@jhizzard/termdeck 1.7.0 → 1.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jhizzard/termdeck",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Browser-based terminal multiplexer with metadata overlays, panel flashback memory recall, and AI-aware session management",
   "bin": {
     "termdeck": "./packages/cli/src/index.js"

package/packages/client/public/app.js

@@ -472,6 +472,14 @@
       // /api/sessions/:id/input, and reply-form targets are unaffected.
       setupPanelDragDrop(panel);
 
+      // Sprint 72 T3 — web-chat (Grok) panels render a live screencast canvas +
+      // an inject input box instead of an xterm. Branch AFTER the shared chrome
+      // (header/meta/drawer) is built, then return; the entire xterm path below
+      // stays byte-identical for every other panel type.
+      if (meta.type === 'web-chat') {
+        return mountWebChatPanel(id, sessionData, panel);
+      }
+
       // Create xterm.js instance
       const terminal = new Terminal({
         fontFamily: "'SF Mono', 'Cascadia Code', 'JetBrains Mono', 'Fira Code', Consolas, monospace",
@@ -653,6 +661,297 @@
       return { terminal, ws, fitAddon };
     }
 
+    // ===== Sprint 72 T3: web-chat (Grok) canvas panel =====
+    // A web-chat panel mirrors a real, logged-in headful grok.com tab: T1's CDP
+    // screencast frames paint to a <canvas>; an input box injects a prompt into
+    // the live composer (T2 routes {type:'input'} → grok.inject); and canvas
+    // mouse/wheel events forward back to the tab ({type:'web-chat-input'} →
+    // handle.sendInput) so the human can drive it in-deck. The xterm render path
+    // (createTerminalPanel, above) is untouched for every non-web-chat panel.
+
+    function ensureWebChatStyles() {
+      if (document.getElementById('wc-styles')) return;
+      const style = document.createElement('style');
+      style.id = 'wc-styles';
+      style.textContent = [
+        '.panel-terminal.web-chat-terminal{display:flex;flex-direction:column;height:100%;min-height:0;background:#000;}',
+        '.web-chat-stage{flex:1;min-height:0;position:relative;display:flex;align-items:center;justify-content:center;overflow:hidden;background:#000;}',
+        '.web-chat-canvas{display:block;max-width:100%;max-height:100%;outline:none;}',
+        '.web-chat-input-bar{display:flex;gap:6px;padding:6px;border-top:1px solid #1f2335;background:#16161e;}',
+        '.web-chat-input{flex:1;min-width:0;padding:6px 8px;border:1px solid #1f2335;border-radius:6px;background:#1a1b26;color:#c0caf5;font:13px/1.3 inherit;}',
+        '.web-chat-input:focus{outline:none;border-color:#7aa2f7;}',
+        '.web-chat-send{padding:6px 14px;border:0;border-radius:6px;background:#7aa2f7;color:#0b0b14;font-weight:600;cursor:pointer;}',
+        '.web-chat-send:hover{background:#8fb3ff;}',
+      ].join('');
+      document.head.appendChild(style);
+    }
+
+    // Build the two WS frames that drive T2's server-side two-stage assembler
+    // (routeWebChatInput): (1) the prompt wrapped in bracketed-paste markers —
+    // buffered server-side after the markers are stripped — then (2) a lone CR,
+    // the submit signal that fires grok.inject on the accumulated text. The
+    // wrapper is what makes a MULTI-LINE prompt safe: the server submits on a
+    // TRAILING CR, so a naive `text + '\r'` would submit early on an embedded
+    // newline. Same shape as the 4+1 orchestrator inject. Pure (vm-extract tested).
+    function webChatSubmitFrames(text) {
+      return [
+        { type: 'input', data: '\x1b[200~' + String(text) + '\x1b[201~' },
+        { type: 'input', data: '\r' },
+      ];
+    }
+
+    function mountWebChatPanel(id, sessionData, panel) {
+      const meta = sessionData.meta;
+      ensureWebChatStyles();
+
+      const container = document.getElementById(`term-${id}`);
+      container.classList.add('web-chat-terminal');
+      container.innerHTML =
+        `<div class="web-chat-stage" id="wc-stage-${id}">` +
+          `<canvas class="web-chat-canvas" id="wc-canvas-${id}" tabindex="0"></canvas>` +
+        `</div>` +
+        `<form class="web-chat-input-bar" id="wc-form-${id}" autocomplete="off">` +
+          `<input type="text" class="web-chat-input" id="wc-input-${id}" placeholder="Message Grok…  (Enter sends into the live session)">` +
+          `<button type="submit" class="web-chat-send" id="wc-send-${id}">send</button>` +
+        `</form>`;
+
+      const stage = document.getElementById(`wc-stage-${id}`);
+      const canvas = document.getElementById(`wc-canvas-${id}`);
+      const ctx = canvas.getContext('2d');
+      const inputEl = document.getElementById(`wc-input-${id}`);
+      const formEl = document.getElementById(`wc-form-${id}`);
+
+      let lastImg = null, lastDevW = 0, lastDevH = 0, map = null;
+
+      // Paint one screencast frame. T1's frame-channel shape exposes `dataUrl`
+      // (drops straight into Image.src) + deviceWidth/deviceHeight (the page
+      // viewport in CSS px, needed to map clicks back to page coordinates).
+      function paintFrame(frame) {
+        if (!frame) return;
+        const url = frame.dataUrl || (frame.data ? `data:image/${frame.format || 'jpeg'};base64,${frame.data}` : null);
+        if (!url) return;
+        const img = new Image();
+        img.onload = () => {
+          lastImg = img;
+          lastDevW = frame.deviceWidth || img.naturalWidth;
+          lastDevH = frame.deviceHeight || img.naturalHeight;
+          drawLastFrame();
+        };
+        img.src = url;
+      }
+
+      // Letterbox the last frame into the canvas, tracking the transform so
+      // pointer events can be mapped back to page coordinates.
+      function drawLastFrame() {
+        if (!lastImg) return;
+        const rect = stage.getBoundingClientRect();
+        const dpr = window.devicePixelRatio || 1;
+        const cw = Math.max(1, Math.round(rect.width)), ch = Math.max(1, Math.round(rect.height));
+        if (canvas.width !== Math.round(cw * dpr) || canvas.height !== Math.round(ch * dpr)) {
+          canvas.width = Math.round(cw * dpr);
+          canvas.height = Math.round(ch * dpr);
+          canvas.style.width = cw + 'px';
+          canvas.style.height = ch + 'px';
+        }
+        const iw = lastImg.naturalWidth, ih = lastImg.naturalHeight;
+        const scale = Math.min(canvas.width / iw, canvas.height / ih);
+        const dw = iw * scale, dh = ih * scale;
+        const dx = (canvas.width - dw) / 2, dy = (canvas.height - dh) / 2;
+        ctx.fillStyle = '#000';
+        ctx.fillRect(0, 0, canvas.width, canvas.height);
+        ctx.drawImage(lastImg, dx, dy, dw, dh);
+        map = { dx, dy, scale, iw, ih, dpr };
+      }
+
+      // canvas client px → page CSS px (or null if the click hit the letterbox).
+      function mapToPage(clientX, clientY) {
+        if (!map || !lastDevW || !lastDevH) return null;
+        const rect = canvas.getBoundingClientRect();
+        const px = (clientX - rect.left) * map.dpr, py = (clientY - rect.top) * map.dpr;
+        const ix = (px - map.dx) / map.scale, iy = (py - map.dy) / map.scale;
+        if (ix < 0 || iy < 0 || ix > map.iw || iy > map.ih) return null;
+        return { x: Math.round(ix * (lastDevW / map.iw)), y: Math.round(iy * (lastDevH / map.ih)) };
+      }
+
+      function liveWs() { const e = state.sessions.get(id); return e && e.ws; }
+      // Submit a composer prompt via T2's two-stage assembler (bracketed-paste
+      // body buffered, then a lone CR fires grok.inject). NOT a single raw
+      // {type:'input',data:text} — that has no submit sentinel and buffers
+      // server-side forever (T4 FINDING 13:30).
+      function sendComposerSubmit(text) {
+        const ws = liveWs();
+        if (!ws || ws.readyState !== WebSocket.OPEN) return false;
+        for (const frame of webChatSubmitFrames(text)) ws.send(JSON.stringify(frame));
+        return true;
+      }
+      function sendCdpEvent(event) {
+        const ws = liveWs();
+        if (ws && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: 'web-chat-input', event }));
+      }
+
+      // Input box → submit the prompt into the live composer via the two-stage
+      // assembler. Clearing the field is gated on the WS send so a prompt is
+      // never silently lost when the socket is down.
+      formEl.addEventListener('submit', (e) => {
+        e.preventDefault();
+        const text = inputEl.value;
+        if (!text.trim()) return;
+        if (sendComposerSubmit(text)) inputEl.value = '';
+      });
+      inputEl.addEventListener('focus', () => { panel.classList.add('active-input'); state.focusedId = id; });
+      inputEl.addEventListener('blur', () => { panel.classList.remove('active-input'); });
+
+      // Canvas → forward clicks + wheel to the live tab so the human can drive
+      // it in-deck. (Text typing stays in the input box for v1; full keyboard
+      // forwarding is a future enhancement to avoid hijacking deck shortcuts.)
+      canvas.addEventListener('mousedown', (e) => {
+        const pt = mapToPage(e.clientX, e.clientY); if (!pt) return;
+        canvas.focus(); state.focusedId = id;
+        sendCdpEvent({ kind: 'mouse', type: 'mousePressed', x: pt.x, y: pt.y, button: 'left', clickCount: 1 });
+      });
+      canvas.addEventListener('mouseup', (e) => {
+        const pt = mapToPage(e.clientX, e.clientY); if (!pt) return;
+        sendCdpEvent({ kind: 'mouse', type: 'mouseReleased', x: pt.x, y: pt.y, button: 'left', clickCount: 1 });
+      });
+      canvas.addEventListener('wheel', (e) => {
+        const pt = mapToPage(e.clientX, e.clientY); if (!pt) return;
+        e.preventDefault();
+        sendCdpEvent({ kind: 'mouse', type: 'mouseWheel', x: pt.x, y: pt.y, deltaX: e.deltaX, deltaY: e.deltaY });
+      }, { passive: false });
+
+      const ws = new WebSocket(`${WS_BASE}?session=${id}`);
+      ws.onmessage = (event) => handleWebChatWsMessage(id, event, paintFrame);
+      ws.onclose = (event) => {
+        const e2 = state.sessions.get(id); if (!e2) return;
+        if (event.code === 4000 || event.code === 4001) return;
+        const p = document.getElementById(`panel-${id}`);
+        if (p && p.classList.contains('exited')) return;
+        const delay = Math.min(1000 * Math.pow(2, (e2._reconnectAttempts || 0)), 10000);
+        e2._reconnectAttempts = (e2._reconnectAttempts || 0) + 1;
+        if (e2._reconnectAttempts <= 5) setTimeout(() => reconnectWebChat(id), delay);
+        else updatePanelMeta(id, { status: 'errored', statusDetail: 'Connection lost' });
+      };
+
+      // Re-letterbox on panel resize (fitAll() also calls our fitAddon.fit()).
+      const resizeObserver = new ResizeObserver(() => { try { drawLastFrame(); } catch (err) { /* ignore */ } });
+      resizeObserver.observe(stage);
+
+      state.sessions.set(id, {
+        session: sessionData,
+        ws,
+        el: panel,
+        isWebChat: true,
+        canvas, ctx, inputEl,
+        paintFrame, drawLastFrame,
+        // No xterm. A no-op-ish fitAddon keeps fitAll()/drawer-resize loops safe
+        // AND re-letterboxes the canvas on a global re-fit.
+        fitAddon: { fit() { drawLastFrame(); } },
+        activeTab: 'overview',
+        drawerOpen: false,
+        commandHistory: [],
+        commandsLoaded: false,
+        memoryHits: [],
+        statusLog: [],
+        webChatLog: [],
+        lastKnownStatus: meta.status,
+      });
+
+      appendStatusLog(id, meta.status, meta.statusDetail || '');
+      setupDrawerListeners(id);
+      renderOverviewTab(id);
+      renderSwitcher();
+      const replyBtn = document.getElementById(`reply-btn-${id}`);
+      if (replyBtn) replyBtn.disabled = state.sessions.size < 2;
+      refreshAllReplyFormsFor(id);
+      refreshPanelIndices();
+      revealNewPanelIfFiltered(meta);
+      refreshDashboardChrome();
+      requestAnimationFrame(() => drawLastFrame());
+
+      return { ws, canvas };
+    }
+
+    // Shared WS dispatch for web-chat panels (used by both initial mount and
+    // reconnect). Mirrors the xterm handler's non-output cases exactly (same
+    // downstream fns) but routes screencast frames → canvas and grok text → an
+    // in-memory transcript instead of writing to an xterm.
+    function handleWebChatWsMessage(id, event, paintFrame) {
+      let msg;
+      try { msg = JSON.parse(event.data); }
+      catch (err) { console.error('[client] web-chat ws parse failed:', err); return; }
+      const entry = state.sessions.get(id);
+      switch (msg.type) {
+        case 'web-chat-frame':
+          if (paintFrame) paintFrame(msg.frame);
+          else if (entry && entry.paintFrame) entry.paintFrame(msg.frame);
+          break;
+        case 'output':
+          // Grok response text. The canvas is the visual; keep a transcript for
+          // potential future drawer rendering. Never write to a (nonexistent) xterm.
+          if (entry) { (entry.webChatLog = entry.webChatLog || []).push(msg.data); }
+          break;
+        case 'meta':
+          updatePanelMeta(id, msg.session.meta);
+          break;
+        case 'proactive_memory':
+          showProactiveToast(id, msg.hit, msg.flashback_event_id);
+          break;
+        case 'exit': {
+          updatePanelMeta(id, { status: 'exited', statusDetail: `Exited (${msg.exitCode})` });
+          const p = document.getElementById(`panel-${id}`);
+          if (p) p.classList.add('exited');
+          refreshAllReplyFormsFor(id);
+          refreshPanelIndices();
+          renderSwitcher();
+          break;
+        }
+        case 'panel_exited':
+          handlePanelExited(msg.sessionId, msg.exitCode);
+          break;
+        case 'status_broadcast':
+          updateGlobalStats(msg.sessions);
+          break;
+        case 'config_changed':
+          if (msg.config) {
+            state.config = { ...state.config, ...msg.config };
+            if (typeof renderSettingsPanel === 'function') renderSettingsPanel();
+            if (typeof updateRagIndicator === 'function') updateRagIndicator();
+          }
+          break;
+        case 'projects_changed':
+          if (msg.projects && state.config) {
+            state.config.projects = msg.projects;
+            if (typeof rebuildProjectDropdown === 'function') rebuildProjectDropdown();
+          }
+          break;
+      }
+    }
+
+    function reconnectWebChat(id) {
+      const entry = state.sessions.get(id);
+      if (!entry) return;
+      const ws = new WebSocket(`${WS_BASE}?session=${id}`);
+      ws.onmessage = (event) => handleWebChatWsMessage(id, event, entry.paintFrame);
+      ws.onopen = () => {
+        entry._reconnectAttempts = 0;
+        entry.ws = ws;
+        updatePanelMeta(id, { status: 'active', statusDetail: 'Reconnected' });
+      };
+      ws.onclose = (event) => {
+        const p = document.getElementById(`panel-${id}`);
+        if (p && p.classList.contains('exited')) return;
+        if (event.code === 4001) {
+          updatePanelMeta(id, { status: 'exited', statusDetail: 'Session ended' });
+          if (p) p.classList.add('exited');
+          return;
+        }
+        const delay = Math.min(1000 * Math.pow(2, (entry._reconnectAttempts || 0)), 10000);
+        entry._reconnectAttempts = (entry._reconnectAttempts || 0) + 1;
+        if (entry._reconnectAttempts <= 5) setTimeout(() => reconnectWebChat(id), delay);
+        else updatePanelMeta(id, { status: 'errored', statusDetail: 'Connection lost' });
+      };
+    }
+
     // ===== Sprint 65: project-filter chips + ORCH-panel pin + tile lifecycle =====
     // Brad's 2026-05-13 v2 spec (BACKLOG § D.5) — three dashboard-reliability
     // surfaces sharing one client-side lane:
@@ -1738,8 +2037,10 @@
         entry.el.classList.add('primary');
       }
 
-      // Focus the xterm textarea (without stealing pointer)
-      try { entry.terminal.focus(); } catch (err) { /* ignore */ }
+      // Focus the xterm textarea (without stealing pointer); web-chat panels
+      // focus their inject input instead.
+      if (entry.terminal) { try { entry.terminal.focus(); } catch (err) { /* ignore */ } }
+      else if (entry.inputEl) { try { entry.inputEl.focus(); } catch (err) { /* ignore */ } }
       state.focusedId = id;
 
       // Flash the panel border briefly
@@ -1833,7 +2134,7 @@
         setTimeout(() => {
           try { entry.fitAddon.fit(); } catch (err) { /* ignore */ }
           const ws = entry.ws;
-          if (ws && ws.readyState === WebSocket.OPEN) {
+          if (ws && ws.readyState === WebSocket.OPEN && entry.terminal) {  // PTY resize only; web-chat has no cols/rows
             ws.send(JSON.stringify({
               type: 'resize',
               cols: entry.terminal.cols,
@@ -2054,6 +2355,8 @@
       const entry = state.sessions.get(id);
       if (entry && entry.terminal) {
         try { entry.terminal.focus(); } catch (err) { /* ignore */ }
+      } else if (entry && entry.inputEl) {
+        try { entry.inputEl.focus(); } catch (err) { /* ignore */ }  // web-chat inject box
       }
 
       // Re-fit all visible terminals
@@ -2164,9 +2467,9 @@
 
       const entry = state.sessions.get(id);
       if (entry) {
-        entry.terminal.dispose();
-        entry.ws.close();
-        entry.el.remove();
+        if (entry.terminal) entry.terminal.dispose();  // web-chat panels have no xterm
+        if (entry.ws) entry.ws.close();
+        if (entry.el) entry.el.remove();
         state.sessions.delete(id);
       }
 
@@ -2183,7 +2486,7 @@
       if (!entry) return;
 
       const themeObj = getThemeObject(themeId);
-      entry.terminal.options.theme = themeObj;
+      if (entry.terminal) entry.terminal.options.theme = themeObj;  // no xterm on web-chat panels
 
       // Persist to server (writes to sessions.theme_override server-side)
       api('PATCH', `/api/sessions/${id}`, { theme: themeId });
@@ -2199,7 +2502,7 @@
       const updated = await api('PATCH', '/api/sessions/' + id, { theme: null });
       const resolved = updated && updated.meta && updated.meta.theme;
       if (!resolved) return;
-      entry.terminal.options.theme = getThemeObject(resolved);
+      if (entry.terminal) entry.terminal.options.theme = getThemeObject(resolved);
       const sel = document.getElementById('theme-' + id);
       if (sel && sel.value !== resolved) sel.value = resolved;
     }
@@ -2267,9 +2570,14 @@
       const entry = state.sessions.get(id);
       if (!entry) return;
 
+      // Sprint 72 T3 — web-chat panels have no xterm; route mnestra output to a
+      // no-op writer so askAI still caches Memory-tab hits without crashing on a
+      // missing terminal. (xterm panels render inline exactly as before.)
+      const tw = (s) => { if (entry.terminal) { try { entry.terminal.write(s); } catch (e) { /* ignore */ } } };
+
       // Early return if AI queries are not available
       if (!state.config.aiQueryAvailable) {
-        entry.terminal.write(
+        tw(
           '\r\n\x1b[33m[mnestra] AI queries are not available.\x1b[0m\r\n' +
           '\x1b[33mTo enable, add the following to ~/.termdeck/config.yaml:\x1b[0m\r\n' +
           '\x1b[90m  rag:\r\n' +
@@ -2292,7 +2600,7 @@
         });
 
         if (result.error) {
-          entry.terminal.write(`\r\n\x1b[33m[mnestra] ${result.error}\x1b[0m\r\n`);
+          tw(`\r\n\x1b[33m[mnestra] ${result.error}\x1b[0m\r\n`);
         } else if (result.memories && result.memories.length > 0) {
           // Cache hits for the Memory tab
           if (!entry.memoryHits) entry.memoryHits = [];
@@ -2307,7 +2615,7 @@
           if (entry.drawerOpen && entry.activeTab === 'memory') {
             renderMemoryTab(id);
           }
-          const cols = entry.terminal.cols || 80;
+          const cols = (entry.terminal && entry.terminal.cols) || 80;
           const wrap = (text, indent) => {
             const maxW = cols - indent - 2;
             const words = text.split(/\s+/);
@@ -2325,23 +2633,23 @@
             return lines;
           };
 
-          entry.terminal.write(`\r\n\x1b[36m━━━ Mnestra: ${result.total} memories found ━━━\x1b[0m\r\n`);
+          tw(`\r\n\x1b[36m━━━ Mnestra: ${result.total} memories found ━━━\x1b[0m\r\n`);
           for (const m of result.memories) {
             const score = m.similarity ? `${(m.similarity * 100).toFixed(0)}%` : '';
             const proj = m.project ? m.project : '';
-            entry.terminal.write(`\r\n\x1b[35m● ${m.source_type}\x1b[0m \x1b[90m${proj} ${score}\x1b[0m\r\n`);
+            tw(`\r\n\x1b[35m● ${m.source_type}\x1b[0m \x1b[90m${proj} ${score}\x1b[0m\r\n`);
             const contentLines = wrap(m.content || '(empty)', 2);
             for (const cl of contentLines) {
-              entry.terminal.write(`${cl}\r\n`);
+              tw(`${cl}\r\n`);
             }
           }
-          entry.terminal.write(`\r\n\x1b[36m━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\x1b[0m\r\n\r\n`);
+          tw(`\r\n\x1b[36m━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\x1b[0m\r\n\r\n`);
         } else {
-          entry.terminal.write(`\r\n\x1b[33m[mnestra] No relevant memories found.\x1b[0m\r\n`);
+          tw(`\r\n\x1b[33m[mnestra] No relevant memories found.\x1b[0m\r\n`);
         }
       } catch (err) {
         console.error('[client] AI query failed:', err);
-        entry.terminal.write(`\r\n\x1b[31m[mnestra] Query failed: ${err.message}\x1b[0m\r\n`);
+        tw(`\r\n\x1b[31m[mnestra] Query failed: ${err.message}\x1b[0m\r\n`);
       }
 
       inputEl.value = '';
@@ -3447,6 +3755,7 @@
         'codex': 'Codex CLI',
         'gemini': 'Gemini CLI',
         'grok': 'Grok CLI',
+        'web-chat': 'Grok (web)',
         'python-server': 'Python Server',
         'one-shot': 'One-shot'
       };
@@ -3542,7 +3851,7 @@
         if (themeSelect && themeSelect.value !== meta.theme) {
           themeSelect.value = meta.theme;
           const entry = state.sessions.get(id);
-          if (entry) {
+          if (entry && entry.terminal) {  // web-chat panels have no xterm to theme
             entry.terminal.options.theme = getThemeObject(meta.theme);
           }
         }
@@ -5017,7 +5326,8 @@
             : (curIdx - 1 + ids.length) % ids.length;
           const entry = state.sessions.get(ids[next]);
           if (entry) {
-            entry.terminal.focus();
+            if (entry.terminal) entry.terminal.focus();
+            else if (entry.inputEl) entry.inputEl.focus();  // web-chat: focus the inject box
             state.focusedId = ids[next];
           }
         }

package/packages/server/src/agent-adapters/index.js

@@ -19,6 +19,12 @@ const grok = require('./grok');
 // Sprint 70 T1 — Antigravity CLI (`agy`). Registered under its canonical
 // adapter name `antigravity` (= source_agent); the binary it matches is `agy`.
 const antigravity = require('./agy');
+// Sprint 72 T2 — Grok web-chat panel (`type:'web-chat'`). NOT a node-pty agent:
+// driven by the CDP render-bridge (packages/web-chat-driver) against a real
+// grok.com tab. Registered for `getAdapterForSessionType('web-chat')` +
+// onPanelClose/periodic capture only — its `matches:()=>false` + absent
+// `patterns.prompt` mean it never participates in output/command detection.
+const webChatGrok = require('./web-chat-grok');
 
 // Keyed by adapter name (NOT session.meta.type — adapters expose their own
 // `sessionType` field for that mapping). Order is iteration order for the
@@ -32,6 +38,12 @@ const AGENT_ADAPTERS = {
   // claims that string in the detect loop. agy panels are normally resolved by
   // exact-binary direct-spawn, not output sniffing, so order is not load-bearing.
   antigravity,
+  // Sprint 72 T2 — web-chat-grok. Order is irrelevant: it carries no
+  // `patterns.prompt` and `matches()` returns false, so detectAdapter() + the
+  // direct-spawn loop skip it entirely. It is reachable ONLY via
+  // getAdapterForSessionType('web-chat') (the `.find(a=>a.sessionType===type)`
+  // fallback, since the registry key 'web-chat-grok' ≠ sessionType 'web-chat').
+  'web-chat-grok': webChatGrok,
 };
 
 // Convenience accessor — returns the adapter whose `sessionType` matches the

package/packages/server/src/agent-adapters/web-chat-grok.js

@@ -0,0 +1,259 @@
+// web-chat-grok adapter — Sprint 72 T2 (Workstream B)
+//
+// Sixth adapter in the AGENT_ADAPTERS registry (see ./index.js). Unlike every
+// other adapter it is NOT backed by a node-pty child process — a `web-chat`
+// panel is driven by T1's CDP render-bridge against a real, logged-in headful
+// grok.com tab (`packages/web-chat-driver`). The adapter is the seam the
+// TermDeck server (index.js) consumes; the driver is the seam the adapter
+// consumes. See docs/sprint-72-grok-panel/PLANNING.md § "The 8 TermDeck seams".
+//
+// ── Why a distinct adapter from grok.js (the CLI) ────────────────────────────
+// grok.js drives the `grok-dev` CLI (PTY, ~/.grok/grok.db, GROK_MODEL env). This
+// adapter drives grok.com in a browser — the FLAT-RATE (subscription) path to
+// Grok's reasoning model, which the CLI rejects (`reasoningEffort` → HTTP 400;
+// see grok-models.js). Same provider, different runtime + different cost
+// realization, so it is a separate `sessionType:'web-chat'`. Provenance is
+// tagged `sourceAgent:'grok'` this sprint (ORCH zero-touch decision — see the
+// "source_agent attribution" section); a distinct 'grok-web' tag is deferred.
+//
+// ── The one hard constraint: NO node-pty, NO on-disk transcript ──────────────
+// There is no PTY stream and no conversation file on disk. The server seam
+// accumulates each turn (injected prompt + Grok's completed response) into an
+// in-memory buffer `session._webChatTranscript.turns` (`[{role,content}]`).
+// `resolveTranscriptPath` materializes that buffer into a Gemini-shaped JSON
+// envelope tempfile — EXACTLY the agy.js (Sprint 70 T1) pattern — so the
+// bundled hook's `parseAutoDetect`/`parseGeminiJson` ingest it with NO
+// dedicated `TRANSCRIPT_PARSERS['web-chat']` entry. onPanelClose's close→hook
+// path is reused with no second write path. (Mirrors agy's "live source →
+// tempfile envelope → existing hook" decoupling from the hook layer.)
+//
+// ── statusFor is a contract backstop, not the primary status signal ──────────
+// PTY adapters derive status by pattern-matching escape-laden output. A
+// web-chat panel has no escapes; its status is EVENT-driven by the server seam
+// (a prompt was injected ⇒ 'thinking'; T3's completion detector fired ⇒
+// 'idle'). `statusFor(text)` is implemented for contract uniformity + as a
+// text-shape backstop (and is what index.js routes a completed response
+// through), but the load-bearing transitions are wired in index.js off the
+// driver's inject/onComplete events. We deliberately do NOT carry a
+// `patterns.error` (a Grok answer that DISCUSSES an error is not a panel
+// error) — index.js does not route web-chat text through `_detectErrors`.
+//
+// ── source_agent attribution ─────────────────────────────────────────────────
+// `sourceAgent:'grok'` (ORCH decision 2026-06-08, Blocker 3): we reuse the
+// already-allow-listed 'grok' tag so this sprint touches ZERO release-sensitive
+// surface — the bundled hooks in packages/stack-installer/assets/hooks/* (Brad
+// runs the installed copy) stay pristine. The provenance is still accurate
+// (it IS Grok producing the content); it just doesn't yet distinguish web from
+// CLI. A distinct 'grok-web' tag — which WOULD require adding 'grok-web' to the
+// hook's ALLOWED_SOURCE_AGENTS (else normalizeSourceAgent coerces the row to
+// 'claude') + a hook-version-stamp bump + an install refresh — is deferred to a
+// follow-up. onPanelClose emits `adapter.sourceAgent || adapter.name`.
+//
+// Byte-floor note (also deferred with grok-web): the bundled hook skips
+// transcripts < 5 KB unless sessionType is specifically exempted (only
+// 'antigravity' is today). Our materialized envelope is compact, so a SHORT
+// (<5 KB) web-chat session is currently dropped — substantive auditor/worker
+// sessions (the real use case) run well past 5 KB and capture normally. The
+// exemption is a hook edit, so it rides the same deferred follow-up.
+//
+// Contract — see ./claude.js header for the full annotated adapter shape.
+
+'use strict';
+
+// ──────────────────────────────────────────────────────────────────────────
+// Patterns. A web-chat panel produces no PTY output, so there is intentionally
+// NO `prompt` pattern (would let detectAdapter steal a real PTY panel's output)
+// and NO `error` pattern (chat prose mentioning "Error:" is not a panel error;
+// index.js never runs `_detectErrors` on web-chat text). `thinking` is the one
+// useful text shape: if a completed response somehow still carries Grok's
+// shimmer label, treat it as still-working. Reused conceptually from grok.js.
+// ──────────────────────────────────────────────────────────────────────────
+
+const THINKING = /Planning next moves|Generating plan[….]|Answering[….]|\bThinking\b/;
+
+// ──────────────────────────────────────────────────────────────────────────
+// statusFor — text → { status, statusDetail } | null. By the time index.js
+// routes a string here it is a COMPLETED Grok response (the onComplete event
+// already fired), so the dominant outcome is 'idle' (Grok is done, awaiting the
+// next prompt). The thinking branch is a defensive backstop for the unlikely
+// case a streaming/partial chunk is routed through. null on empty/non-string
+// preserves the contract's "leave status untouched" semantics.
+// ──────────────────────────────────────────────────────────────────────────
+
+function statusFor(data) {
+  if (typeof data !== 'string' || data.length === 0) return null;
+  if (THINKING.test(data)) {
+    return { status: 'thinking', statusDetail: 'Grok is responding…' };
+  }
+  return { status: 'idle', statusDetail: 'Ready' };
+}
+
+// ──────────────────────────────────────────────────────────────────────────
+// parseTranscript — web-chat capture is ALWAYS structured (the server seam
+// builds `[{role,content}]` turns; there is no raw-ANSI path like agy's TUI
+// scrape). Dual-mode for round-trip safety: accept this adapter's own
+// Gemini-shaped envelope `{messages:[{type,content}]}` AND a bare
+// `[{role,content}]` array. Returns [] on empty/garbage (fail-soft parity).
+// Content truncated to 400 chars to match the other adapters' parsers and the
+// hook's summary builder.
+// ──────────────────────────────────────────────────────────────────────────
+
+function parseTranscript(raw) {
+  if (typeof raw !== 'string' || raw.length === 0) return [];
+  let obj;
+  try { obj = JSON.parse(raw); }
+  catch (_) { return []; }
+  const rows = Array.isArray(obj)
+    ? obj
+    : (obj && Array.isArray(obj.messages) ? obj.messages : null);
+  if (!rows) return [];
+  const out = [];
+  for (const m of rows) {
+    if (!m || typeof m !== 'object') continue;
+    // Accept both shapes: {role} (array form) and {type} (envelope form). Only
+    // 'user'/'assistant' pass in EITHER field; any other value is dropped — same
+    // as the bundled hook's parseGeminiJson treats the envelope (we only ever
+    // materialize 'user'/'assistant', so this is strictness, not behavior loss).
+    let role = null;
+    if (m.role === 'user' || m.role === 'assistant') role = m.role;
+    else if (m.type === 'user' || m.type === 'assistant') role = m.type;
+    if (role !== 'user' && role !== 'assistant') continue;
+    const content = m.content;
+    let text = '';
+    if (typeof content === 'string') text = content;
+    else if (Array.isArray(content)) {
+      text = content
+        .filter((c) => c && typeof c.text === 'string')
+        .map((c) => c.text)
+        .join(' ');
+    }
+    if (text) out.push({ role, content: text.slice(0, 400) });
+  }
+  return out;
+}
+
+// ──────────────────────────────────────────────────────────────────────────
+// resolveTranscriptPath — Sprint 72 T2. No on-disk transcript exists; the
+// server seam accumulates turns into `session._webChatTranscript.turns`. We
+// materialize that into a Gemini-shaped `{messages:[{type,content}]}` tempfile
+// the bundled hook's parseAutoDetect ingests. Returns null when the panel
+// produced no turn so onPanelClose + the periodic-capture timer no-op cleanly.
+//
+// Called by BOTH onPanelClose (once, at close) and onPanelPeriodicCapture
+// (every interval) — each call re-materializes the current buffer so the
+// periodic timer's size-delta throttle sees the transcript grow. Mirrors agy's
+// resolveTranscriptPath exactly (same envelope shape, same tmpfile discipline).
+// ──────────────────────────────────────────────────────────────────────────
+
+// Per-turn content cap. The hook truncates to 400 for the summary, but storing
+// a bit more keeps the envelope useful for any future richer consumer while
+// bounding tempfile size on a long auditor session.
+const MAX_TURN_CHARS = 4000;
+
+async function resolveTranscriptPath(session) {
+  const fs = require('fs');
+  const path = require('path');
+  const os = require('os');
+  if (!session || !session.meta) return null;
+  const buf = session._webChatTranscript;
+  if (!buf || !Array.isArray(buf.turns) || buf.turns.length === 0) return null;
+
+  const messages = [];
+  for (const t of buf.turns) {
+    if (!t || (t.role !== 'user' && t.role !== 'assistant')) continue;
+    const content = typeof t.content === 'string' ? t.content : '';
+    if (!content) continue;
+    messages.push({ type: t.role, content: content.slice(0, MAX_TURN_CHARS) });
+  }
+  if (messages.length === 0) return null;
+
+  const envelope = { messages };
+  const safeId = String(session.id || `unknown-${session.pid || ''}`)
+    .replace(/[^a-zA-Z0-9._-]/g, '_');
+  const tmpfile = path.join(os.tmpdir(), `termdeck-webchat-${safeId}.json`);
+  try {
+    fs.writeFileSync(tmpfile, JSON.stringify(envelope), 'utf8');
+  } catch (_) {
+    return null; // fail-soft — a tmpfile write failure must not block teardown
+  }
+  return tmpfile;
+}
+
+// ──────────────────────────────────────────────────────────────────────────
+// bootPromptTemplate — a web-chat Grok panel used as a 4+1 lane gets its boot
+// prompt INJECTED into the composer (via the server's two-stage inject seam),
+// not typed into a CLI. Same memory_recall + read-instructional-file + read-
+// sprint-docs scaffold as the Grok CLI adapter; points at AGENTS.md (Grok's
+// project-prompt convention). Contract-complete placeholder.
+// ──────────────────────────────────────────────────────────────────────────
+
+function bootPromptTemplate(lane = {}, sprint = {}) {
+  const tn = lane.id || 'T?';
+  const sprintNum = sprint.number || '?';
+  const sprintName = sprint.name || 'unnamed';
+  const project = (lane.project || sprint.project || 'termdeck');
+  const briefing = lane.briefingPath || `docs/sprint-${sprintNum}-${sprintName}/${tn}-<lane>.md`;
+  const topic = lane.topic || lane.briefingPath || sprintName;
+  return [
+    `You are ${tn} in Sprint ${sprintNum} (${sprintName}). Boot sequence:`,
+    `1. memory_recall(project="${project}", query="${topic}")`,
+    `2. memory_recall(query="recent decisions and bugs")`,
+    `3. Read ~/.claude/CLAUDE.md and ./AGENTS.md`,
+    `4. Read docs/sprint-${sprintNum}-${sprintName}/PLANNING.md`,
+    `5. Read docs/sprint-${sprintNum}-${sprintName}/STATUS.md`,
+    `6. Read ${briefing}`,
+    '',
+    'Then begin. Stay in your lane. Post FINDING / FIX-PROPOSED / DONE in STATUS.md.',
+    "Don't bump versions, don't touch CHANGELOG, don't commit.",
+  ].join('\n');
+}
+
+const webChatGrokAdapter = {
+  name: 'web-chat-grok',
+  sessionType: 'web-chat',
+  // ORCH decision 2026-06-08 (Blocker 3): reuse the already-allow-listed 'grok'
+  // tag so this sprint touches zero release-sensitive hook surface. A distinct
+  // 'grok-web' tag is deferred (needs a hook allowlist edit + version bump).
+  // See the "source_agent attribution" header for the full rationale.
+  sourceAgent: 'grok',
+  // Sprint 50 T3 — human-readable label for launcher buttons + panel headers.
+  displayName: 'Grok (Web)',
+  // Provider URL the CDP driver navigates the dedicated-profile tab to on
+  // attach (T1's `cdp.attach({startUrl})` defaults to about:blank). Provider-
+  // owned so a future web-chat-<provider> adapter sets its own. The server seam
+  // reads this and passes it through as `startUrl`.
+  webChatUrl: 'https://grok.com',
+  // CRITICAL: never claim a command-spawned session. web-chat panels are created
+  // ONLY via an explicit `type:'web-chat'` on POST /api/sessions — never by
+  // output sniffing or command-string match. Returning false here (and carrying
+  // no `patterns.prompt` below) guarantees this adapter can never hijack a real
+  // PTY panel's detection in detectAdapter()/the direct-spawn loop.
+  matches: () => false,
+  // No `spawn` block — there is no binary. The direct-spawn loop in index.js is
+  // gated on `matches()` (always false here) so it is never reached.
+  patterns: {
+    // Intentionally NO `prompt` (see matches) and NO `error` (chat prose is not
+    // a panel error). Only the thinking shimmer, used by statusFor.
+    thinking: THINKING,
+  },
+  patternNames: {},
+  statusFor,
+  parseTranscript,
+  // 10th adapter field — materializes the in-flight turn buffer into a tempfile
+  // envelope (see header). Its PRESENCE is what makes onPanelClose +
+  // onPanelPeriodicCapture fire for web-chat panels.
+  resolveTranscriptPath,
+  bootPromptTemplate,
+  // The whole point of the web path: flat-rate subscription, not per-token.
+  costBand: 'subscription',
+  // N/A for a browser composer — the server seam assembles the 4+1 two-stage
+  // paste/submit into a single `grok.inject(handle, fullText)` call, so there is
+  // no PTY bracketed-paste handler to be capable-or-not. Declared for contract
+  // completeness.
+  acceptsPaste: true,
+  // No MCP config to auto-wire — grok.com is a browser session, not a CLI with
+  // an MCP-server registry file. null = user-managed/none (same as Claude).
+  mcpConfig: null,
+};
+
+module.exports = webChatGrokAdapter;

package/packages/server/src/index.js

@@ -104,7 +104,7 @@ const { createGraphRoutes } = require('./graph-routes');
 const { createProjectsRoutes } = require('./projects-routes');
 const orchestrationPreview = require('./orchestration-preview');
 const { createPtyReaper } = require('./pty-reaper');
-const { AGENT_ADAPTERS } = require('./agent-adapters');
+const { AGENT_ADAPTERS, getAdapterForSessionType } = require('./agent-adapters');
 const { deriveRagMode } = require('./rag-mode');
 const { resolveSpawnShell } = require('./spawn-shell');
 
@@ -245,6 +245,37 @@ function _setSpawnPeriodicCaptureHookImplForTesting(fn) {
   _spawnPeriodicCaptureHookImpl = typeof fn === 'function' ? fn : _defaultSpawnPeriodicCaptureHookImpl;
 }
 
+// Sprint 72 T2 — web-chat driver resolver (Workstream B). A `web-chat` panel is
+// backed by T1's CDP render-bridge (packages/web-chat-driver), NOT node-pty.
+// Lazy-required + fail-soft: if the driver isn't built/installed yet (T1/T3
+// build it in parallel) the require throws and we return null, so a web-chat
+// spawn degrades to 'errored' status instead of crashing the server — PTY
+// panels AND the parallel Sprint 71 deck stay completely unaffected. The
+// require is by RELATIVE PATH (resolving the package's own package.json `main`),
+// not a root dependency, per Guardrail 5 (no root package.json churn; the
+// driver keeps its own isolated install). Tests inject a fake driver via
+// `_setWebChatDriverImplForTesting` (same DI rationale as the hook-spawn impls
+// above) so the seams are exercised with no real Chrome / CDP / network.
+//
+// Defensive aggregator-gap handling: the driver's src/index.js currently
+// exports only `{ cdp }` (T3's `grok` namespace isn't wired into the aggregator
+// yet — flagged in Sprint 72 STATUS.md). If `.grok` is absent we attach it from
+// the sub-module directly so this seam works before that one-line T1 fix lands.
+function _defaultWebChatDriverImpl() {
+  let driver;
+  try { driver = require('../../web-chat-driver'); }
+  catch (_e) { return null; }
+  if (driver && !driver.grok) {
+    try { driver = { ...driver, grok: require('../../web-chat-driver/src/grok') }; }
+    catch (_e) { /* grok namespace not present yet — cdp-only handle is degraded but non-fatal */ }
+  }
+  return driver;
+}
+let _webChatDriverImpl = _defaultWebChatDriverImpl;
+function _setWebChatDriverImplForTesting(fn) {
+  _webChatDriverImpl = typeof fn === 'function' ? fn : _defaultWebChatDriverImpl;
+}
+
 // Fires when a panel's PTY exits. Routes through the adapter registry's
 // new `resolveTranscriptPath` field (10th adapter field, Sprint 50) and
 // invokes the bundled `~/.claude/hooks/memory-session-end.js` with the
@@ -1324,6 +1355,328 @@ function createServer(config) {
   // the same wiring (transcripts, RAG, Mnestra flashback) without copy-paste.
   // Returns the Session object regardless of PTY success — status will be
   // 'errored' if pty.spawn threw.
+  // ────────────────────────────────────────────────────────────────────────
+  // Sprint 72 T2 (Workstream B) — web-chat panel lifecycle.
+  //
+  // A `web-chat` session is driven by T1's CDP render-bridge against a real
+  // grok.com tab, NOT node-pty. These closures are the server seams that
+  // consume the `web-chat-grok` adapter + the driver, reusing the SAME
+  // inject/read/transcript/capture machinery the PTY panels use. The PTY path
+  // (`if (pty)` in spawnTerminalSession) is left byte-identical (Guardrail 3);
+  // everything web-chat is gated on `session.meta.type === 'web-chat'`.
+  // ────────────────────────────────────────────────────────────────────────
+
+  // Per-server panel counter so each web-chat panel gets a distinct CDP port
+  // (T1's profile.js: "T2 allocates a distinct port per panel"). The first
+  // panel uses the canonical 'grok' profile + base port — the warm-login
+  // location the human signs into once. Additional concurrent panels get their
+  // own profile + port (their own Chrome). NOTE: that means panel ≥2 has an
+  // ISOLATED Grok login, not the shared one — the shared-browser-multi-tab
+  // model is a follow-up (flagged in STATUS); single-panel is the sprint scope.
+  let _webChatPanelSeq = 0;
+
+  // Resolve the dedicated profile (NAME → T1's resolveProfileDir maps it to
+  // ~/.termdeck/web-chat-profiles/<name>; an absolute path is used verbatim),
+  // the per-panel CDP port, and the provider start URL (from the adapter).
+  // Posture: never the human's DEFAULT Chrome profile (Chrome 136+ blocks CDP
+  // there anyway). Every value is config/env-overridable.
+  function resolveWebChatProfile(adapter) {
+    const wc = (config && config.webChat) || {};
+    const n = _webChatPanelSeq++;
+    const baseName = wc.profile || process.env.TERMDECK_WEBCHAT_PROFILE || 'grok';
+    const userDataDir = wc.userDataDir
+      || process.env.TERMDECK_WEBCHAT_USER_DATA_DIR
+      || (n === 0 ? baseName : `${baseName}-${n + 1}`);
+    const basePort = parseInt(
+      String(wc.cdpPort || process.env.TERMDECK_WEBCHAT_CDP_PORT || '9333'), 10,
+    );
+    const cdpPort = (Number.isFinite(basePort) ? basePort : 9333) + n;
+    const startUrl = (adapter && adapter.webChatUrl) || wc.startUrl || 'https://grok.com';
+    return { userDataDir, cdpPort, startUrl };
+  }
+
+  // Set status + fire the (best-effort) status-change telemetry. No-op once the
+  // panel is exited so a late driver callback can't resurrect a dead panel.
+  function applyWebChatStatus(session, { status, statusDetail } = {}) {
+    if (!status || session.meta.status === 'exited') return;
+    const oldStatus = session.meta.status;
+    session.meta.status = status;
+    session.meta.statusDetail = statusDetail || '';
+    session.meta.lastActivity = new Date().toISOString();
+    if (oldStatus !== status && session.onStatusChange) {
+      try { session.onStatusChange(session, oldStatus, status); }
+      catch (err) { console.error('[web-chat] onStatusChange error:', err && err.message); }
+    }
+  }
+
+  // Register the periodic-capture timer — web-chat is a non-Claude adapter WITH
+  // resolveTranscriptPath, so it is eligible exactly like a Codex/Gemini/Grok/
+  // agy panel. Replicated from the PTY path (index.js spawn block) rather than
+  // shared so the PTY branch stays byte-identical (Guardrail 3).
+  function maybeRegisterWebChatPeriodicCapture(session) {
+    try {
+      const adapter = getAdapterForSessionType(session.meta.type);
+      const eligible = adapter
+        && adapter.sessionType !== 'claude-code'
+        && typeof adapter.resolveTranscriptPath === 'function';
+      const intervalMs = _resolvePeriodicCaptureIntervalMs();
+      if (eligible && intervalMs > 0) {
+        session._periodicCapture = { lastSize: 0, lastFireMs: 0, timer: null };
+        session._periodicCapture.timer = setInterval(() => {
+          onPanelPeriodicCapture(session).catch((err) => {
+            console.error('[periodic-capture] async error:', err && err.message ? err.message : err);
+          });
+        }, intervalMs);
+        if (session._periodicCapture.timer.unref) session._periodicCapture.timer.unref();
+      }
+    } catch (_e) { /* fail-soft */ }
+  }
+
+  // A completed Grok turn (from the driver's onComplete OR a degraded driver's
+  // inject-resolved text): record it, update status via the adapter, broadcast
+  // {type:'output'}, archive to the transcript writer. Deliberately NOT
+  // session.analyzeOutput() — its _detectErrors would false-positive 'errored'
+  // on chat prose containing "Error:" (see web-chat-grok.js header). statusFor
+  // gives the same status outcome without that hazard.
+  function onWebChatResponse(session, responseText) {
+    if (typeof responseText !== 'string' || responseText.length === 0) return;
+    if (session.meta.status === 'exited') return;
+
+    if (session._webChatTranscript && Array.isArray(session._webChatTranscript.turns)) {
+      session._webChatTranscript.turns.push({ role: 'assistant', content: responseText });
+    }
+
+    const adapter = getAdapterForSessionType('web-chat');
+    let applied = false;
+    if (adapter && typeof adapter.statusFor === 'function') {
+      const st = adapter.statusFor(responseText);
+      if (st && st.status) { applyWebChatStatus(session, st); applied = true; }
+    }
+    if (!applied) session.meta.lastActivity = new Date().toISOString();
+
+    if (session.ws && session.ws.readyState === 1) {
+      try { session.ws.send(JSON.stringify({ type: 'output', data: responseText })); }
+      catch (_e) { /* never disrupt */ }
+    }
+    if (transcriptWriter) {
+      try { transcriptWriter.append(session.id, responseText, Buffer.byteLength(responseText, 'utf8')); }
+      catch (_e) { /* never let transcript failures disrupt the data path */ }
+    }
+  }
+
+  // Route injected/typed text to the driver's "type into composer + send",
+  // NOT pty.write. Assembles the 4+1 two-stage submit (paste body buffered,
+  // fired on the lone-`\r`) so the orchestrator inject pattern works UNCHANGED.
+  // Returns a small status object the route maps to HTTP.
+  function routeWebChatInput(session, text) {
+    if (typeof text !== 'string') return { ok: false, code: 'invalid_text' };
+    const wc = session._webChat;
+    if (!wc || !wc.handle || !wc.driver || !wc.driver.grok
+        || typeof wc.driver.grok.inject !== 'function') {
+      return { ok: false, code: 'web_chat_not_ready' };
+    }
+    if (!session._webChatInput) session._webChatInput = { pending: '' };
+
+    // Strip bracketed-paste markers; a trailing CR/LF is the submit signal.
+    // No trailing newline ⇒ accumulate only (the two-stage stage-1 case).
+    const stripped = text.replace(/\x1b\[200~/g, '').replace(/\x1b\[201~/g, '');
+    const m = stripped.match(/^([\s\S]*?)[\r\n]+$/);
+    let content; let doSubmit;
+    if (m) { content = m[1]; doSubmit = true; } else { content = stripped; doSubmit = false; }
+    if (content) session._webChatInput.pending += content;
+    if (!doSubmit) return { ok: true, buffered: true };
+
+    const full = session._webChatInput.pending;
+    session._webChatInput.pending = '';
+    if (!full) return { ok: true, empty: true };
+
+    if (session._webChatTranscript && Array.isArray(session._webChatTranscript.turns)) {
+      session._webChatTranscript.turns.push({ role: 'user', content: full });
+    }
+    // Event-driven status so the orchestrator inject-verify sees 'thinking'
+    // immediately after the submit lands (parity with a PTY agent panel).
+    applyWebChatStatus(session, { status: 'thinking', statusDetail: 'Grok is responding…' });
+
+    try {
+      const p = Promise.resolve(wc.driver.grok.inject(wc.handle, full));
+      if (!wc.unsubscribe) {
+        // onComplete wasn't wired (degraded/cdp-only driver) — pull the reply
+        // from inject's resolved value instead so the turn is still captured.
+        p.then((responseText) => onWebChatResponse(session, responseText))
+         .catch((err) => {
+           console.error('[web-chat] inject failed:', err && err.message ? err.message : err);
+           applyWebChatStatus(session, { status: 'errored', statusDetail: `inject failed: ${err && err.message ? err.message : 'unknown'}` });
+         });
+      } else {
+        // Push model: the onComplete listener handles the reply; just surface
+        // inject errors (double-processing avoided by not consuming the value).
+        p.catch((err) => {
+          console.error('[web-chat] inject failed:', err && err.message ? err.message : err);
+          applyWebChatStatus(session, { status: 'errored', statusDetail: `inject failed: ${err && err.message ? err.message : 'unknown'}` });
+        });
+      }
+    } catch (err) {
+      return { ok: false, code: 'inject_threw', error: err && err.message ? err.message : 'unknown' };
+    }
+    return { ok: true, submitted: true };
+  }
+
+  // The web-chat analog of term.onExit. Idempotent (guarded by
+  // `_webChatClosed`): fires the memory-capture hook (seam 7), clears the
+  // periodic timer, broadcasts exit/panel_exited, and tears down the driver.
+  // Wired into DELETE /api/sessions/:id + the driver disconnect callback.
+  function closeWebChatSession(session, opts = {}) {
+    if (!session || session._webChatClosed) return;
+    session._webChatClosed = true;
+    const exitCode = typeof opts.exitCode === 'number' ? opts.exitCode : 0;
+    const signal = opts.signal || null;
+
+    session.meta.status = 'exited';
+    session.meta.exitCode = exitCode;
+    session.meta.exitedAt = new Date().toISOString();
+    session.meta.statusDetail = `Closed${signal ? ` (${signal})` : ''}`;
+
+    if (session.ws && session.ws.readyState === 1) {
+      try { session.ws.send(JSON.stringify({ type: 'exit', exitCode, signal })); }
+      catch (_e) { /* fail-soft */ }
+    }
+    try {
+      const exitPayload = JSON.stringify({
+        type: 'panel_exited',
+        sessionId: session.id,
+        exitCode,
+        signal: signal || null,
+        exitedAt: session.meta.exitedAt,
+      });
+      wss.clients.forEach((client) => {
+        if (client.readyState === 1) {
+          try { client.send(exitPayload); }
+          catch (err) { console.error('[ws] panel_exited send failed:', err); }
+        }
+      });
+    } catch (err) {
+      console.error('[ws] panel_exited broadcast failed:', err);
+    }
+
+    // Clear the periodic timer BEFORE the close hook so a tick mid-teardown
+    // can't race onPanelClose (same ordering as the PTY path).
+    if (session._periodicCapture && session._periodicCapture.timer) {
+      try { clearInterval(session._periodicCapture.timer); }
+      catch (_e) { /* fail-soft */ }
+      session._periodicCapture.timer = null;
+    }
+
+    onPanelClose(session).catch((err) => {
+      console.error('[panel-close] async error:', err && err.message ? err.message : err);
+    });
+
+    // Tear down driver listeners + detach the CDP handle (tolerant of whichever
+    // teardown method T1's handle exposes).
+    try {
+      const wc = session._webChat;
+      if (wc) {
+        if (typeof wc.unsubscribe === 'function') { try { wc.unsubscribe(); } catch (_e) { /* fail-soft */ } }
+        const h = wc.handle;
+        if (h && typeof h.close === 'function') { try { h.close(); } catch (_e) { /* fail-soft */ } }
+        else if (h && typeof h.detach === 'function') { try { h.detach(); } catch (_e) { /* fail-soft */ } }
+        else if (wc.driver && wc.driver.cdp && typeof wc.driver.cdp.detach === 'function') {
+          try { wc.driver.cdp.detach(h); } catch (_e) { /* fail-soft */ }
+        }
+      }
+    } catch (_e) { /* fail-soft */ }
+  }
+
+  // Boot a web-chat panel: attach T1's driver fire-and-forget (route stays
+  // sync), wire screencast→WS, completion→capture, disconnect→close. Fail-soft
+  // at every step — a missing/partial/throwing driver degrades the panel to
+  // 'errored', never crashes the server.
+  function setupWebChatSession(session) {
+    session.pty = null;
+    session.pid = null;
+    session.meta.status = 'starting';
+    session.meta.statusDetail = 'Connecting to Grok…';
+
+    const adapter = getAdapterForSessionType('web-chat');
+    const driver = _webChatDriverImpl();
+    if (!driver || !driver.cdp || typeof driver.cdp.attach !== 'function' || !adapter) {
+      session.meta.status = 'errored';
+      session.meta.statusDetail = (!driver || !driver.cdp)
+        ? 'web-chat driver not available'
+        : (!adapter ? 'web-chat adapter not registered' : 'web-chat driver missing cdp.attach');
+      return;
+    }
+
+    // In-flight transcript buffer + two-stage inject assembler state.
+    session._webChatTranscript = { turns: [] };
+    session._webChatInput = { pending: '' };
+    // Best-effort status telemetry parity with PTY panels.
+    session.onStatusChange = (sess, oldStatus, newStatus) => {
+      try { rag.onStatusChanged(sess, oldStatus, newStatus); }
+      catch (_e) { /* telemetry is best-effort */ }
+    };
+
+    maybeRegisterWebChatPeriodicCapture(session);
+
+    const { userDataDir, cdpPort, startUrl } = resolveWebChatProfile(adapter);
+
+    (async () => {
+      let handle;
+      try {
+        handle = await driver.cdp.attach({ userDataDir, port: cdpPort, startUrl });
+      } catch (err) {
+        console.error('[web-chat] attach failed:', err && err.message ? err.message : err);
+        if (session.meta.status !== 'exited') {
+          session.meta.status = 'errored';
+          session.meta.statusDetail = `web-chat attach failed: ${err && err.message ? err.message : 'unknown'}`;
+        }
+        return;
+      }
+      if (session._webChatClosed) {
+        // Panel was deleted during attach — detach immediately, don't wire.
+        try { if (handle && typeof handle.close === 'function') handle.close(); } catch (_e) { /* fail-soft */ }
+        return;
+      }
+      session._webChat = { driver, handle, unsubscribe: null };
+
+      // Screencast → WS canvas frames (T3 paints). Prefer handle-method form
+      // (T1's per-session recommendation); fall back to the standalone form.
+      try {
+        const onFrame = (frame) => {
+          if (session.ws && session.ws.readyState === 1) {
+            try { session.ws.send(JSON.stringify({ type: 'web-chat-frame', frame })); }
+            catch (_e) { /* never disrupt */ }
+          }
+        };
+        if (handle && typeof handle.screencast === 'function') handle.screencast(onFrame);
+        else if (driver.cdp && typeof driver.cdp.screencast === 'function') driver.cdp.screencast(handle, onFrame);
+      } catch (err) {
+        console.error('[web-chat] screencast wiring failed:', err && err.message ? err.message : err);
+      }
+
+      // Completed Grok turn → capture (push model).
+      try {
+        if (driver.grok && typeof driver.grok.onComplete === 'function') {
+          session._webChat.unsubscribe = driver.grok.onComplete(handle, (responseText) => {
+            onWebChatResponse(session, responseText);
+          });
+        }
+      } catch (err) {
+        console.error('[web-chat] onComplete wiring failed:', err && err.message ? err.message : err);
+      }
+
+      // Driver/Chrome disconnect → panel close (web-chat analog of term.onExit).
+      try {
+        if (handle && typeof handle.onDisconnect === 'function') {
+          handle.onDisconnect(() => closeWebChatSession(session, { exitCode: 0, signal: 'disconnect' }));
+        } else if (driver.cdp && typeof driver.cdp.onDisconnect === 'function') {
+          driver.cdp.onDisconnect(handle, () => closeWebChatSession(session, { exitCode: 0, signal: 'disconnect' }));
+        }
+      } catch (_e) { /* optional hook — absence is fine */ }
+
+      applyWebChatStatus(session, { status: 'idle', statusDetail: 'Ready' });
+    })();
+  }
+
   function spawnTerminalSession({ command, cwd, project, label, type, theme, reason, role }) {
     const rawCwd = cwd || config.projects?.[project]?.path || os.homedir();
     const resolvedCwd = path.resolve(rawCwd.replace(/^~/, os.homedir()));
@@ -1341,6 +1694,17 @@ function createServer(config) {
       role: role || null,
     });
 
+    // Sprint 72 T2 — web-chat panels are driver-backed, not PTY-backed. Boot
+    // T1's CDP render-bridge (fire-and-forget; `pty` stays null) and return the
+    // session synchronously, exactly as the PTY path returns before the first
+    // onData. setupWebChatSession is fully fail-soft, so this branch can never
+    // crash a spawn — and it sits BEFORE `if (pty)` so a web-chat panel never
+    // touches node-pty.
+    if (session.meta.type === 'web-chat') {
+      setupWebChatSession(session);
+      return session;
+    }
+
     if (pty) {
       // Four launch shapes (Sprint 64 T2 carve-out 2.4 extends the original three):
       //   (1) no command            → spawn the default shell interactively
@@ -1888,8 +2252,14 @@ function createServer(config) {
     const session = sessions.get(req.params.id);
     if (!session) return res.status(404).json({ error: 'Session not found' });
 
-    // Kill PTY process
-    if (session.pty) {
+    // Sprint 72 T2 — web-chat panels have no PTY to kill. Fire the idempotent
+    // close path (memory capture + periodic-timer cleanup + exit/panel_exited
+    // broadcast + driver detach) — the web-chat analog of term.onExit — before
+    // removing the session from the manager.
+    if (session.meta.type === 'web-chat') {
+      closeWebChatSession(session, { exitCode: 0, signal: 'SIGTERM' });
+    } else if (session.pty) {
+      // Kill PTY process
       try { session.pty.kill(); } catch (err) { console.error('[pty] kill failed for session', req.params.id + ':', err); }
       // Sprint 63 T1 (Item 1.2) — stamp `_destroyed = true` on the pty wrapper
       // so `safelyResizePty` can short-circuit any resize attempts that arrive
@@ -1912,6 +2282,60 @@ function createServer(config) {
   app.post('/api/sessions/:id/input', (req, res) => {
     const session = sessions.get(req.params.id);
     if (!session) return res.status(404).json({ error: 'Session not found' });
+    // Sprint 72 T2 — web-chat panels have no PTY. Route the inject to the
+    // driver (type into composer + send) BEFORE the `!session.pty` 410 guard
+    // below (which would otherwise reject every web-chat inject as "exited").
+    // Self-contained (own rate-limit + logging + response) so the PTY path
+    // below stays byte-identical (Guardrail 3).
+    if (session.meta.type === 'web-chat') {
+      if (session.meta.status === 'exited' || session._webChatClosed) {
+        const msg = `Panel ${req.params.id} has exited`;
+        return res.status(410).json({
+          ok: false, code: 'panel_exited', error: msg, message: msg,
+          exitCode: session.meta.exitCode ?? null,
+          exitedAt: session.meta.exitedAt || null,
+        });
+      }
+      const { text, source, fromSessionId } = req.body || {};
+      if (typeof text !== 'string') return res.status(400).json({ error: 'Missing text' });
+
+      // Same 10 writes/sec/session rate limit as the PTY path below.
+      const now = Date.now();
+      const bucket = inputRateLimit.get(session.id) || { windowStart: now, count: 0 };
+      if (now - bucket.windowStart >= 1000) { bucket.windowStart = now; bucket.count = 0; }
+      bucket.count += 1;
+      inputRateLimit.set(session.id, bucket);
+      if (bucket.count > 10) return res.status(429).json({ error: 'Rate limit exceeded (10/sec)' });
+
+      const result = routeWebChatInput(session, text);
+      if (!result.ok && result.code !== 'invalid_text') {
+        // Driver not attached yet (or inject threw) — 409 Conflict so the caller
+        // can retry; distinct from 410 (gone) / 400 (bad input).
+        return res.status(409).json({
+          ok: false, code: result.code || 'web_chat_not_ready',
+          error: result.error || 'web-chat panel not ready',
+        });
+      }
+      if (!result.ok) return res.status(400).json({ error: 'Missing text' });
+
+      session.meta.replyCount = (session.meta.replyCount || 0) + 1;
+      const effectiveSource = source || 'user';
+      if (db) {
+        try {
+          const snippet = fromSessionId ? `from:${fromSessionId}` : null;
+          logCommand(db, session.id, text.slice(0, 500), snippet, effectiveSource);
+        } catch (err) {
+          console.error('[db] logCommand (web-chat input) failed:', err);
+        }
+      }
+      return res.json({
+        ok: true,
+        bytes: Buffer.byteLength(text, 'utf8'),
+        replyCount: session.meta.replyCount,
+        buffered: !!result.buffered,
+        submitted: !!result.submitted,
+      });
+    }
     // Sprint 65 T2 (2.3) — inject to a dead panel returns 410 Gone, not the
     // pre-Sprint-65 silent 404. The orchestrator POSTing to an exited panel
     // (Brad's D.5 item 3 — "10 dead codex cli") got a 404 that reads as
@@ -2119,14 +2543,22 @@ function createServer(config) {
   app.get('/api/sessions/:id/buffer', (req, res) => {
     const session = sessions.get(req.params.id);
     if (!session) return res.status(404).json({ error: 'Session not found' });
-    if (session.meta.status === 'exited' || !session.pty) {
+    // Sprint 72 T2 — web-chat panels have no PTY by design, so only the
+    // exited check gates them (the `!session.pty` arm is PTY-only). This keeps
+    // the orchestrator's inject-verify poll (status:'thinking' after a submit)
+    // working on a web-chat panel exactly as on a PTY agent panel (seam 4/5).
+    const isWebChat = session.meta.type === 'web-chat';
+    if (session.meta.status === 'exited' || (!isWebChat && !session.pty)) {
       return res.status(404).json({ error: 'Session is exited' });
     }
+    const inFlight = isWebChat
+      ? ((session._webChatInput && session._webChatInput.pending) || '')
+      : (session._inputBuffer || '');
     res.json({
       ok: true,
-      pid: session.pty.pid,
-      inputBufferLength: (session._inputBuffer || '').length,
-      inputBufferPreview: (session._inputBuffer || '').slice(-200),
+      pid: session.pty ? session.pty.pid : (session.pid || null),
+      inputBufferLength: inFlight.length,
+      inputBufferPreview: inFlight.slice(-200),
       lastActivity: session.meta.lastActivity,
       status: session.meta.status,
       statusDetail: session.meta.statusDetail || '',
@@ -2816,12 +3248,37 @@ function createServer(config) {
 
         switch (parsed.type) {
           case 'input':
-            if (session.pty && !session.pty._destroyed) {
+            // Sprint 72 T2 — web-chat composer text from the client input box
+            // goes to the driver's inject (type+send), NOT pty.write. Same
+            // two-stage assembler as the POST /input route, so a trailing-`\r`
+            // submits. PTY panels are untouched (the else-branch is verbatim).
+            if (session.meta.type === 'web-chat') {
+              routeWebChatInput(session, parsed.data);
+            } else if (session.pty && !session.pty._destroyed) {
               session.pty.write(parsed.data);
               session.trackInput(parsed.data);
             }
             break;
 
+          case 'web-chat-input':
+            // Sprint 72 T2 — raw CDP input-event forwarding for DIRECT human
+            // interaction with the live Grok tab (mouse/keyboard on the
+            // screencast canvas). T3's canvas emits
+            // {type:'web-chat-input', event:<CDP Input.* payload>}; routed to
+            // the driver's sendInput. Never reaches a PTY.
+            if (session.meta.type === 'web-chat' && session._webChat && session._webChat.handle) {
+              const wc = session._webChat;
+              try {
+                if (typeof wc.handle.sendInput === 'function') wc.handle.sendInput(parsed.event);
+                else if (wc.driver && wc.driver.cdp && typeof wc.driver.cdp.sendInput === 'function') {
+                  wc.driver.cdp.sendInput(wc.handle, parsed.event);
+                }
+              } catch (err) {
+                console.error('[web-chat] sendInput failed:', err && err.message ? err.message : err);
+              }
+            }
+            break;
+
           case 'resize':
             // Sprint 60 v1.0.14 — safelyResizePty guards against the
             // pty-reaper-closed-the-fd race that surfaced 25x in Brad's
@@ -3191,4 +3648,8 @@ module.exports = {
   // Sprint 70 T1 — stdout-capture spawn-wrap resolver (best-effort stdbuf).
   _resolveStdoutCaptureSpawn,
   _resetStdbufToolCacheForTesting,
+  // Sprint 72 T2 — web-chat driver DI seam. Tests inject a fake driver so the
+  // web-chat seams (spawn/inject/output/status/close/capture) are exercised
+  // with no real Chrome / CDP / network.
+  _setWebChatDriverImplForTesting,
 };