@provos/ironcurtain 0.9.1 → 0.11.0

package/dist/workflow/worktree.d.ts

@@ -0,0 +1,43 @@
+export type MergeResult = {
+    readonly status: 'clean';
+    readonly commitHash: string;
+} | {
+    readonly status: 'conflict';
+    readonly conflictFiles: readonly string[];
+};
+export interface WorktreeInfo {
+    readonly path: string;
+    readonly branch: string;
+    readonly parallelKey: string;
+}
+/** Manages git worktrees for parallel coding slots in workflows. */
+export interface WorktreeManager {
+    /** Create a worktree for a parallel slot. Returns the worktree path. */
+    create(repoPath: string, branchName: string, baseBranch: string): Promise<string>;
+    /** Merge a worktree branch into the base branch. */
+    merge(repoPath: string, branchName: string, baseBranch: string): Promise<MergeResult>;
+    /** Remove a worktree and optionally delete its branch. */
+    remove(worktreePath: string, deleteBranch?: boolean): Promise<void>;
+    /** List active worktrees managed by workflows. */
+    listActive(): readonly WorktreeInfo[];
+}
+/**
+ * Git worktree manager for parallel coding workflows. Uses `execFile`
+ * with argument arrays exclusively -- never shell string concatenation.
+ */
+export declare class GitWorktreeManager implements WorktreeManager {
+    private readonly worktreeBaseDir;
+    private readonly activeWorktrees;
+    constructor(worktreeBaseDir: string);
+    create(repoPath: string, branchName: string, baseBranch: string): Promise<string>;
+    merge(repoPath: string, branchName: string, baseBranch: string): Promise<MergeResult>;
+    remove(worktreePath: string, deleteBranch?: boolean): Promise<void>;
+    listActive(): readonly WorktreeInfo[];
+    /**
+     * Find the main working tree directory from any worktree path.
+     * Uses `git rev-parse --git-common-dir` to locate the shared .git directory,
+     * then resolves to its parent (the main working tree).
+     */
+    private findMainWorktree;
+    private getHeadCommitHash;
+}

package/dist/workflow/worktree.js

@@ -0,0 +1,106 @@
+import { execFile as execFileCb } from 'node:child_process';
+import { promisify } from 'node:util';
+import { resolve } from 'node:path';
+const execFileAsync = promisify(execFileCb);
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+/**
+ * Git worktree manager for parallel coding workflows. Uses `execFile`
+ * with argument arrays exclusively -- never shell string concatenation.
+ */
+export class GitWorktreeManager {
+    worktreeBaseDir;
+    activeWorktrees = [];
+    constructor(worktreeBaseDir) {
+        this.worktreeBaseDir = worktreeBaseDir;
+    }
+    async create(repoPath, branchName, baseBranch) {
+        const worktreePath = resolve(this.worktreeBaseDir, branchName);
+        await execFileAsync('git', ['worktree', 'add', worktreePath, '-b', branchName, baseBranch], { cwd: repoPath });
+        this.activeWorktrees.push({
+            path: worktreePath,
+            branch: branchName,
+            parallelKey: branchName,
+        });
+        return worktreePath;
+    }
+    async merge(repoPath, branchName, baseBranch) {
+        await execFileAsync('git', ['checkout', baseBranch], { cwd: repoPath });
+        try {
+            await execFileAsync('git', ['merge', '--no-ff', branchName], { cwd: repoPath });
+            const commitHash = await this.getHeadCommitHash(repoPath);
+            return { status: 'clean', commitHash };
+        }
+        catch (err) {
+            const execErr = err;
+            const conflictFiles = parseConflictFiles(execErr.stdout ?? '', execErr.stderr ?? '');
+            // Abort the failed merge to leave the repo in a clean state
+            await execFileAsync('git', ['merge', '--abort'], { cwd: repoPath }).catch(() => { });
+            return { status: 'conflict', conflictFiles };
+        }
+    }
+    async remove(worktreePath, deleteBranch) {
+        const info = this.activeWorktrees.find((w) => w.path === worktreePath);
+        const branchName = info?.branch;
+        // Discover the main repo directory from the worktree before removing it
+        const mainRepoDir = await this.findMainWorktree(worktreePath);
+        await execFileAsync('git', ['worktree', 'remove', worktreePath, '--force'], {
+            cwd: mainRepoDir,
+        });
+        // Remove from tracking
+        const idx = this.activeWorktrees.findIndex((w) => w.path === worktreePath);
+        if (idx >= 0) {
+            this.activeWorktrees.splice(idx, 1);
+        }
+        if (deleteBranch && branchName) {
+            try {
+                await execFileAsync('git', ['branch', '-D', branchName], {
+                    cwd: mainRepoDir,
+                });
+            }
+            catch {
+                // Branch may already be deleted
+            }
+        }
+    }
+    listActive() {
+        return [...this.activeWorktrees];
+    }
+    /**
+     * Find the main working tree directory from any worktree path.
+     * Uses `git rev-parse --git-common-dir` to locate the shared .git directory,
+     * then resolves to its parent (the main working tree).
+     */
+    async findMainWorktree(worktreePath) {
+        // --git-common-dir returns the shared .git directory across all worktrees
+        const { stdout: commonDir } = await execFileAsync('git', ['rev-parse', '--git-common-dir'], {
+            cwd: worktreePath,
+        });
+        // commonDir is the path to the shared .git directory (e.g., /repo/.git)
+        return resolve(worktreePath, commonDir.trim(), '..');
+    }
+    async getHeadCommitHash(repoPath) {
+        const { stdout } = await execFileAsync('git', ['rev-parse', 'HEAD'], { cwd: repoPath });
+        return stdout.trim();
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Parse conflict file paths from git merge output. Git lists conflicting
+ * files in both stdout (CONFLICT lines) and stderr.
+ */
+function parseConflictFiles(stdout, stderr) {
+    const combined = `${stdout}\n${stderr}`;
+    const conflicts = [];
+    // Match "CONFLICT (content): Merge conflict in <path>"
+    const pattern = /CONFLICT\s+\([^)]+\):\s+Merge conflict in\s+(.+)/g;
+    let match;
+    while ((match = pattern.exec(combined)) !== null) {
+        conflicts.push(match[1].trim());
+    }
+    return conflicts;
+}
+//# sourceMappingURL=worktree.js.map

package/dist/workflow/worktree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.js","sourceRoot":"","sources":["../../src/workflow/worktree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAmC5C,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAGA;IAFZ,eAAe,GAAmB,EAAE,CAAC;IAEtD,YAA6B,eAAuB;QAAvB,oBAAe,GAAf,eAAe,CAAQ;IAAG,CAAC;IAExD,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,UAAkB,EAAE,UAAkB;QACnE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE/D,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE/G,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YACxB,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,UAAU;SACxB,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,UAAkB,EAAE,UAAkB;QAClE,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEhF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAA2C,CAAC;YAC5D,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YAErF,4DAA4D;YAC5D,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEpF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB,EAAE,YAAsB;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,EAAE,MAAM,CAAC;QAEhC,wEAAwE;QACxE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAE9D,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE;YAC1E,GAAG,EAAE,WAAW;SACjB,CAAC,CAAC;QAEH,uBAAuB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QAC3E,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,YAAY,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE;oBACvD,GAAG,EAAE,WAAW;iBACjB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACjD,0EAA0E;QAC1E,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE;YAC1F,GAAG,EAAE,YAAY;SAClB,CAAC,CAAC;QACH,wEAAwE;QACxE,OAAO,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QAC9C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;CACF;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,MAAc;IACxD,MAAM,QAAQ,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;IACxC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,uDAAuD;IACvD,MAAM,OAAO,GAAG,mDAAmD,CAAC;IACpE,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/docker/Dockerfile.base

@@ -3,7 +3,7 @@ FROM mcr.microsoft.com/devcontainers/universal:latest
 # Standard IronCurtain directory structure
 # The universal image uses 'codespace' as the non-root user (uid 1000).
 USER root
-RUN apt-get update && apt-get install -y --no-install-recommends socat && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends socat sudo git-lfs && rm -rf /var/lib/apt/lists/*
 
 # IronCurtain CA (for MITM proxy trust)
 # This file is copied into a temporary build context by ensureImage().
@@ -26,10 +26,21 @@ RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
 ENV UV_NATIVE_TLS=1
 ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python
 RUN uv python install 3.12
+# Install pip so agents can use `pip install` directly.
+RUN apt-get update && apt-get install -y --no-install-recommends python3-pip && rm -rf /var/lib/apt/lists/*
 
 RUN mkdir -p /workspace /etc/ironcurtain /run/ironcurtain && \
     chown codespace:codespace /workspace /etc/ironcurtain /run/ironcurtain
 
+RUN npm install -g node-gyp
+
+# Playwright + Chromium: pre-install so containers work with --network=none.
+# Install system deps as root, then browser to a shared path.
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers
+RUN npx playwright install-deps chromium && \
+    npx playwright install chromium && \
+    chmod -R o+rx /opt/playwright-browsers
+
 WORKDIR /workspace
 USER codespace
 

package/docker/Dockerfile.base.arm64

@@ -10,7 +10,7 @@ USER root
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     # Existing
-    git socat ca-certificates \
+    git git-lfs sudo socat ca-certificates curl \
     # Build tools for native extensions
     build-essential cmake pkg-config \
     # Graphics/Qt runtime + dev
@@ -26,6 +26,13 @@ RUN apt-get update && \
     fontconfig fonts-dejavu-core \
     && rm -rf /var/lib/apt/lists/*
 
+# Grant passwordless sudo to codespace (matches devcontainers/universal behavior)
+RUN echo "codespace ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/codespace && \
+    chmod 0440 /etc/sudoers.d/codespace
+
+# Initialize git-lfs
+RUN git lfs install --system
+
 # IronCurtain CA (for MITM proxy trust)
 # This file is copied into a temporary build context by ensureImage().
 COPY ironcurtain-ca-cert.pem /usr/local/share/ca-certificates/ironcurtain-ca.crt
@@ -48,9 +55,18 @@ RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
 ENV UV_NATIVE_TLS=1
 ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python
 RUN uv python install 3.12
+# Install pip so agents can use `pip install` directly.
+RUN apt-get update && apt-get install -y --no-install-recommends python3-pip && rm -rf /var/lib/apt/lists/*
 
 RUN npm install -g node-gyp
 
+# Playwright + Chromium: pre-install so containers work with --network=none.
+# Install system deps as root, then browser to a shared path.
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers
+RUN npx playwright install-deps chromium && \
+    npx playwright install chromium && \
+    chmod -R o+rx /opt/playwright-browsers
+
 RUN mkdir -p /workspace /etc/ironcurtain /run/ironcurtain && \
     chown codespace:codespace /workspace /etc/ironcurtain /run/ironcurtain
 

package/docker/entrypoint-claude-code.sh

@@ -4,6 +4,52 @@
 # Non-PTY mode: CMD is "sleep infinity" (agent commands arrive via docker exec).
 # PTY mode: CMD is the socat PTY command from buildPtyCommand().
 
+# Runtime UID remap (Linux only).
+#
+# Issue #232: when the host UID is not 1000, bind-mounted directories
+# (e.g., the conversation-state dir) appear inside the container owned
+# by the host UID, and the baked codespace user (UID 1000) cannot write
+# to them. The host-side launcher passes `--user 0:0` plus the host
+# UID/GID via IRONCURTAIN_AGENT_UID / IRONCURTAIN_AGENT_GID so this
+# block (running as root) can renumber the codespace account to match
+# the host before dropping privileges. On macOS, Docker Desktop's
+# VirtioFS translates UIDs transparently and the env vars are not set,
+# so this block is skipped.
+if [ "$(id -u)" = "0" ] && [ -n "$IRONCURTAIN_AGENT_UID" ] && [ -n "$IRONCURTAIN_AGENT_GID" ]; then
+  if [ "$IRONCURTAIN_AGENT_UID" != "1000" ] || [ "$IRONCURTAIN_AGENT_GID" != "1000" ]; then
+    # Renumber the codespace user/group to the host UID/GID, then fix
+    # ownership on the baked home dir and workspace mount so the
+    # remapped codespace user can read/write them. Bind-mounted
+    # subdirectories (conversation state, sockets, orientation) keep
+    # their host-side ownership, which now matches codespace.
+    #
+    # FAIL HARD on remap errors. Previously these commands ran without
+    # return-code checks: if `usermod -u $HOST_UID codespace` collided
+    # with an existing image user (plausible for system UIDs like 33
+    # `www-data` or 100 `systemd-network`), the entrypoint would
+    # silently continue, then `chown` and `runuser -u codespace`
+    # would operate on the still-UID-1000 codespace — recreating the
+    # original issue #232 bug with no diagnostic. Abort with an explicit
+    # error instead so the operator sees what went wrong.
+    groupmod -g "$IRONCURTAIN_AGENT_GID" codespace || {
+      echo "[ironcurtain] groupmod failed: cannot remap codespace group to GID $IRONCURTAIN_AGENT_GID (already in use?)" >&2
+      exit 1
+    }
+    usermod -u "$IRONCURTAIN_AGENT_UID" -g "$IRONCURTAIN_AGENT_GID" codespace || {
+      echo "[ironcurtain] usermod failed: cannot remap codespace user to UID $IRONCURTAIN_AGENT_UID (already in use?)" >&2
+      exit 1
+    }
+    chown -R "$IRONCURTAIN_AGENT_UID:$IRONCURTAIN_AGENT_GID" /home/codespace /workspace || {
+      echo "[ironcurtain] chown failed: cannot reset ownership of /home/codespace and /workspace to $IRONCURTAIN_AGENT_UID:$IRONCURTAIN_AGENT_GID" >&2
+      exit 1
+    }
+  fi
+  # Re-exec the entrypoint as the (possibly remapped) codespace user.
+  # The remainder of this script runs under codespace, so $HOME and
+  # sudoers (which keys on the username) resolve correctly.
+  exec runuser -u codespace -- "$0" "$@"
+fi
+
 # Bridge UDS to local TCP so HTTPS_PROXY works
 MITM_SOCK="/run/ironcurtain/mitm-proxy.sock"
 PROXY_PORT=18080

package/docker/entrypoint-goose.sh

@@ -2,6 +2,31 @@
 # IronCurtain entrypoint for Goose containers.
 # Sets up proxy bridges, writes Goose config, then hands off to CMD.
 
+# Runtime UID remap (Linux only). See entrypoint-claude-code.sh for the
+# full rationale (issue #232). Skipped on macOS where Docker Desktop
+# translates UIDs and the env vars are not set.
+if [ "$(id -u)" = "0" ] && [ -n "$IRONCURTAIN_AGENT_UID" ] && [ -n "$IRONCURTAIN_AGENT_GID" ]; then
+  if [ "$IRONCURTAIN_AGENT_UID" != "1000" ] || [ "$IRONCURTAIN_AGENT_GID" != "1000" ]; then
+    # Fail hard on remap errors — see entrypoint-claude-code.sh for the
+    # full rationale. Without explicit checks, a UID collision (host UID
+    # already in use by a system user baked into the image) silently
+    # recreates the original issue #232 bug.
+    groupmod -g "$IRONCURTAIN_AGENT_GID" codespace || {
+      echo "[ironcurtain] groupmod failed: cannot remap codespace group to GID $IRONCURTAIN_AGENT_GID (already in use?)" >&2
+      exit 1
+    }
+    usermod -u "$IRONCURTAIN_AGENT_UID" -g "$IRONCURTAIN_AGENT_GID" codespace || {
+      echo "[ironcurtain] usermod failed: cannot remap codespace user to UID $IRONCURTAIN_AGENT_UID (already in use?)" >&2
+      exit 1
+    }
+    chown -R "$IRONCURTAIN_AGENT_UID:$IRONCURTAIN_AGENT_GID" /home/codespace /workspace || {
+      echo "[ironcurtain] chown failed: cannot reset ownership of /home/codespace and /workspace to $IRONCURTAIN_AGENT_UID:$IRONCURTAIN_AGENT_GID" >&2
+      exit 1
+    }
+  fi
+  exec runuser -u codespace -- "$0" "$@"
+fi
+
 # 1. Bridge MITM proxy UDS to local TCP (same as Claude Code entrypoint)
 MITM_SOCK="/run/ironcurtain/mitm-proxy.sock"
 PROXY_PORT=18080

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provos/ironcurtain",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "type": "module",
   "description": "Secure agent runtime with trusted process mediation",
   "license": "Apache-2.0",
@@ -44,11 +44,14 @@
     "src/config/generated/compiled-policy.json",
     "src/config/generated/tool-annotations.json",
     "src/config/generated/test-scenarios.json",
+    "src/workflow/workflows/",
+    "packages/web-ui/docs/workflow-state-machine.png",
     "README.md",
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc && node scripts/copy-assets.mjs",
+    "build": "tsc && node scripts/copy-assets.mjs && npm run build:web-ui --if-present",
+    "build:web-ui": "npm run build -w packages/web-ui",
     "start": "tsx src/cli.ts start",
     "annotate-tools": "tsx src/cli.ts annotate-tools",
     "compile-policy": "tsx src/cli.ts compile-policy",
@@ -58,7 +61,8 @@
     "config": "tsx src/cli.ts config",
     "setup": "tsx src/cli.ts setup",
     "prepublishOnly": "npm run build",
-    "test": "vitest run",
+    "test": "bash scripts/test.sh",
+    "test:web-ui": "npm test -w packages/web-ui",
     "test:watch": "vitest",
     "lint": "eslint src/ test/",
     "format": "prettier --log-level=warn --write 'src/**/*.ts' 'test/**/*.ts'",
@@ -70,7 +74,7 @@
     "@ai-sdk/anthropic": "^3.0.49",
     "@ai-sdk/google": "^3.0.33",
     "@ai-sdk/openai": "^3.0.36",
-    "@anthropic-ai/sandbox-runtime": "^0.0.42",
+    "@anthropic-ai/sandbox-runtime": "^0.0.49",
     "@clack/prompts": "^1.0.1",
     "@cyanheads/git-mcp-server": "^2.8.4",
     "@modelcontextprotocol/sdk": "^1.27.1",
@@ -89,9 +93,14 @@
     "minimatch": "^10.2.1",
     "node-forge": "^1.3.3",
     "ora": "^9.3.0",
+    "p-limit": "^7.3.0",
     "shell-quote": "^1.8.3",
     "turndown": "^7.2.2",
-    "uuid": "^13.0.0",
+    "undici": "^7.24.0",
+    "uuid": "^14.0.0",
+    "ws": "^8.20.0",
+    "xstate": "^5.30.0",
+    "yaml": "^2.8.3",
     "zod": "^4.3.6"
   },
   "optionalDependencies": {
@@ -102,13 +111,19 @@
     "minimatch": "^10.2.1"
   },
   "lint-staged": {
-    "*.ts": [
+    "!(packages/**)/*.ts": [
       "prettier --check",
       "eslint"
+    ],
+    "packages/web-ui/**/*.{ts,svelte}": [
+      "prettier --check --config packages/web-ui/.prettierrc",
+      "npm run lint -w packages/web-ui",
+      "npm run check -w packages/web-ui"
     ]
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
+    "@modelcontextprotocol/server-filesystem": "^2026.1.14",
     "@types/jsdom": "^28.0.0",
     "@types/node": "^25.3.0",
     "@types/node-forge": "^1.3.14",
@@ -123,7 +138,6 @@
     "tsx": "^4.19.0",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.56.0",
-    "vitest": "^4.0.18",
-    "ws": "^8.19.0"
+    "vitest": "^4.0.18"
   }
 }

package/packages/web-ui/README.md

@@ -0,0 +1,113 @@
+# IronCurtain Web UI
+
+Opt-in web dashboard for the IronCurtain daemon. Provides a browser-based interface to monitor sessions, respond to escalations, manage scheduled jobs, and track resource budgets. The frontend is a Svelte 5 SPA that communicates with the daemon over a JSON-RPC WebSocket protocol with bearer token authentication.
+
+![Dashboard](docs/dashboard.png)
+
+## Quick Start
+
+Start the daemon with the `--web-ui` flag:
+
+```bash
+ironcurtain daemon --web-ui
+```
+
+The daemon prints an auth URL to stderr:
+
+```
+Web UI: http://localhost:7400/?token=<TOKEN>
+```
+
+Open that URL in a browser. The token is required -- paste it into the login screen if the URL parameter is lost. To use a custom port, pass `--web-port <port>`.
+
+## Features
+
+- Dashboard with session, escalation, and job summary stats
+- Interactive chat sessions with persona selection and markdown-rendered responses
+- Escalation approval/denial with whitelist candidate selection
+- Job management: run, enable, disable, recompile, remove
+- Collapsible tool call groups in session output
+- Three themes: Iron (dark charcoal + amber), Daylight (light + teal), Midnight (navy + blue)
+- Real-time updates pushed over WebSocket
+- Resource budget tracking per session (tokens, steps, cost, wall-clock time)
+
+## Development
+
+### With the real daemon (two terminals)
+
+```bash
+# Terminal 1 -- daemon with dev mode (skips Origin validation for Vite's port)
+ironcurtain daemon --web-ui --web-ui-dev
+
+# Terminal 2 -- Vite dev server with hot reload
+cd packages/web-ui && npm run dev
+```
+
+Open `http://localhost:5173?token=<TOKEN>` (copy the token from Terminal 1). Vite proxies `/ws` to the daemon on port 7400.
+
+### With the mock server (no Docker or LLM needed)
+
+```bash
+# Terminal 1
+cd packages/web-ui && npm run mock-server
+
+# Terminal 2
+cd packages/web-ui && npm run dev
+```
+
+Open `http://localhost:5173?token=mock-dev-token`. The mock server simulates the full protocol with canned data -- chat messages produce realistic event sequences (thinking, tool calls, markdown response), sending a message containing "escalate" triggers an escalation flow, and three sample jobs support enable/disable/remove.
+
+See [CLAUDE.md](./CLAUDE.md) for component conventions, directory structure, and theme system details.
+
+## Testing
+
+Three tiers:
+
+### Mock server (manual testing)
+
+```bash
+npm run mock-server    # Start canned WebSocket server on :7400
+npm run dev            # Start Vite on :5173 in another terminal
+```
+
+### Unit tests
+
+```bash
+npm test                # Run all unit tests (vitest)
+npm run test:watch      # Watch mode during development
+```
+
+Covers WebSocket event handling, output grouping logic, and request correlation. Tests run against pure TypeScript modules extracted from Svelte components for testability.
+
+### E2E tests (Playwright)
+
+```bash
+npx playwright install chromium   # One-time browser install
+npm run e2e                       # Run all E2E tests
+npm run e2e:headed                # Run with visible browser
+```
+
+Playwright auto-starts both the mock server and Vite dev server. Tests cover dashboard stats, session lifecycle, escalation approve/deny, job actions, theme switching, and error states.
+
+## Tech Stack
+
+- **Svelte 5** -- runes-based reactivity (`$state`, `$derived`, `$effect`)
+- **Vite** -- dev server and production bundler
+- **Tailwind CSS v3** -- utility-first styling with CSS custom property theming
+- **phosphor-svelte** -- icons (tree-shaken via Vite plugin)
+- **marked + DOMPurify** -- safe markdown rendering
+- **clsx + tailwind-merge** -- conditional class merging (shadcn-svelte pattern)
+
+## Architecture
+
+The daemon's `WebUiServer` (in `src/web-ui/`) starts an HTTP server that serves the compiled static assets from `dist/web-ui-static/` and upgrades `/ws` connections to WebSocket.
+
+Communication uses a JSON-RPC protocol over WebSocket:
+
+- **Requests**: `{ id, method, params? }` -- client calls like `sessions.create`, `escalations.resolve`, `jobs.run`
+- **Responses**: `{ id, ok, payload?, error? }` -- correlated by `id`
+- **Events**: `{ event, payload, seq }` -- server-push notifications like `session.output`, `escalation.created`, `daemon.status`
+
+Authentication is via a bearer token generated at daemon startup. The token is passed as a `?token=` query parameter on the initial page load and sent with the WebSocket connection. The `--web-ui-dev` flag disables Origin header validation so the Vite dev server on port 5173 can connect to the daemon on port 7400.
+
+Production builds output to `dist/web-ui-static/` (via `npm run build` in the workspace root or `npm run build` in this package). The daemon serves these files as static assets with no additional build step at runtime.