amicus 4.3.0 → 4.4.1

package/electron/fold.js

@@ -66,7 +66,7 @@ function createFoldHandler(state) {
         `Session: ${state.sessionId || state.taskId}`,
         `Client: ${state.client}`,
         `CWD: ${state.cwd}`,
-        `Mode: interactive`,
+        'Mode: interactive',
         '---',
         summary || 'Session ended without summary.'
       ].join('\n');

package/electron/ipc-workspace.js

@@ -0,0 +1,283 @@
+/**
+ * Council Workspace IPC (v4.4 §4.5) — all seven workspace: channels.
+ *
+ * ipc-setup.js registration pattern + DI for tests. Every handler validates
+ * the sender against the workspace window via isPrivilegedSender (M9
+ * belt-and-suspenders, even though this window has one webContents). All
+ * reads are main-process-side; the renderer never sees a filesystem path
+ * except for display. Read-only against runDir (spec §6.2): fold writes to
+ * OUR stdout; abort delegates to the engine's own council-aware path.
+ *
+ * The in-process v4.3/v4.0 seam: require('../src/mcp-server').handlers —
+ * requiring mcp-server does NOT start the server (cli-handlers-status.js:3).
+ */
+'use strict';
+
+const path = require('path');
+const { pathToFileURL } = require('url');
+const { logger } = require('../src/utils/logger');
+const { isPrivilegedSender } = require('./ipc-guard');
+const { isRealpathContained } = require('../src/workspace/artifact-guard');
+
+function defaultDeps() {
+  return {
+    scanCouncilRuns: (...a) => require('../src/workspace/run-scan').scanCouncilRuns(...a),
+    getRunDetail: (...a) => require('../src/workspace/run-detail').getRunDetail(...a),
+    readPointer: (...a) => require('../src/workspace/run-scan').readPointer(...a),
+    readRunArtifact: (...a) => require('../src/workspace/artifact-guard').readRunArtifact(...a),
+    buildFoldText: (...a) => require('../src/workspace/fold-format').buildFoldText(...a),
+    normalizeLive: (...a) => require('../src/workspace/live-normalize').normalizeLive(...a),
+    handlers: () => require('../src/mcp-server').handlers,
+    // Node passes an Error to this callback when the chunk fails to flush
+    // (e.g. a dead parent pipe / closed stdout) — reject on it rather than
+    // resolving unconditionally, or a failed write reports {ok:true} to the
+    // renderer and permanently latches gate.hasCompleted() (code review fix).
+    stdoutWrite: (text) => new Promise((resolve, reject) => {
+      process.stdout.write(text, (err) => (err ? reject(err) : resolve()));
+    }),
+    openExternal: (url) => require('electron').shell.openExternal(url),
+    existsSync: (p) => require('fs').existsSync(p),
+    realpathSync: (p) => require('fs').realpathSync(p),
+  };
+}
+
+/**
+ * Two-flag fold latch (fold.js folded/completed pattern WITHOUT the
+ * close-guard fallback-destroy machinery — a workspace fold does no async
+ * model work, so that failure surface does not apply; spec §7).
+ *
+ * ⚠️ COUNCIL REVIEW R2 (A3): `completed` used to be a single unkeyed boolean —
+ * one successful fold latched the gate for the ENTIRE life of the window, for
+ * every run, not just the one that was actually folded. The renderer supports
+ * navigating to a different run within one open window (openRun with a
+ * dynamic runId; a bare `--ui` launch opens the whole project run list, spec
+ * §4.3/§4.4), so: open run A, Fold (succeeds) -> switch to run B, Fold ->
+ * the old code returned {ok:true, already:true} WITHOUT ever writing
+ * anything for B. Silent wrong-result, not cosmetic: the UI reads "Folded ✓"
+ * for a run that was never written to the launching terminal.
+ *
+ * Completion is now keyed per runId (a Set of runIds that have been
+ * successfully folded), so each DISTINCT run gets its own honest
+ * begin()/hasCompleted() pair. `writing` (in flight) stays a single GLOBAL
+ * flag on purpose: at most one fold write can be in progress at any instant
+ * regardless of which run it is for (there is exactly one stdout stream to
+ * write to), so a second concurrent call — for the SAME run or a different
+ * one — still correctly gets 'fold-in-flight' rather than interleaving two
+ * writes.
+ *
+ * Why per-run, not "reset the whole gate when the active run changes" or
+ * "keep one global one-shot latch and just report it more honestly": the
+ * plan's spec §7 line ("the fold nonce is per-window-launch... one fold
+ * write per launch... a second fold of the SAME run legitimately returns
+ * already:true") was written before multi-run navigation existed and reads
+ * naturally as "don't spam-refold what you already folded" rather than "the
+ * whole window may only ever fold one run, period." Concretely, allowing one
+ * successful fold per DISTINCT run within a single launch is safe: the
+ * workspace's fold-write path (src/sidecar/workspace-window.js) just relays
+ * accumulated stdout live and returns the exit code once the window closes —
+ * it does no first/last-marker disambiguation the way the OLDER headless
+ * model-session flow's findTrailingFoldMarker does (src/headless.js) — and
+ * every fold block is self-identifying (`Session: <runId>`,
+ * src/workspace/fold-format.js), so two distinct runs folded into the same
+ * launch's stdout are unambiguous to whatever reads it. A global
+ * one-shot-per-window latch would instead be a real product regression: it
+ * would make "browse several runs and fold the ones you care about" — the
+ * whole point of the window NOT auto-closing after a fold — impossible
+ * without reopening the workspace for every run after the first.
+ */
+function createFoldGate() {
+  let writing = false;
+  let writingRunId = null;
+  const completedRuns = new Set();
+  let pendingClose = false;
+  return {
+    /** @returns {boolean} true when a write may start for runId */
+    begin(runId) {
+      if (writing || completedRuns.has(runId)) { return false; }
+      writing = true;
+      writingRunId = runId;
+      return true;
+    },
+    /** @returns {boolean} true when a close was blocked during the write */
+    settle({ ok }) {
+      writing = false;
+      if (ok) { completedRuns.add(writingRunId); }
+      writingRunId = null;
+      const p = pendingClose;
+      pendingClose = false;
+      return p;
+    },
+    isWriting() { return writing; },
+    hasCompleted(runId) { return completedRuns.has(runId); },
+    noteBlockedClose() { pendingClose = true; },
+  };
+}
+
+/**
+ * @param {() => object|null} getWindow returns the workspace BrowserWindow
+ * @param {{project: string, nonce: string, ipc?: object, gate?: object, deps?: object}} ctx
+ * @returns {{gate: object}}
+ */
+function registerWorkspaceHandlers(getWindow, ctx) {
+  const { project, nonce } = ctx;
+  const deps = { ...defaultDeps(), ...(ctx.deps || {}) };
+  const ipc = ctx.ipc || require('electron').ipcMain;
+  const gate = ctx.gate || createFoldGate();
+  const fromWorkspace = (event) => isPrivilegedSender(event, getWindow);
+  // ⚠️ CODE REVIEW (task-9 post-approval): settle()'s pendingClose signal used to be
+  // read only on the success path below, so a close blocked while a fold was writing
+  // silently dropped on the two failure paths (settle({ok:false}) at the detail-error
+  // early return and in the outer catch) — the window stayed open with no further
+  // close handler poised to retry until the user clicked X again. All three settle()
+  // call sites must honor a pending close identically.
+  const closeIfPending = (shouldClose) => {
+    if (!shouldClose) { return; }
+    const win = getWindow();
+    if (win && !win.isDestroyed()) { win.close(); }
+  };
+
+  ipc.handle('workspace:list-runs', (event) => {
+    if (!fromWorkspace(event)) { return []; }
+    try { return deps.scanCouncilRuns(project); }
+    catch (err) { logger.error('workspace list-runs failed', { error: err.message }); return []; }
+  });
+
+  ipc.handle('workspace:get-run', (event, runId) => {
+    if (!fromWorkspace(event)) { return { error: 'unauthorized' }; }
+    try { return deps.getRunDetail(project, String(runId)); }
+    catch (err) { return { runId: String(runId), error: err.message }; }
+  });
+
+  ipc.handle('workspace:get-live', async (event, runId) => {
+    if (!fromWorkspace(event)) { return { ok: false, error: 'unauthorized' }; }
+    try {
+      const result = await deps.handlers().amicus_status({ taskId: String(runId) }, project);
+      const text = result && result.content && result.content[0] ? result.content[0].text : '';
+      if (result && result.isError) { return { ok: false, error: String(text).slice(0, 500) }; }
+      let doc;
+      try { doc = JSON.parse(text); } catch { return { ok: false, error: 'unparseable status doc' }; }
+      return deps.normalizeLive(doc);
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  });
+
+  ipc.handle('workspace:read-artifact', (event, runId, name) => {
+    if (!fromWorkspace(event)) { return { error: 'unauthorized' }; }
+    try { return deps.readRunArtifact(project, String(runId), String(name)); }
+    catch (err) { return { error: err.message }; }
+  });
+
+  ipc.handle('workspace:abort-run', async (event, runId) => {
+    if (!fromWorkspace(event)) { return { ok: false, error: 'unauthorized' }; }
+    try {
+      const result = await deps.handlers().amicus_abort({ taskId: String(runId) }, project);
+      const text = result && result.content && result.content[0] ? result.content[0].text : '';
+      return { ok: !(result && result.isError), detail: String(text).slice(0, 2000) };
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  });
+
+  ipc.handle('workspace:fold', async (event, runId) => {
+    if (!fromWorkspace(event)) { return { ok: false, error: 'unauthorized' }; }
+    const runKey = String(runId);
+    // Gate keyed on runKey (council review R2, A3 — see createFoldGate's
+    // docblock): completing run A must not latch a DIFFERENT run B.
+    if (gate.hasCompleted(runKey)) { return { ok: true, already: true }; }
+    if (!gate.begin(runKey)) { return { ok: false, error: 'fold-in-flight' }; }
+    try {
+      const detail = deps.getRunDetail(project, runKey);
+      if (detail.error || !detail.run || detail.run.parseError) {
+        closeIfPending(gate.settle({ ok: false }));
+        return { ok: false, error: detail.error || 'run.json unavailable' };
+      }
+      const chairRead = deps.readRunArtifact(project, runKey, 'chair-output.md');
+      // Distinguish a security fence firing (e.g. the realpath-escape check)
+      // from a benign absence (not written yet) — both fall through to the
+      // same safe fallback body below, but only one of them is worth an
+      // operator's attention (code review fix).
+      if (chairRead && chairRead.error) {
+        logger.warn('Workspace fold: chair-output.md unavailable', { runId: runKey, reason: chairRead.error });
+      }
+      const chairText = chairRead && chairRead.text ? chairRead.text : null;
+      const text = deps.buildFoldText({
+        nonce, project, run: detail.run, tally: detail.tally, verdict: detail.verdict, chairText,
+      });
+      await deps.stdoutWrite(text + '\n');
+      logger.info('Workspace fold completed', { runId: runKey });
+      closeIfPending(gate.settle({ ok: true }));
+      return { ok: true };
+    } catch (err) {
+      closeIfPending(gate.settle({ ok: false }));
+      logger.error('Workspace fold failed', { error: err.message });
+      return { ok: false, error: err.message };
+    }
+  });
+
+  ipc.handle('workspace:open-report', (event, runId) => {
+    if (!fromWorkspace(event)) { return { ok: false, error: 'unauthorized' }; }
+    // ⚠️ DE-ROT (F59): the SHIPPED readPointer (src/council/run-state.js:133-139,
+    // which Task 2's dedupe makes this deps entry resolve to) returns **null** for a
+    // missing/corrupt pointer — it never returns {error}. A bare `ptr.error` throws a
+    // TypeError straight out of the handler, and this was the only one of the seven
+    // with no try/catch. Guard for null AND wrap, like the other six.
+    try {
+      const ptr = deps.readPointer(project, String(runId));
+      if (!ptr || ptr.error) { return { ok: false, error: (ptr && ptr.error) || 'run pointer not found' }; }
+
+      // Containment fence FIRST (council review C1, MAJOR, unanimous; ROUND 4 ORDERING
+      // FIX, third live paid council, blocker-adjacent — this handler is the direct
+      // analogue of the same bug fixed in src/workspace/artifact-guard.js's
+      // readRunArtifact): this handler was the only filesystem-reaching workspace:
+      // channel with no containment check, and the only one that hands a disk-derived
+      // path to a shell verb (openExternal) — ptr.runDir is charset-blind and never
+      // validated beyond truthiness (src/council/run-state.js:133-139). The
+      // existsSync(report) probe used to run BEFORE this fence: read-only and
+      // Boolean, so it never leaked file content, but it let a tampered/stale pointer
+      // use file-EXISTENCE as an out-of-project oracle ahead of any containment check
+      // — the same "resolve+fence before touching the filesystem at all" invariant
+      // every other channel in this file now honours. Resolve+fence runDir first;
+      // only then probe/read anything derived from it.
+      let realProject, realRunDir;
+      try {
+        realProject = deps.realpathSync(project);
+        realRunDir = deps.realpathSync(ptr.runDir);
+      } catch {
+        return { ok: false, error: 'run directory unreadable' };
+      }
+      if (!isRealpathContained(realProject, realRunDir)) {
+        return { ok: false, error: 'run directory escapes project' };
+      }
+
+      const report = path.join(ptr.runDir, 'report.html');
+      if (!deps.existsSync(report)) { return { ok: false, error: 'report.html not written' }; }
+
+      // Inner fence (independent of the one above): report.html must resolve inside
+      // runDir too — a symlinked report.html can't escape the run dir either. Fail
+      // closed on any realpath error (permission, dangling symlink) rather than let
+      // it fall through to openExternal. Generic message (round 4): a readFileSync/
+      // realpathSync failure's err.message embeds the full resolved path it tried to
+      // open — interpolating it here would hand the renderer an internal filesystem
+      // path via the IPC response.
+      let realReport;
+      try {
+        realReport = deps.realpathSync(report);
+      } catch {
+        return { ok: false, error: 'report path unreadable' };
+      }
+      if (!isRealpathContained(realRunDir, realReport)) {
+        return { ok: false, error: 'report escapes run directory' };
+      }
+
+      deps.openExternal(pathToFileURL(realReport).href);
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  });
+
+  return { gate };
+}
+
+module.exports = { registerWorkspaceHandlers, createFoldGate };

package/electron/main.js

@@ -79,6 +79,10 @@ const WINDOW_POSITION = process.env.AMICUS_WINDOW_POSITION || 'right';
 // marker. That's safe here because the GUI fold write is exit-code driven, not
 // marker-detected, so an un-advertised fallback nonce can't be exploited.
 const FOLD_NONCE = process.env.AMICUS_FOLD_NONCE;
+// v4.4 Council Workspace mode (AMICUS_MODE=council-workspace). Set by
+// src/sidecar/workspace-window.js; PROJECT defaults to cwd for direct launches.
+const PROJECT = process.env.AMICUS_PROJECT || process.cwd();
+const RUN_ID = process.env.AMICUS_RUN_ID || '';
 
 const OPENCODE_URL = `http://localhost:${OPENCODE_PORT}`;
 
@@ -138,7 +142,10 @@ function createAmicusWindow() {
   let updateInfo = null;
   const updateInfoRaw = process.env.AMICUS_UPDATE_INFO;
   if (updateInfoRaw) {
-    try { updateInfo = JSON.parse(updateInfoRaw); } catch (_) {}
+    try { updateInfo = JSON.parse(updateInfoRaw); } catch (_) {
+      // A malformed AMICUS_UPDATE_INFO is not worth failing launch over:
+      // updateInfo stays null and the direct check below takes over.
+    }
   }
   if (!updateInfo) {
     const { getUpdateInfo, initUpdateCheck } = require('../src/utils/updater');
@@ -510,6 +517,27 @@ function createSettingsChildWindow() {
   settingsWin.webContents.on('page-title-updated', (e) => e.preventDefault());
 }
 
+// ============================================================================
+// Council Workspace (v4.4) — third mode; window body lives in workspace-shell.js
+// ============================================================================
+
+function createCouncilWorkspace() {
+  const { createWorkspaceWindow } = require('./workspace-shell');
+  const { registerWorkspaceHandlers, createFoldGate } = require('./ipc-workspace');
+  const { generateFoldNonce } = require('../src/utils/fold-marker');
+  const gate = createFoldGate();
+  registerWorkspaceHandlers(() => mainWindow, {
+    project: PROJECT,
+    nonce: FOLD_NONCE || generateFoldNonce(),
+    gate,
+  });
+  mainWindow = createWorkspaceWindow({ runId: RUN_ID, gate, headless: !!process.env.AMICUS_HEADLESS_TEST });
+  mainWindow.on('closed', () => {
+    mainWindow = null;
+    app.quit();
+  });
+}
+
 // ============================================================================
 // App Lifecycle
 // ============================================================================
@@ -523,6 +551,8 @@ app.whenReady().then(() => {
 
   if (MODE === 'setup') {
     createSetupWindow().catch((err) => { logger.error('createSetupWindow failed', err); });
+  } else if (MODE === 'council-workspace') {
+    createCouncilWorkspace();
   } else {
     createAmicusWindow();
   }

package/electron/preload-workspace.js

@@ -0,0 +1,40 @@
+/**
+ * Council Workspace Preload — minimal typed IPC bridge (v4.4 §4.2/§4.5).
+ *
+ * The workspace page loads via loadFile (a real file:// origin), so
+ * contextBridge works under FULL sandbox — no data:-URL workaround needed
+ * (docs/electron-testing.md Known Limitations; the setup wizard only works
+ * because it runs sandbox:false, a posture this page must not inherit: it
+ * renders untrusted model prose, the H9 surface).
+ *
+ * Exposes exactly one function. No openExternal bridge, no listeners.
+ * Unknown channel → throw (preload-setup.js pattern).
+ *
+ * ⚠️ DE-ROT (F30): this header used to name the banned electron module (the
+ * one preload-setup.js:9 imports for openExternal). Step 1 asserts
+ * expect(SRC).not.toContain(...) against the RAW file source — comments
+ * included — so that word here made Task 7 fail its own test. Never let the
+ * literal token appear anywhere in this file. Step 4's "PASS (3 tests)" is
+ * correct only with the reworded line above.
+ */
+const { contextBridge, ipcRenderer } = require('electron');
+
+const ALLOWED_CHANNELS = [
+  'workspace:list-runs',
+  'workspace:get-run',
+  'workspace:get-live',
+  'workspace:read-artifact',
+  'workspace:abort-run',
+  'workspace:fold',
+  'workspace:open-report',
+];
+
+contextBridge.exposeInMainWorld('amicusWorkspace', {
+  /** Invoke an allowlisted workspace IPC channel. */
+  invoke: (channel, ...args) => {
+    if (!ALLOWED_CHANNELS.includes(channel)) {
+      throw new Error(`IPC channel not allowed: ${channel}`);
+    }
+    return ipcRenderer.invoke(channel, ...args);
+  },
+});

package/electron/setup-ui-aliases.js

@@ -22,7 +22,7 @@ const ALIAS_GROUPS = [
  * @returns {string} HTML fragment with search, groups, rows, and add button
  */
 function buildAliasEditorHTML(aliases) {
-  const searchInput = `<input type="text" id="alias-search" class="alias-search" placeholder="Search aliases..." autocomplete="off" spellcheck="false">`;
+  const searchInput = '<input type="text" id="alias-search" class="alias-search" placeholder="Search aliases..." autocomplete="off" spellcheck="false">';
 
   const groups = ALIAS_GROUPS.map(group => {
     const rows = group.keys
@@ -31,10 +31,10 @@ function buildAliasEditorHTML(aliases) {
         const model = aliases[key];
         return `<div class="alias-row" data-alias="${key}">` +
           `<span class="alias-name">${key}</span>` +
-          `<span class="alias-arrow">\u2192</span>` +
+          '<span class="alias-arrow">\u2192</span>' +
           `<span class="alias-model">${model}</span>` +
           `<button class="alias-delete" data-alias="${key}">\u00d7</button>` +
-          `</div>`;
+          '</div>';
       }).join('\n        ');
 
     const count = group.keys.filter(key => aliases[key] !== undefined).length;
@@ -51,9 +51,9 @@ function buildAliasEditorHTML(aliases) {
   const exampleModel = aliases[exampleAlias] || 'openrouter/google/gemini-3.1-flash-lite-preview';
 
   // SVG icons for the example box
-  const terminalIcon = `<svg class="alias-icon-accent" width="16" height="16" viewBox="0 0 16 16" fill="none"><rect x="1" y="2" width="14" height="12" rx="2" stroke-width="1.5"/><path d="M4 6l2.5 2L4 10" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M8.5 10H11" class="alias-icon-faint-path" stroke-width="1.5" stroke-linecap="round"/></svg>`;
-  const arrowIcon = `<svg class="alias-icon-accent" width="20" height="12" viewBox="0 0 20 12" fill="none"><path d="M2 6h14" stroke-width="1.5" stroke-linecap="round"/><path d="M13 2l4 4-4 4" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
-  const modelIcon = `<svg class="alias-icon-ok" width="16" height="16" viewBox="0 0 16 16" fill="none"><circle cx="8" cy="5" r="3" stroke-width="1.5"/><path d="M8 8v3" stroke-width="1.5" stroke-linecap="round"/><circle cx="4" cy="13" r="1.5" stroke-width="1.2"/><circle cx="8" cy="13" r="1.5" stroke-width="1.2"/><circle cx="12" cy="13" r="1.5" stroke-width="1.2"/><path d="M4 11.5L8 11M8 11l4 .5" stroke-width="1" stroke-linecap="round"/></svg>`;
+  const terminalIcon = '<svg class="alias-icon-accent" width="16" height="16" viewBox="0 0 16 16" fill="none"><rect x="1" y="2" width="14" height="12" rx="2" stroke-width="1.5"/><path d="M4 6l2.5 2L4 10" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M8.5 10H11" class="alias-icon-faint-path" stroke-width="1.5" stroke-linecap="round"/></svg>';
+  const arrowIcon = '<svg class="alias-icon-accent" width="20" height="12" viewBox="0 0 20 12" fill="none"><path d="M2 6h14" stroke-width="1.5" stroke-linecap="round"/><path d="M13 2l4 4-4 4" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+  const modelIcon = '<svg class="alias-icon-ok" width="16" height="16" viewBox="0 0 16 16" fill="none"><circle cx="8" cy="5" r="3" stroke-width="1.5"/><path d="M8 8v3" stroke-width="1.5" stroke-linecap="round"/><circle cx="4" cy="13" r="1.5" stroke-width="1.2"/><circle cx="8" cy="13" r="1.5" stroke-width="1.2"/><circle cx="12" cy="13" r="1.5" stroke-width="1.2"/><path d="M4 11.5L8 11M8 11l4 .5" stroke-width="1" stroke-linecap="round"/></svg>';
 
   const exampleBox = `<div class="routing-example">
         <div class="example-label">How it works</div>

package/electron/workspace-shell.js

@@ -0,0 +1,85 @@
+/**
+ * Council Workspace window (v4.4 §4.1/§4.2) — the third Electron mode's
+ * BrowserWindow. One window, no WebContentsView split: the workspace is a
+ * single first-party page. Extracted from main.js (grandfathered size) so
+ * the posture is source-testable.
+ *
+ * H9 posture: this page renders untrusted model prose, so it is the MOST
+ * locked-down page in the app — full sandbox, minimal preload, CSP in the
+ * page itself, and it never navigates or opens windows.
+ *
+ * Close semantics (spec §7 resolved Q3): NO auto-fold on close — closing a
+ * viewer discards nothing (all artifacts are on disk). The only guard is the
+ * in-flight fold-write latch supplied by ipc-workspace's gate.
+ */
+'use strict';
+
+const path = require('path');
+const { BrowserWindow } = require('electron');
+const { TOKENS } = require('../src/design/tokens');
+// ⚠️ DE-ROT (F31): shipped guard for exactly this show:false hazard — reuse, don't
+// re-invent (electron/load-failsafe.js:27, paired with show:false at main.js:210-232).
+const { attachLoadFailsafe } = require('./load-failsafe');
+const { logger } = require('../src/utils/logger');
+
+const ICON_PATH = path.join(__dirname, 'assets', 'icon.png');
+
+/**
+ * @param {{runId?: string, gate: {isWriting: () => boolean, noteBlockedClose: () => void}, headless?: boolean}} opts
+ * @returns {BrowserWindow}
+ */
+function createWorkspaceWindow({ runId, gate, headless }) {
+  const win = new BrowserWindow({
+    width: 1100, height: 800, minWidth: 860, minHeight: 600,
+    show: false,
+    frame: true, backgroundColor: TOKENS.bg,
+    title: 'Amicus Council Workspace',
+    icon: ICON_PATH,
+    webPreferences: {
+      preload: path.join(__dirname, 'preload-workspace.js'),
+      contextIsolation: true, nodeIntegration: false, sandbox: true,
+    },
+  });
+
+  win.webContents.on('will-navigate', (event) => { event.preventDefault(); });
+  win.webContents.setWindowOpenHandler(() => ({ action: 'deny' }));
+  win.webContents.on('page-title-updated', (e) => e.preventDefault());
+
+  // ⚠️ DE-ROT (F31): attach BEFORE loadFile. onFail shows the window anyway (so the
+  // user sees an empty-but-present shell instead of nothing) and logs the reason;
+  // default timeout is 15s (load-failsafe.js:19). No buildLoadErrorHTML here — the
+  // workspace page is first-party and CSP-locked, so just surface + log.
+  const failsafe = attachLoadFailsafe({
+    webContents: win.webContents,
+    onFail: ({ reason, errorCode, errorDescription, validatedURL }) => {
+      logger.error('Council Workspace page failed to load', {
+        reason, errorCode, errorDescription, validatedURL, runId: runId || ''
+      });
+      if (!headless && !win.isDestroyed()) { win.show(); }
+    },
+  });
+
+  // ⚠️ CODE REVIEW: loadFile() rejects on load failure (and, until Task 11 lands
+  // workspace-ui/index.html, on EVERY launch). The failsafe above already surfaces
+  // and logs the failure, so swallow the rejection itself rather than leaving an
+  // unhandled rejection in the main process (precedent: main.js's own
+  // .loadURL(...).catch(() => {})).
+  win.loadFile(path.join(__dirname, 'workspace-ui', 'index.html'), { query: { runId: runId || '' } })
+    .catch(() => {});
+
+  win.once('ready-to-show', () => {
+    failsafe.cancel(); // disarm on the success path
+    if (!headless) { win.show(); }
+  });
+
+  win.on('close', (event) => {
+    if (gate && gate.isWriting()) {
+      event.preventDefault();
+      gate.noteBlockedClose();
+    }
+  });
+
+  return win;
+}
+
+module.exports = { createWorkspaceWindow };

package/electron/workspace-ui/index.html

@@ -0,0 +1,111 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta http-equiv="Content-Security-Policy"
+        content="default-src 'none'; script-src file:; style-src file: 'unsafe-inline'; font-src file:; img-src file: data:">
+  <title>Amicus Council Workspace</title>
+  <link rel="stylesheet" href="../../src/design/tokens.css">
+  <link rel="stylesheet" href="./workspace.css">
+</head>
+<body>
+  <div id="app">
+    <aside id="rail" aria-label="Council runs">
+      <header class="rail-head">
+        <span class="rail-title">Council runs</span>
+        <span id="rail-project" class="rail-project mono"></span>
+      </header>
+      <ul id="run-list" tabindex="0" aria-label="Run list"></ul>
+    </aside>
+
+    <main id="detail">
+      <div id="empty-state" class="empty-state">Select a council run</div>
+
+      <div id="run-view" hidden>
+        <header id="run-header">
+          <div class="run-head-row">
+            <h1 id="run-title" class="mono"></h1>
+            <div id="run-chips" class="chips"></div>
+          </div>
+          <div class="run-head-row">
+            <div id="cost-gauge" class="gauge" role="meter" aria-label="Run cost vs ceiling">
+              <div id="cost-gauge-fill" class="gauge-fill"></div>
+              <span id="cost-gauge-text" class="gauge-text mono"></span>
+            </div>
+            <label class="blind-label">
+              <input type="checkbox" id="blind-toggle"> Blind mode
+            </label>
+            <button id="abort-btn" class="btn danger" hidden>Abort run…</button>
+          </div>
+        </header>
+
+        <div id="banner" class="banner" hidden></div>
+
+        <nav id="stage-rail" class="stage-rail" aria-label="Stages"></nav>
+
+        <section id="seats-panel" class="panel" aria-label="Seats">
+          <h2 class="panel-title">Seats</h2>
+          <table class="table">
+            <thead>
+              <tr><th>Seat</th><th>Role</th><th>Status</th><th>Stage</th><th>Msgs</th>
+                  <th>Tokens in/out</th><th>Cost</th><th>Last activity</th><th></th></tr>
+            </thead>
+            <tbody id="seats-body"></tbody>
+          </table>
+        </section>
+
+        <details id="reviews-panel" class="panel">
+          <summary class="panel-title">Stage-1 reviews</summary>
+          <div id="reviews-body" class="prose-host"></div>
+        </details>
+
+        <details id="bundle-panel" class="panel">
+          <summary class="panel-title">Peer-review packet (verbatim)</summary>
+          <div id="bundle-body" class="prose-host"></div>
+        </details>
+
+        <details id="judges-panel" class="panel">
+          <summary class="panel-title">Judge outputs</summary>
+          <div id="judges-body" class="prose-host"></div>
+        </details>
+
+        <section id="matrix-panel" class="panel" aria-label="Adjudication matrix">
+          <h2 class="panel-title">Adjudication matrix</h2>
+          <div id="matrix-body"></div>
+        </section>
+
+        <section id="verdict-panel" class="panel" aria-label="Verdict">
+          <h2 class="panel-title">Verdict</h2>
+          <div id="verdict-body"></div>
+        </section>
+
+        <section id="cost-panel" class="panel" aria-label="Cost">
+          <h2 class="panel-title">Cost by seat</h2>
+          <div id="cost-body"></div>
+        </section>
+      </div>
+    </main>
+  </div>
+
+  <div id="dialog-abort" class="dialog-backdrop" hidden>
+    <div class="dialog" role="dialog" aria-modal="true" aria-labelledby="dialog-abort-title">
+      <h2 id="dialog-abort-title">Abort this council run?</h2>
+      <p>The active wave and solo legs will be aborted via the engine's abort path. Artifacts already on disk stay browsable.</p>
+      <div class="dialog-actions">
+        <button id="dialog-abort-cancel" class="btn">Cancel</button>
+        <button id="dialog-abort-confirm" class="btn danger">Abort run</button>
+      </div>
+    </div>
+  </div>
+
+  <script src="./md-lite.js"></script>
+  <script src="./live-model.js"></script>
+  <script src="./workspace-render.js"></script>
+  <script src="./workspace-matrix.js"></script>
+  <!-- ⚠️ DE-ROT (F05): panels + verbs are the Task 13 split of workspace-app.js.
+       Load order matters: workspace-app.js boots last and owns `state`. -->
+  <script src="./workspace-panels.js"></script>
+  <script src="./workspace-verbs.js"></script>
+  <script src="./workspace-app.js"></script>
+</body>
+</html>