 §6.3). The
+ * server keeps `status` the store's ladder value and says beside it what a
+ * step proven BY ASSERTION under `continuity.proof: off` is:
+ * `provenByAssertion`, `statusLabel` (`[proven (unverified)]`, the label
+ * continuity's own renderers give it) and the `unverified` refs it cited. That
+ * one is never a green "proven" — nothing checked it — so it is amber,
+ * labelled unverified, and its title names the refs nothing resolved. A
+ * server that predates the fields reads as before.
+ */
+export function ladderStatus(row) {
+  const status = String(row?.status ?? "");
+  const label =
+    typeof row?.statusLabel === "string" ? row.statusLabel.replace(/^\[(.*)\]$/, "$1") : "";
+  if (row?.provenByAssertion === true) {
+    const refs = (Array.isArray(row.unverified) ? row.unverified : [])
+      .map((ref) => {
+        const id = String(ref?.toolUseId ?? "");
+        return typeof ref?.sessionId === "string" && id !== "" ? `${id} (${ref.sessionId})` : id;
+      })
+      .filter((ref) => ref !== "");
+    return {
+      tone: "warn",
+      text: label !== "" ? label : "proven (unverified)",
+      title: `proven by assertion (continuity.proof: off) — ${
+        refs.length > 0 ? `cited, not verified: ${refs.join(", ")}` : "no cited ref was verified"
+      }`,
+    };
+  }
+  return { tone: ladderTone(status), text: label !== "" ? label : status, title: null };
+}
+
+function ladderDot(row) {
+  const { tone, text, title } = ladderStatus(row);
+  return title === null ? dot(tone, text) : el("span", { title }, [dot(tone, text)]);
+}
+
 function goalsCard(data) {
   const goals = Array.isArray(data.goals) ? data.goals : [];
   if (goals.length === 0)
@@ -793,7 +830,7 @@ function goalsCard(data) {
       goals.map((g) =>
         el("tr", null, [
           el("td", { text: String(g.title ?? "") }),
-          el("td", null, [dot(ladderTone(g.status), String(g.status ?? ""))]),
+          el("td", null, [ladderDot(g)]),
           el("td", {
             text:
               typeof g.current === "number" && typeof g.target === "number"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/hangar-ui",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "type": "module",
   "description": "The Hangar web console's static UI — zero-build, dependency-free browser ES modules embedded as text assets for the single-binary CLI to hand to the hangar server",
   "main": "dist/index.js",
@@ -8,7 +8,8 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   },
   "scripts": {
@@ -32,5 +33,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["dist", "assets", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "assets", "README.md", "LICENSE", "NOTICE"],
+  "engines": {
+    "bun": ">=1.3.14"
+  }
 }