labgate 0.5.30 → 0.5.32

package/dist/lib/ui.js

@@ -45,13 +45,18 @@ const ws_1 = require("ws");
 const config_js_1 = require("./config.js");
 const init_js_1 = require("./init.js");
 const container_js_1 = require("./container.js");
+const runtime_js_1 = require("./runtime.js");
 const audit_js_1 = require("./audit.js");
 const slurm_db_js_1 = require("./slurm-db.js");
 const slurm_poller_js_1 = require("./slurm-poller.js");
 const results_store_js_1 = require("./results-store.js");
+const display_store_js_1 = require("./display-store.js");
 const policy_js_1 = require("./policy.js");
 const license_js_1 = require("./license.js");
 const web_terminal_js_1 = require("./web-terminal.js");
+const explorer_js_1 = require("./explorer.js");
+const explorer_eval_js_1 = require("./explorer-eval.js");
+const explorer_store_js_1 = require("./explorer-store.js");
 const log = __importStar(require("./log.js"));
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const HTML_PATH = (0, path_1.resolve)(__dirname, '..', 'lib', 'ui.html');
@@ -69,6 +74,11 @@ const LABGATE_INSTRUCTION_START = '<!-- LABGATE_SESSION_INSTRUCTION_START -->';
 const LABGATE_INSTRUCTION_END = '<!-- LABGATE_SESSION_INSTRUCTION_END -->';
 const IRIS_SAMPLE_DATASET_NAME = 'flowers-iris';
 const IRIS_SAMPLE_SOURCE_URL = 'https://raw.githubusercontent.com/mwaskom/seaborn-data/master/iris.csv';
+const PODMAN_SETUP_TIMEOUT_MS = 30 * 60 * 1000;
+const PODMAN_SETUP_MAX_BUFFER = 16 * 1024 * 1024;
+const EXPLORER_TSP_TEMPLATE_DIR = (0, path_1.resolve)(__dirname, '..', '..', 'templates', 'tsp-lab');
+const EXPLORER_TSP_TEMPLATE_SOURCE_REPO = (0, path_1.join)((0, config_js_1.getExplorerRootDir)(), 'templates', 'tsp-lab-source');
+const EXPLORER_ARTIFACT_READ_MAX_BYTES = 2 * 1024 * 1024;
 const IRIS_SAMPLE_README = '# Iris Flowers Dataset (Sample)\n' +
     '\n' +
     'Source: https://raw.githubusercontent.com/mwaskom/seaborn-data/master/iris.csv\n' +
@@ -85,14 +95,41 @@ function resolveIrisSampleSourceUrl() {
 let slurmDB = null;
 let slurmPoller = null;
 let resultsStore = null;
+let displayStore = null;
 const REQUIRED_SLURM_COMMANDS = ['sbatch', 'squeue', 'sacct', 'scancel'];
 const webTerminalBridges = new Map();
+const WEB_TERMINAL_INIT_RETENTION_MS = 60 * 60 * 1000;
+const WEB_TERMINAL_IMAGE_PULL_TIMEOUT_MS = 60 * 60 * 1000;
+const WEB_TERMINAL_IMAGE_PULL_MAX_BUFFER = 64 * 1024 * 1024;
+const WEB_TERMINAL_AGENT_PREP_TIMEOUT_MS = 30 * 60 * 1000;
+const WEB_TERMINAL_AGENT_PREP_MAX_BUFFER = 32 * 1024 * 1024;
+const WEB_TERMINAL_STARTUP_READY_TIMEOUT_MS = 90 * 1000;
+const WEB_TERMINAL_STARTUP_READY_POLL_MS = 120;
+const WEB_TERMINAL_STARTUP_READY_BUFFER_LIMIT = 64 * 1024;
+const WEB_TERMINAL_STARTUP_ALIVE_CHECK_MS = 750;
+const WEB_TERMINAL_BUFFER_MAX_BYTES = 512_000;
+const WEB_TERMINAL_HISTORY_MAX_BYTES = 8 * 1024 * 1024;
+const WEB_TERMINAL_HISTORY_CHUNK_BYTES = 8 * 1024;
+const WEB_TERMINAL_HISTORY_PAGE_DEFAULT = 120;
+const WEB_TERMINAL_HISTORY_PAGE_MAX = 600;
+const WEB_TERMINAL_STARTUP_HEADER_RE = /(?:^|\n)\s*LabGate\s*(?:\n|$)/i;
+const WEB_TERMINAL_STARTUP_BLOCKED_RE = /(?:^|\n)\s*Blocked\s+\d+\s+patterns\b/i;
+const CLAUDE_HEADLESS_STDERR_LIMIT = 12_000;
+const webTerminalInitJobs = new Map();
+const webTerminalImagePullLocks = new Map();
+const webTerminalAgentPrepLocks = new Map();
 function getResultsStore() {
     if (!resultsStore) {
         resultsStore = new results_store_js_1.ResultsStore((0, config_js_1.getResultsDbPath)());
     }
     return resultsStore;
 }
+function getDisplayStore() {
+    if (!displayStore) {
+        displayStore = new display_store_js_1.DisplayStore((0, config_js_1.getDisplayDbPath)());
+    }
+    return displayStore;
+}
 function hasCommandInPath(command) {
     const pathValue = (process.env.PATH || '').trim();
     if (!pathValue)
@@ -137,6 +174,475 @@ function getSlurmRuntimeStatus() {
         missingCommands,
     };
 }
+function commandErrorDetail(err) {
+    return [
+        err?.stderr,
+        err?.stdout,
+        err?.message,
+        err?.cause?.stderr,
+        err?.cause?.stdout,
+        err?.cause?.message,
+    ]
+        .filter((part) => typeof part === 'string' && part.trim().length > 0)
+        .map((part) => String(part).trim())
+        .join('\n');
+}
+function isPodmanNotReadyError(error) {
+    return /podman is installed but not ready/i.test(error || '');
+}
+async function prepareRuntimeForWebTerminal(preferred) {
+    const initial = (0, runtime_js_1.checkRuntime)(preferred);
+    if (initial.ok) {
+        return { ok: true, initialized: false };
+    }
+    const canAutoSetupPodman = ((0, os_1.platform)() === 'darwin' &&
+        preferred !== 'apptainer' &&
+        hasCommandInPath('podman') &&
+        isPodmanNotReadyError(initial.error));
+    if (!canAutoSetupPodman) {
+        return {
+            ok: false,
+            initialized: false,
+            error: initial.error || 'Container runtime unavailable.',
+        };
+    }
+    log.step('Podman runtime not ready. Attempting automatic machine setup for UI launch...');
+    try {
+        try {
+            await execFileAsync('podman', ['machine', 'init'], {
+                timeout: PODMAN_SETUP_TIMEOUT_MS,
+                maxBuffer: PODMAN_SETUP_MAX_BUFFER,
+            });
+        }
+        catch (err) {
+            const detail = commandErrorDetail(err);
+            if (!/already exists/i.test(detail)) {
+                throw err;
+            }
+        }
+        await execFileAsync('podman', ['machine', 'start'], {
+            timeout: PODMAN_SETUP_TIMEOUT_MS,
+            maxBuffer: PODMAN_SETUP_MAX_BUFFER,
+        });
+    }
+    catch (err) {
+        const detail = commandErrorDetail(err);
+        return {
+            ok: false,
+            initialized: true,
+            error: [
+                'Podman setup failed during UI session launch.',
+                detail || 'Unknown Podman error.',
+                '',
+                'Try in a terminal:',
+                '  podman machine init',
+                '  podman machine start',
+            ].join('\n'),
+        };
+    }
+    const after = (0, runtime_js_1.checkRuntime)(preferred);
+    if (!after.ok) {
+        return {
+            ok: false,
+            initialized: true,
+            error: after.error || 'Container runtime unavailable after setup.',
+        };
+    }
+    return { ok: true, initialized: true };
+}
+function createWebTerminalInitId() {
+    return `wti-${Date.now().toString(36)}-${(0, crypto_1.randomBytes)(2).toString('hex')}`;
+}
+function createWebTerminalInitJob(agent, workdir) {
+    const now = new Date().toISOString();
+    return {
+        id: createWebTerminalInitId(),
+        agent,
+        workdir,
+        status: 'running',
+        stage: 'queued',
+        message: 'Queued session initialization.',
+        startedAt: now,
+        updatedAt: now,
+        session: null,
+        error: null,
+        code: null,
+        phase: null,
+        initialized: false,
+    };
+}
+function pruneWebTerminalInitJobs() {
+    const now = Date.now();
+    for (const [id, job] of webTerminalInitJobs.entries()) {
+        if (job.status === 'running')
+            continue;
+        const ageMs = now - Date.parse(job.updatedAt || job.startedAt || '');
+        if (Number.isFinite(ageMs) && ageMs > WEB_TERMINAL_INIT_RETENTION_MS) {
+            webTerminalInitJobs.delete(id);
+        }
+    }
+}
+function updateWebTerminalInitJob(id, patch) {
+    const existing = webTerminalInitJobs.get(id);
+    if (!existing)
+        return null;
+    const updated = {
+        ...existing,
+        ...patch,
+        updatedAt: new Date().toISOString(),
+    };
+    webTerminalInitJobs.set(id, updated);
+    return updated;
+}
+function serializeWebTerminalInitJob(job) {
+    return {
+        id: job.id,
+        agent: job.agent,
+        workdir: job.workdir,
+        status: job.status,
+        stage: job.stage,
+        message: job.message,
+        startedAt: job.startedAt,
+        updatedAt: job.updatedAt,
+        session: job.session,
+        error: job.error,
+        code: job.code,
+        phase: job.phase,
+        initialized: job.initialized,
+    };
+}
+async function withWebTerminalImagePullLock(lockKey, work) {
+    const existing = webTerminalImagePullLocks.get(lockKey);
+    if (existing) {
+        await existing;
+        return;
+    }
+    let current = null;
+    current = (async () => {
+        try {
+            await work();
+        }
+        finally {
+            if (current && webTerminalImagePullLocks.get(lockKey) === current) {
+                webTerminalImagePullLocks.delete(lockKey);
+            }
+        }
+    })();
+    webTerminalImagePullLocks.set(lockKey, current);
+    await current;
+}
+async function ensureWebTerminalImageReady(runtime, image, onProgress) {
+    onProgress?.('image_check', `Checking image availability for ${image}...`);
+    if (runtime === 'podman') {
+        const imageExists = async () => {
+            try {
+                await execFileAsync('podman', ['image', 'exists', image], {
+                    timeout: 10_000,
+                    maxBuffer: WEB_TERMINAL_IMAGE_PULL_MAX_BUFFER,
+                });
+                return true;
+            }
+            catch {
+                return false;
+            }
+        };
+        if (await imageExists())
+            return;
+        await withWebTerminalImagePullLock(`podman:${image}`, async () => {
+            if (await imageExists())
+                return;
+            onProgress?.('image_pull', `Pulling container image ${image}...`);
+            await execFileAsync('podman', ['pull', image], {
+                timeout: WEB_TERMINAL_IMAGE_PULL_TIMEOUT_MS,
+                maxBuffer: WEB_TERMINAL_IMAGE_PULL_MAX_BUFFER,
+            });
+        });
+        return;
+    }
+    const imagesDir = (0, config_js_1.getImagesDir)();
+    const sifPath = (0, path_1.join)(imagesDir, (0, container_js_1.imageToSifName)(image));
+    if ((0, fs_1.existsSync)(sifPath))
+        return;
+    await withWebTerminalImagePullLock(`apptainer:${image}`, async () => {
+        if ((0, fs_1.existsSync)(sifPath))
+            return;
+        (0, fs_1.mkdirSync)(imagesDir, { recursive: true });
+        onProgress?.('image_pull', `Pulling container image ${image}...`);
+        await execFileAsync('apptainer', ['pull', sifPath, `docker://${image}`], {
+            timeout: WEB_TERMINAL_IMAGE_PULL_TIMEOUT_MS,
+            maxBuffer: WEB_TERMINAL_IMAGE_PULL_MAX_BUFFER,
+        });
+    });
+}
+function getWebTerminalAgentBootstrapSpec(agent) {
+    if (agent === 'codex') {
+        return { bin: 'codex', pkg: '@openai/codex' };
+    }
+    return { bin: 'claude', pkg: '@anthropic-ai/claude-code' };
+}
+async function withWebTerminalAgentPrepareLock(lockKey, work) {
+    const existing = webTerminalAgentPrepLocks.get(lockKey);
+    if (existing) {
+        await existing;
+        return;
+    }
+    let current = null;
+    current = (async () => {
+        try {
+            await work();
+        }
+        finally {
+            if (current && webTerminalAgentPrepLocks.get(lockKey) === current) {
+                webTerminalAgentPrepLocks.delete(lockKey);
+            }
+        }
+    })();
+    webTerminalAgentPrepLocks.set(lockKey, current);
+    await current;
+}
+function getPodmanPrewarmNetworkArgs(networkMode) {
+    const mode = String(networkMode || '').trim().toLowerCase();
+    if (mode === 'none')
+        return ['--network', 'none'];
+    if (mode === 'host')
+        return ['--network', 'host'];
+    return [];
+}
+async function runWebTerminalAgentBootstrapScript(runtime, image, sandboxHome, resolvedWorkdir, networkMode, script) {
+    if (runtime === 'podman') {
+        const result = await execFileAsync('podman', [
+            'run',
+            '--rm',
+            '--workdir', '/work',
+            '--volume', `${sandboxHome}:/home/sandbox`,
+            '--volume', `${resolvedWorkdir}:/work`,
+            '--env', 'HOME=/home/sandbox',
+            ...getPodmanPrewarmNetworkArgs(networkMode),
+            image,
+            'bash',
+            '-lc',
+            script,
+        ], {
+            timeout: WEB_TERMINAL_AGENT_PREP_TIMEOUT_MS,
+            maxBuffer: WEB_TERMINAL_AGENT_PREP_MAX_BUFFER,
+        });
+        return {
+            stdout: String(result?.stdout || ''),
+            stderr: String(result?.stderr || ''),
+        };
+    }
+    const sifPath = (0, path_1.join)((0, config_js_1.getImagesDir)(), (0, container_js_1.imageToSifName)(image));
+    const result = await execFileAsync('apptainer', [
+        'exec',
+        '--containall',
+        '--cleanenv',
+        '--home', `${sandboxHome}:/home/sandbox`,
+        '--bind', `${resolvedWorkdir}:/work`,
+        '--pwd', '/work',
+        sifPath,
+        'bash',
+        '-lc',
+        script,
+    ], {
+        timeout: WEB_TERMINAL_AGENT_PREP_TIMEOUT_MS,
+        maxBuffer: WEB_TERMINAL_AGENT_PREP_MAX_BUFFER,
+    });
+    return {
+        stdout: String(result?.stdout || ''),
+        stderr: String(result?.stderr || ''),
+    };
+}
+async function ensureWebTerminalAgentReady(runtime, image, agent, resolvedWorkdir, networkMode, onProgress) {
+    const spec = getWebTerminalAgentBootstrapSpec(agent);
+    const sandboxHome = (0, config_js_1.getSandboxHome)();
+    const installedBin = (0, path_1.join)(sandboxHome, '.npm-global', 'bin', spec.bin);
+    if ((0, fs_1.existsSync)(installedBin)) {
+        return;
+    }
+    await withWebTerminalAgentPrepareLock(spec.bin, async () => {
+        if ((0, fs_1.existsSync)(installedBin))
+            return;
+        onProgress?.('agent_prepare', `Preparing ${agent} CLI in sandbox home...`);
+        const script = [
+            'set -euo pipefail',
+            'export HOME=/home/sandbox',
+            'mkdir -p "$HOME/.npm-global"',
+            'npm config set prefix "$HOME/.npm-global" 2>/dev/null || true',
+            'export PATH="$HOME/.npm-global/bin:$PATH"',
+            `if ! command -v ${spec.bin} >/dev/null 2>&1; then npm i -g ${spec.pkg}; fi`,
+        ].join('\n');
+        await runWebTerminalAgentBootstrapScript(runtime, image, sandboxHome, resolvedWorkdir, networkMode, script);
+    });
+}
+function extractAgentVersionFromOutput(output) {
+    const marker = String(output || '')
+        .split('\n')
+        .map((line) => line.trim())
+        .find((line) => line.startsWith('LABGATE_AGENT_VERSION:'));
+    if (!marker)
+        return null;
+    const raw = marker.slice('LABGATE_AGENT_VERSION:'.length).trim();
+    if (!raw)
+        return null;
+    return raw.replace(/^v/, '');
+}
+async function updateWebTerminalAgentCli(runtime, image, agent, resolvedWorkdir, networkMode) {
+    const spec = getWebTerminalAgentBootstrapSpec(agent);
+    const sandboxHome = (0, config_js_1.getSandboxHome)();
+    let version = null;
+    await withWebTerminalAgentPrepareLock(spec.bin, async () => {
+        const script = [
+            'set -euo pipefail',
+            'export HOME=/home/sandbox',
+            'mkdir -p "$HOME/.npm-global"',
+            'npm config set prefix "$HOME/.npm-global" 2>/dev/null || true',
+            'export PATH="$HOME/.npm-global/bin:$PATH"',
+            `npm i -g "${spec.pkg}"`,
+            `_labgate_ver="$(${spec.bin} --version 2>/dev/null || true)"`,
+            '_labgate_ver="$(printf "%s" "$_labgate_ver" | head -n 1 | tr -d \'\\r\')"',
+            'echo "LABGATE_AGENT_VERSION:${_labgate_ver}"',
+        ].join('\n');
+        const result = await runWebTerminalAgentBootstrapScript(runtime, image, sandboxHome, resolvedWorkdir, networkMode, script);
+        version = extractAgentVersionFromOutput([result.stdout, result.stderr].filter(Boolean).join('\n'));
+    });
+    return { version };
+}
+function toRuntimeUnavailableResult(runtimeReady) {
+    return {
+        ok: false,
+        status: runtimeReady.initialized ? 502 : 503,
+        body: {
+            ok: false,
+            code: 'runtime_unavailable',
+            phase: 'runtime_setup',
+            initialized: runtimeReady.initialized,
+            error: runtimeReady.error || 'Container runtime unavailable.',
+        },
+    };
+}
+async function startWebTerminalSession(agent, resolvedWorkdir, opts = {}) {
+    const onProgress = opts.onProgress;
+    const config = (0, config_js_1.loadConfig)();
+    onProgress?.('runtime_setup', 'Checking container runtime...');
+    const runtimeReady = await prepareRuntimeForWebTerminal(config.runtime);
+    if (!runtimeReady.ok) {
+        return toRuntimeUnavailableResult(runtimeReady);
+    }
+    const runtimeCheck = (0, runtime_js_1.checkRuntime)(config.runtime);
+    if (!runtimeCheck.ok || !runtimeCheck.runtime) {
+        return {
+            ok: false,
+            status: runtimeReady.initialized ? 502 : 503,
+            body: {
+                ok: false,
+                code: 'runtime_unavailable',
+                phase: 'runtime_setup',
+                initialized: runtimeReady.initialized,
+                error: runtimeCheck.error || 'Container runtime unavailable.',
+            },
+        };
+    }
+    // Preflight tmux before any slow image/agent preparation to avoid unnecessary side effects.
+    const tmuxAvailable = await (0, web_terminal_js_1.ensureTmuxAvailable)();
+    if (!tmuxAvailable.ok) {
+        return {
+            ok: false,
+            status: 500,
+            body: { ok: false, error: tmuxAvailable.error },
+        };
+    }
+    if (opts.prewarmImage) {
+        try {
+            await ensureWebTerminalImageReady(runtimeCheck.runtime, config.image, onProgress);
+        }
+        catch (err) {
+            const detail = commandErrorDetail(err);
+            return {
+                ok: false,
+                status: 502,
+                body: {
+                    ok: false,
+                    code: 'image_prepare_failed',
+                    phase: 'image_prepare',
+                    runtime: runtimeCheck.runtime,
+                    image: config.image,
+                    error: detail || `Failed to pull image ${config.image}.`,
+                },
+            };
+        }
+    }
+    if (opts.prewarmAgent) {
+        try {
+            await ensureWebTerminalAgentReady(runtimeCheck.runtime, config.image, agent, resolvedWorkdir, config.network.mode, onProgress);
+        }
+        catch (err) {
+            const detail = commandErrorDetail(err);
+            return {
+                ok: false,
+                status: 502,
+                body: {
+                    ok: false,
+                    code: 'agent_prepare_failed',
+                    phase: 'agent_prepare',
+                    runtime: runtimeCheck.runtime,
+                    agent,
+                    image: config.image,
+                    error: detail || `Failed to prepare ${agent} in sandbox home.`,
+                },
+            };
+        }
+    }
+    onProgress?.('tmux_check', 'Checking terminal multiplexer availability...');
+    const cliEntrypoint = resolveCliEntrypoint();
+    const id = `wt-${Date.now().toString(36)}-${(0, crypto_1.randomBytes)(2).toString('hex')}`;
+    const record = (0, web_terminal_js_1.createWebTerminalRecord)({
+        id,
+        agent,
+        runtime: runtimeCheck.runtime,
+        workdir: resolvedWorkdir,
+    });
+    (0, web_terminal_js_1.writeWebTerminalRecord)(record);
+    onProgress?.('session_start', `Starting ${agent} terminal session...`);
+    try {
+        await (0, web_terminal_js_1.startTmuxWebTerminalSession)(record, cliEntrypoint);
+        (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, { status: 'running', exitCode: null, error: null });
+    }
+    catch (err) {
+        const message = err?.message ?? String(err);
+        (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, { status: 'failed', exitCode: 1, error: message });
+        return {
+            ok: false,
+            status: 500,
+            body: { ok: false, error: `Could not start tmux session: ${message}` },
+        };
+    }
+    onProgress?.('session_start', 'Attaching terminal bridge...');
+    const bridge = await ensureWebTerminalBridge(record);
+    if (!bridge) {
+        try {
+            await (0, web_terminal_js_1.killTmuxSession)(record.tmuxSession);
+        }
+        catch { /* best effort */ }
+        (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, {
+            status: 'failed',
+            exitCode: 1,
+            error: 'node-pty bridge unavailable',
+        });
+        return {
+            ok: false,
+            status: 500,
+            body: {
+                ok: false,
+                error: 'Started tmux session but could not create terminal bridge (node-pty unavailable).',
+            },
+        };
+    }
+    await waitForWebTerminalStartupSummary(record, bridge, onProgress);
+    return {
+        ok: true,
+        session: serializeWebTerminalSession(record),
+    };
+}
 function readBody(req) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -420,7 +926,9 @@ function normalizeWebTerminalAgent(raw) {
 function serializeWebTerminalSession(record) {
     return {
         id: record.id,
+        name: record.name || '',
         agent: record.agent,
+        runtime: record.runtime || '',
         workdir: record.workdir,
         node: record.node,
         tmuxSession: record.tmuxSession,
@@ -441,11 +949,62 @@ async function loadNodePtyModule() {
     }
 }
 function appendWebTerminalBuffer(bridge, chunk) {
+    if (!chunk)
+        return [];
     bridge.buffer += chunk;
     // Keep recent output bounded to avoid unbounded memory growth.
-    if (bridge.buffer.length > 512_000) {
-        bridge.buffer = bridge.buffer.slice(bridge.buffer.length - 512_000);
+    if (bridge.buffer.length > WEB_TERMINAL_BUFFER_MAX_BYTES) {
+        bridge.buffer = bridge.buffer.slice(bridge.buffer.length - WEB_TERMINAL_BUFFER_MAX_BYTES);
+    }
+    const appended = [];
+    for (let i = 0; i < chunk.length; i += WEB_TERMINAL_HISTORY_CHUNK_BYTES) {
+        const piece = chunk.slice(i, i + WEB_TERMINAL_HISTORY_CHUNK_BYTES);
+        if (!piece)
+            continue;
+        const seq = bridge.nextSeq++;
+        const nextChunk = { seq, data: piece };
+        bridge.history.push(nextChunk);
+        appended.push(nextChunk);
+        bridge.historyBytes += piece.length;
+    }
+    while (bridge.historyBytes > WEB_TERMINAL_HISTORY_MAX_BYTES && bridge.history.length > 0) {
+        const removed = bridge.history.shift();
+        if (!removed)
+            break;
+        bridge.historyBytes = Math.max(0, bridge.historyBytes - removed.data.length);
     }
+    return appended;
+}
+function getWebTerminalHistoryPage(bridge, options) {
+    const history = bridge.history;
+    if (!history.length) {
+        return {
+            chunks: [],
+            hasMore: false,
+            nextBefore: null,
+            oldestSeq: null,
+            latestSeq: null,
+        };
+    }
+    const beforeSeq = options?.beforeSeq ?? null;
+    const rawLimit = options?.limit ?? WEB_TERMINAL_HISTORY_PAGE_DEFAULT;
+    const limit = Math.max(1, Math.min(WEB_TERMINAL_HISTORY_PAGE_MAX, Math.floor(rawLimit)));
+    let endIndex = history.length;
+    if (beforeSeq !== null && Number.isFinite(beforeSeq)) {
+        const idx = history.findIndex((chunk) => chunk.seq >= beforeSeq);
+        endIndex = idx >= 0 ? idx : history.length;
+    }
+    endIndex = Math.max(0, Math.min(endIndex, history.length));
+    const startIndex = Math.max(0, endIndex - limit);
+    const chunks = history.slice(startIndex, endIndex);
+    const hasMore = startIndex > 0;
+    return {
+        chunks,
+        hasMore,
+        nextBefore: hasMore && chunks.length > 0 ? chunks[0].seq : null,
+        oldestSeq: history[0]?.seq ?? null,
+        latestSeq: history[history.length - 1]?.seq ?? null,
+    };
 }
 function sendWebTerminalMessage(ws, payload) {
     if (ws.readyState !== ws_1.WebSocket.OPEN)
@@ -457,6 +1016,157 @@ function sendWebTerminalMessage(ws, payload) {
         // Best effort.
     }
 }
+function parseJsonObjectLine(line) {
+    try {
+        const parsed = JSON.parse(line);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function readRecordString(record, key) {
+    const value = record[key];
+    return typeof value === 'string' ? value : '';
+}
+function normalizeToolUseId(value) {
+    if (typeof value === 'string')
+        return value.trim();
+    if (typeof value === 'number' && Number.isFinite(value))
+        return String(value);
+    return '';
+}
+function collectClaudeTextFromContent(content) {
+    if (!Array.isArray(content))
+        return '';
+    let text = '';
+    for (const part of content) {
+        if (!part || typeof part !== 'object' || Array.isArray(part))
+            continue;
+        const node = part;
+        if (node.type === 'text' && typeof node.text === 'string') {
+            text += node.text;
+        }
+    }
+    return text;
+}
+function extractClaudeStreamSessionId(event) {
+    const direct = readRecordString(event, 'session_id').trim();
+    if (direct)
+        return direct;
+    const message = event.message;
+    if (!message || typeof message !== 'object' || Array.isArray(message))
+        return '';
+    const nested = readRecordString(message, 'session_id').trim();
+    return nested || '';
+}
+function extractClaudeAssistantSnapshot(event) {
+    const type = readRecordString(event, 'type').trim().toLowerCase();
+    if (type === 'assistant') {
+        const message = event.message;
+        if (message && typeof message === 'object' && !Array.isArray(message)) {
+            const content = message.content;
+            const contentText = collectClaudeTextFromContent(content);
+            if (contentText)
+                return contentText;
+        }
+    }
+    if (type === 'result') {
+        const resultText = readRecordString(event, 'result');
+        if (resultText)
+            return resultText;
+    }
+    return '';
+}
+function isClaudeAuthenticationFailure(event, assistantSnapshot, stderrText) {
+    const packed = JSON.stringify(event).toLowerCase();
+    const message = `${assistantSnapshot}\n${stderrText}`.toLowerCase();
+    const authRe = /oauth token has expired|authentication_error|failed to authenticate|api error:\s*401/i;
+    return authRe.test(packed) || authRe.test(message);
+}
+function buildClaudeHeadlessApptainerArgs(config, workdir, prompt, resumeSessionId) {
+    const sandboxHome = (0, config_js_1.getSandboxHome)();
+    const sifPath = (0, path_1.join)((0, config_js_1.getImagesDir)(), (0, container_js_1.imageToSifName)(config.image));
+    const resume = resumeSessionId.trim();
+    // Ensure display.json exists before bind-mounting it
+    const displayDbPath = (0, config_js_1.getDisplayDbPath)();
+    if (!(0, fs_1.existsSync)(displayDbPath)) {
+        (0, config_js_1.ensurePrivateDir)((0, path_1.dirname)(displayDbPath));
+        (0, fs_1.writeFileSync)(displayDbPath, JSON.stringify({ version: 1, events: [] }, null, 2) + '\n', {
+            encoding: 'utf-8',
+            mode: config_js_1.PRIVATE_FILE_MODE,
+        });
+    }
+    return [
+        'exec',
+        '--containall',
+        '--cleanenv',
+        '--home', `${sandboxHome}:/home/sandbox`,
+        '--bind', `${workdir}:/work`,
+        '--pwd', '/work',
+        ...config.filesystem.extra_paths.flatMap(({ path: p, mode }) => {
+            const resolved = p.replace(/^~/, (0, os_1.homedir)());
+            const target = `/mnt/${(0, path_1.basename)(resolved)}`;
+            const bindSpec = mode === 'ro' ? `${resolved}:${target}:ro` : `${resolved}:${target}`;
+            return ['--bind', bindSpec];
+        }),
+        ...(config.datasets || []).flatMap(({ path: p, name, mode }) => {
+            const resolved = p.replace(/^~/, (0, os_1.homedir)());
+            const bindSpec = mode === 'ro' ? `${resolved}:/datasets/${name}:ro` : `${resolved}:/datasets/${name}`;
+            return ['--bind', bindSpec];
+        }),
+        ...((0, fs_1.existsSync)((0, config_js_1.getConfigPath)()) ? ['--bind', `${(0, config_js_1.getConfigPath)()}:/labgate-config/config.json`] : []),
+        '--bind', `${(0, config_js_1.getDisplayDbPath)()}:/labgate-config/display.json`,
+        '--env', 'HOME=/home/sandbox',
+        '--env', 'ANTHROPIC_API_KEY=',
+        sifPath,
+        '/home/sandbox/.npm-global/bin/claude',
+        '-p',
+        '--verbose',
+        '--output-format',
+        'stream-json',
+        '--include-partial-messages',
+        ...(resume ? ['--resume', resume] : []),
+        prompt,
+    ];
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function stripAnsiForStartupReadiness(text) {
+    return String(text || '')
+        .replace(/\u001b\][^\u0007]*(?:\u0007|\u001b\\)/g, '')
+        .replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, '')
+        .replace(/\r/g, '\n');
+}
+function hasWebTerminalStartupSummary(buffer) {
+    const plain = stripAnsiForStartupReadiness(buffer);
+    return WEB_TERMINAL_STARTUP_HEADER_RE.test(plain) && WEB_TERMINAL_STARTUP_BLOCKED_RE.test(plain);
+}
+async function waitForWebTerminalStartupSummary(record, bridge, onProgress) {
+    const deadline = Date.now() + WEB_TERMINAL_STARTUP_READY_TIMEOUT_MS;
+    let lastAliveCheck = 0;
+    onProgress?.('session_start', `Finalizing ${record.agent} startup...`);
+    while (Date.now() < deadline) {
+        const recent = bridge.buffer.length > WEB_TERMINAL_STARTUP_READY_BUFFER_LIMIT
+            ? bridge.buffer.slice(-WEB_TERMINAL_STARTUP_READY_BUFFER_LIMIT)
+            : bridge.buffer;
+        if (hasWebTerminalStartupSummary(recent))
+            return;
+        if (!bridge.pty)
+            return;
+        const now = Date.now();
+        if (now - lastAliveCheck >= WEB_TERMINAL_STARTUP_ALIVE_CHECK_MS) {
+            lastAliveCheck = now;
+            const alive = await (0, web_terminal_js_1.hasTmuxSession)(record.tmuxSession);
+            if (!alive)
+                return;
+        }
+        await sleep(WEB_TERMINAL_STARTUP_READY_POLL_MS);
+    }
+}
 function broadcastWebTerminalMessage(bridge, payload) {
     for (const ws of bridge.clients) {
         if (ws.readyState !== ws_1.WebSocket.OPEN) {
@@ -466,6 +1176,23 @@ function broadcastWebTerminalMessage(bridge, payload) {
         sendWebTerminalMessage(ws, payload);
     }
 }
+function closeWebTerminalBridgeClients(bridge, code = 4001, reason = 'labgate-bridge-detached') {
+    const clients = Array.from(bridge.clients);
+    bridge.clients.clear();
+    for (const ws of clients) {
+        try {
+            ws.close(code, reason);
+        }
+        catch {
+            try {
+                ws.close();
+            }
+            catch {
+                // Best effort.
+            }
+        }
+    }
+}
 async function ensureWebTerminalBridge(record) {
     const existing = webTerminalBridges.get(record.id);
     if (existing && existing.pty)
@@ -482,6 +1209,13 @@ async function ensureWebTerminalBridge(record) {
         log.warn(`Could not resolve tmux binary for web terminal bridge ${record.id}: ${err?.message ?? String(err)}`);
         return null;
     }
+    try {
+        // Keep wheel scrolling intuitive for both new and existing sessions.
+        await execFileAsync(tmuxBin, ['set-option', '-t', record.tmuxSession, 'mouse', 'on'], { timeout: 10_000 });
+    }
+    catch {
+        // Best effort only; attach should still proceed.
+    }
     const env = {};
     for (const [k, v] of Object.entries(process.env)) {
         if (v !== undefined)
@@ -514,40 +1248,65 @@ async function ensureWebTerminalBridge(record) {
     const bridge = existing || {
         id: record.id,
         buffer: '',
+        history: [],
+        historyBytes: 0,
+        nextSeq: 1,
+        stopRequested: false,
         clients: new Set(),
         pty: ptyProcess,
     };
+    bridge.stopRequested = false;
     bridge.pty = ptyProcess;
     webTerminalBridges.set(record.id, bridge);
     ptyProcess.onData((data) => {
-        appendWebTerminalBuffer(bridge, data);
-        broadcastWebTerminalMessage(bridge, { type: 'data', id: record.id, data });
+        const appended = appendWebTerminalBuffer(bridge, data);
+        for (const chunk of appended) {
+            broadcastWebTerminalMessage(bridge, {
+                type: 'data',
+                id: record.id,
+                data: chunk.data,
+                seqStart: chunk.seq,
+                seqEnd: chunk.seq,
+            });
+        }
     });
     ptyProcess.onExit(async () => {
+        const stopRequested = bridge.stopRequested;
+        bridge.stopRequested = false;
         bridge.pty = null;
         const alive = await (0, web_terminal_js_1.hasTmuxSession)(record.tmuxSession);
-        if (!alive) {
-            const exitInfo = (0, web_terminal_js_1.readWebTerminalExitInfo)(record.id);
-            const finalCode = exitInfo?.exitCode ?? (record.exitCode ?? 0);
-            const finalStatus = finalCode === 0 ? 'exited' : 'failed';
-            const updated = (0, web_terminal_js_1.updateWebTerminalRecordStatus)(record.id, {
-                status: finalStatus,
-                exitCode: finalCode,
-                error: finalCode === 0 ? null : (record.error || `Exited with code ${finalCode}`),
-            });
-            broadcastWebTerminalMessage(bridge, {
-                type: 'status',
-                id: record.id,
-                status: updated?.status ?? finalStatus,
-                exitCode: updated?.exitCode ?? finalCode,
-            });
+        if (alive) {
+            if (stopRequested)
+                return;
+            // Another tmux client (for example `labgate continue`) may have force-detached this bridge.
+            // Clear stale alternate-screen data and require clients to reconnect for a clean reattach.
+            bridge.buffer = '';
+            bridge.history = [];
+            bridge.historyBytes = 0;
+            closeWebTerminalBridgeClients(bridge);
+            return;
         }
+        const exitInfo = (0, web_terminal_js_1.readWebTerminalExitInfo)(record.id);
+        const finalCode = exitInfo?.exitCode ?? (record.exitCode ?? 0);
+        const finalStatus = finalCode === 0 ? 'exited' : 'failed';
+        const updated = (0, web_terminal_js_1.updateWebTerminalRecordStatus)(record.id, {
+            status: finalStatus,
+            exitCode: finalCode,
+            error: finalCode === 0 ? null : (record.error || `Exited with code ${finalCode}`),
+        });
+        broadcastWebTerminalMessage(bridge, {
+            type: 'status',
+            id: record.id,
+            status: updated?.status ?? finalStatus,
+            exitCode: updated?.exitCode ?? finalCode,
+        });
     });
     return bridge;
 }
 function stopWebTerminalBridge(bridge) {
     if (!bridge.pty)
         return;
+    bridge.stopRequested = true;
     try {
         bridge.pty.kill('SIGTERM');
     }
@@ -555,17 +1314,251 @@ function stopWebTerminalBridge(bridge) {
         // Best effort.
     }
 }
-function serveHTML(res) {
+async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
+    const send = (payload) => {
+        sendWebTerminalMessage(ws, payload);
+    };
+    const trimmedPrompt = prompt.trim();
+    if (!trimmedPrompt) {
+        send({ type: 'error', error: 'prompt is required' });
+        return () => { };
+    }
+    send({ type: 'status', stage: 'runtime_setup', message: 'Checking container runtime...' });
+    const config = (0, config_js_1.loadConfig)();
+    const runtimeReady = await prepareRuntimeForWebTerminal(config.runtime);
+    if (!runtimeReady.ok) {
+        send({
+            type: 'error',
+            code: 'runtime_unavailable',
+            error: runtimeReady.error || 'Container runtime unavailable.',
+        });
+        return () => { };
+    }
+    const runtimeCheck = (0, runtime_js_1.checkRuntime)(config.runtime);
+    if (!runtimeCheck.ok || !runtimeCheck.runtime) {
+        send({
+            type: 'error',
+            code: 'runtime_unavailable',
+            error: runtimeCheck.error || 'Container runtime unavailable.',
+        });
+        return () => { };
+    }
+    if (runtimeCheck.runtime !== 'apptainer') {
+        send({
+            type: 'error',
+            code: 'runtime_unsupported',
+            error: `Headless Claude chat currently supports Apptainer only (detected: ${runtimeCheck.runtime}).`,
+        });
+        return () => { };
+    }
     try {
-        const html = (0, fs_1.readFileSync)(HTML_PATH, 'utf-8').replaceAll(WRITE_TOKEN_PLACEHOLDER, UI_WRITE_TOKEN);
-        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-        res.end(html);
+        await ensureWebTerminalImageReady(runtimeCheck.runtime, config.image, (stage, message) => {
+            send({ type: 'status', stage, message });
+        });
     }
-    catch {
-        res.writeHead(500, { 'Content-Type': 'text/plain' });
-        res.end('Could not load UI HTML');
+    catch (err) {
+        send({
+            type: 'error',
+            code: 'image_prepare_failed',
+            error: commandErrorDetail(err) || `Failed to prepare image ${config.image}.`,
+        });
+        return () => { };
     }
-}
+    try {
+        await ensureWebTerminalAgentReady(runtimeCheck.runtime, config.image, 'claude', record.workdir, config.network.mode, (stage, message) => send({ type: 'status', stage, message }));
+    }
+    catch (err) {
+        send({
+            type: 'error',
+            code: 'agent_prepare_failed',
+            error: commandErrorDetail(err) || 'Failed to prepare Claude CLI in sandbox home.',
+        });
+        return () => { };
+    }
+    const args = buildClaudeHeadlessApptainerArgs(config, record.workdir, trimmedPrompt, resumeSessionId);
+    send({ type: 'status', stage: 'run', message: 'Running Claude in headless mode...' });
+    const child = (0, child_process_1.spawn)('apptainer', args, {
+        cwd: record.workdir,
+        env: process.env,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stdoutBuffer = '';
+    let stderrBuffer = '';
+    let latestClaudeSessionId = resumeSessionId.trim();
+    let emittedAssistantText = '';
+    let doneSent = false;
+    let syntheticToolUseSeq = 0;
+    const sendDone = (exitCode) => {
+        if (doneSent)
+            return;
+        doneSent = true;
+        send({
+            type: 'done',
+            exitCode,
+            sessionId: latestClaudeSessionId || null,
+            isError: exitCode !== 0,
+        });
+        try {
+            ws.close();
+        }
+        catch {
+            // Best effort.
+        }
+    };
+    child.stdout.on('data', (chunk) => {
+        stdoutBuffer += chunk.toString('utf-8');
+        while (true) {
+            const idx = stdoutBuffer.indexOf('\n');
+            if (idx < 0)
+                break;
+            const line = stdoutBuffer.slice(0, idx).trim();
+            stdoutBuffer = stdoutBuffer.slice(idx + 1);
+            if (!line)
+                continue;
+            const event = parseJsonObjectLine(line);
+            if (!event)
+                continue;
+            const sessionId = extractClaudeStreamSessionId(event);
+            if (sessionId && sessionId !== latestClaudeSessionId) {
+                latestClaudeSessionId = sessionId;
+                send({ type: 'session', sessionId });
+            }
+            const snapshot = extractClaudeAssistantSnapshot(event);
+            if (snapshot) {
+                let delta = '';
+                if (snapshot.startsWith(emittedAssistantText)) {
+                    delta = snapshot.slice(emittedAssistantText.length);
+                    emittedAssistantText = snapshot;
+                }
+                else if (!emittedAssistantText.startsWith(snapshot)) {
+                    delta = snapshot;
+                    emittedAssistantText = snapshot;
+                }
+                if (delta) {
+                    send({ type: 'delta', text: delta });
+                }
+            }
+            // Forward tool_use events from assistant messages
+            const eventType = readRecordString(event, 'type').trim().toLowerCase();
+            if (eventType === 'assistant') {
+                const msgContent = event.message?.content;
+                if (Array.isArray(msgContent)) {
+                    for (const block of msgContent) {
+                        if (block && typeof block === 'object' && !Array.isArray(block) && block.type === 'tool_use') {
+                            const toolBlock = block;
+                            const toolName = String(toolBlock.name || 'tool');
+                            const detail = extractToolDetailFromToolUseBlock(toolBlock);
+                            const toolUseId = normalizeToolUseId(toolBlock.id) || `tool-${Date.now().toString(36)}-${(++syntheticToolUseSeq).toString(36)}`;
+                            // Intercept display_widget calls and forward rich content payload
+                            if (toolName === 'display_widget') {
+                                const input = toolBlock.input;
+                                if (input && typeof input.widget === 'string') {
+                                    send({
+                                        type: 'rich_content',
+                                        widget: String(input.widget),
+                                        title: input.title ? String(input.title) : undefined,
+                                        data: (input.data && typeof input.data === 'object') ? input.data : {},
+                                        id: toolUseId,
+                                    });
+                                }
+                            }
+                            // Always also send the normal tool_use card
+                            send({ type: 'tool_use', tool_use_id: toolUseId, name: toolName, detail });
+                        }
+                    }
+                }
+            }
+            // Forward tool_result events (indicates tool execution completed)
+            if (eventType === 'user') {
+                const msgContent = event.message?.content;
+                if (Array.isArray(msgContent)) {
+                    for (const block of msgContent) {
+                        if (block && typeof block === 'object' && !Array.isArray(block) && block.type === 'tool_result') {
+                            const resultBlock = block;
+                            const toolUseId = normalizeToolUseId(resultBlock.tool_use_id);
+                            send({
+                                type: 'tool_result',
+                                tool_use_id: toolUseId || undefined,
+                                is_error: !!resultBlock.is_error,
+                            });
+                        }
+                    }
+                }
+            }
+            if (isClaudeAuthenticationFailure(event, snapshot, stderrBuffer)) {
+                send({
+                    type: 'auth_required',
+                    error: 'Claude authentication is required. Run /login in raw terminal mode to refresh session.',
+                });
+            }
+        }
+    });
+    child.stderr.on('data', (chunk) => {
+        const text = chunk.toString('utf-8');
+        stderrBuffer = (stderrBuffer + text).slice(-CLAUDE_HEADLESS_STDERR_LIMIT);
+    });
+    child.on('error', (err) => {
+        send({
+            type: 'error',
+            code: 'spawn_failed',
+            error: err.message || String(err),
+        });
+        sendDone(1);
+    });
+    child.on('close', (code) => {
+        const remaining = stdoutBuffer.trim();
+        if (remaining) {
+            const event = parseJsonObjectLine(remaining);
+            if (event) {
+                const sessionId = extractClaudeStreamSessionId(event);
+                if (sessionId && sessionId !== latestClaudeSessionId) {
+                    latestClaudeSessionId = sessionId;
+                    send({ type: 'session', sessionId });
+                }
+                const snapshot = extractClaudeAssistantSnapshot(event);
+                if (snapshot) {
+                    if (snapshot.startsWith(emittedAssistantText)) {
+                        const delta = snapshot.slice(emittedAssistantText.length);
+                        emittedAssistantText = snapshot;
+                        if (delta)
+                            send({ type: 'delta', text: delta });
+                    }
+                    else if (!emittedAssistantText.startsWith(snapshot)) {
+                        emittedAssistantText = snapshot;
+                        send({ type: 'delta', text: snapshot });
+                    }
+                }
+            }
+        }
+        const exitCode = typeof code === 'number' ? code : 1;
+        if (exitCode !== 0) {
+            const detail = stderrBuffer.trim();
+            if (detail) {
+                send({ type: 'error', code: 'claude_failed', error: detail });
+            }
+        }
+        sendDone(exitCode);
+    });
+    return () => {
+        try {
+            child.kill('SIGTERM');
+        }
+        catch {
+            // Best effort.
+        }
+    };
+}
+function serveHTML(res) {
+    try {
+        const html = (0, fs_1.readFileSync)(HTML_PATH, 'utf-8').replaceAll(WRITE_TOKEN_PLACEHOLDER, UI_WRITE_TOKEN);
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end(html);
+    }
+    catch {
+        res.writeHead(500, { 'Content-Type': 'text/plain' });
+        res.end('Could not load UI HTML');
+    }
+}
 function handleGetConfig(_req, res) {
     const effective = (0, config_js_1.loadEffectiveConfig)();
     const response = { ...effective.config };
@@ -1334,6 +2327,39 @@ function findProjectJsonlFiles(agent) {
 /**
  * Extract a human-readable detail string from a JSONL entry's tool_use blocks.
  */
+function extractToolDetailFromToolUseBlock(block) {
+    const name = String(block.name || '');
+    const inputRaw = block.input;
+    const input = inputRaw && typeof inputRaw === 'object' && !Array.isArray(inputRaw)
+        ? inputRaw
+        : {};
+    if (name === 'Bash' || name === 'bash') {
+        const cmd = String(input.command || '').slice(0, 60);
+        return cmd ? `Ran \`${cmd}\`` : 'Running Bash';
+    }
+    if (name === 'Edit' || name === 'edit') {
+        const file = String(input.file_path || '').split('/').pop() || '';
+        return file ? `Edited ${file}` : 'Editing a file';
+    }
+    if (name === 'Read' || name === 'read') {
+        const file = String(input.file_path || '').split('/').pop() || '';
+        return file ? `Read ${file}` : 'Reading a file';
+    }
+    if (name === 'Write' || name === 'write') {
+        const file = String(input.file_path || '').split('/').pop() || '';
+        return file ? `Wrote ${file}` : 'Writing a file';
+    }
+    if (name === 'Grep' || name === 'grep') {
+        return `Searching for "${String(input.pattern || '').slice(0, 40)}"`;
+    }
+    if (name === 'Glob' || name === 'glob') {
+        return `Finding files: ${String(input.pattern || '').slice(0, 40)}`;
+    }
+    if (name === 'Task' || name === 'task') {
+        return 'Spawned subagent';
+    }
+    return `Using ${name}`;
+}
 function extractToolDetail(entry) {
     if (!entry.message?.content)
         return '';
@@ -1341,35 +2367,8 @@ function extractToolDetail(entry) {
     if (!Array.isArray(content))
         return '';
     for (const block of content) {
-        if (block.type === 'tool_use') {
-            const name = block.name || '';
-            const input = block.input || {};
-            if (name === 'Bash' || name === 'bash') {
-                const cmd = (input.command || '').slice(0, 60);
-                return cmd ? `Ran \`${cmd}\`` : `Running Bash`;
-            }
-            if (name === 'Edit' || name === 'edit') {
-                const file = (input.file_path || '').split('/').pop() || '';
-                return file ? `Edited ${file}` : 'Editing a file';
-            }
-            if (name === 'Read' || name === 'read') {
-                const file = (input.file_path || '').split('/').pop() || '';
-                return file ? `Read ${file}` : 'Reading a file';
-            }
-            if (name === 'Write' || name === 'write') {
-                const file = (input.file_path || '').split('/').pop() || '';
-                return file ? `Wrote ${file}` : 'Writing a file';
-            }
-            if (name === 'Grep' || name === 'grep') {
-                return `Searching for "${(input.pattern || '').slice(0, 40)}"`;
-            }
-            if (name === 'Glob' || name === 'glob') {
-                return `Finding files: ${(input.pattern || '').slice(0, 40)}`;
-            }
-            if (name === 'Task' || name === 'task') {
-                return `Spawned subagent`;
-            }
-            return `Using ${name}`;
+        if (block && typeof block === 'object' && !Array.isArray(block) && block.type === 'tool_use') {
+            return extractToolDetailFromToolUseBlock(block);
         }
     }
     return '';
@@ -1915,55 +2914,209 @@ async function handlePostWebTerminalStart(req, res) {
             json(res, { ok: false, error: `workdir is not a directory: ${resolvedWorkdir}` }, 400);
             return;
         }
-        const tmuxAvailable = await (0, web_terminal_js_1.ensureTmuxAvailable)();
-        if (!tmuxAvailable.ok) {
-            json(res, { ok: false, error: tmuxAvailable.error }, 500);
+        const result = await startWebTerminalSession(agent, resolvedWorkdir);
+        if (!result.ok) {
+            json(res, result.body, result.status);
+            return;
+        }
+        json(res, { ok: true, session: result.session });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message ?? String(err) }, 500);
+    }
+}
+async function runWebTerminalInitJob(id) {
+    const job = webTerminalInitJobs.get(id);
+    if (!job)
+        return;
+    const progress = (stage, message) => {
+        updateWebTerminalInitJob(id, {
+            status: 'running',
+            stage,
+            message,
+        });
+    };
+    try {
+        const result = await startWebTerminalSession(job.agent, job.workdir, {
+            prewarmImage: true,
+            prewarmAgent: true,
+            onProgress: progress,
+        });
+        if (result.ok) {
+            updateWebTerminalInitJob(id, {
+                status: 'ready',
+                stage: 'ready',
+                message: 'Session ready.',
+                session: result.session,
+                error: null,
+                code: null,
+                phase: null,
+            });
+            pruneWebTerminalInitJobs();
             return;
         }
-        const cliEntrypoint = resolveCliEntrypoint();
-        const id = `wt-${Date.now().toString(36)}-${(0, crypto_1.randomBytes)(2).toString('hex')}`;
-        const record = (0, web_terminal_js_1.createWebTerminalRecord)({
-            id,
-            agent,
-            workdir: resolvedWorkdir,
+        const body = result.body || {};
+        const errText = String(body.error || 'Session initialization failed.');
+        updateWebTerminalInitJob(id, {
+            status: 'failed',
+            stage: 'failed',
+            message: errText.split('\n')[0] || 'Session initialization failed.',
+            session: null,
+            error: errText,
+            code: typeof body.code === 'string' ? body.code : null,
+            phase: typeof body.phase === 'string' ? body.phase : null,
+            initialized: body.initialized === true,
+        });
+    }
+    catch (err) {
+        const detail = commandErrorDetail(err) || (err?.message ?? String(err));
+        updateWebTerminalInitJob(id, {
+            status: 'failed',
+            stage: 'failed',
+            message: 'Session initialization failed.',
+            session: null,
+            error: detail,
+            code: 'init_failed',
+            phase: 'init',
+            initialized: false,
         });
-        (0, web_terminal_js_1.writeWebTerminalRecord)(record);
+    }
+    finally {
+        pruneWebTerminalInitJobs();
+    }
+}
+async function handlePostWebTerminalInit(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body || '{}');
+        const agent = normalizeWebTerminalAgent(parsed.agent || 'claude');
+        const rawWorkdir = String(parsed.workdir || '').trim();
+        if (!agent) {
+            json(res, { ok: false, error: 'agent must be "claude" or "codex"' }, 400);
+            return;
+        }
+        if (!rawWorkdir) {
+            json(res, { ok: false, error: 'workdir is required' }, 400);
+            return;
+        }
+        const resolvedWorkdir = (0, path_1.resolve)(rawWorkdir.replace(/^~/, (0, os_1.homedir)()));
+        if (!(0, fs_1.existsSync)(resolvedWorkdir)) {
+            json(res, { ok: false, error: `workdir does not exist: ${resolvedWorkdir}` }, 400);
+            return;
+        }
+        let st;
+        try {
+            st = (0, fs_1.statSync)(resolvedWorkdir);
+        }
+        catch {
+            json(res, { ok: false, error: `Could not access workdir: ${resolvedWorkdir}` }, 400);
+            return;
+        }
+        if (!st.isDirectory()) {
+            json(res, { ok: false, error: `workdir is not a directory: ${resolvedWorkdir}` }, 400);
+            return;
+        }
+        pruneWebTerminalInitJobs();
+        const job = createWebTerminalInitJob(agent, resolvedWorkdir);
+        webTerminalInitJobs.set(job.id, job);
+        void runWebTerminalInitJob(job.id);
+        json(res, { ok: true, init: serializeWebTerminalInitJob(job) }, 202);
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message ?? String(err) }, 500);
+    }
+}
+async function handlePostWebTerminalAgentUpdate(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body || '{}');
+        const agent = normalizeWebTerminalAgent(parsed.agent || '');
+        if (!agent) {
+            json(res, { ok: false, error: 'agent must be "claude" or "codex"' }, 400);
+            return;
+        }
+        const config = (0, config_js_1.loadConfig)();
+        const runtimeReady = await prepareRuntimeForWebTerminal(config.runtime);
+        if (!runtimeReady.ok) {
+            json(res, {
+                ok: false,
+                code: 'runtime_unavailable',
+                phase: 'runtime_setup',
+                initialized: runtimeReady.initialized,
+                error: runtimeReady.error || 'Container runtime unavailable.',
+            }, runtimeReady.initialized ? 502 : 503);
+            return;
+        }
+        const runtimeCheck = (0, runtime_js_1.checkRuntime)(config.runtime);
+        if (!runtimeCheck.ok || !runtimeCheck.runtime) {
+            json(res, {
+                ok: false,
+                code: 'runtime_unavailable',
+                phase: 'runtime_setup',
+                initialized: runtimeReady.initialized,
+                error: runtimeCheck.error || 'Container runtime unavailable.',
+            }, runtimeReady.initialized ? 502 : 503);
+            return;
+        }
         try {
-            await (0, web_terminal_js_1.startTmuxWebTerminalSession)(record, cliEntrypoint);
-            (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, { status: 'running', exitCode: null, error: null });
+            await ensureWebTerminalImageReady(runtimeCheck.runtime, config.image);
         }
         catch (err) {
-            const message = err?.message ?? String(err);
-            (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, { status: 'failed', exitCode: 1, error: message });
-            json(res, { ok: false, error: `Could not start tmux session: ${message}` }, 500);
+            const detail = commandErrorDetail(err);
+            json(res, {
+                ok: false,
+                code: 'image_prepare_failed',
+                phase: 'image_prepare',
+                runtime: runtimeCheck.runtime,
+                image: config.image,
+                error: detail || `Failed to pull image ${config.image}.`,
+            }, 502);
             return;
         }
-        const bridge = await ensureWebTerminalBridge(record);
-        if (!bridge) {
-            try {
-                await (0, web_terminal_js_1.killTmuxSession)(record.tmuxSession);
-            }
-            catch { /* best effort */ }
-            (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, {
-                status: 'failed',
-                exitCode: 1,
-                error: 'node-pty bridge unavailable',
+        try {
+            const updated = await updateWebTerminalAgentCli(runtimeCheck.runtime, config.image, agent, (0, os_1.homedir)(), config.network.mode);
+            const spec = getWebTerminalAgentBootstrapSpec(agent);
+            json(res, {
+                ok: true,
+                agent,
+                pkg: spec.pkg,
+                runtime: runtimeCheck.runtime,
+                image: config.image,
+                version: updated.version,
+                restartNotice: `Restart active ${agent} sessions to use the updated CLI.`,
             });
+        }
+        catch (err) {
+            const detail = commandErrorDetail(err);
             json(res, {
                 ok: false,
-                error: 'Started tmux session but could not create terminal bridge (node-pty unavailable).',
-            }, 500);
-            return;
+                code: 'agent_update_failed',
+                phase: 'agent_prepare',
+                agent,
+                runtime: runtimeCheck.runtime,
+                image: config.image,
+                error: detail || `Failed to update ${agent} CLI.`,
+            }, 502);
         }
-        json(res, {
-            ok: true,
-            session: serializeWebTerminalSession(record),
-        });
     }
     catch (err) {
         json(res, { ok: false, error: err?.message ?? String(err) }, 500);
     }
 }
+async function handleGetWebTerminalInit(reqUrl, res) {
+    pruneWebTerminalInitJobs();
+    const id = String(reqUrl.searchParams.get('id') || '').trim();
+    if (!id) {
+        json(res, { ok: false, error: 'id is required' }, 400);
+        return;
+    }
+    const job = webTerminalInitJobs.get(id);
+    if (!job) {
+        json(res, { ok: false, error: 'Initialization job not found' }, 404);
+        return;
+    }
+    json(res, { ok: true, init: serializeWebTerminalInitJob(job) });
+}
 async function handleGetWebTerminalSessions(res) {
     const records = (0, web_terminal_js_1.listWebTerminalRecords)();
     const localNode = (0, os_1.hostname)();
@@ -1990,6 +3143,82 @@ async function handleGetWebTerminalSessions(res) {
     const sessions = (0, web_terminal_js_1.listWebTerminalRecords)().map(serializeWebTerminalSession);
     json(res, { ok: true, sessions });
 }
+async function handleGetWebTerminalHistory(reqUrl, res) {
+    const id = String(reqUrl.searchParams.get('id') || '').trim();
+    if (!(0, web_terminal_js_1.isValidWebTerminalId)(id)) {
+        json(res, { ok: false, error: 'Invalid terminal session id' }, 400);
+        return;
+    }
+    const record = (0, web_terminal_js_1.readWebTerminalRecord)(id);
+    if (!record) {
+        json(res, { ok: false, error: 'Terminal session not found' }, 404);
+        return;
+    }
+    if (record.node !== (0, os_1.hostname)()) {
+        json(res, { ok: false, error: `Terminal session is on a different node (${record.node})` }, 400);
+        return;
+    }
+    const beforeRaw = String(reqUrl.searchParams.get('before') || '').trim();
+    let beforeSeq = null;
+    if (beforeRaw) {
+        const parsedBefore = Number(beforeRaw);
+        if (!Number.isFinite(parsedBefore)) {
+            json(res, { ok: false, error: 'Invalid before sequence number' }, 400);
+            return;
+        }
+        beforeSeq = Math.max(0, Math.floor(parsedBefore));
+    }
+    const limitRaw = String(reqUrl.searchParams.get('limit') || '').trim();
+    let limit = WEB_TERMINAL_HISTORY_PAGE_DEFAULT;
+    if (limitRaw) {
+        const parsedLimit = Number(limitRaw);
+        if (!Number.isFinite(parsedLimit)) {
+            json(res, { ok: false, error: 'Invalid history limit' }, 400);
+            return;
+        }
+        limit = Math.max(1, Math.min(WEB_TERMINAL_HISTORY_PAGE_MAX, Math.floor(parsedLimit)));
+    }
+    const bridge = await ensureWebTerminalBridge(record);
+    if (!bridge) {
+        json(res, { ok: false, error: 'Could not open terminal bridge' }, 500);
+        return;
+    }
+    const page = getWebTerminalHistoryPage(bridge, { beforeSeq, limit });
+    json(res, {
+        ok: true,
+        id: record.id,
+        history: {
+            ...page,
+            limit,
+        },
+    });
+}
+async function handlePostWebTerminalRename(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body || '{}');
+        const id = String(parsed.id || '').trim();
+        const name = typeof parsed.name === 'string' ? parsed.name.trim() : '';
+        if (!(0, web_terminal_js_1.isValidWebTerminalId)(id)) {
+            json(res, { ok: false, error: 'Invalid terminal session id' }, 400);
+            return;
+        }
+        if (name && !(0, web_terminal_js_1.isValidWebTerminalName)(name)) {
+            json(res, { ok: false, error: 'Invalid session name format' }, 400);
+            return;
+        }
+        const result = (0, web_terminal_js_1.renameWebTerminalRecord)(id, name);
+        if (!result.ok) {
+            const status = result.code === 'name_taken' ? 409 : result.code === 'not_found' ? 404 : 400;
+            json(res, { ok: false, error: result.error, code: result.code }, status);
+            return;
+        }
+        json(res, { ok: true, session: serializeWebTerminalSession(result.record) });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message ?? String(err) }, 500);
+    }
+}
 async function handlePostWebTerminalStop(req, res) {
     try {
         const body = await readBody(req);
@@ -2066,8 +3295,15 @@ async function handleValidatePath(req, res) {
 async function handleBrowseDir(req, res) {
     try {
         const body = await readBody(req);
-        const { path: rawPath } = JSON.parse(body);
-        const resolved = (rawPath && typeof rawPath === 'string' ? rawPath : '~').replace(/^~/, (0, os_1.homedir)());
+        const parsed = JSON.parse(body);
+        const rawPath = typeof parsed.path === 'string' ? parsed.path : '~';
+        const includeFiles = !!parsed.includeFiles;
+        const includeHidden = !!parsed.includeHidden;
+        const rawLimit = Number(parsed.maxEntries);
+        const maxEntries = Number.isFinite(rawLimit)
+            ? Math.max(100, Math.min(5000, Math.floor(rawLimit)))
+            : 2000;
+        const resolved = rawPath.replace(/^~/, (0, os_1.homedir)());
         if (!(0, fs_1.existsSync)(resolved) || !(0, fs_1.statSync)(resolved).isDirectory()) {
             json(res, { ok: false, error: 'Not a directory', path: resolved });
             return;
@@ -2081,19 +3317,41 @@ async function handleBrowseDir(req, res) {
             return;
         }
         const dirs = [];
+        const files = [];
+        let truncated = false;
         for (const entry of entries) {
-            if (entry.startsWith('.'))
-                continue; // skip dotfiles
+            if (!includeHidden && entry.startsWith('.'))
+                continue; // skip dotfiles by default
             const full = (0, path_1.join)(resolved, entry);
             try {
-                if ((0, fs_1.statSync)(full).isDirectory()) {
+                const st = (0, fs_1.statSync)(full);
+                if (st.isDirectory()) {
                     dirs.push({ name: entry, path: full });
                 }
+                else if (includeFiles && st.isFile()) {
+                    files.push({ name: entry, path: full });
+                }
             }
             catch { /* skip inaccessible */ }
+            if ((dirs.length + files.length) >= maxEntries) {
+                truncated = true;
+                break;
+            }
         }
         dirs.sort((a, b) => a.name.localeCompare(b.name));
-        json(res, { ok: true, path: resolved, dirs });
+        files.sort((a, b) => a.name.localeCompare(b.name));
+        const entriesOut = [
+            ...dirs.map((d) => ({ name: d.name, path: d.path, type: 'dir' })),
+            ...files.map((f) => ({ name: f.name, path: f.path, type: 'file' })),
+        ];
+        json(res, {
+            ok: true,
+            path: resolved,
+            dirs,
+            files: includeFiles ? files : undefined,
+            entries: includeFiles ? entriesOut : undefined,
+            truncated,
+        });
     }
     catch (err) {
         json(res, { ok: false, error: err.message ?? String(err) }, 400);
@@ -2413,6 +3671,10 @@ function mapContainerPathToHost(path, sandboxHome) {
         return (0, config_js_1.getConfigPath)();
     if (path === '/labgate-config/slurm.db')
         return (0, config_js_1.getSlurmDbPath)();
+    if (path === '/labgate-config/results.json')
+        return (0, config_js_1.getResultsDbPath)();
+    if (path === '/labgate-config/display.json')
+        return (0, config_js_1.getDisplayDbPath)();
     return path;
 }
 function readMcpConfigData() {
@@ -2585,7 +3847,7 @@ function collectMcpState() {
             env: resultsEntry?.env || null,
             mcpConfigPath,
             serverPath: resolveServerPathFromEntry(resultsEntry, sandboxHome),
-            dbPath: null,
+            dbPath: resolveDbPathFromEntry(resultsEntry, sandboxHome),
             tools: [
                 { name: 'list_results', title: 'List Results', description: 'List recorded results with filtering and pagination' },
                 { name: 'register_result', title: 'Register Result', description: 'Create a new structured result entry' },
@@ -3168,45 +4430,210 @@ function handleGetSlurmStats(res) {
 }
 // ── SSE: Server-Sent Events for real-time dashboard updates ──
 const sseClients = new Set();
-function handleSSE(_req, res) {
-    res.writeHead(200, {
-        'Content-Type': 'text/event-stream',
-        'Cache-Control': 'no-cache',
-        'Connection': 'keep-alive',
-        'Access-Control-Allow-Origin': '*',
+const RESULTS_WATCH_DEBOUNCE_MS = 120;
+let lastResultsSignature = getResultsFileSignature();
+let resultsWatcher = null;
+let resultsWatchDebounce = null;
+function getResultsFileSignature() {
+    const resultsPath = (0, config_js_1.getResultsDbPath)();
+    try {
+        if (!(0, fs_1.existsSync)(resultsPath))
+            return 'missing';
+        const st = (0, fs_1.statSync)(resultsPath);
+        return `${st.size}:${Math.floor(st.mtimeMs)}`;
+    }
+    catch {
+        return 'error';
+    }
+}
+function maybeBroadcastResultsChanged() {
+    const signature = getResultsFileSignature();
+    if (signature === lastResultsSignature)
+        return;
+    if (sseClients.size === 0)
+        return;
+    lastResultsSignature = signature;
+    broadcastSSE('results_changed', {
+        changed_at: new Date().toISOString(),
+        signature,
     });
-    res.write(':\n\n'); // comment to establish connection
-    sseClients.add(res);
-    res.on('close', () => sseClients.delete(res));
 }
-function broadcastSSE(event, data) {
-    const payload = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
-    for (const client of sseClients) {
+function scheduleResultsChangeCheck(delayMs = RESULTS_WATCH_DEBOUNCE_MS) {
+    if (resultsWatchDebounce) {
+        clearTimeout(resultsWatchDebounce);
+    }
+    resultsWatchDebounce = setTimeout(() => {
+        resultsWatchDebounce = null;
+        maybeBroadcastResultsChanged();
+    }, delayMs);
+    resultsWatchDebounce.unref?.();
+}
+function stopResultsWatcher() {
+    if (resultsWatchDebounce) {
+        clearTimeout(resultsWatchDebounce);
+        resultsWatchDebounce = null;
+    }
+    if (resultsWatcher) {
         try {
-            client.write(payload);
+            resultsWatcher.close();
         }
         catch {
-            sseClients.delete(client);
+            // Best effort.
         }
+        resultsWatcher = null;
     }
 }
-// Push session updates to all connected SSE clients every 2 seconds
-let sseInterval = null;
-function startSSEBroadcast() {
-    if (sseInterval)
+function startResultsWatcher() {
+    if (resultsWatcher)
         return;
-    sseInterval = setInterval(async () => {
-        if (sseClients.size === 0)
-            return;
-        // Reuse handleGetSessions logic
-        const dir = (0, config_js_1.getSessionsDir)();
-        const sessions = [];
-        if ((0, fs_1.existsSync)(dir)) {
-            const localHost = (0, os_1.hostname)();
-            const files = (0, fs_1.readdirSync)(dir).filter((f) => f.endsWith('.json'));
-            for (const file of files) {
-                try {
-                    const data = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(dir, file), 'utf-8'));
+    lastResultsSignature = getResultsFileSignature();
+    const resultsPath = (0, config_js_1.getResultsDbPath)();
+    const watchDir = (0, path_1.dirname)(resultsPath);
+    const watchFile = (0, path_1.basename)(resultsPath);
+    try {
+        (0, config_js_1.ensurePrivateDir)(watchDir);
+    }
+    catch {
+        // Best effort.
+    }
+    try {
+        resultsWatcher = (0, fs_1.watch)(watchDir, (_eventType, filename) => {
+            const changed = filename ? String(filename) : '';
+            if (changed && changed !== watchFile)
+                return;
+            scheduleResultsChangeCheck();
+        });
+        resultsWatcher.on('error', () => {
+            stopResultsWatcher();
+        });
+    }
+    catch {
+        resultsWatcher = null;
+    }
+}
+// ── Display (widgets) file watcher ──
+const DISPLAY_WATCH_DEBOUNCE_MS = 120;
+let lastDisplaySignature = getDisplayFileSignature();
+let displayWatcher = null;
+let displayWatchDebounce = null;
+function getDisplayFileSignature() {
+    const displayPath = (0, config_js_1.getDisplayDbPath)();
+    try {
+        if (!(0, fs_1.existsSync)(displayPath))
+            return 'missing';
+        const st = (0, fs_1.statSync)(displayPath);
+        return `${st.size}:${Math.floor(st.mtimeMs)}`;
+    }
+    catch {
+        return 'error';
+    }
+}
+function maybeBroadcastWidgetsChanged() {
+    const signature = getDisplayFileSignature();
+    if (signature === lastDisplaySignature)
+        return;
+    if (sseClients.size === 0)
+        return;
+    lastDisplaySignature = signature;
+    broadcastSSE('widgets_changed', {
+        changed_at: new Date().toISOString(),
+        signature,
+    });
+}
+function scheduleDisplayChangeCheck(delayMs = DISPLAY_WATCH_DEBOUNCE_MS) {
+    if (displayWatchDebounce) {
+        clearTimeout(displayWatchDebounce);
+    }
+    displayWatchDebounce = setTimeout(() => {
+        displayWatchDebounce = null;
+        maybeBroadcastWidgetsChanged();
+    }, delayMs);
+    displayWatchDebounce.unref?.();
+}
+function stopDisplayWatcher() {
+    if (displayWatchDebounce) {
+        clearTimeout(displayWatchDebounce);
+        displayWatchDebounce = null;
+    }
+    if (displayWatcher) {
+        try {
+            displayWatcher.close();
+        }
+        catch {
+            // Best effort.
+        }
+        displayWatcher = null;
+    }
+}
+function startDisplayWatcher() {
+    if (displayWatcher)
+        return;
+    lastDisplaySignature = getDisplayFileSignature();
+    const displayPath = (0, config_js_1.getDisplayDbPath)();
+    const watchDir = (0, path_1.dirname)(displayPath);
+    const watchFile = (0, path_1.basename)(displayPath);
+    try {
+        (0, config_js_1.ensurePrivateDir)(watchDir);
+    }
+    catch {
+        // Best effort.
+    }
+    try {
+        displayWatcher = (0, fs_1.watch)(watchDir, (_eventType, filename) => {
+            const changed = filename ? String(filename) : '';
+            if (changed && changed !== watchFile)
+                return;
+            scheduleDisplayChangeCheck();
+        });
+        displayWatcher.on('error', () => {
+            stopDisplayWatcher();
+        });
+    }
+    catch {
+        displayWatcher = null;
+    }
+}
+function handleSSE(_req, res) {
+    res.writeHead(200, {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache',
+        'Connection': 'keep-alive',
+        'Access-Control-Allow-Origin': '*',
+    });
+    res.write(':\n\n'); // comment to establish connection
+    sseClients.add(res);
+    res.on('close', () => sseClients.delete(res));
+}
+function broadcastSSE(event, data) {
+    const payload = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+    for (const client of sseClients) {
+        try {
+            client.write(payload);
+        }
+        catch {
+            sseClients.delete(client);
+        }
+    }
+}
+// Push session updates to all connected SSE clients every 2 seconds
+let sseInterval = null;
+function startSSEBroadcast() {
+    if (sseInterval)
+        return;
+    startResultsWatcher();
+    startDisplayWatcher();
+    sseInterval = setInterval(async () => {
+        if (sseClients.size === 0)
+            return;
+        // Reuse handleGetSessions logic
+        const dir = (0, config_js_1.getSessionsDir)();
+        const sessions = [];
+        if ((0, fs_1.existsSync)(dir)) {
+            const localHost = (0, os_1.hostname)();
+            const files = (0, fs_1.readdirSync)(dir).filter((f) => f.endsWith('.json'));
+            for (const file of files) {
+                try {
+                    const data = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(dir, file), 'utf-8'));
                     if (data.node === localHost) {
                         try {
                             process.kill(data.pid, 0);
@@ -3271,6 +4698,8 @@ function startSSEBroadcast() {
             }
             catch { /* slurm DB unavailable */ }
         }
+        // Results changes may come from external MCP processes; emit only on file mutation.
+        maybeBroadcastResultsChanged();
     }, 2000);
     sseInterval.unref?.();
 }
@@ -3337,136 +4766,778 @@ function handleGetAdminPolicy(_req, res) {
         json(res, { ok: true, policy, bootstrap: false });
         return;
     }
-    if (context.bootstrapPolicySetup) {
+    if (context.bootstrapPolicySetup) {
+        json(res, {
+            ok: true,
+            bootstrap: true,
+            policy: buildBootstrapPolicyTemplate(context),
+            message: `No policy is configured yet. Saving this file will make "${context.currentUser}" the initial admin.`,
+        });
+        return;
+    }
+    json(res, { ok: false, error: 'No policy file found' }, 404);
+}
+async function handlePostAdminPolicy(req, res) {
+    const context = requireAdmin(res, { allowBootstrapPolicySetup: true });
+    if (!context)
+        return;
+    try {
+        const body = await readBody(req);
+        const incoming = JSON.parse(body);
+        const errors = (0, policy_js_1.validatePolicy)(incoming);
+        if (errors.length > 0) {
+            json(res, { ok: false, errors }, 400);
+            return;
+        }
+        let policy = incoming;
+        let addedBootstrapAdmin = false;
+        // First-time setup guard: ensure the bootstrap user cannot lock themselves out.
+        if (context.bootstrapPolicySetup) {
+            const names = Array.isArray(policy.admins?.usernames) ? policy.admins.usernames : [];
+            const alreadyIncluded = names.includes(context.currentUser);
+            policy = {
+                ...policy,
+                admins: {
+                    usernames: [...new Set([context.currentUser, ...names])],
+                },
+            };
+            addedBootstrapAdmin = !alreadyIncluded;
+        }
+        (0, policy_js_1.savePolicy)(policy);
+        json(res, {
+            ok: true,
+            bootstrapCompleted: context.bootstrapPolicySetup,
+            addedBootstrapAdmin,
+        });
+    }
+    catch (err) {
+        json(res, { ok: false, errors: [err.message ?? String(err)] }, 400);
+    }
+}
+function handleGetAdminUsers(_req, res) {
+    if (!requireAdmin(res))
+        return;
+    const effective = (0, config_js_1.loadEffectiveConfig)();
+    const sharedDir = effective.sharedSessionsDir;
+    // Collect sessions from shared dir or fall back to local sessions
+    const sessionsDir = sharedDir && (0, fs_1.existsSync)(sharedDir) ? sharedDir : (0, config_js_1.getSessionsDir)();
+    const sessions = [];
+    if ((0, fs_1.existsSync)(sessionsDir)) {
+        const files = (0, fs_1.readdirSync)(sessionsDir).filter((f) => f.endsWith('.json'));
+        for (const f of files) {
+            try {
+                const data = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(sessionsDir, f), 'utf-8'));
+                sessions.push(data);
+            }
+            catch {
+                // Skip malformed session files
+            }
+        }
+    }
+    // Group by user (sessions have a 'user' field when written to shared dir)
+    const userMap = new Map();
+    for (const s of sessions) {
+        const user = s.user ?? 'unknown';
+        if (!userMap.has(user)) {
+            userMap.set(user, { sessions: [], lastActivity: '' });
+        }
+        const entry = userMap.get(user);
+        entry.sessions.push(s);
+        const started = s.started ?? '';
+        if (started > entry.lastActivity)
+            entry.lastActivity = started;
+    }
+    const users = [...userMap.entries()].map(([username, data]) => ({
+        username,
+        activeSessions: data.sessions.length,
+        lastActivity: data.lastActivity,
+        sessions: data.sessions,
+    }));
+    json(res, { ok: true, users });
+}
+function handleGetAdminLogs(_req, res) {
+    if (!requireAdmin(res))
+        return;
+    const effective = (0, config_js_1.loadEffectiveConfig)();
+    const logDir = effective.sharedAuditDir && (0, fs_1.existsSync)(effective.sharedAuditDir)
+        ? effective.sharedAuditDir
+        : (0, config_js_1.getLogDir)(effective.config);
+    if (!(0, fs_1.existsSync)(logDir)) {
+        json(res, { ok: true, logs: [] });
+        return;
+    }
+    const files = (0, fs_1.readdirSync)(logDir)
+        .filter((f) => f.endsWith('.jsonl'))
+        .sort()
+        .reverse();
+    const logs = [];
+    const maxEntries = 100;
+    for (const f of files) {
+        if (logs.length >= maxEntries)
+            break;
+        try {
+            const content = (0, fs_1.readFileSync)((0, path_1.join)(logDir, f), 'utf-8');
+            const lines = content.split('\n').filter(l => l.trim());
+            for (const line of lines.reverse()) {
+                if (logs.length >= maxEntries)
+                    break;
+                try {
+                    logs.push(JSON.parse(line));
+                }
+                catch { /* skip malformed lines */ }
+            }
+        }
+        catch { /* skip unreadable files */ }
+    }
+    json(res, { ok: true, logs });
+}
+function handleGetAdminLicense(_req, res) {
+    if (!requireAdmin(res))
+        return;
+    const status = (0, license_js_1.validateLicense)();
+    json(res, { ok: true, license: status });
+}
+// ── Display file endpoint ────────────────────────────────
+// Serves files from the container filesystem to the browser for display widgets.
+// Maps container paths to host paths using the same mount logic as the session.
+function resolveDisplayFilePath(containerPath) {
+    const config = (0, config_js_1.loadConfig)();
+    const sandboxHome = (0, config_js_1.getSandboxHome)();
+    // /home/sandbox/... → sandbox home
+    if (containerPath.startsWith('/home/sandbox/')) {
+        return (0, path_1.join)(sandboxHome, containerPath.slice('/home/sandbox/'.length));
+    }
+    // /datasets/<name>/... → dataset host path
+    const datasetMatch = containerPath.match(/^\/datasets\/([^/]+)\/(.+)$/);
+    if (datasetMatch) {
+        const [, dsName, rest] = datasetMatch;
+        const ds = (config.datasets || []).find((d) => d.name === dsName);
+        if (ds) {
+            const resolved = ds.path.replace(/^~/, (0, os_1.homedir)());
+            return (0, path_1.join)(resolved, rest);
+        }
+    }
+    // /work/... → workdir from active sessions
+    if (containerPath.startsWith('/work/')) {
+        const rest = containerPath.slice('/work/'.length);
+        // Check active session workdirs
+        try {
+            const sessionDir = (0, config_js_1.getSessionsDir)();
+            if ((0, fs_1.existsSync)(sessionDir)) {
+                const files = (0, fs_1.readdirSync)(sessionDir).filter((f) => f.endsWith('.json'));
+                for (const f of files) {
+                    try {
+                        const data = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(sessionDir, f), 'utf-8'));
+                        if (data.workdir) {
+                            const candidate = (0, path_1.join)(data.workdir, rest);
+                            if ((0, fs_1.existsSync)(candidate))
+                                return candidate;
+                        }
+                    }
+                    catch { /* skip */ }
+                }
+            }
+        }
+        catch { /* skip */ }
+    }
+    // /mnt/<basename>/... → extra_paths
+    const mntMatch = containerPath.match(/^\/mnt\/([^/]+)\/(.+)$/);
+    if (mntMatch) {
+        const [, mountBase, rest] = mntMatch;
+        const ep = config.filesystem.extra_paths.find((p) => {
+            const resolved = p.path.replace(/^~/, (0, os_1.homedir)());
+            return (0, path_1.basename)(resolved) === mountBase;
+        });
+        if (ep) {
+            const resolved = ep.path.replace(/^~/, (0, os_1.homedir)());
+            return (0, path_1.join)(resolved, rest);
+        }
+    }
+    return null;
+}
+function getContentTypeForFile(filePath) {
+    const ext = filePath.split('.').pop()?.toLowerCase() || '';
+    const mimeMap = {
+        png: 'image/png',
+        jpg: 'image/jpeg',
+        jpeg: 'image/jpeg',
+        gif: 'image/gif',
+        svg: 'image/svg+xml',
+        webp: 'image/webp',
+        pdf: 'application/pdf',
+        csv: 'text/csv',
+        tsv: 'text/tab-separated-values',
+        txt: 'text/plain',
+        json: 'application/json',
+        pdb: 'chemical/x-pdb',
+        cif: 'chemical/x-cif',
+        mmcif: 'chemical/x-mmcif',
+        fasta: 'text/plain',
+        fa: 'text/plain',
+        fastq: 'text/plain',
+        fq: 'text/plain',
+        html: 'text/html',
+        xml: 'application/xml',
+    };
+    return mimeMap[ext] || 'application/octet-stream';
+}
+function handleDisplayFile(reqUrl, res) {
+    const containerPath = reqUrl.searchParams.get('path');
+    if (!containerPath) {
+        json(res, { ok: false, error: 'Missing path parameter' }, 400);
+        return;
+    }
+    // Prevent directory traversal
+    if (containerPath.includes('..') || containerPath.includes('\0')) {
+        json(res, { ok: false, error: 'Invalid path' }, 400);
+        return;
+    }
+    const hostPath = resolveDisplayFilePath(containerPath);
+    if (!hostPath) {
+        json(res, { ok: false, error: 'Path not within any allowed mount' }, 404);
+        return;
+    }
+    // Verify the resolved path doesn't escape via symlinks
+    let realPath;
+    try {
+        realPath = (0, fs_1.realpathSync)(hostPath);
+    }
+    catch {
+        json(res, { ok: false, error: 'File not found' }, 404);
+        return;
+    }
+    try {
+        const stat = (0, fs_1.statSync)(realPath);
+        if (!stat.isFile()) {
+            json(res, { ok: false, error: 'Not a file' }, 400);
+            return;
+        }
+        // Limit to 50MB
+        if (stat.size > 50 * 1024 * 1024) {
+            json(res, { ok: false, error: 'File too large (max 50MB)' }, 413);
+            return;
+        }
+        const contentType = getContentTypeForFile(realPath);
+        const data = (0, fs_1.readFileSync)(realPath);
+        res.writeHead(200, {
+            'Content-Type': contentType,
+            'Content-Length': data.length,
+            'Cache-Control': 'no-cache',
+        });
+        res.end(data);
+    }
+    catch {
+        json(res, { ok: false, error: 'Failed to read file' }, 500);
+    }
+}
+function handleGetWidgets(res) {
+    try {
+        const store = getDisplayStore();
+        const widgets = store.listEvents();
+        json(res, { ok: true, widgets });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err.message || 'Failed to list widgets' }, 500);
+    }
+}
+function handleClearWidgets(res) {
+    try {
+        const store = getDisplayStore();
+        store.clearEvents();
+        json(res, { ok: true });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err.message || 'Failed to clear widgets' }, 500);
+    }
+}
+function parseExplorerExperimentId(reqUrl) {
+    return String(reqUrl.searchParams.get('experiment_id') || '').trim();
+}
+function parseExplorerRunId(reqUrl) {
+    return String(reqUrl.searchParams.get('run_id') || '').trim();
+}
+function parseExplorerListInt(raw, fallback, min, max) {
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed))
+        return fallback;
+    return Math.max(min, Math.min(max, Math.floor(parsed)));
+}
+async function ensureExplorerQuickstartSourceRepo() {
+    if (!(0, fs_1.existsSync)(EXPLORER_TSP_TEMPLATE_DIR)) {
+        throw new Error(`Bundled template not found: ${EXPLORER_TSP_TEMPLATE_DIR}`);
+    }
+    const gitDir = (0, path_1.join)(EXPLORER_TSP_TEMPLATE_SOURCE_REPO, '.git');
+    if ((0, fs_1.existsSync)(gitDir))
+        return EXPLORER_TSP_TEMPLATE_SOURCE_REPO;
+    (0, config_js_1.ensurePrivateDir)((0, path_1.dirname)(EXPLORER_TSP_TEMPLATE_SOURCE_REPO));
+    (0, fs_1.mkdirSync)(EXPLORER_TSP_TEMPLATE_SOURCE_REPO, { recursive: true, mode: config_js_1.PRIVATE_DIR_MODE });
+    (0, fs_1.cpSync)(EXPLORER_TSP_TEMPLATE_DIR, EXPLORER_TSP_TEMPLATE_SOURCE_REPO, { recursive: true, force: true });
+    await execFileAsync('git', ['init', '.'], { cwd: EXPLORER_TSP_TEMPLATE_SOURCE_REPO });
+    await execFileAsync('git', ['add', '.'], { cwd: EXPLORER_TSP_TEMPLATE_SOURCE_REPO });
+    try {
+        await execFileAsync('git', ['-c', 'user.name=labgate-ui', '-c', 'user.email=labgate@local', 'commit', '-m', 'template baseline'], { cwd: EXPLORER_TSP_TEMPLATE_SOURCE_REPO });
+    }
+    catch (err) {
+        const detail = commandErrorDetail(err);
+        if (!/nothing to commit/i.test(detail)) {
+            throw err;
+        }
+    }
+    return EXPLORER_TSP_TEMPLATE_SOURCE_REPO;
+}
+async function parseExplorerQuickstartInput(body) {
+    const nameInput = String(body.name || '').trim();
+    const experimentName = nameInput || `TSP Demo ${new Date().toISOString().slice(0, 19).replace('T', ' ')}`;
+    const modeRaw = String(body.agent_mode || 'stub').trim().toLowerCase();
+    const agentMode = modeRaw === 'claude' ? 'claude_headless' : (modeRaw || 'stub');
+    if (agentMode !== 'stub' && agentMode !== 'claude_headless') {
+        throw new Error('agent_mode must be stub or claude_headless');
+    }
+    const claudeResumeSessionId = String(body.claude_resume_session_id || '').trim();
+    const claudeTimeoutRaw = body.claude_timeout_sec;
+    const claudeTimeout = Number(claudeTimeoutRaw);
+    if (claudeTimeoutRaw !== undefined &&
+        (!Number.isFinite(claudeTimeout) || claudeTimeout < 60 || claudeTimeout > 14_400)) {
+        throw new Error('claude_timeout_sec must be between 60 and 14400');
+    }
+    const sourceRepoInput = String(body.source_repo_path || '').trim();
+    const sourceRepoPath = sourceRepoInput
+        ? (0, path_1.resolve)(sourceRepoInput)
+        : await ensureExplorerQuickstartSourceRepo();
+    if (!(0, fs_1.existsSync)(sourceRepoPath)) {
+        throw new Error(`source_repo_path not found: ${sourceRepoPath}`);
+    }
+    const evalCommand = String(body.eval_command || 'python3 eval.py').trim() || 'python3 eval.py';
+    const timeoutRaw = body.eval_timeout_sec;
+    const evalTimeoutSec = timeoutRaw === undefined ? 30 : Number(timeoutRaw);
+    if (!Number.isFinite(evalTimeoutSec) || evalTimeoutSec < 5 || evalTimeoutSec > 86_400) {
+        throw new Error('eval_timeout_sec must be between 5 and 86400');
+    }
+    const policy = {
+        epsilon: 0.15,
+        top_n: 5,
+        agent_mode: agentMode,
+    };
+    if (agentMode === 'stub') {
+        policy.stub_patch_file = 'stub-patches/enable_two_opt.patch';
+    }
+    else {
+        if (claudeResumeSessionId)
+            policy.claude_resume_session_id = claudeResumeSessionId;
+        if (claudeTimeoutRaw !== undefined)
+            policy.claude_timeout_sec = Math.floor(claudeTimeout);
+    }
+    return {
+        experimentName,
+        sourceRepoPath,
+        evalCommand,
+        evalTimeoutSec: Math.floor(evalTimeoutSec),
+        policy,
+    };
+}
+function handleGetExplorerExperiments(reqUrl, res) {
+    const limit = parseExplorerListInt(reqUrl.searchParams.get('limit'), 20, 1, 500);
+    const offset = parseExplorerListInt(reqUrl.searchParams.get('offset'), 0, 0, 100_000);
+    const store = new explorer_store_js_1.ExplorerStore();
+    try {
+        const experiments = store.listExperiments(limit, offset);
+        json(res, {
+            ok: true,
+            experiments,
+            returned: experiments.length,
+            limit,
+            offset,
+        });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message || String(err) }, 500);
+    }
+    finally {
+        store.close();
+    }
+}
+function handleGetExplorerOverview(reqUrl, res) {
+    const experimentId = parseExplorerExperimentId(reqUrl);
+    if (!experimentId) {
+        json(res, { ok: false, error: 'Missing experiment_id' }, 400);
+        return;
+    }
+    try {
+        const overview = (0, explorer_js_1.getExperimentOverview)(experimentId);
+        if (!overview) {
+            json(res, { ok: false, error: 'Experiment not found' }, 404);
+            return;
+        }
+        json(res, { ok: true, overview });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message || String(err) }, 500);
+    }
+}
+function handleGetExplorerTree(reqUrl, res) {
+    const experimentId = parseExplorerExperimentId(reqUrl);
+    if (!experimentId) {
+        json(res, { ok: false, error: 'Missing experiment_id' }, 400);
+        return;
+    }
+    const mode = String(reqUrl.searchParams.get('mode') || 'best_path').trim() === 'full' ? 'full' : 'best_path';
+    try {
+        const tree = (0, explorer_js_1.getExperimentTree)(experimentId, mode);
+        json(res, { ok: true, tree });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message || String(err) }, 500);
+    }
+}
+function handleGetExplorerRuns(reqUrl, res) {
+    const experimentId = parseExplorerExperimentId(reqUrl);
+    if (!experimentId) {
+        json(res, { ok: false, error: 'Missing experiment_id' }, 400);
+        return;
+    }
+    const limit = parseExplorerListInt(reqUrl.searchParams.get('limit'), 20, 1, 500);
+    const offset = parseExplorerListInt(reqUrl.searchParams.get('offset'), 0, 0, 100_000);
+    const store = new explorer_store_js_1.ExplorerStore();
+    try {
+        const runs = store.listRuns(experimentId, { limit, offset });
+        const total = store.getRunCount(experimentId);
+        json(res, { ok: true, runs, total, returned: runs.length, limit, offset });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message || String(err) }, 500);
+    }
+    finally {
+        store.close();
+    }
+}
+function handleGetExplorerRun(reqUrl, res) {
+    const runId = parseExplorerRunId(reqUrl);
+    if (!runId) {
+        json(res, { ok: false, error: 'Missing run_id' }, 400);
+        return;
+    }
+    try {
+        const details = (0, explorer_js_1.getRunDetails)(runId);
+        if (!details) {
+            json(res, { ok: false, error: 'Run not found' }, 404);
+            return;
+        }
+        json(res, { ok: true, details });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message || String(err) }, 500);
+    }
+}
+function handleGetExplorerCompare(reqUrl, res) {
+    const experimentId = parseExplorerExperimentId(reqUrl);
+    const runId = parseExplorerRunId(reqUrl);
+    if (!experimentId || !runId) {
+        json(res, { ok: false, error: 'Missing experiment_id or run_id' }, 400);
+        return;
+    }
+    const compareTo = String(reqUrl.searchParams.get('to') || 'best').trim() || 'best';
+    const includePatch = reqUrl.searchParams.get('include_patch') === '1';
+    try {
+        const comparison = (0, explorer_js_1.compareRun)({
+            experiment_id: experimentId,
+            run_id: runId,
+            compare_to: compareTo,
+            include_patch: includePatch,
+        });
+        json(res, { ok: true, comparison });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message || String(err) }, 500);
+    }
+}
+function handleGetExplorerArtifact(reqUrl, res) {
+    const runId = parseExplorerRunId(reqUrl);
+    if (!runId) {
+        json(res, { ok: false, error: 'Missing run_id' }, 400);
+        return;
+    }
+    const kind = String(reqUrl.searchParams.get('kind') || 'summary').trim().toLowerCase();
+    if (!['summary', 'diff', 'stdout', 'stderr', 'eval', 'agent', 'claude_stdout', 'claude_stderr'].includes(kind)) {
+        json(res, { ok: false, error: 'Invalid kind (expected summary|diff|stdout|stderr|eval|agent|claude_stdout|claude_stderr)' }, 400);
+        return;
+    }
+    const details = (0, explorer_js_1.getRunDetails)(runId);
+    if (!details) {
+        json(res, { ok: false, error: 'Run not found' }, 404);
+        return;
+    }
+    const artifacts = details.artifacts;
+    const pathByKind = {
+        summary: artifacts.summary_path,
+        diff: artifacts.diff_path,
+        stdout: artifacts.stdout_path,
+        stderr: artifacts.stderr_path,
+        eval: artifacts.eval_json_path,
+        agent: artifacts.agent_log_path,
+        claude_stdout: artifacts.claude_stdout_path,
+        claude_stderr: artifacts.claude_stderr_path,
+    };
+    const availableByKind = {
+        summary: artifacts.available.summary,
+        diff: artifacts.available.diff,
+        stdout: artifacts.available.stdout,
+        stderr: artifacts.available.stderr,
+        eval: artifacts.available.eval_json,
+        agent: artifacts.available.agent_log,
+        claude_stdout: artifacts.available.claude_stdout,
+        claude_stderr: artifacts.available.claude_stderr,
+    };
+    const filePath = pathByKind[kind];
+    if (!filePath || !availableByKind[kind] || !(0, fs_1.existsSync)(filePath)) {
+        json(res, {
+            ok: false,
+            error: 'Artifact missing (possibly pruned)',
+            artifacts_pruned: artifacts.artifacts_pruned,
+            worktree_pruned: artifacts.worktree_pruned,
+        }, 404);
+        return;
+    }
+    try {
+        const st = (0, fs_1.statSync)(filePath);
+        if (!st.isFile()) {
+            json(res, { ok: false, error: 'Artifact is not a file' }, 400);
+            return;
+        }
+        const readBytes = Math.min(st.size, EXPLORER_ARTIFACT_READ_MAX_BYTES);
+        const offset = Math.max(0, st.size - readBytes);
+        const fd = (0, fs_1.openSync)(filePath, 'r');
+        const buf = Buffer.alloc(readBytes);
+        try {
+            (0, fs_1.readSync)(fd, buf, 0, readBytes, offset);
+        }
+        finally {
+            (0, fs_1.closeSync)(fd);
+        }
+        let text = buf.toString('utf-8');
+        if (offset > 0) {
+            const firstNewline = text.indexOf('\n');
+            if (firstNewline >= 0)
+                text = text.slice(firstNewline + 1);
+        }
+        if (kind === 'eval') {
+            let parsedEval = null;
+            try {
+                parsedEval = JSON.parse(text);
+            }
+            catch {
+                parsedEval = null;
+            }
+            json(res, {
+                ok: true,
+                kind,
+                path: filePath,
+                size: st.size,
+                truncated: st.size > readBytes,
+                eval: parsedEval,
+                raw: text,
+            });
+            return;
+        }
+        json(res, {
+            ok: true,
+            kind,
+            path: filePath,
+            size: st.size,
+            truncated: st.size > readBytes,
+            text,
+        });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message || String(err) }, 500);
+    }
+}
+async function handlePostExplorerQuickstart(req, res) {
+    try {
+        let body = {};
+        try {
+            body = JSON.parse(await readBody(req) || '{}');
+        }
+        catch {
+            body = {};
+        }
+        const input = await parseExplorerQuickstartInput(body);
+        const experiment = (0, explorer_js_1.createExplorerExperiment)({
+            name: input.experimentName,
+            source_repo_path: input.sourceRepoPath,
+            eval_command: input.evalCommand,
+            eval_timeout_sec: input.evalTimeoutSec,
+            policy: input.policy,
+            retention: {
+                keep_worktrees: false,
+                artifacts: 'minimal',
+                keep_last_n: 50,
+                keep_best: true,
+                keep_failed_last_n: 20,
+                max_delete_runs: 200,
+            },
+        });
+        const baselineArtifactDir = (0, config_js_1.getExplorerArtifactDir)(experiment.id, 'baseline');
+        const baseline = (0, explorer_eval_js_1.runEvaluation)({
+            worktree_path: experiment.repo_path,
+            eval_command: experiment.eval_command,
+            timeout_sec: experiment.eval_timeout_sec,
+            artifact_dir: baselineArtifactDir,
+        });
+        const store = new explorer_store_js_1.ExplorerStore();
+        try {
+            store.createEvent(experiment.id, 'note', {
+                message: 'baseline evaluation',
+                status: baseline.status,
+                score: baseline.score ?? null,
+                artifact_dir: baselineArtifactDir,
+                error: baseline.error || null,
+            });
+        }
+        finally {
+            store.close();
+        }
+        const overview = (0, explorer_js_1.getExperimentOverview)(experiment.id);
         json(res, {
             ok: true,
-            bootstrap: true,
-            policy: buildBootstrapPolicyTemplate(context),
-            message: `No policy is configured yet. Saving this file will make "${context.currentUser}" the initial admin.`,
+            experiment,
+            baseline: {
+                status: baseline.status,
+                score: baseline.score ?? null,
+                error: baseline.error || null,
+                artifact_dir: baselineArtifactDir,
+            },
+            overview,
         });
-        return;
     }
-    json(res, { ok: false, error: 'No policy file found' }, 404);
+    catch (err) {
+        const message = err?.message || String(err);
+        const status = /must be|not found/i.test(message) ? 400 : 500;
+        json(res, { ok: false, error: message }, status);
+    }
 }
-async function handlePostAdminPolicy(req, res) {
-    const context = requireAdmin(res, { allowBootstrapPolicySetup: true });
-    if (!context)
-        return;
+async function handlePostExplorerRegister(req, res) {
     try {
-        const body = await readBody(req);
-        const incoming = JSON.parse(body);
-        const errors = (0, policy_js_1.validatePolicy)(incoming);
-        if (errors.length > 0) {
-            json(res, { ok: false, errors }, 400);
-            return;
-        }
-        let policy = incoming;
-        let addedBootstrapAdmin = false;
-        // First-time setup guard: ensure the bootstrap user cannot lock themselves out.
-        if (context.bootstrapPolicySetup) {
-            const names = Array.isArray(policy.admins?.usernames) ? policy.admins.usernames : [];
-            const alreadyIncluded = names.includes(context.currentUser);
-            policy = {
-                ...policy,
-                admins: {
-                    usernames: [...new Set([context.currentUser, ...names])],
-                },
-            };
-            addedBootstrapAdmin = !alreadyIncluded;
+        let body = {};
+        try {
+            body = JSON.parse(await readBody(req) || '{}');
         }
-        (0, policy_js_1.savePolicy)(policy);
+        catch {
+            body = {};
+        }
+        const input = await parseExplorerQuickstartInput(body);
+        const experiment = (0, explorer_js_1.createExplorerExperiment)({
+            name: input.experimentName,
+            source_repo_path: input.sourceRepoPath,
+            eval_command: input.evalCommand,
+            eval_timeout_sec: input.evalTimeoutSec,
+            policy: input.policy,
+            retention: {
+                keep_worktrees: false,
+                artifacts: 'minimal',
+                keep_last_n: 50,
+                keep_best: true,
+                keep_failed_last_n: 20,
+                max_delete_runs: 200,
+            },
+        });
+        const overview = (0, explorer_js_1.getExperimentOverview)(experiment.id);
         json(res, {
             ok: true,
-            bootstrapCompleted: context.bootstrapPolicySetup,
-            addedBootstrapAdmin,
+            experiment,
+            overview,
+            flow: {
+                tool: 'experiment_register',
+                initialized: false,
+            },
         });
     }
     catch (err) {
-        json(res, { ok: false, errors: [err.message ?? String(err)] }, 400);
+        const message = err?.message || String(err);
+        const status = /must be|not found/i.test(message) ? 400 : 500;
+        json(res, { ok: false, error: message }, status);
     }
 }
-function handleGetAdminUsers(_req, res) {
-    if (!requireAdmin(res))
-        return;
-    const effective = (0, config_js_1.loadEffectiveConfig)();
-    const sharedDir = effective.sharedSessionsDir;
-    // Collect sessions from shared dir or fall back to local sessions
-    const sessionsDir = sharedDir && (0, fs_1.existsSync)(sharedDir) ? sharedDir : (0, config_js_1.getSessionsDir)();
-    const sessions = [];
-    if ((0, fs_1.existsSync)(sessionsDir)) {
-        const files = (0, fs_1.readdirSync)(sessionsDir).filter((f) => f.endsWith('.json'));
-        for (const f of files) {
-            try {
-                const data = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(sessionsDir, f), 'utf-8'));
-                sessions.push(data);
-            }
-            catch {
-                // Skip malformed session files
+async function handlePostExplorerInit(req, res) {
+    try {
+        let body = {};
+        try {
+            body = JSON.parse(await readBody(req) || '{}');
+        }
+        catch {
+            body = {};
+        }
+        const experimentId = String(body.experiment_id || '').trim();
+        if (!experimentId) {
+            json(res, { ok: false, error: 'Missing experiment_id' }, 400);
+            return;
+        }
+        const store = new explorer_store_js_1.ExplorerStore();
+        try {
+            const experiment = store.getExperiment(experimentId);
+            if (!experiment) {
+                json(res, { ok: false, error: 'Experiment not found' }, 404);
+                return;
             }
+            const baselineArtifactDir = (0, config_js_1.getExplorerArtifactDir)(experiment.id, 'baseline');
+            const baseline = (0, explorer_eval_js_1.runEvaluation)({
+                worktree_path: experiment.repo_path,
+                eval_command: experiment.eval_command,
+                timeout_sec: experiment.eval_timeout_sec,
+                artifact_dir: baselineArtifactDir,
+            });
+            store.createEvent(experiment.id, 'note', {
+                message: 'experiment initialized with baseline evaluation',
+                status: baseline.status,
+                score: baseline.score ?? null,
+                artifact_dir: baselineArtifactDir,
+                error: baseline.error || null,
+            });
+            const overview = (0, explorer_js_1.getExperimentOverview)(experiment.id, store);
+            json(res, {
+                ok: true,
+                experiment,
+                baseline: {
+                    status: baseline.status,
+                    score: baseline.score ?? null,
+                    error: baseline.error || null,
+                    artifact_dir: baselineArtifactDir,
+                },
+                overview,
+                flow: {
+                    tool: 'experiment_init',
+                    initialized: true,
+                },
+            });
         }
-    }
-    // Group by user (sessions have a 'user' field when written to shared dir)
-    const userMap = new Map();
-    for (const s of sessions) {
-        const user = s.user ?? 'unknown';
-        if (!userMap.has(user)) {
-            userMap.set(user, { sessions: [], lastActivity: '' });
+        finally {
+            store.close();
         }
-        const entry = userMap.get(user);
-        entry.sessions.push(s);
-        const started = s.started ?? '';
-        if (started > entry.lastActivity)
-            entry.lastActivity = started;
     }
-    const users = [...userMap.entries()].map(([username, data]) => ({
-        username,
-        activeSessions: data.sessions.length,
-        lastActivity: data.lastActivity,
-        sessions: data.sessions,
-    }));
-    json(res, { ok: true, users });
-}
-function handleGetAdminLogs(_req, res) {
-    if (!requireAdmin(res))
-        return;
-    const effective = (0, config_js_1.loadEffectiveConfig)();
-    const logDir = effective.sharedAuditDir && (0, fs_1.existsSync)(effective.sharedAuditDir)
-        ? effective.sharedAuditDir
-        : (0, config_js_1.getLogDir)(effective.config);
-    if (!(0, fs_1.existsSync)(logDir)) {
-        json(res, { ok: true, logs: [] });
-        return;
+    catch (err) {
+        json(res, { ok: false, error: err?.message || String(err) }, 500);
     }
-    const files = (0, fs_1.readdirSync)(logDir)
-        .filter((f) => f.endsWith('.jsonl'))
-        .sort()
-        .reverse();
-    const logs = [];
-    const maxEntries = 100;
-    for (const f of files) {
-        if (logs.length >= maxEntries)
-            break;
+}
+async function handlePostExplorerTick(req, res) {
+    try {
+        let body = {};
         try {
-            const content = (0, fs_1.readFileSync)((0, path_1.join)(logDir, f), 'utf-8');
-            const lines = content.split('\n').filter(l => l.trim());
-            for (const line of lines.reverse()) {
-                if (logs.length >= maxEntries)
-                    break;
-                try {
-                    logs.push(JSON.parse(line));
-                }
-                catch { /* skip malformed lines */ }
-            }
+            body = JSON.parse(await readBody(req) || '{}');
         }
-        catch { /* skip unreadable files */ }
+        catch {
+            body = {};
+        }
+        const experimentId = String(body.experiment_id || '').trim();
+        if (!experimentId) {
+            json(res, { ok: false, error: 'Missing experiment_id' }, 400);
+            return;
+        }
+        const result = (0, explorer_js_1.runAutopilotTick)(experimentId);
+        const runDetails = result.run_id ? (0, explorer_js_1.getRunDetails)(result.run_id) : null;
+        json(res, { ok: true, result, run_details: runDetails });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message || String(err) }, 500);
     }
-    json(res, { ok: true, logs });
-}
-function handleGetAdminLicense(_req, res) {
-    if (!requireAdmin(res))
-        return;
-    const status = (0, license_js_1.validateLicense)();
-    json(res, { ok: true, license: status });
 }
 function upgradeUnauthorized(socket) {
     try {
@@ -3510,6 +5581,7 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
     const socketPath = options.socketPath || (0, config_js_1.getUiSocketPath)();
     const tcpPort = Number.isFinite(options.port) ? Math.floor(options.port) : null;
     const useTcp = tcpPort !== null;
+    const prewarmImageOnStartup = options.prewarmImageOnStartup === true;
     const requestedPort = tcpPort ?? 0;
     const maxPort = requestedPort + 3;
     const uiAccessToken = useTcp ? (0, crypto_1.randomBytes)(24).toString('hex') : '';
@@ -3522,9 +5594,16 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
         (0, config_js_1.ensurePrivateDir)((0, path_1.dirname)(socketPath));
     }
     const wsServer = new ws_1.WebSocketServer({ noServer: true });
+    const claudeWsServer = new ws_1.WebSocketServer({ noServer: true });
     wsServer.on('connection', async (ws, req) => {
         const reqUrl = new URL(req.url || '/', 'http://localhost');
         const id = reqUrl.searchParams.get('id') || '';
+        const replayRaw = String(reqUrl.searchParams.get('replay') || '').trim().toLowerCase();
+        const replayDisabled = replayRaw === '0' || replayRaw === 'false' || replayRaw === 'off';
+        const afterSeqRaw = String(reqUrl.searchParams.get('afterSeq') || '').trim();
+        const parsedAfterSeq = afterSeqRaw ? Number(afterSeqRaw) : NaN;
+        const hasAfterSeq = afterSeqRaw.length > 0 && Number.isFinite(parsedAfterSeq);
+        const afterSeq = hasAfterSeq ? Math.floor(parsedAfterSeq) : null;
         const record = (0, web_terminal_js_1.readWebTerminalRecord)(id);
         if (!record) {
             sendWebTerminalMessage(ws, { type: 'error', error: 'Terminal session not found' });
@@ -3545,7 +5624,19 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             exitCode: record.exitCode,
             error: record.error,
         });
-        if (bridge.buffer) {
+        if (afterSeq !== null) {
+            const pending = bridge.history.filter((chunk) => chunk.seq > afterSeq);
+            for (const chunk of pending) {
+                sendWebTerminalMessage(ws, {
+                    type: 'data',
+                    id: record.id,
+                    data: chunk.data,
+                    seqStart: chunk.seq,
+                    seqEnd: chunk.seq,
+                });
+            }
+        }
+        else if (!replayDisabled && bridge.buffer) {
             sendWebTerminalMessage(ws, { type: 'data', id: record.id, data: bridge.buffer });
         }
         ws.on('message', (raw) => {
@@ -3586,6 +5677,65 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             }
         });
     });
+    claudeWsServer.on('connection', (ws, req) => {
+        const reqUrl = new URL(req.url || '/', 'http://localhost');
+        const id = (reqUrl.searchParams.get('id') || '').trim();
+        const record = (0, web_terminal_js_1.readWebTerminalRecord)(id);
+        if (!record || record.node !== (0, os_1.hostname)()) {
+            sendWebTerminalMessage(ws, { type: 'error', error: 'Terminal session not found on this node.' });
+            ws.close();
+            return;
+        }
+        if (record.agent !== 'claude') {
+            sendWebTerminalMessage(ws, { type: 'error', error: 'Headless chat is currently supported for Claude sessions only.' });
+            ws.close();
+            return;
+        }
+        let disposeRun = null;
+        let runInFlight = false;
+        ws.on('message', (raw) => {
+            if (runInFlight) {
+                sendWebTerminalMessage(ws, { type: 'error', error: 'Headless Claude run already in progress for this socket.' });
+                return;
+            }
+            let parsed = null;
+            try {
+                parsed = JSON.parse(raw.toString('utf-8'));
+            }
+            catch {
+                sendWebTerminalMessage(ws, { type: 'error', error: 'Invalid request payload.' });
+                return;
+            }
+            if (!parsed || parsed.type !== 'prompt') {
+                sendWebTerminalMessage(ws, { type: 'error', error: 'Unsupported request. Expected { type: "prompt", prompt }.' });
+                return;
+            }
+            const prompt = typeof parsed.prompt === 'string' ? parsed.prompt : '';
+            const resumeSessionId = typeof parsed.resumeSessionId === 'string' ? parsed.resumeSessionId : '';
+            runInFlight = true;
+            void startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId)
+                .then((cleanup) => {
+                disposeRun = cleanup;
+            })
+                .catch((err) => {
+                sendWebTerminalMessage(ws, {
+                    type: 'error',
+                    code: 'headless_failed',
+                    error: err?.message ?? String(err),
+                });
+                sendWebTerminalMessage(ws, { type: 'done', exitCode: 1, isError: true });
+            });
+        });
+        ws.on('close', () => {
+            if (disposeRun) {
+                try {
+                    disposeRun();
+                }
+                catch { /* best effort */ }
+            }
+            disposeRun = null;
+        });
+    });
     const server = (0, http_1.createServer)(async (req, res) => {
         const url = req.url ?? '/';
         const reqUrl = new URL(url, 'http://localhost');
@@ -3711,9 +5861,24 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             else if (pathname === '/api/terminal/sessions' && method === 'GET') {
                 await handleGetWebTerminalSessions(res);
             }
+            else if (pathname === '/api/terminal/history' && method === 'GET') {
+                await handleGetWebTerminalHistory(reqUrl, res);
+            }
+            else if (pathname === '/api/terminal/init' && method === 'GET') {
+                await handleGetWebTerminalInit(reqUrl, res);
+            }
+            else if (pathname === '/api/terminal/init' && method === 'POST') {
+                await handlePostWebTerminalInit(req, res);
+            }
             else if (pathname === '/api/terminal/start' && method === 'POST') {
                 await handlePostWebTerminalStart(req, res);
             }
+            else if (pathname === '/api/terminal/agent/update' && method === 'POST') {
+                await handlePostWebTerminalAgentUpdate(req, res);
+            }
+            else if (pathname === '/api/terminal/rename' && method === 'POST') {
+                await handlePostWebTerminalRename(req, res);
+            }
             else if (pathname === '/api/terminal/stop' && method === 'POST') {
                 await handlePostWebTerminalStop(req, res);
             }
@@ -3770,6 +5935,54 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             else if (pathname === '/api/admin/license' && method === 'GET') {
                 handleGetAdminLicense(req, res);
             }
+            else if (pathname === '/api/explorer/experiments' && method === 'GET') {
+                handleGetExplorerExperiments(reqUrl, res);
+            }
+            else if (pathname === '/api/explorer/overview' && method === 'GET') {
+                handleGetExplorerOverview(reqUrl, res);
+            }
+            else if (pathname === '/api/explorer/tree' && method === 'GET') {
+                handleGetExplorerTree(reqUrl, res);
+            }
+            else if (pathname === '/api/explorer/runs' && method === 'GET') {
+                handleGetExplorerRuns(reqUrl, res);
+            }
+            else if (pathname === '/api/explorer/run' && method === 'GET') {
+                handleGetExplorerRun(reqUrl, res);
+            }
+            else if (pathname === '/api/explorer/compare' && method === 'GET') {
+                handleGetExplorerCompare(reqUrl, res);
+            }
+            else if (pathname === '/api/explorer/artifact' && method === 'GET') {
+                handleGetExplorerArtifact(reqUrl, res);
+            }
+            else if (pathname === '/api/explorer/register' && method === 'POST') {
+                await handlePostExplorerRegister(req, res);
+            }
+            else if (pathname === '/api/explorer/init' && method === 'POST') {
+                await handlePostExplorerInit(req, res);
+            }
+            else if (pathname === '/api/explorer/quickstart' && method === 'POST') {
+                await handlePostExplorerQuickstart(req, res);
+            }
+            else if (pathname === '/api/explorer/tick' && method === 'POST') {
+                await handlePostExplorerTick(req, res);
+            }
+            else if (pathname === '/api/explorer/step' && method === 'POST') {
+                await handlePostExplorerTick(req, res);
+            }
+            else if (pathname === '/api/explorer/go' && method === 'POST') {
+                await handlePostExplorerTick(req, res);
+            }
+            else if (pathname === '/api/display/file' && method === 'GET') {
+                handleDisplayFile(reqUrl, res);
+            }
+            else if (pathname === '/api/widgets' && method === 'GET') {
+                handleGetWidgets(res);
+            }
+            else if (pathname === '/api/widgets/clear' && method === 'POST') {
+                handleClearWidgets(res);
+            }
             else if (pathname.startsWith('/fonts/') && method === 'GET') {
                 serveFontFile(pathname, res);
             }
@@ -3807,7 +6020,8 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
     });
     server.on('upgrade', (req, socket, head) => {
         const reqUrl = new URL(req.url || '/', 'http://localhost');
-        if (reqUrl.pathname !== '/api/terminal/ws') {
+        const pathname = reqUrl.pathname;
+        if (pathname !== '/api/terminal/ws' && pathname !== '/api/claude/ws') {
             upgradeBadRequest(socket);
             return;
         }
@@ -3837,8 +6051,18 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             upgradeBadRequest(socket);
             return;
         }
-        wsServer.handleUpgrade(req, socket, head, (ws) => {
-            wsServer.emit('connection', ws, req);
+        if (pathname === '/api/terminal/ws') {
+            wsServer.handleUpgrade(req, socket, head, (ws) => {
+                wsServer.emit('connection', ws, req);
+            });
+            return;
+        }
+        if (record.agent !== 'claude') {
+            upgradeBadRequest(socket);
+            return;
+        }
+        claudeWsServer.handleUpgrade(req, socket, head, (ws) => {
+            claudeWsServer.emit('connection', ws, req);
         });
     });
     const bindTcp = (nextPort) => {
@@ -3860,51 +6084,105 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
         if (started)
             return;
         started = true;
-        if (useTcp) {
-            const actualPort = server.address()?.port ?? listenPort;
-            dashboardQuickLink = `http://localhost:${actualPort}${UI_SHORT_LINK_PREFIX}${uiShortCode}`;
-            log.step(`Settings: ${formatTerminalHyperlink(dashboardQuickLink)}`);
-            try {
-                writeDashboardLink(dashboardQuickLink);
-            }
-            catch {
-                // Best effort: statusline can still fall back to LABGATE_DASHBOARD_URL/default URL.
-            }
-            if (shouldAutoOpenUiBrowser(standalone)) {
-                autoOpenUiBrowser(dashboardQuickLink);
+        void (async () => {
+            if (prewarmImageOnStartup) {
+                try {
+                    const cfg = (0, config_js_1.loadConfig)();
+                    const runtimeReady = await prepareRuntimeForWebTerminal(cfg.runtime);
+                    if (!runtimeReady.ok) {
+                        const firstLine = String(runtimeReady.error || 'Container runtime unavailable.')
+                            .split('\n')[0]
+                            .trim();
+                        log.warn(`Skipping startup image preparation: ${firstLine}`);
+                    }
+                    else {
+                        const runtimeCheck = (0, runtime_js_1.checkRuntime)(cfg.runtime);
+                        if (!runtimeCheck.ok || !runtimeCheck.runtime) {
+                            const firstLine = String(runtimeCheck.error || 'Container runtime unavailable.')
+                                .split('\n')[0]
+                                .trim();
+                            log.warn(`Skipping startup image preparation: ${firstLine}`);
+                        }
+                        else {
+                            const runtime = runtimeCheck.runtime;
+                            const image = cfg.image;
+                            let imageExists = false;
+                            if (runtime === 'podman') {
+                                try {
+                                    await execFileAsync('podman', ['image', 'exists', image], {
+                                        timeout: 10_000,
+                                        maxBuffer: WEB_TERMINAL_IMAGE_PULL_MAX_BUFFER,
+                                    });
+                                    imageExists = true;
+                                }
+                                catch {
+                                    imageExists = false;
+                                }
+                            }
+                            else {
+                                imageExists = (0, fs_1.existsSync)((0, path_1.join)((0, config_js_1.getImagesDir)(), (0, container_js_1.imageToSifName)(image)));
+                            }
+                            if (!imageExists) {
+                                log.step(`No cached image found for ${image}. Preparing it before opening UI...`);
+                                await ensureWebTerminalImageReady(runtime, image);
+                                log.success(`Prepared image ${image}.`);
+                            }
+                        }
+                    }
+                }
+                catch (err) {
+                    const detail = commandErrorDetail(err);
+                    const firstLine = (detail || err?.message || String(err)).split('\n')[0].trim();
+                    log.warn(`Startup image preparation failed: ${firstLine}`);
+                }
             }
-        }
-        else {
-            try {
-                (0, fs_1.chmodSync)(socketPath, config_js_1.PRIVATE_FILE_MODE);
+            if (useTcp) {
+                const actualPort = server.address()?.port ?? listenPort;
+                // Use an explicit IPv4 loopback host to avoid `localhost` IPv6 collisions on macOS.
+                dashboardQuickLink = `http://127.0.0.1:${actualPort}${UI_SHORT_LINK_PREFIX}${uiShortCode}`;
+                log.step(`Settings: ${formatTerminalHyperlink(dashboardQuickLink)}`);
+                try {
+                    writeDashboardLink(dashboardQuickLink);
+                }
+                catch {
+                    // Best effort: statusline can still fall back to LABGATE_DASHBOARD_URL/default URL.
+                }
+                if (shouldAutoOpenUiBrowser(standalone)) {
+                    autoOpenUiBrowser(dashboardQuickLink);
+                }
             }
-            catch {
-                // Best effort on platforms that do not support chmod on sockets.
+            else {
+                try {
+                    (0, fs_1.chmodSync)(socketPath, config_js_1.PRIVATE_FILE_MODE);
+                }
+                catch {
+                    // Best effort on platforms that do not support chmod on sockets.
+                }
+                log.step(`Settings socket: ${socketPath}`);
+                log.step('Use `labgate ui` for browser access on localhost (default port: 7700).');
             }
-            log.step(`Settings socket: ${socketPath}`);
-            log.step('Use `labgate ui` for browser access on localhost (default port: 7700).');
-        }
-        if (standalone) {
-            log.step('Press Ctrl+C to stop');
-        }
-        // Initialise SLURM tracking if enabled
-        const slurmConfig = (0, config_js_1.loadConfig)();
-        if (slurmConfig.slurm.enabled && !slurmDB) {
-            try {
-                slurmDB = new slurm_db_js_1.SlurmJobDB((0, config_js_1.getSlurmDbPath)());
-                slurmPoller = new slurm_poller_js_1.SlurmPoller({
-                    db: slurmDB,
-                    pollIntervalMs: slurmConfig.slurm.poll_interval_seconds * 1000,
-                    sacctLookbackHours: slurmConfig.slurm.sacct_lookback_hours,
-                });
-                slurmPoller.start();
-                log.step('SLURM job tracking enabled');
+            if (standalone) {
+                log.step('Press Ctrl+C to stop');
             }
-            catch (err) {
-                log.warn(`SLURM tracking unavailable: ${err.message}`);
+            // Initialise SLURM tracking if enabled
+            const slurmConfig = (0, config_js_1.loadConfig)();
+            if (slurmConfig.slurm.enabled && !slurmDB) {
+                try {
+                    slurmDB = new slurm_db_js_1.SlurmJobDB((0, config_js_1.getSlurmDbPath)());
+                    slurmPoller = new slurm_poller_js_1.SlurmPoller({
+                        db: slurmDB,
+                        pollIntervalMs: slurmConfig.slurm.poll_interval_seconds * 1000,
+                        sacctLookbackHours: slurmConfig.slurm.sacct_lookback_hours,
+                    });
+                    slurmPoller.start();
+                    log.step('SLURM job tracking enabled');
+                }
+                catch (err) {
+                    log.warn(`SLURM tracking unavailable: ${err.message}`);
+                }
             }
-        }
-        startSSEBroadcast();
+            startSSEBroadcast();
+        })();
     });
     server.on('close', () => {
         if (dashboardQuickLink)
@@ -3920,6 +6198,7 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
         }
         webTerminalBridges.clear();
         wsServer.close();
+        claudeWsServer.close();
     });
     server.on('error', (err) => {
         if (!useTcp && err.code === 'EADDRINUSE') {
@@ -3963,6 +6242,13 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
                 // Best effort cleanup.
             }
         }
+        if (sseInterval) {
+            clearInterval(sseInterval);
+            sseInterval = null;
+        }
+        sseClients.clear();
+        stopResultsWatcher();
+        stopDisplayWatcher();
         // Cleanup SLURM resources
         if (slurmPoller) {
             slurmPoller.stop();
@@ -3976,6 +6262,7 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             slurmDB = null;
         }
         resultsStore = null;
+        displayStore = null;
     });
     return server;
 }