@miller-tech/uap 1.145.0 → 1.146.1

package/tools/agents/scripts/anthropic_proxy.py

@@ -1960,6 +1960,60 @@ last_session_id = ""
 _last_ctx_recheck_ts: float = 0.0
 _CTX_RECHECK_INTERVAL: float = 60.0  # Re-detect context window every 60s
 
+# ── Vision (multimodal) support ──────────────────────────────────────────────
+# The upstream llama-server advertises image support in /props
+# (modalities.vision: true when launched with --mmproj). When available, the
+# proxy passes Anthropic `image` content blocks through to the model as
+# OpenAI image_url data-URI parts, so coding agents can visually check their
+# outputs (screenshots, rendered pages). PROXY_VISION=auto probes and
+# self-configures per upstream; on/off force it.
+PROXY_VISION = os.environ.get("PROXY_VISION", "auto").strip().lower()
+# Rough per-image token cost for context accounting (Qwen-VL-class encoders
+# land in the hundreds-to-~1k range per image at typical screenshot sizes).
+PROXY_IMAGE_TOKEN_ESTIMATE = int(os.environ.get("PROXY_IMAGE_TOKEN_ESTIMATE", "800"))
+upstream_vision: bool = False
+_last_vision_recheck_ts: float = 0.0
+_VISION_RECHECK_INTERVAL: float = 60.0
+
+
+def vision_enabled() -> bool:
+    if PROXY_VISION == "on":
+        return True
+    if PROXY_VISION == "off":
+        return False
+    return upstream_vision
+
+
+async def _maybe_recheck_vision() -> None:
+    """Periodically re-probe upstream /props for vision support (auto mode).
+
+    Handles server restarts that add/remove --mmproj mid-session. Non-blocking:
+    skips inside the check interval; failures keep the last known value.
+    """
+    global upstream_vision, _last_vision_recheck_ts
+    if PROXY_VISION != "auto":
+        return
+    now = time.time()
+    if now - _last_vision_recheck_ts < _VISION_RECHECK_INTERVAL:
+        return
+    _last_vision_recheck_ts = now
+    if http_client is None:
+        return
+    try:
+        props_url = LLAMA_CPP_BASE.replace("/v1", "/props")
+        resp = await http_client.get(props_url, timeout=2.0)
+        if resp.status_code == 200:
+            modalities = (resp.json() or {}).get("modalities") or {}
+            detected = bool(modalities.get("vision"))
+            if detected != upstream_vision:
+                logger.warning(
+                    "VISION: upstream modalities.vision=%s — image passthrough %s",
+                    detected, "ENABLED" if detected else "DISABLED",
+                )
+                upstream_vision = detected
+    except Exception:
+        pass  # Non-critical; retry next interval
+
 
 def _cleanup_stale_monitors(now_ts: float) -> None:
     stale = [
@@ -2087,6 +2141,13 @@ def estimate_message_tokens(msg: dict) -> int:
                     tokens += estimate_tokens(json.dumps(block.get("input", {})))
                 elif block.get("type") == "tool_result":
                     tokens += estimate_tokens(_extract_text(block.get("content", "")))
+                    inner = block.get("content")
+                    if isinstance(inner, list):
+                        tokens += PROXY_IMAGE_TOKEN_ESTIMATE * sum(
+                            1 for b in inner if isinstance(b, dict) and b.get("type") == "image"
+                        )
+                elif block.get("type") == "image":
+                    tokens += PROXY_IMAGE_TOKEN_ESTIMATE
     return tokens
 
 
@@ -3387,6 +3448,29 @@ async def _shared_secret_auth(request: Request, call_next):
 # ===========================================================================
 
 
+def _image_block_to_openai(block: dict) -> dict | None:
+    """Anthropic image block → OpenAI image_url part (data URI or URL)."""
+    src = block.get("source") or {}
+    if src.get("type") == "base64" and src.get("data"):
+        media_type = src.get("media_type", "image/png")
+        return {"type": "image_url", "image_url": {"url": f"data:{media_type};base64,{src['data']}"}}
+    if src.get("type") == "url" and src.get("url"):
+        return {"type": "image_url", "image_url": {"url": src["url"]}}
+    return None
+
+
+def _extract_images(content) -> list[dict]:
+    """Collect OpenAI image_url parts nested in Anthropic content."""
+    images: list[dict] = []
+    if isinstance(content, list):
+        for b in content:
+            if isinstance(b, dict) and b.get("type") == "image":
+                part = _image_block_to_openai(b)
+                if part:
+                    images.append(part)
+    return images
+
+
 def anthropic_to_openai_messages(anthropic_body: dict) -> list[dict]:
     """Convert Anthropic message format to OpenAI message format.
 
@@ -3443,11 +3527,22 @@ def anthropic_to_openai_messages(anthropic_body: dict) -> list[dict]:
             messages.append({"role": role, "content": content})
         elif isinstance(content, list):
             parts = []
+            image_parts: list[dict] = []
             for block in content:
                 if isinstance(block, str):
                     parts.append(block)
                 elif block.get("type") == "text":
                     parts.append(block.get("text", ""))
+                elif block.get("type") == "image":
+                    # Vision passthrough: forward as an OpenAI image_url part
+                    # when the upstream model has an mmproj loaded; otherwise
+                    # leave an explicit placeholder (silent drops made agents
+                    # think the model saw the screenshot).
+                    part = _image_block_to_openai(block) if vision_enabled() else None
+                    if part:
+                        image_parts.append(part)
+                    else:
+                        parts.append("[image omitted: the serving model has no vision support]")
                 elif block.get("type") == "thinking":
                     # Drop thinking blocks from user/assistant content when
                     # echoed back into history — model shouldn't see them.
@@ -3480,15 +3575,44 @@ def anthropic_to_openai_messages(anthropic_body: dict) -> list[dict]:
                     tu_id = block.get("tool_use_id", "")
                     if isinstance(tu_id, str) and tu_id.startswith("toolu_"):
                         tu_id = tu_id[len("toolu_"):]
+                    tr_text = _extract_text(block.get("content", ""))
+                    tr_images = _extract_images(block.get("content", "")) if vision_enabled() else []
+                    if not vision_enabled():
+                        inner = block.get("content")
+                        n_imgs = (
+                            sum(1 for b in inner if isinstance(b, dict) and b.get("type") == "image")
+                            if isinstance(inner, list) else 0
+                        )
+                        if n_imgs:
+                            tr_text = (tr_text + f"\n[{n_imgs} image(s) omitted: the serving model has no vision support]").strip()
                     messages.append(
                         {
                             "role": "tool",
                             "tool_call_id": tu_id,
-                            "content": _extract_text(block.get("content", "")),
+                            "content": tr_text,
                         }
                     )
+                    if tr_images:
+                        # OpenAI tool messages are text-only for llama.cpp —
+                        # deliver tool-result images as an adjacent user turn
+                        # so the model actually SEES them.
+                        messages.append(
+                            {
+                                "role": "user",
+                                "content": [
+                                    {"type": "text", "text": "[image(s) attached from the preceding tool result]"},
+                                    *tr_images,
+                                ],
+                            }
+                        )
                     continue
-            if parts:
+            if image_parts:
+                typed: list[dict] = []
+                if parts:
+                    typed.append({"type": "text", "text": "\n".join(parts)})
+                typed.extend(image_parts)
+                messages.append({"role": role, "content": typed})
+            elif parts:
                 messages.append({"role": role, "content": "\n".join(parts)})
 
     return messages
@@ -10175,6 +10299,7 @@ async def messages(request: Request):
 
     # Periodically re-detect context window from upstream (handles server restarts)
     await _maybe_recheck_context_window()
+    await _maybe_recheck_vision()
 
     if _should_passthrough_model(model):
         logger.info("PASSTHROUGH: model=%s -> %s", model, ANTHROPIC_API_BASE)

package/tools/agents/tests/test_vision_passthrough.py

@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""Vision passthrough: Anthropic image blocks → OpenAI image_url parts.
+
+The upstream llama-server advertises vision in /props (modalities.vision) when
+launched with --mmproj; the proxy autodetects and forwards images so coding
+agents can visually check their outputs. Without vision the proxy leaves an
+explicit placeholder instead of silently dropping (agents believed the model
+saw screenshots it never received).
+"""
+
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+proxy = _load_proxy_module()
+
+PNG_B64 = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg=="
+
+
+def _img_block():
+    return {"type": "image", "source": {"type": "base64", "media_type": "image/png", "data": PNG_B64}}
+
+
+class VisionOnTests(unittest.TestCase):
+    def setUp(self):
+        self._saved = (proxy.PROXY_VISION, proxy.upstream_vision)
+        proxy.PROXY_VISION = "auto"
+        proxy.upstream_vision = True
+
+    def tearDown(self):
+        proxy.PROXY_VISION, proxy.upstream_vision = self._saved
+
+    def test_user_image_becomes_typed_multimodal_content(self):
+        body = {"messages": [{"role": "user", "content": [
+            {"type": "text", "text": "what does this screenshot show?"},
+            _img_block(),
+        ]}]}
+        msgs = proxy.anthropic_to_openai_messages(body)
+        self.assertEqual(len(msgs), 1)
+        content = msgs[0]["content"]
+        self.assertIsInstance(content, list)
+        kinds = [p["type"] for p in content]
+        self.assertEqual(kinds, ["text", "image_url"])
+        self.assertTrue(content[1]["image_url"]["url"].startswith("data:image/png;base64,"))
+
+    def test_url_source_passthrough(self):
+        body = {"messages": [{"role": "user", "content": [
+            {"type": "image", "source": {"type": "url", "url": "https://x/y.png"}},
+        ]}]}
+        msgs = proxy.anthropic_to_openai_messages(body)
+        self.assertEqual(msgs[0]["content"][0]["image_url"]["url"], "https://x/y.png")
+
+    def test_tool_result_images_delivered_as_adjacent_user_turn(self):
+        body = {"messages": [{"role": "user", "content": [
+            {"type": "tool_result", "tool_use_id": "toolu_abc", "content": [
+                {"type": "text", "text": "screenshot captured"},
+                _img_block(),
+            ]},
+        ]}]}
+        msgs = proxy.anthropic_to_openai_messages(body)
+        self.assertEqual(msgs[0]["role"], "tool")
+        self.assertIn("screenshot captured", msgs[0]["content"])
+        self.assertEqual(msgs[1]["role"], "user")
+        parts = msgs[1]["content"]
+        self.assertEqual(parts[0]["type"], "text")
+        self.assertEqual(parts[1]["type"], "image_url")
+
+    def test_text_only_messages_stay_plain_strings(self):
+        body = {"messages": [{"role": "user", "content": [{"type": "text", "text": "hi"}]}]}
+        msgs = proxy.anthropic_to_openai_messages(body)
+        self.assertEqual(msgs[0]["content"], "hi")
+
+    def test_image_token_estimate_counts(self):
+        msg = {"role": "user", "content": [_img_block(), {"type": "text", "text": "x"}]}
+        with_img = proxy.estimate_message_tokens(msg)
+        without = proxy.estimate_message_tokens({"role": "user", "content": [{"type": "text", "text": "x"}]})
+        self.assertGreaterEqual(with_img - without, proxy.PROXY_IMAGE_TOKEN_ESTIMATE)
+
+
+class VisionOffTests(unittest.TestCase):
+    def setUp(self):
+        self._saved = (proxy.PROXY_VISION, proxy.upstream_vision)
+        proxy.PROXY_VISION = "auto"
+        proxy.upstream_vision = False
+
+    def tearDown(self):
+        proxy.PROXY_VISION, proxy.upstream_vision = self._saved
+
+    def test_user_image_becomes_explicit_placeholder(self):
+        body = {"messages": [{"role": "user", "content": [
+            {"type": "text", "text": "see image"}, _img_block(),
+        ]}]}
+        msgs = proxy.anthropic_to_openai_messages(body)
+        content = msgs[0]["content"]
+        self.assertIsInstance(content, str)
+        self.assertIn("image omitted", content)
+
+    def test_tool_result_image_noted_in_text(self):
+        body = {"messages": [{"role": "user", "content": [
+            {"type": "tool_result", "tool_use_id": "t1", "content": [
+                {"type": "text", "text": "shot"}, _img_block(),
+            ]},
+        ]}]}
+        msgs = proxy.anthropic_to_openai_messages(body)
+        self.assertEqual(len(msgs), 1)  # no adjacent user turn without vision
+        self.assertIn("1 image(s) omitted", msgs[0]["content"])
+
+    def test_force_on_overrides_missing_upstream(self):
+        proxy.PROXY_VISION = "on"
+        self.assertTrue(proxy.vision_enabled())
+        proxy.PROXY_VISION = "off"
+        proxy.upstream_vision = True
+        self.assertFalse(proxy.vision_enabled())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/web/dash/styles.css

@@ -324,3 +324,34 @@ label.field { display: flex; flex-direction: column; gap: 4px; font-size: 11px;
 ::-webkit-scrollbar-track { background: var(--bg); }
 ::-webkit-scrollbar-thumb { background: var(--bg3); border-radius: 3px; }
 ::-webkit-scrollbar-thumb:hover { background: var(--fg3); }
+
+
+/* ── Policy management panel ── */
+.pol-hint { color: var(--fg); opacity: .6; font-size: 12px; margin-bottom: 8px; }
+.pol-toolbar { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 12px; }
+.btn-sm { padding: 2px 8px; font-size: 12px; }
+.btn-on { border-color: var(--green); color: var(--green); }
+.btn-off { border-color: var(--red); color: var(--red); }
+.pol-list { display: flex; flex-direction: column; gap: 6px; }
+.pol-row { display: flex; align-items: center; gap: 12px; padding: 8px 12px; background: var(--bg); border: 1px solid var(--border); border-radius: var(--radius); }
+.pol-row.off { opacity: .55; }
+.pol-row.dragging { opacity: .4; outline: 1px dashed var(--cyan); }
+.pol-handle { cursor: grab; color: var(--fg); opacity: .4; font-size: 16px; user-select: none; }
+.pol-main { flex: 1; min-width: 0; }
+.pol-name { font-weight: 600; }
+.pol-desc { font-size: 12px; opacity: .65; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.pol-badges { display: flex; gap: 6px; flex-wrap: wrap; margin-top: 4px; }
+.pol-badge { font-size: 10px; padding: 1px 6px; border-radius: 999px; border: 1px solid var(--border); text-transform: lowercase; }
+.pol-badge.lvl-required { border-color: var(--red); color: var(--red); }
+.pol-badge.lvl-recommended { border-color: var(--yellow); color: var(--yellow); }
+.pol-badge.lvl-optional { opacity: .6; }
+.pol-badge.on { border-color: var(--green); color: var(--green); }
+.pol-badge.off { border-color: var(--red); color: var(--red); }
+.pol-badge.prio { border-color: var(--cyan); color: var(--cyan); }
+.pol-actions { display: flex; gap: 6px; flex-shrink: 0; }
+.pol-detail .field { display: block; margin: 8px 0; }
+.pol-select { background: var(--bg); color: var(--fg); border: 1px solid var(--border); border-radius: var(--radius); padding: 4px; }
+.pol-section-label { font-size: 11px; text-transform: uppercase; letter-spacing: .05em; opacity: .5; margin: 12px 0 4px; }
+.pol-desc-full { font-size: 13px; line-height: 1.5; }
+.pol-prompt { background: var(--bg); border: 1px solid var(--border); border-radius: var(--radius); padding: 12px; font-size: 12px; white-space: pre-wrap; word-break: break-word; max-height: 50vh; overflow: auto; }
+.pol-suggest-list { padding-left: 20px; font-size: 13px; line-height: 1.6; }

package/web/dash/tab-policies.js

@@ -1,12 +1,233 @@
 /**
- * tab-policies.js — Policies tab stub
- * Registers with UAP.registerTab and renders a "coming soon" message
- * (textContent only, per the module contract — no innerHTML).
+ * tab-policies.js — Policy management panel.
+ *
+ * Lists every policy ordered by firing priority (fires-earliest first) and lets
+ * the operator: view each policy's description + full prompt, toggle it, change
+ * level/stage, duplicate it, drag-and-drop to reorder (manual), ask for an
+ * intelligent order (heuristic + AI refine), dedupe, and import/export the whole
+ * set. All DOM is built with UAP.el (no innerHTML), mutations go through UAP.api
+ * (token-guarded); GET reads use fetch on UAP.API_URL.
  */
+(function () {
+  'use strict';
+  if (typeof UAP === 'undefined' || !UAP.registerTab) return;
+  var el = UAP.el, api = UAP.api, toast = UAP.toast;
 
-UAP.registerTab('policies', {
-  label: 'Policies',
-  render(root, state) {
-    root.textContent = 'Policies — coming soon';
+  function get(path) {
+    return fetch(UAP.API_URL + path).then(function (r) {
+      if (!r.ok) throw new Error('HTTP ' + r.status);
+      return r.json();
+    });
   }
-});
+
+  var LEVELS = ['REQUIRED', 'RECOMMENDED', 'OPTIONAL'];
+  var STAGES = ['pre-exec', 'always', 'post-exec', 'review'];
+
+  function badge(text, cls) { return el('span', { class: 'pol-badge ' + (cls || ''), text: text }); }
+
+  function reloadInto(listEl) {
+    UAP.clear(listEl);
+    listEl.appendChild(el('div', { class: 'muted', text: 'Loading policies…' }));
+    return get('/api/policies').then(function (d) {
+      renderList(listEl, (d && d.policies) || []);
+    }).catch(function (e) {
+      UAP.clear(listEl);
+      listEl.appendChild(el('div', { class: 'empty', text: 'Failed to load policies: ' + e.message }));
+    });
+  }
+
+  // Drag-and-drop reorder: track the dragged row, reorder DOM on hover, then
+  // persist the new id order via /api/policies/reorder on drop.
+  function attachDnD(row, listEl) {
+    row.setAttribute('draggable', 'true');
+    row.addEventListener('dragstart', function (e) {
+      row.classList.add('dragging');
+      e.dataTransfer.effectAllowed = 'move';
+      try { e.dataTransfer.setData('text/plain', row.dataset.id); } catch (_) {}
+    });
+    row.addEventListener('dragend', function () {
+      row.classList.remove('dragging');
+      persistOrder(listEl);
+    });
+    row.addEventListener('dragover', function (e) {
+      e.preventDefault();
+      var dragging = listEl.querySelector('.pol-row.dragging');
+      if (!dragging || dragging === row) return;
+      var rect = row.getBoundingClientRect();
+      var after = (e.clientY - rect.top) > rect.height / 2;
+      listEl.insertBefore(dragging, after ? row.nextSibling : row);
+    });
+  }
+
+  function persistOrder(listEl) {
+    var ids = [];
+    listEl.querySelectorAll('.pol-row').forEach(function (r) { ids.push(r.dataset.id); });
+    api('/api/policies/reorder', { order: ids })
+      .then(function () { toast('Order saved', 'ok'); })
+      .catch(function () {});
+  }
+
+  function policyRow(p, listEl) {
+    var row = el('div', { class: 'pol-row' + (p.isActive ? '' : ' off') });
+    row.dataset.id = p.id;
+    var handle = el('span', { class: 'pol-handle', title: 'Drag to reorder' }, '⠿');
+    var main = el('div', { class: 'pol-main' },
+      el('div', { class: 'pol-name', text: p.name }),
+      el('div', { class: 'pol-desc', text: p.description || '(no description)' }),
+      el('div', { class: 'pol-badges' },
+        badge(p.level, 'lvl-' + String(p.level || '').toLowerCase()),
+        badge(p.stage, 'stage'),
+        badge(p.category, 'cat'),
+        badge('prio ' + p.priority, 'prio')
+      )
+    );
+    var actions = el('div', { class: 'pol-actions' },
+      el('button', { class: 'btn btn-sm', title: 'View description + prompt', onclick: function () { openDetail(p.id); } }, 'View'),
+      el('button', { class: 'btn btn-sm', title: 'Duplicate', onclick: function () { duplicate(p.id, listEl); } }, 'Duplicate'),
+      el('button', {
+        class: 'btn btn-sm ' + (p.isActive ? 'btn-on' : 'btn-off'),
+        title: p.isActive ? 'Enabled — click to disable' : 'Disabled — click to enable',
+        onclick: function () { toggle(p.id, listEl); }
+      }, p.isActive ? 'On' : 'Off')
+    );
+    row.appendChild(handle);
+    row.appendChild(main);
+    row.appendChild(actions);
+    attachDnD(row, listEl);
+    return row;
+  }
+
+  function renderList(listEl, policies) {
+    UAP.clear(listEl);
+    if (!policies.length) {
+      listEl.appendChild(el('div', { class: 'empty', text: 'No policies installed. Import a bundle or run setup.' }));
+      return;
+    }
+    policies.forEach(function (p) { listEl.appendChild(policyRow(p, listEl)); });
+  }
+
+  function toggle(id, listEl) {
+    api('/api/policy/' + id + '/toggle').then(function () { reloadInto(listEl); }).catch(function () {});
+  }
+
+  function duplicate(id, listEl) {
+    api('/api/policy/' + id + '/duplicate').then(function () {
+      toast('Policy duplicated', 'ok');
+      reloadInto(listEl);
+    }).catch(function () {});
+  }
+
+  function openDetail(id) {
+    get('/api/policy/' + id).then(function (p) {
+      var body = el('div', { class: 'pol-detail' },
+        el('div', { class: 'pol-badges' },
+          badge(p.level, 'lvl-' + String(p.level || '').toLowerCase()),
+          badge(p.stage, 'stage'),
+          badge(p.category, 'cat'),
+          badge('prio ' + p.priority, 'prio'),
+          badge(p.isActive ? 'enabled' : 'disabled', p.isActive ? 'on' : 'off')
+        ),
+        el('label', { class: 'field' }, 'Level',
+          selectFor(LEVELS, p.level, function (v) { api('/api/policy/' + id + '/level', { level: v }).then(function () { toast('Level updated', 'ok'); }); })),
+        el('label', { class: 'field' }, 'Stage',
+          selectFor(STAGES, p.stage, function (v) { api('/api/policy/' + id + '/stage', { stage: v }).then(function () { toast('Stage updated', 'ok'); }); })),
+        el('div', { class: 'pol-section-label', text: 'Description' }),
+        el('div', { class: 'pol-desc-full', text: p.description || '(none)' }),
+        el('div', { class: 'pol-section-label', text: 'Prompt (rawMarkdown)' }),
+        el('pre', { class: 'pol-prompt', text: p.rawMarkdown || '' })
+      );
+      UAP.drawer(p.name, body);
+    }).catch(function (e) { toast('Failed to load policy: ' + e.message, 'err'); });
+  }
+
+  function selectFor(options, current, onChange) {
+    var sel = el('select', { class: 'pol-select' });
+    options.forEach(function (o) {
+      var opt = el('option', { value: o, text: o });
+      if (o === current) opt.selected = true;
+      sel.appendChild(opt);
+    });
+    sel.addEventListener('change', function () { onChange(sel.value); });
+    return sel;
+  }
+
+  function suggestOrder(listEl) {
+    toast('Computing intelligent order…', 'ok');
+    api('/api/policies/suggest-order', { ai: true }).then(function (res) {
+      var order = res.order || [];
+      var list = el('ol', { class: 'pol-suggest-list' });
+      order.forEach(function (o) { list.appendChild(el('li', { text: o.name })); });
+      var body = el('div', { class: 'pol-suggest' },
+        el('div', { class: 'pol-badges' }, badge(res.source === 'ai' ? 'AI refined' : 'heuristic', res.source === 'ai' ? 'on' : 'cat')),
+        el('div', { class: 'pol-section-label', text: 'Rationale' }),
+        el('div', { class: 'pol-desc-full', text: res.rationale || '' }),
+        el('div', { class: 'pol-section-label', text: 'Proposed firing order (first fires earliest)' }),
+        list,
+        el('div', { class: 'modal-actions' },
+          el('button', { class: 'btn btn-primary', onclick: function () {
+            api('/api/policies/reorder', { order: order.map(function (o) { return o.id; }) }).then(function () {
+              toast('Applied intelligent order', 'ok');
+              UAP.closeDrawer();
+              reloadInto(listEl);
+            });
+          } }, 'Apply this order'))
+      );
+      UAP.drawer('Intelligent policy order', body);
+    }).catch(function (e) { toast('Suggest failed: ' + e.message, 'err'); });
+  }
+
+  function dedupe(listEl) {
+    api('/api/policies/dedupe').then(function (res) {
+      toast(res.removed ? ('Removed ' + res.removed + ' duplicate(s)') : 'No duplicates found', 'ok');
+      reloadInto(listEl);
+    }).catch(function () {});
+  }
+
+  function exportPolicies() {
+    // GET download — navigate to the export endpoint (Content-Disposition attachment).
+    var a = el('a', { href: UAP.API_URL + '/api/policies/export', download: 'uap-policies.json' });
+    document.body.appendChild(a);
+    a.click();
+    document.body.removeChild(a);
+  }
+
+  function importPolicies(listEl) {
+    var input = el('input', { type: 'file', accept: '.json,application/json', style: 'display:none' });
+    input.addEventListener('change', function () {
+      var file = input.files && input.files[0];
+      if (!file) return;
+      var reader = new FileReader();
+      reader.onload = function () {
+        var bundle;
+        try { bundle = JSON.parse(String(reader.result)); }
+        catch (e) { toast('Invalid JSON bundle', 'err'); return; }
+        api('/api/policies/import', bundle).then(function (res) {
+          toast('Imported ' + (res.imported || 0) + ' policies', 'ok');
+          reloadInto(listEl);
+        }).catch(function () {});
+      };
+      reader.readAsText(file);
+    });
+    document.body.appendChild(input);
+    input.click();
+    document.body.removeChild(input);
+  }
+
+  function render(root) {
+    UAP.clear(root);
+    var listEl = el('div', { class: 'pol-list' });
+    var toolbar = el('div', { class: 'pol-toolbar' },
+      el('button', { class: 'btn btn-primary', onclick: function () { suggestOrder(listEl); } }, '✨ AI suggest order'),
+      el('button', { class: 'btn', onclick: function () { dedupe(listEl); } }, 'Dedupe'),
+      el('button', { class: 'btn', onclick: function () { importPolicies(listEl); } }, 'Import'),
+      el('button', { class: 'btn', onclick: function () { exportPolicies(); } }, 'Export'),
+      el('button', { class: 'btn', onclick: function () { reloadInto(listEl); } }, 'Refresh')
+    );
+    root.appendChild(el('div', { class: 'pol-hint', text: 'Drag rows to reorder (earlier = fires first). Order minimizes wasted turns: cheap, high-block gates fire first.' }));
+    root.appendChild(toolbar);
+    root.appendChild(listEl);
+    reloadInto(listEl);
+  }
+
+  UAP.registerTab('policies', { label: 'Policies', render: render });
+})();

package/web/dashboard.html

@@ -47,5 +47,8 @@
     <script src="/dash/charts.js"></script>
     <script src="/dash/core.js"></script>
     <script src="/dash/tabs.js"></script>
+    <!-- Loaded AFTER tabs.js so its registerTab('policies') overrides the inline
+         stub with the full policy-management panel (view/duplicate/reorder/AI-order/import/export). -->
+    <script src="/dash/tab-policies.js"></script>
   </body>
 </html>