@critiquedotsh/harness 0.1.3 → 0.1.4

package/README.md

@@ -71,6 +71,12 @@ Then:
 critique-code
 ```
 
+Or skip the TTY and open a local browser UI (still the same Pi author kernel in this process, bound to `127.0.0.1` only):
+
+```bash
+critique-code web
+```
+
 Describe the change. Slash lines (`/review`, `/ship`, …) are never sent to the model.
 
 ## What a session does
@@ -92,6 +98,7 @@ Interactive TTY sessions keep **stdout quiet**. Pass `--json` for the session en
 ```text
 critique-code
 critique-code chat [--intent <text>] [--models provider/model,...] [--cwd <dir>] [--store <dir>] [--voice] [--json]
+critique-code web [--port <n>] [--cwd <dir>] [--store <dir>] [--models ...]
 critique-code login
 critique-code settings | keys | models
 critique-code review [--depth quick|standard|paranoid] [--focus general,security] [--models ...] [--base <ref>] [--intent <text>] [--cwd <dir>] [--store <dir>]
@@ -105,6 +112,7 @@ critique-code help
 | Command | Purpose |
 | --- | --- |
 | `critique-code` / `chat` | Interactive author session |
+| `web` | Local browser UI on `127.0.0.1` (same author kernel; no TTY required) |
 | `login` | Browser device approval; connect Critique Inference |
 | `settings` / `keys` / `models` | TUI for route, stored keys, and model ids |
 | `review` | Evidence harness (JSON on stdout) |
@@ -126,6 +134,7 @@ critique-code help
 | `--base <ref>` | Review against a git base ref (not a checkout) |
 | `--voice` | Start the author session in voice mode |
 | `--json` | Print the session envelope on stdout even on a TTY |
+| `--port <n>` | Loopback port for `critique-code web` (`0` = ephemeral) |
 | `-h` / `help` | Help |
 
 `critique-code review` is read-only. Use `critique-code repair <review-run-id>` for explicit repair. `--repair apply` on `review` is rejected.

package/dist/cli.js

@@ -20251,7 +20251,7 @@ function defaultOpenUrl(url) {
   } catch {
   }
 }
-async function connectCritiqueInference(input) {
+async function beginCritiqueInferenceLogin(input) {
   const env = input.env ?? process.env;
   const origin = critiqueSiteOrigin(env);
   const fetchImpl = input.io.fetch ?? fetch;
@@ -20273,35 +20273,47 @@ async function connectCritiqueInference(input) {
   (input.io.openUrl ?? defaultOpenUrl)(verifyUrl);
   const intervalMs = Math.max(2, authorization.interval ?? 3) * 1e3;
   const deadline = Date.now() + Math.max(30, authorization.expires_in ?? 600) * 1e3;
-  while (Date.now() < deadline) {
-    if (input.io.signal?.aborted) throw new Error("Browser sign-in cancelled.");
-    await sleep(intervalMs);
-    const polled = await fetchImpl(`${origin}/api/new/v1/device/token`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ device_code: authorization.device_code }),
-      signal: input.io.signal
-    });
-    const token = await polled.json().catch(() => null);
-    if (token?.status === "authorization_pending") continue;
-    if (token?.status === "expired") throw new Error("The website approval code expired. Run /login again.");
-    if (token?.status === "denied") throw new Error("Website approval was denied.");
-    const apiKey = token?.api_key?.trim() || token?.apiKey?.trim();
-    if (token?.status === "authorized" && apiKey) {
-      await saveCritiqueCodeCredential({ home: input.home, kind: "critique", key: apiKey });
-      await saveCritiqueCodeRuntimeSettings({
-        home: input.home,
-        settings: settingsFromSelection({
-          route: "critique-inference",
-          author: DEFAULT_INFERENCE_MODEL,
-          review: [DEFAULT_INFERENCE_MODEL]
-        })
+  const deviceCode = authorization.device_code;
+  const finished = (async () => {
+    while (Date.now() < deadline) {
+      if (input.io.signal?.aborted) throw new Error("Browser sign-in cancelled.");
+      await sleep(intervalMs);
+      const polled = await fetchImpl(`${origin}/api/new/v1/device/token`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ device_code: deviceCode }),
+        signal: input.io.signal
       });
-      input.io.note("Critique Inference is connected. Default model is critique/auto.");
-      return { apiKey, verificationUri: verifyUrl };
+      const token = await polled.json().catch(() => null);
+      if (token?.status === "authorization_pending") continue;
+      if (token?.status === "expired") throw new Error("The website approval code expired. Run /login again.");
+      if (token?.status === "denied") throw new Error("Website approval was denied.");
+      const apiKey = token?.api_key?.trim() || token?.apiKey?.trim();
+      if (token?.status === "authorized" && apiKey) {
+        await saveCritiqueCodeCredential({ home: input.home, kind: "critique", key: apiKey });
+        await saveCritiqueCodeRuntimeSettings({
+          home: input.home,
+          settings: settingsFromSelection({
+            route: "critique-inference",
+            author: DEFAULT_INFERENCE_MODEL,
+            review: [DEFAULT_INFERENCE_MODEL]
+          })
+        });
+        input.io.note("Critique Inference is connected. Default model is critique/auto.");
+        return { apiKey, verificationUri: verifyUrl };
+      }
     }
-  }
-  throw new Error("Timed out waiting for website approval.");
+    throw new Error("Timed out waiting for website approval.");
+  })();
+  return {
+    verificationUri: verifyUrl,
+    userCode: authorization.user_code,
+    finished
+  };
+}
+async function connectCritiqueInference(input) {
+  const started = await beginCritiqueInferenceLogin(input);
+  return started.finished;
 }
 
 // lib/finish/critique-code-settings-tui.ts
@@ -21979,8 +21991,9 @@ function authorModelId(model) {
   return piModelId(model);
 }
 function createAuthorLineReader(input) {
-  if (Array.isArray(input.lines)) {
-    const rows = input.lines;
+  const lines = input.lines;
+  if (Array.isArray(lines)) {
+    const rows = lines;
     let index = 0;
     return {
       async readLine() {
@@ -21995,8 +22008,8 @@ function createAuthorLineReader(input) {
       }
     };
   }
-  if (input.lines) {
-    const iterator = input.lines[Symbol.asyncIterator]();
+  if (lines != null && !Array.isArray(lines)) {
+    const iterator = lines[Symbol.asyncIterator]();
     return {
       async readLine() {
         const next = await iterator.next();
@@ -22444,6 +22457,10 @@ ${task.prompt}`,
       if (coordinator.session().review_required) {
         await runReviewGate("write_budget");
       }
+    } catch (error) {
+      const text = error instanceof Error ? error.message : String(error);
+      input.stderr.write(`${text.endsWith("\n") ? text : `${text}
+`}`);
     } finally {
       activity.endTurn();
       reader.resume();
@@ -22626,6 +22643,831 @@ ${task.prompt}`,
   };
 }
 
+// lib/finish/critique-code-web-server.ts
+init_change_capsule();
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { basename as basename3 } from "node:path";
+import { execFileSync, spawn as spawn5 } from "node:child_process";
+
+// lib/finish/critique-code-line-hub.ts
+var CritiqueCodeLineHub = class {
+  #queued = [];
+  #wait;
+  #closed = false;
+  get closed() {
+    return this.#closed;
+  }
+  push(line) {
+    if (this.#closed) return false;
+    if (this.#wait) {
+      this.onState?.(true);
+      const waiting = this.#wait;
+      this.#wait = void 0;
+      waiting(line);
+      return true;
+    }
+    this.#queued.push(line);
+    return true;
+  }
+  close() {
+    this.#closed = true;
+    this.#wait?.(void 0);
+    this.#wait = void 0;
+  }
+  async *[Symbol.asyncIterator]() {
+    for (; ; ) {
+      if (this.#queued.length > 0) {
+        this.onState?.(true);
+        yield this.#queued.shift();
+        continue;
+      }
+      if (this.#closed) return;
+      this.onState?.(false);
+      const line = await new Promise((resolve13) => {
+        this.#wait = resolve13;
+      });
+      if (line === void 0) return;
+      yield line;
+    }
+  }
+};
+
+// lib/finish/critique-code-web-server.ts
+init_critique_code_model_defaults();
+init_critique_code_runtime_config();
+
+// lib/finish/critique-code-web-ui.ts
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function humanizeCritiqueCodeWebError(text) {
+  const raw = text.replace(/\u001b\[[0-9;]*m/g, "").trim();
+  const missing = raw.match(/No API key found for ([a-z0-9._-]+)/i);
+  if (missing) {
+    const provider = missing[1] ?? "this provider";
+    return `No API key for ${provider}. Use Login to connect Critique Inference, or run critique-code keys in the TTY for BYOK, then restart critique-code web.`;
+  }
+  return raw.replace(/(?:file:\/\/)?\S+\.vendor\/node_modules\S+/g, "").replace(/https?:\/\/\S+\/node_modules\/\S+/g, "").replace(/\n[ \t]*\n[ \t]*\n+/g, "\n\n").trim().slice(0, 1200);
+}
+function critiqueCodeWebPage(input) {
+  const repositoryName = escapeHtml(input.repository_name);
+  const repositoryRoot = escapeHtml(input.repository_root);
+  const branch = escapeHtml(input.branch);
+  const model = escapeHtml(input.model);
+  const listen = escapeHtml(input.listen);
+  const modelShort = escapeHtml(input.model.replace(/^openrouter\//, "").replace(/^critique\//, "critique/"));
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>CritiqueCode</title>
+<style>
+:root {
+  --bg: #0e0e0e;
+  --rail: #111111;
+  --panel: #161616;
+  --prompt: #1c1c1c;
+  --line: rgba(255,255,255,.08);
+  --fg: #ececec;
+  --muted: #8d8d8d;
+  --faint: #5c5c5c;
+  --live: #3dd68c;
+  --warn: #d4a017;
+  --err: #e36d6d;
+  --ease: cubic-bezier(.32,.72,0,1);
+}
+* { box-sizing: border-box; }
+html, body { margin: 0; height: 100%; background: var(--bg); color: var(--fg);
+  font-family: "SF Pro Text", "Segoe UI", ui-sans-serif, system-ui, sans-serif;
+  font-size: 14px; letter-spacing: -0.011em; }
+button, textarea { font: inherit; color: inherit; }
+button { cursor: pointer; }
+.shell { display: grid; grid-template-columns: 56px 1fr; min-height: 100dvh; }
+.rail { background: var(--rail); border-right: 1px solid var(--line); display: flex; flex-direction: column; align-items: center; padding: 14px 0; gap: 12px; }
+.mark { width: 30px; height: 30px; border-radius: 8px; background: #1b1b1b; border: 1px solid var(--line); display: grid; place-items: center; font-size: 12px; font-weight: 600; letter-spacing: .04em; }
+.rail .plus { width: 30px; height: 30px; border-radius: 8px; background: transparent; border: 1px solid var(--line); color: var(--muted); display: grid; place-items: center; transition: border-color .2s var(--ease), color .2s var(--ease); }
+.rail .plus:hover { color: var(--fg); border-color: rgba(255,255,255,.2); }
+.stage { display: grid; grid-template-rows: auto 1fr auto; min-width: 0; min-height: 100dvh; }
+header { display: flex; align-items: center; justify-content: space-between; gap: 16px; padding: 14px 22px 8px; }
+.session { display: flex; align-items: center; gap: 10px; color: var(--fg); font-size: 13px; font-weight: 500; }
+.session svg { opacity: .55; }
+.badges { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: 8px; }
+.badge { display: inline-flex; align-items: center; gap: 7px; padding: 5px 10px; border-radius: 999px; background: #181818; border: 1px solid var(--line); color: var(--muted); font-size: 12px; font-variant-numeric: tabular-nums; }
+.badge .dot { width: 7px; height: 7px; border-radius: 50%; background: var(--live); box-shadow: 0 0 0 3px rgba(61,214,140,.12); }
+.badge.model { max-width: 280px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+main { min-height: 0; overflow: auto; }
+#empty { max-width: 560px; margin: 12vh auto 0; padding: 0 24px 40px; }
+#empty h1 { margin: 0 0 28px; font-size: 28px; font-weight: 500; color: #6e6e6e; letter-spacing: -.03em; }
+.meta { list-style: none; margin: 0; padding: 0; display: grid; gap: 14px; color: var(--muted); font-size: 13px; }
+.meta li { display: grid; grid-template-columns: 18px 1fr; gap: 12px; align-items: start; }
+.meta svg { margin-top: 2px; opacity: .7; }
+.meta strong { color: var(--fg); font-weight: 500; word-break: break-all; }
+#feed { max-width: 720px; margin: 0 auto; padding: 12px 24px 28px; display: none; }
+#feed.on { display: block; }
+.turn { margin: 0 0 28px; }
+.prompt { background: var(--prompt); border: 1px solid var(--line); border-radius: 12px; padding: 14px 16px; line-height: 1.5; white-space: pre-wrap; word-break: break-word; }
+.steps { margin: 10px 2px 0; color: var(--faint); font-size: 12px; }
+.steps summary { cursor: pointer; list-style: none; display: flex; justify-content: space-between; gap: 12px; }
+.steps summary::-webkit-details-marker { display: none; }
+.steps[open] summary { color: var(--muted); }
+.step-list { margin: 8px 0 0; padding: 10px 12px; background: #141414; border-radius: 10px; border: 1px solid var(--line); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12px; color: var(--muted); white-space: pre-wrap; word-break: break-word; }
+.reply { margin: 14px 2px 0; line-height: 1.6; white-space: pre-wrap; word-break: break-word; color: #dedede; }
+.reply h { display: block; font-weight: 600; color: #fff; margin: 0 0 8px; font-size: 15px; }
+.note, .alert, .review-card { margin: 14px 0; padding: 12px 14px; border-radius: 12px; line-height: 1.5; white-space: pre-wrap; word-break: break-word; }
+.note { color: var(--muted); }
+.alert { background: rgba(227,109,109,.08); color: #f0c7c7; border: 1px solid rgba(227,109,109,.18); }
+.review-card { background: #141414; border: 1px solid var(--line); color: var(--muted); font-size: 13px; }
+.dock { padding: 0 20px 22px; }
+.composer { max-width: 720px; margin: 0 auto; background: var(--panel); border: 1px solid var(--line); border-radius: 18px; padding: 6px 6px 8px; box-shadow: 0 18px 40px rgba(0,0,0,.28); }
+textarea { width: 100%; min-height: 56px; max-height: 200px; resize: none; background: transparent; border: 0; padding: 12px 14px 4px; outline: none; line-height: 1.45; }
+textarea::placeholder { color: #6a6a6a; }
+.bar { display: flex; align-items: center; justify-content: space-between; gap: 10px; padding: 4px 6px 4px 8px; }
+.cmds { display: flex; flex-wrap: wrap; gap: 2px; min-width: 0; }
+.cmds button { background: transparent; border: 0; color: var(--muted); padding: 5px 8px; border-radius: 8px; font-size: 12px; }
+.cmds button:hover { background: rgba(255,255,255,.05); color: var(--fg); }
+.bar-right { display: flex; align-items: center; gap: 8px; flex-shrink: 0; }
+.model-chip { color: var(--muted); font-size: 12px; max-width: 180px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+#send { width: 34px; height: 34px; border: 0; border-radius: 10px; background: #ececec; color: #111; display: grid; place-items: center; transition: transform .18s var(--ease), opacity .18s var(--ease); }
+#send:hover { transform: translateY(-1px); }
+#send:disabled, textarea:disabled { opacity: .4; cursor: not-allowed; }
+#modal { display: none; position: fixed; inset: 0; background: rgba(0,0,0,.55); align-items: center; justify-content: center; padding: 24px; z-index: 4; }
+#modal.open { display: flex; }
+.dialog { width: min(520px, 100%); background: #161616; border: 1px solid var(--line); border-radius: 16px; padding: 18px; }
+.dialog h3 { margin: 0 0 8px; font-size: 15px; font-weight: 600; }
+.dialog .purpose { color: var(--muted); font-size: 13px; }
+.preview { max-height: 240px; overflow: auto; white-space: pre-wrap; word-break: break-word; margin: 12px 0 16px; padding: 12px; background: #101010; border-radius: 10px; font-family: ui-monospace, Menlo, monospace; font-size: 12px; color: var(--muted); }
+.modal-actions { display: flex; gap: 8px; justify-content: flex-end; }
+.modal-actions button { border: 1px solid var(--line); background: #1c1c1c; border-radius: 10px; padding: 8px 12px; }
+.modal-actions .deny { color: var(--err); }
+.modal-actions #approve { background: #ececec; color: #111; border-color: transparent; }
+@media (max-width: 720px) {
+  .shell { grid-template-columns: 1fr; }
+  .rail { display: none; }
+  header { padding: 12px 16px 4px; }
+  .dock { padding: 0 12px 16px; }
+}
+</style>
+</head>
+<body>
+<div class="shell">
+  <aside class="rail">
+    <div class="mark" title="CritiqueCode">C</div>
+    <button type="button" class="plus" id="focus-composer" title="Focus composer" aria-label="Focus composer">
+      <svg width="14" height="14" viewBox="0 0 14 14" fill="none"><path d="M7 2v10M2 7h10" stroke="currentColor" stroke-width="1.4"/></svg>
+    </button>
+  </aside>
+  <div class="stage">
+    <header>
+      <div class="session">
+        <svg width="14" height="14" viewBox="0 0 14 14" fill="none"><path d="M2 4h10v8H2zM4 4V3a3 3 0 0 1 6 0v1" stroke="currentColor" stroke-width="1.2"/></svg>
+        New session
+      </div>
+      <div class="badges">
+        <span class="badge"><span class="dot"></span>${listen}</span>
+        <span class="badge" id="files-badge" hidden></span>
+        <span class="badge model" title="${model}">${modelShort}</span>
+      </div>
+    </header>
+    <main>
+      <div id="empty">
+        <h1>New session</h1>
+        <ul class="meta">
+          <li>
+            <svg width="16" height="16" viewBox="0 0 16 16" fill="none"><path d="M2.5 4.5h4l1.5 1.5H13.5v7H2.5z" stroke="currentColor" stroke-width="1.2"/></svg>
+            <span><strong>${repositoryRoot}</strong></span>
+          </li>
+          <li>
+            <svg width="16" height="16" viewBox="0 0 16 16" fill="none"><path d="M4 12V8m0 0a2 2 0 1 0 0-4 2 2 0 0 0 0 4zm8-4v4m0 0a2 2 0 1 0 0 4 2 2 0 0 0 0-4zM6 8h4" stroke="currentColor" stroke-width="1.2"/></svg>
+            <span>Main branch (<strong>${branch}</strong>)</span>
+          </li>
+          <li>
+            <svg width="16" height="16" viewBox="0 0 16 16" fill="none"><circle cx="8" cy="8" r="5.5" stroke="currentColor" stroke-width="1.2"/><path d="M8 5.5V8l2 1.5" stroke="currentColor" stroke-width="1.2"/></svg>
+            <span>Loopback only \xB7 ${repositoryName}</span>
+          </li>
+        </ul>
+      </div>
+      <div id="feed"></div>
+    </main>
+    <div class="dock">
+      <div class="composer">
+        <textarea id="input" rows="2" placeholder="Ask anything\u2026"></textarea>
+        <div class="bar">
+          <div class="cmds">
+            <button type="button" data-cmd="/review">Review</button>
+            <button type="button" data-cmd="/review all">Review all</button>
+            <button type="button" data-cmd="/repair">Repair</button>
+            <button type="button" data-cmd="/ship">Ship</button>
+            <button type="button" data-cmd="/skills">Skills</button>
+            <button type="button" data-cmd="/login" id="login">Login</button>
+            <button type="button" data-cmd="/exit">Exit</button>
+          </div>
+          <div class="bar-right">
+            <span class="model-chip">${modelShort}</span>
+            <button type="button" id="send" aria-label="Send">
+              <svg width="14" height="14" viewBox="0 0 14 14" fill="none"><path d="M7 11V3M3.5 6.5 7 3l3.5 3.5" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+<div id="modal">
+  <div class="dialog">
+    <h3>Run this command?</h3>
+    <div class="purpose" id="exec-purpose"></div>
+    <div class="preview" id="exec-preview"></div>
+    <div class="modal-actions">
+      <button type="button" class="deny" id="deny">Deny</button>
+      <button type="button" id="approve">Approve</button>
+    </div>
+  </div>
+</div>
+<script>
+window.CRITIQUE_CODE_TOKEN = "__CRITIQUE_CODE_TOKEN__";
+(function () {
+  var TOKEN = window.CRITIQUE_CODE_TOKEN;
+  var emptyEl = document.getElementById("empty");
+  var feedEl = document.getElementById("feed");
+  var filesBadge = document.getElementById("files-badge");
+  var inputEl = document.getElementById("input");
+  var sendEl = document.getElementById("send");
+  var modalEl = document.getElementById("modal");
+  var purposeEl = document.getElementById("exec-purpose");
+  var previewEl = document.getElementById("exec-preview");
+  var busy = false;
+  var turnEl = null;
+  var assistantEl = null;
+  var pendingExecId = null;
+  var es = null;
+  var reconnectTimer = null;
+
+  function headers() {
+    return { "content-type": "application/json", "x-critique-code-token": TOKEN };
+  }
+
+  function api(method, path, body) {
+    return fetch(path, {
+      method: method,
+      headers: headers(),
+      body: body ? JSON.stringify(body) : undefined
+    });
+  }
+
+  function showFeed() {
+    emptyEl.style.display = "none";
+    feedEl.className = "on";
+  }
+
+  function setBusy(next) {
+    busy = !!next;
+    sendEl.disabled = busy;
+    inputEl.disabled = busy;
+  }
+
+  function scrollMain() {
+    var main = document.querySelector("main");
+    if (main) main.scrollTop = main.scrollHeight;
+  }
+
+  function addBlock(className, text) {
+    showFeed();
+    turnEl = null;
+    assistantEl = null;
+    var node = document.createElement("div");
+    node.className = className;
+    node.textContent = text == null ? "" : String(text);
+    feedEl.appendChild(node);
+    scrollMain();
+    return node;
+  }
+
+  function startTurn(text) {
+    showFeed();
+    assistantEl = null;
+    turnEl = document.createElement("div");
+    turnEl.className = "turn";
+    var prompt = document.createElement("div");
+    prompt.className = "prompt";
+    prompt.textContent = text;
+    turnEl.appendChild(prompt);
+    feedEl.appendChild(turnEl);
+    scrollMain();
+  }
+
+  function appendAssistant(text) {
+    if (!turnEl) {
+      showFeed();
+      turnEl = document.createElement("div");
+      turnEl.className = "turn";
+      feedEl.appendChild(turnEl);
+    }
+    if (!assistantEl) {
+      assistantEl = document.createElement("div");
+      assistantEl.className = "reply";
+      turnEl.appendChild(assistantEl);
+    }
+    assistantEl.textContent = (assistantEl.textContent || "") + (text || "");
+    scrollMain();
+  }
+
+  function addTool(name, phase, detail) {
+    if (!turnEl) {
+      showFeed();
+      turnEl = document.createElement("div");
+      turnEl.className = "turn";
+      feedEl.appendChild(turnEl);
+    }
+    var steps = turnEl.querySelector(".steps");
+    if (!steps) {
+      steps = document.createElement("details");
+      steps.className = "steps";
+      var summary = document.createElement("summary");
+      summary.innerHTML = "<span>Show steps</span><span class=\\"dur\\"></span>";
+      var list = document.createElement("div");
+      list.className = "step-list";
+      steps.appendChild(summary);
+      steps.appendChild(list);
+      if (assistantEl) turnEl.insertBefore(steps, assistantEl);
+      else turnEl.appendChild(steps);
+    }
+    var listEl = steps.querySelector(".step-list");
+    var line = (name || "tool") + " " + (phase || "");
+    if (detail) line += "\\n" + detail;
+    listEl.textContent = (listEl.textContent ? listEl.textContent + "\\n" : "") + line;
+    scrollMain();
+  }
+
+  function setPaths(paths) {
+    if (!paths || !paths.length) {
+      filesBadge.hidden = true;
+      filesBadge.textContent = "";
+      return;
+    }
+    filesBadge.hidden = false;
+    filesBadge.textContent = paths.length === 1 ? "1 file" : String(paths.length) + " files";
+    filesBadge.title = paths.join("\\n");
+  }
+
+  function setReview(text) {
+    if (!text) return;
+    addBlock("review-card", text);
+  }
+
+  function showExec(req) {
+    if (!req) {
+      modalEl.className = "";
+      pendingExecId = null;
+      return;
+    }
+    pendingExecId = req.id;
+    purposeEl.textContent = req.purpose || "";
+    previewEl.textContent = req.preview || "";
+    modalEl.className = "open";
+  }
+
+  function handleEvent(ev) {
+    if (!ev || !ev.type) return;
+    switch (ev.type) {
+      case "note":
+        addBlock("note", ev.text);
+        break;
+      case "user":
+        startTurn(ev.text);
+        break;
+      case "assistant_delta":
+        appendAssistant(ev.text);
+        break;
+      case "tool":
+        addTool(ev.name, ev.phase, ev.detail);
+        break;
+      case "exec_request":
+        showExec({ id: ev.id, purpose: ev.purpose, preview: ev.preview });
+        break;
+      case "exec_resolved":
+        if (pendingExecId === ev.id) showExec(null);
+        addBlock("note", ev.decision === "approve" ? "Run approved. Output is not Evidence." : "Run denied.");
+        break;
+      case "review":
+        setReview((ev.text || "") + (ev.conclusion ? "\\n" + ev.conclusion : ""));
+        break;
+      case "busy":
+        setBusy(ev.busy);
+        break;
+      case "ended":
+        setBusy(false);
+        addBlock("note", ev.reason ? "Session ended \xB7 " + ev.reason : "Session ended");
+        break;
+      case "error":
+        addBlock("alert", ev.text);
+        break;
+    }
+  }
+
+  function applySnapshot(s) {
+    if (!s) return;
+    setBusy(s.busy);
+    setPaths(s.changed_paths);
+    if (s.last_review_text) setReview(s.last_review_text);
+    if (s.pending_exec) showExec(s.pending_exec);
+  }
+
+  function connect() {
+    if (es) {
+      es.close();
+      es = null;
+    }
+    es = new EventSource("/api/events?token=" + encodeURIComponent(TOKEN));
+    es.onmessage = function (msg) {
+      try { handleEvent(JSON.parse(msg.data)); } catch (e) {}
+    };
+    es.onerror = function () {
+      if (es) { es.close(); es = null; }
+      if (reconnectTimer) clearTimeout(reconnectTimer);
+      reconnectTimer = setTimeout(connect, 1200);
+    };
+  }
+
+  function startLogin() {
+    api("POST", "/api/login", {}).then(function (res) {
+      return res.json().then(function (body) {
+        if (!res.ok) addBlock("alert", body.error || "Could not start Login.");
+      });
+    }).catch(function () {
+      addBlock("alert", "Could not start Login.");
+    });
+  }
+
+  function submitText(raw) {
+    var text = (raw == null ? inputEl.value : raw).trim();
+    if (!text || busy) return;
+    if (text === "/login" || text === "login") {
+      if (raw == null) inputEl.value = "";
+      startLogin();
+      return;
+    }
+    var isCmd = text.charAt(0) === "/";
+    if (raw == null) inputEl.value = "";
+    api("POST", isCmd ? "/api/command" : "/api/prompt", { text: text }).then(function (res) {
+      if (!res.ok) addBlock("alert", "Request failed");
+    }).catch(function () {
+      addBlock("alert", "Request failed");
+    });
+  }
+
+  function decide(decision) {
+    if (!pendingExecId) return;
+    var id = pendingExecId;
+    api("POST", "/api/exec", { id: id, decision: decision }).then(function () {
+      showExec(null);
+    }).catch(function () {
+      addBlock("alert", "Could not resolve the run.");
+    });
+  }
+
+  sendEl.addEventListener("click", function () { submitText(null); });
+  document.getElementById("focus-composer").addEventListener("click", function () {
+    inputEl.focus();
+  });
+  inputEl.addEventListener("keydown", function (e) {
+    if (e.key === "Enter" && !e.shiftKey) {
+      e.preventDefault();
+      submitText(null);
+    }
+  });
+  document.querySelectorAll(".cmds button").forEach(function (btn) {
+    btn.addEventListener("click", function () {
+      var cmd = btn.getAttribute("data-cmd");
+      if (cmd === "/login") {
+        startLogin();
+        return;
+      }
+      submitText(cmd);
+    });
+  });
+  document.getElementById("approve").addEventListener("click", function () { decide("approve"); });
+  document.getElementById("deny").addEventListener("click", function () { decide("deny"); });
+
+  api("GET", "/api/snapshot").then(function (res) { return res.json(); }).then(applySnapshot).catch(function () {});
+  connect();
+})();
+</script>
+</body>
+</html>
+`;
+}
+
+// lib/finish/critique-code-web-server.ts
+var KERNEL_REQUIRED3 = "Interactive author requires a live driver and at least one model. Run /login to connect Critique Inference in the browser, or add a BYOK key with /keys. Default is Critique Inference critique/auto. This is not a fake chat.";
+function gitBranch(root) {
+  try {
+    return execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+      cwd: root,
+      encoding: "utf8",
+      timeout: 2e3
+    }).trim() || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+async function startCritiqueCodeWebServer(input) {
+  const host = input.host ?? "127.0.0.1";
+  if (host !== "127.0.0.1" && host !== "localhost") {
+    throw new Error("CritiqueCode web UI binds only to 127.0.0.1. LAN listen is not allowed.");
+  }
+  const bindHost = "127.0.0.1";
+  const env = input.env ?? process.env;
+  let model = "critique/auto";
+  try {
+    const config = await loadCritiqueCodeRuntimeConfig(env);
+    const authorModels = input.author_models && input.author_models.length > 0 ? [...input.author_models] : await resolveHarnessModels({ role: "author", env, config });
+    const driver = await resolveOptionalPiDriver({ driver: input.driver, env });
+    if (authorModels.length === 0 || !driver) {
+      return { kind: "kernel_required", limitation: KERNEL_REQUIRED3 };
+    }
+    model = piModelId(authorModels[0]);
+  } catch (error) {
+    return { kind: "kernel_required", limitation: error instanceof Error ? error.message : String(error) };
+  }
+  const repositoryRoot = await findRepositoryRoot(input.cwd);
+  const token = randomBytes(18).toString("base64url");
+  const hub = new CritiqueCodeLineHub();
+  const clients = /* @__PURE__ */ new Set();
+  const execs = /* @__PURE__ */ new Map();
+  let busy = false;
+  let ended;
+  const changedPaths = [];
+  let lastReviewText = "";
+  let pendingExec;
+  const emit = (event) => {
+    const payload = `data: ${JSON.stringify(event)}
+
+`;
+    for (const client of clients) client.write(payload);
+  };
+  hub.onState = (nextBusy) => {
+    busy = nextBusy;
+    emit({ type: "busy", busy });
+  };
+  const mapKernel = (event) => {
+    if (event.type === "text_delta" && event.text) {
+      emit({ type: "assistant_delta", text: event.text });
+      return;
+    }
+    if (event.type === "tool_started" || event.type === "tool_completed") {
+      if (event.tool_name === "critique_write_file" && event.detail && event.type === "tool_completed") {
+        if (!changedPaths.includes(event.detail)) changedPaths.push(event.detail);
+      }
+      emit({
+        type: "tool",
+        name: event.tool_name,
+        detail: event.detail,
+        phase: event.type === "tool_started" ? "started" : "completed"
+      });
+      return;
+    }
+    if (event.type === "session_failed") {
+      emit({ type: "error", text: humanizeCritiqueCodeWebError(event.error ?? event.detail ?? "session failed") });
+    }
+  };
+  const approveExec = (request) => new Promise((resolve13) => {
+    const id4 = randomBytes(9).toString("hex");
+    const pending = { id: id4, purpose: request.purpose, preview: request.preview, resolve: resolve13 };
+    execs.set(id4, pending);
+    pendingExec = { id: id4, purpose: request.purpose, preview: request.preview };
+    emit({ type: "exec_request", id: id4, purpose: request.purpose, preview: request.preview });
+  });
+  const snapshot = () => ({
+    repository_root: repositoryRoot,
+    model,
+    busy,
+    changed_paths: [...changedPaths],
+    last_review_text: lastReviewText,
+    ...pendingExec ? { pending_exec: pendingExec } : {},
+    ...ended ? { ended } : {}
+  });
+  const originOk = (req, port) => {
+    const origin = req.headers.origin;
+    if (!origin) return true;
+    return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;
+  };
+  const tokenOk = (req) => {
+    const header = req.headers["x-critique-code-token"];
+    if (typeof header === "string" && header === token) return true;
+    const url2 = new URL(req.url ?? "/", "http://127.0.0.1");
+    return url2.searchParams.get("token") === token;
+  };
+  const readJson = async (req) => {
+    const chunks = [];
+    for await (const chunk of req) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    if (chunks.length === 0) return {};
+    try {
+      const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+      return parsed && typeof parsed === "object" ? parsed : {};
+    } catch {
+      return {};
+    }
+  };
+  const send = (res, status, body, contentType = "application/json; charset=utf-8") => {
+    const text = typeof body === "string" ? body : JSON.stringify(body);
+    res.writeHead(status, {
+      "content-type": contentType,
+      "cache-control": "no-store"
+    });
+    res.end(text);
+  };
+  const server = createServer(async (req, res) => {
+    const port = listeningPort();
+    const url2 = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+    const path2 = url2.pathname;
+    if (req.method === "GET" && path2 === "/") {
+      const html = critiqueCodeWebPage({
+        repository_name: basename3(repositoryRoot),
+        repository_root: repositoryRoot,
+        branch: gitBranch(repositoryRoot),
+        model,
+        listen: `127.0.0.1:${port}`
+      }).replaceAll("__CRITIQUE_CODE_TOKEN__", token);
+      send(res, 200, html, "text/html; charset=utf-8");
+      return;
+    }
+    if (req.method === "GET" && path2 === "/api/events") {
+      if (!tokenOk(req)) {
+        send(res, 401, { error: "unauthorized" });
+        return;
+      }
+      res.writeHead(200, {
+        "content-type": "text/event-stream; charset=utf-8",
+        "cache-control": "no-store",
+        connection: "keep-alive"
+      });
+      res.write(`data: ${JSON.stringify({ type: "busy", busy })}
+
+`);
+      clients.add(res);
+      req.on("close", () => {
+        clients.delete(res);
+      });
+      return;
+    }
+    if (!tokenOk(req)) {
+      send(res, 401, { error: "unauthorized" });
+      return;
+    }
+    if (!originOk(req, port)) {
+      send(res, 403, { error: "origin refused" });
+      return;
+    }
+    if (req.method === "GET" && path2 === "/api/snapshot") {
+      send(res, 200, snapshot());
+      return;
+    }
+    if (req.method === "POST" && (path2 === "/api/prompt" || path2 === "/api/command")) {
+      const body = await readJson(req);
+      const text = String(body.text ?? body.prompt ?? "").trim();
+      if (!text) {
+        send(res, 400, { error: "text required" });
+        return;
+      }
+      if (ended) {
+        send(res, 409, { error: "session ended" });
+        return;
+      }
+      emit({ type: "user", text });
+      const queued = hub.push(text);
+      send(res, queued ? 202 : 409, { ok: queued });
+      return;
+    }
+    if (req.method === "POST" && path2 === "/api/exec") {
+      const body = await readJson(req);
+      const id4 = String(body.id ?? "");
+      const decision = body.decision === "approve" ? "approve" : "deny";
+      const pending = execs.get(id4);
+      if (!pending) {
+        send(res, 404, { error: "unknown exec" });
+        return;
+      }
+      execs.delete(id4);
+      pendingExec = void 0;
+      pending.resolve(decision);
+      emit({ type: "exec_resolved", id: id4, decision });
+      send(res, 200, { ok: true });
+      return;
+    }
+    if (req.method === "POST" && path2 === "/api/login") {
+      try {
+        const started = await beginCritiqueInferenceLogin({
+          home: critiqueCodeHome(env),
+          env,
+          io: {
+            note: (message) => emit({ type: "note", text: message })
+          }
+        });
+        send(res, 202, { ok: true, verification_uri: started.verificationUri });
+        void started.finished.then(() => {
+          emit({ type: "note", text: "Inference is connected. Restart critique-code web if you want this session on critique/auto." });
+        }).catch((error) => {
+          const text = error instanceof Error ? error.message : String(error);
+          emit({ type: "error", text: humanizeCritiqueCodeWebError(text) });
+        });
+      } catch (error) {
+        const text = error instanceof Error ? error.message : String(error);
+        emit({ type: "error", text: humanizeCritiqueCodeWebError(text) });
+        send(res, 400, { error: humanizeCritiqueCodeWebError(text) });
+      }
+      return;
+    }
+    send(res, 404, { error: "not found" });
+  });
+  let portValue = 0;
+  const listeningPort = () => portValue;
+  await new Promise((resolve13, reject) => {
+    server.once("error", reject);
+    server.listen(input.port ?? 0, bindHost, () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("CritiqueCode web UI failed to bind loopback."));
+        return;
+      }
+      portValue = address.port;
+      resolve13();
+    });
+  });
+  const url = `http://127.0.0.1:${portValue}`;
+  input.stderr.write(`CritiqueCode web UI ${url}
+Loopback only. The author session stays in this process.
+`);
+  const session = runLocalCritiqueCodeAuthor({
+    cwd: repositoryRoot,
+    env,
+    stdout: input.stdout,
+    stderr: {
+      write(chunk) {
+        input.stderr.write(chunk);
+        const text = chunk.trim();
+        if (!text) return;
+        if (/evidence harness|checkpoint|Repair Portfolio|none_promoted|not a correctness proof|transcript is withheld/i.test(text)) {
+          lastReviewText = text.slice(0, 4e3);
+          emit({ type: "review", text: lastReviewText });
+        }
+      }
+    },
+    lines: hub,
+    driver: input.driver,
+    ...input.review ? { review: input.review } : {},
+    ...input.now ? { now: input.now } : {},
+    ...input.checks ? { checks: input.checks } : {},
+    ...input.manifest ? { manifest: input.manifest } : {},
+    host_tools: input.host_tools ?? "discover",
+    ...input.store_root ? { store_root: input.store_root } : {},
+    ...input.specialist_models ? { specialist_models: input.specialist_models } : {},
+    ...input.author_models ? { author_models: input.author_models } : {},
+    approve_exec: approveExec,
+    on_kernel_event: mapKernel,
+    settings_ui: {
+      async select() {
+        return "back";
+      },
+      async prompt() {
+        return void 0;
+      },
+      note(message) {
+        emit({ type: "note", text: message });
+      }
+    }
+  }).then((result) => {
+    ended = result.kind === "kernel_required" ? "kernel_required" : result.reason;
+    emit({ type: "ended", reason: ended });
+    hub.close();
+    return result;
+  });
+  if (input.open !== false) {
+    try {
+      spawn5("open", [url], { stdio: "ignore", detached: true }).unref();
+    } catch {
+    }
+  }
+  return {
+    url,
+    token,
+    async close() {
+      hub.close();
+      for (const pending of execs.values()) pending.resolve("deny");
+      execs.clear();
+      for (const client of clients) client.end();
+      clients.clear();
+      await new Promise((resolve13, reject) => {
+        server.close((error) => {
+          error ? reject(error) : resolve13();
+        });
+      });
+      await session.catch(() => void 0);
+    }
+  };
+}
+
 // lib/finish/critique-code-program.ts
 var CRITIQUE_CODE_EXIT = {
   ok: 0,
@@ -22643,6 +23485,7 @@ Usage:
   pnpm critique-code
   pnpm --filter @critiquedotsh/harness start
   critique-code | critique-code chat [--intent <text>] [--models provider/model,...] [--cwd <dir>] [--store <dir>] [--voice] [--json]
+  critique-code web [--port <n>] [--cwd <dir>] [--store <dir>] [--models ...]
   critique-code login
   critique-code settings | keys | models
   critique-code review [--depth quick|standard|paranoid] [--focus general,security] [--models provider/model,...] [--base <ref>] [--intent <text>] [--cwd <dir>] [--store <dir>]
@@ -22669,6 +23512,7 @@ Interactive author commands:
   /exit
 
 Interactive TTY author sessions keep stdout quiet; pass --json for the session envelope.
+\`critique-code web\` serves a loopback browser UI on 127.0.0.1. The author kernel still runs in this process.
 Other commands print JSON on stdout. Live chrome goes to stderr.
 Author implements, then the controller forces review + verified repair.
 none_promoted is not a correctness proof.
@@ -22704,7 +23548,8 @@ function parseInvocation(argv) {
         help: { type: "boolean", short: "h" },
         json: { type: "boolean" },
         voice: { type: "boolean" },
-        repair: { type: "string" }
+        repair: { type: "string" },
+        port: { type: "string" }
       }
     });
   } catch (error) {
@@ -22816,6 +23661,34 @@ function parseInvocation(argv) {
   if (command === "import-skills") {
     return { command: "skills", import: true, ...cwd ? { cwd } : {} };
   }
+  if (command === "web") {
+    const portRaw = stringFlag(parsed.values.port);
+    let port;
+    if (portRaw) {
+      port = Number(portRaw);
+      if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        return { command: "usage", error: "Port must be an integer from 0 to 65535. 0 means an ephemeral loopback port." };
+      }
+    }
+    let specialist_models;
+    if (models) {
+      try {
+        specialist_models = parseCritiqueCodeModels(models);
+        if (specialist_models.length === 0) {
+          return { command: "usage", error: "Models must be a comma-separated provider:family:model_id or provider/model list, or a JSON array." };
+        }
+      } catch {
+        return { command: "usage", error: "Models must be a comma-separated provider:family:model_id or provider/model list, or a JSON array." };
+      }
+    }
+    return {
+      command: "web",
+      ...cwd ? { cwd } : {},
+      ...storeRoot ? { store_root: storeRoot } : {},
+      ...specialist_models ? { specialist_models, author_models: specialist_models } : {},
+      ...port !== void 0 ? { port } : {}
+    };
+  }
   if (command === "settings" || command === "models" || command === "keys" || command === "login") {
     return {
       command: "settings",
@@ -22829,7 +23702,7 @@ function stringFlag(value) {
 }
 function interactiveCommand(argv) {
   const command = argv.find((arg) => arg !== "--" && !arg.startsWith("-"));
-  return command === void 0 || command === "chat" || command === "settings" || command === "keys" || command === "models" || command === "login";
+  return command === void 0 || command === "chat" || command === "web" || command === "settings" || command === "keys" || command === "models" || command === "login";
 }
 function writeJson(io, value) {
   if (io.stdin?.isTTY === true && !io.argv.includes("--json") && interactiveCommand(io.argv)) return;
@@ -22894,6 +23767,45 @@ ${helpText}`);
       });
       return CRITIQUE_CODE_EXIT.ok;
     }
+    if (invocation.command === "web") {
+      const started = await (io.web ?? startCritiqueCodeWebServer)({
+        cwd: invocation.cwd ?? io.cwd,
+        env: io.env ?? process.env,
+        stdout: io.stdout,
+        stderr: io.stderr,
+        open: !io.web,
+        ...io.driver ? { driver: io.driver } : {},
+        ...io.review ? { review: io.review } : {},
+        ...invocation.store_root ? { store_root: invocation.store_root } : {},
+        ...invocation.specialist_models ? { specialist_models: invocation.specialist_models } : {},
+        ...invocation.author_models ? { author_models: invocation.author_models } : {},
+        ...invocation.port !== void 0 ? { port: invocation.port } : {}
+      });
+      if ("kind" in started && started.kind === "kernel_required") {
+        writeJson(io, { schema_version: "critique.code-cli.v1", command: "web", ...started });
+        io.stderr.write("Interactive author is kernel_required without a live Pi driver.\nnone_promoted is not a correctness proof.\n");
+        return CRITIQUE_CODE_EXIT.kernel_required;
+      }
+      const server = started;
+      writeJson(io, {
+        schema_version: "critique.code-cli.v1",
+        command: "web",
+        url: server.url,
+        bind: "127.0.0.1"
+      });
+      if (io.web) {
+        await server.close();
+        return CRITIQUE_CODE_EXIT.ok;
+      }
+      await new Promise((resolve13) => {
+        const stop = () => {
+          void server.close().finally(resolve13);
+        };
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+      });
+      return CRITIQUE_CODE_EXIT.ok;
+    }
     if (invocation.command === "chat") {
       const result2 = await (io.chat ?? runLocalCritiqueCodeAuthor)({
         cwd: invocation.cwd ?? io.cwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@critiquedotsh/harness",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "CritiqueCode author agent — implement, then forced review and verified repair. Same org as @critiquedotsh/cli; not the sidecar.",
   "homepage": "https://critique.sh/docs/platform/critique-code",
   "repository": {
@@ -34,7 +34,7 @@
     "start": "node --import ../../scripts/register-test-path-alias.mjs --experimental-strip-types src/cli.ts",
     "install:pi": "npm install --prefix .vendor",
     "prepublishOnly": "npm run build",
-    "test": "node --import ../../scripts/register-test-path-alias.mjs --experimental-strip-types --test ../../lib/finish/critique-code-program.test.ts ../../lib/finish/critique-code-local-session.test.ts ../../lib/finish/critique-code-local-author.test.ts ../../lib/finish/critique-code-author-apply.test.ts ../../lib/finish/critique-code-local-repair.test.ts ../../lib/finish/critique-code-author-coordinator.test.ts ../../lib/finish/critique-code-repair-kernel.test.ts ../../lib/finish/critique-code-review-checkpoint.test.ts ../../lib/finish/critique-code-runtime-config.test.ts ../../lib/finish/critique-code-model-defaults.test.ts ../../lib/finish/critique-code-pi-providers.test.ts ../../lib/finish/critique-code-settings-tui.test.ts ../../lib/finish/critique-code-tui-theme.test.ts ../../lib/finish/earendil-pi-driver.test.ts ../../lib/finish/critique-code-device-login.test.ts ../../lib/finish/critique-code-author-commands.test.ts ../../lib/finish/critique-code-skills.test.ts ../../lib/finish/pi-author-task.test.ts ../../lib/finish/pi-session-harness.test.ts"
+    "test": "node --import ../../scripts/register-test-path-alias.mjs --experimental-strip-types --test ../../lib/finish/critique-code-program.test.ts ../../lib/finish/critique-code-local-session.test.ts ../../lib/finish/critique-code-local-author.test.ts ../../lib/finish/critique-code-author-apply.test.ts ../../lib/finish/critique-code-local-repair.test.ts ../../lib/finish/critique-code-author-coordinator.test.ts ../../lib/finish/critique-code-repair-kernel.test.ts ../../lib/finish/critique-code-review-checkpoint.test.ts ../../lib/finish/critique-code-runtime-config.test.ts ../../lib/finish/critique-code-model-defaults.test.ts ../../lib/finish/critique-code-pi-providers.test.ts ../../lib/finish/critique-code-settings-tui.test.ts ../../lib/finish/critique-code-tui-theme.test.ts ../../lib/finish/earendil-pi-driver.test.ts ../../lib/finish/critique-code-device-login.test.ts ../../lib/finish/critique-code-author-commands.test.ts ../../lib/finish/critique-code-skills.test.ts ../../lib/finish/pi-author-task.test.ts ../../lib/finish/pi-session-harness.test.ts ../../lib/finish/critique-code-web-server.test.ts"
   },
   "dependencies": {
     "typescript": "^5.9.3"