keywright-server 0.0.1__py3-none-any.whl

keywright_server/web/templates/mcp_oauth_continue.html

@@ -0,0 +1,14 @@
+{% extends "base.html" %}
+{% block title %}Sign in · Keywright{% endblock %}
+{% block body %}
+<div class="card">
+<h1>Opening sign-in</h1>
+<p>Continue to connect {{ resource_name }}.</p>
+<p><a id="oauth-continue" class="btn p" href="{{ authorization_url }}" rel="noreferrer">Continue to sign in</a></p>
+<p class="help">If sign-in does not open automatically, use the button above.</p>
+<p><a href="/ui/resources/{{ resource_id }}">Back to resource</a></p>
+</div>
+{% endblock %}
+{% block scripts %}
+<script>window.location.replace(document.getElementById('oauth-continue').href);</script>
+{% endblock %}

keywright_server/web/templates/policies.html

@@ -0,0 +1,30 @@
+{% extends "base.html" %}{% block title %}Rules{% endblock %}{% block body %}
+<h1>Standing rules</h1>
+<p class="page-intro"><a href="/ui/friction">Review approval friction and exact-operation suggestions</a>.</p>
+{% if error %}<div class="card" role="alert">{{ error }}</div>{% endif %}
+<div class="card">
+<form method="post" action="/ui/policies">
+<div class="grid">
+<div><label>Pattern</label><input type="text" name="pattern" value="{{ draft.get('pattern', '') }}" placeholder="ssh/nvr/exec/journalctl  ·  mcp/ha/tools/get_state  ·  ssh/dev-box/exec/**" required>
+<div class="help"><code>*</code> one segment, <code>**</code> everything below. A literal pattern also covers everything under it. MCP calls can be qualified by argument: <code>mcp/ha/tools/call_service/service=automation.turn_off</code>, and a value may end in <code>*</code> (<code>entity_id=light.*</code>). Keys come from the resource's argument keys.</div></div>
+<div><label>Effect</label><select name="effect"><option value="allow">allow</option><option value="deny" {{ 'selected' if draft.get('effect') == 'deny' }}>deny (always wins)</option></select></div>
+<div><label>Agent</label><select name="agent_id"><option value="">every agent</option>{% for a in agents %}<option value="{{ a.id }}" {{ 'selected' if draft.get('agent_id') == a.id }}>{{ a.name }}</option>{% endfor %}</select></div>
+<div><label>Note</label><input type="text" name="note" value="{{ draft.get('note', '') }}"></div>
+</div>
+<div class="row" style="margin-top:10px"><button class="btn" name="action" value="preview">Preview recent activity</button><button class="btn p" name="action" value="save">Add rule</button></div>
+</form></div>
+{% if preview %}
+<section class="card" aria-labelledby="preview-title">
+<h2 id="preview-title">Rule preview · not saved</h2>
+<p><b>{{ draft.effect }} <code>{{ draft.pattern }}</code></b> · {{ agent_map[draft.agent_id].name if draft.agent_id in agent_map else 'every agent' }}</p>
+{% include "_policy_preview_results.html" %}
+<p class="small">Edit the draft above and preview again, or choose <b>Add rule</b> to save. Access settings may change after this preview.</p>
+</section>
+{% endif %}
+<div class="card"><table class="data-table" role="table"><thead role="rowgroup"><tr role="row"><th scope="col" role="columnheader">Effect</th><th scope="col" role="columnheader">Pattern</th><th scope="col" role="columnheader">Agent</th><th scope="col" role="columnheader">Note</th><th scope="col" role="columnheader">Added</th><th scope="col" role="columnheader">Actions</th></tr></thead><tbody role="rowgroup">
+{% for p in rows %}<tr role="row"><td role="cell" data-label="Effect"><div class="cell-value"><span class="pill {{ p.effect }}">{{ p.effect }}</span></div></td><td role="cell" data-label="Pattern" class="wide"><div class="cell-value"><code>{{ p.pattern }}</code></div></td>
+<td role="cell" data-label="Agent" class="wide"><div class="cell-value">{{ agent_map[p.agent_id].name if p.agent_id in agent_map else '<i class="mut">all</i>'|safe }}</div></td><td role="cell" data-label="Note" class="wide small"><div class="cell-value">{{ p.note }}<div>{{ constraint_label(p.constraints) }}</div>{% if p.constraints %}<details><summary>Operation constraints</summary>{% with constraints=p.constraints %}{% include "_constraints.html" %}{% endwith %}</details>{% endif %}{% if p.request_id %}<a href="/ui/requests/{{ p.request_id }}">Original decision</a>{% endif %}</div></td>
+<td role="cell" data-label="Added" class="small mut"><div class="cell-value">{{ p.created_at.strftime('%m-%d') }} · {{ p.created_by }}</div></td>
+<td role="cell" data-label="Actions" class="wide actions"><div class="cell-value"><form method="post" action="/ui/policies/{{ p.id }}/delete" class="inline"><button class="btn sm">Delete</button></form></div></td></tr>{% endfor %}
+</tbody></table>{% if not rows %}<p class="mut">No standing rules yet. Add a rule above.</p>{% endif %}</div>
+{% endblock %}

keywright_server/web/templates/request_detail.html

@@ -0,0 +1,27 @@
+{% extends "base.html" %}{% block title %}Request {{ req.id }}{% endblock %}{% block body %}
+<h1>Request <span class="mono">{{ req.id }}</span> <span class="pill {{ req.status }}">{{ req.status }}</span></h1>
+<div class="card">
+<table class="detail-table" role="table"><tbody role="rowgroup">
+<tr role="row"><th scope="row" role="rowheader">Agent</th><td role="cell">{{ req.agent.name }}</td></tr>
+<tr role="row"><th scope="row" role="rowheader">Session</th><td role="cell" class="mono">{{ req.session_id or '— (no session id: “This session” is not available for this request)' }}</td></tr>
+<tr role="row"><th scope="row" role="rowheader">Patterns</th><td role="cell">{% include "_patterns.html" %}</td></tr>
+<tr role="row"><th scope="row" role="rowheader">Reason</th><td role="cell">{{ req.reason or '—' }}</td></tr>
+{% if hazards_of(req.detail) %}<tr role="row"><th scope="row" role="rowheader">Flags</th><td role="cell">{% include "_hazards.html" %}</td></tr>{% endif %}
+{% if req.semantic %}<tr role="row"><th scope="row" role="rowheader">Jev</th><td role="cell">{% include "_semantic.html" %}</td></tr>{% endif %}
+{% set ops = operations(req.detail) %}{% if ops %}<tr role="row"><th scope="row" role="rowheader">Operation{% if ops|length > 1 %}s ({{ ops|length }}){% endif %}</th><td role="cell">{% for pats, op in ops %}<div class="access-source">{% with constraints=op %}{% include "_constraints.html" %}{% endwith %}{% if pats %}<div class="small mut">{% for p in pats %}<code>{{ p }}</code> {% endfor %}</div>{% endif %}</div>{% endfor %}</td></tr>
+{% elif req.detail %}<tr role="row"><th scope="row" role="rowheader">Detail</th><td role="cell"><pre>{{ req.detail | redact | tojson(indent=1) }}</pre></td></tr>{% endif %}
+<tr role="row"><th scope="row" role="rowheader">Created</th><td role="cell">{{ req.created_at }}</td></tr>
+{% if req.decided_at %}<tr role="row"><th scope="row" role="rowheader">Decided</th><td role="cell">{{ req.decided_at }} · {{ decision_label(req) }} via {{ req.decided_via }}{% if req.deny_reason %} · “{{ req.deny_reason }}”{% endif %}</td></tr>{% endif %}
+{% if req.decision_options %}<tr role="row"><th scope="row" role="rowheader">Access scope</th><td role="cell">{{ 'Exact operation' if req.decision_options.extent == 'exact' else 'Listed permission patterns' }}{% if req.decision_options.ttl_s %} · {{ req.decision_options.ttl_s // 60 }} minutes{% endif %}</td></tr>{% endif %}
+</tbody></table>
+{% if req.status == 'pending' %}<div style="margin-top:12px">{% with next='/ui/requests/' ~ req.id, in_detail=True %}{% include "_decide.html" %}{% endwith %}</div>{% endif %}
+</div>
+{% if grants %}<div class="row toolbar"><form method="post" action="/ui/requests/{{ req.id }}/revoke"><input type="hidden" name="next" value="/ui/requests/{{ req.id }}"><button class="btn">Revoke this approval</button></form><span class="small mut">Other permission sources may still allow access. Running operations continue.</span></div>{% endif %}
+{% if rules %}<div class="card">This decision created {{ rules|length }} standing rules. <a href="/ui/policies">Manage those rules</a> to change permanent access.</div>{% endif %}
+{% if timeline %}<h2>Approval activity</h2><div class="card">
+{% for e in timeline %}<div class="access-target"><div><b>{{ e.tool }}</b> · {{ e.decision }} <a href="/ui/audit?q=%23{{ e.id }}">audit #{{ e.id }}</a></div><div class="small mut">{{ e.ts.strftime('%Y-%m-%d %H:%M:%S') }} UTC{% if e.duration_ms is not none %} · {{ e.duration_ms }} ms{% endif %}{% if e.exit_code is not none %} · exit {{ e.exit_code }}{% endif %}</div>
+{% if e.detail.command %}<pre>$ {{ e.detail.command }}</pre>{% elif e.detail.path %}<div><code>{{ e.detail.path }}</code></div>{% elif e.detail.tool %}<div>{{ e.detail.server }} · {{ e.detail.tool }}</div>{% endif %}</div>{% endfor %}
+</div>{% endif %}
+{% if grants %}<h2>Grants from this request</h2><div class="card"><table class="data-table" role="table"><thead role="rowgroup"><tr role="row"><th scope="col" role="columnheader">Pattern</th><th scope="col" role="columnheader">Scope</th><th scope="col" role="columnheader">Expires</th><th scope="col" role="columnheader">Uses</th><th scope="col" role="columnheader">Revoked</th></tr></thead><tbody role="rowgroup">
+{% for g in grants %}<tr role="row"><td role="cell" data-label="Pattern" class="wide"><div class="cell-value"><code>{{ g.pattern }}</code></div></td><td role="cell" data-label="Scope"><div class="cell-value">{{ g.scope }}</div></td><td role="cell" data-label="Expires"><div class="cell-value">{{ g.expires_at or '—' }}</div></td><td role="cell" data-label="Uses"><div class="cell-value">{{ g.uses_remaining if g.uses_remaining is not none else '∞' }}</div></td><td role="cell" data-label="Revoked"><div class="cell-value">{{ g.revoked_at or '' }}</div></td></tr>{% endfor %}</tbody></table></div>{% endif %}
+{% endblock %}

keywright_server/web/templates/requests.html

@@ -0,0 +1,9 @@
+{% extends "base.html" %}{% block title %}Requests{% endblock %}{% block body %}
+<h1>Requests</h1>
+<p class="page-intro"><a href="/ui/friction">Approval friction</a> · recurring requests, decision wait times and call failures.</p>
+<div class="card"><table class="data-table" role="table"><thead role="rowgroup"><tr role="row"><th scope="col" role="columnheader">When</th><th scope="col" role="columnheader">Agent</th><th scope="col" role="columnheader">Patterns</th><th scope="col" role="columnheader">Status</th><th scope="col" role="columnheader">Via</th></tr></thead><tbody role="rowgroup">
+{% for r in rows %}<tr role="row"><td role="cell" data-label="When" class="small mut"><div class="cell-value"><a href="/ui/requests/{{ r.id }}">{{ r.created_at.strftime('%m-%d %H:%M:%S') }}</a></div></td><td role="cell" data-label="Agent" class="wide"><div class="cell-value">{{ r.agent.name }}</div></td>
+<td role="cell" data-label="Patterns" class="wide"><div class="cell-value">{% for p in r.patterns %}<code>{{ p }}</code> {% endfor %}<div class="small mut">{{ r.reason }}</div></div></td>
+<td role="cell" data-label="Status"><div class="cell-value">{% if hazard_level(r.detail) %}<span class="pill {{ hazard_level(r.detail) }}">{{ hazard_level(r.detail) }}</span> {% endif %}<span class="pill {{ r.status }}">{{ r.status }}</span>{% if r.decision_scope %} <span class="small mut">{{ r.decision_scope }}</span>{% endif %}</div></td>
+<td role="cell" data-label="Via" class="small mut"><div class="cell-value">{{ r.decided_via or '' }}</div></td></tr>{% endfor %}</tbody></table>{% if not rows %}<p class="mut">No requests yet. Agent access requests will appear here.</p>{% endif %}</div>
+{% endblock %}

keywright_server/web/templates/resource_form.html

@@ -0,0 +1,198 @@
+{% extends "base.html" %}{% from "_icons.html" import icon %}{% block title %}{{ 'Edit' if res else 'Add' }} {{ preset.title if preset else kind }}{% endblock %}{% block body %}
+{% include "_integration_style.html" %}
+<div class="integration-page integration-form">
+{% if not res %}<a class="integration-back" href="/ui/resources/new">{{ icon('chevron') }} All integrations</a>{% endif %}
+{% if res %}
+{% include "_infrastructure_nav.html" %}
+{% endif %}
+{% if res %}<p class="small mut">Inventory: {% if inventory_asset %}<a href="/ui/inventory/assets/{{ inventory_asset.id }}">{{ inventory_asset.name }}</a>{% else %}<a href="/ui/inventory/assets/new?resource={{ res.id }}">Add this resource to inventory</a> · or link it from an existing inventory record{% endif %}</p>{% endif %}
+
+{% if preset %}
+<div class="integration-intro"><span class="integration-mark {{ preset.icon }}">{% if preset.icon == 'notion' %}N{% else %}{{ icon(preset.icon) }}{% endif %}</span><div><h1>{{ preset.title }}</h1><p>{{ preset.instructions if not res else preset.description }}</p></div></div>
+{% if preset.auth_type == 'oauth' %}<ol class="integration-steps" aria-label="Connection setup"><li {% if not res %}aria-current="step"{% endif %}><span>1</span> Connection details</li><li {% if res %}aria-current="step"{% endif %}><span>2</span> {{ 'Connected' if oauth_status == 'connected' else 'Sign in' }}</li></ol>{% endif %}
+{% else %}<h1>{{ 'Edit' if res else 'Add' }} {{ {'ssh': 'SSH host', 'mcp': 'MCP server', 'llm': 'LLM gateway'}[kind] }}</h1>{% endif %}
+<div class="card"><form method="post" action="/ui/resources">
+<input type="hidden" name="rid" value="{{ res.id if res else '' }}"><input type="hidden" name="kind" value="{{ kind }}">
+<input type="hidden" name="integration" value="{{ preset.id if preset else '' }}">
+<input type="hidden" name="adapter" value="{{ adapter | default('') }}">
+<div class="grid">
+<div><label>Connection name</label><input type="text" name="name" value="{{ res.name if res else preset.default_name if preset else '' }}" required {% if res %}readonly{% endif %}></div>
+<div><label>Agent access</label><select name="default_mode">{% for m, label in [('approval', 'Ask for approval'), ('open', 'Allow by default'), ('locked', 'Require explicit rules')] %}<option value="{{ m }}" {{ 'selected' if res and res.default_mode == m }}>{{ label }}</option>{% endfor %}</select>
+<div class="help">Applies when no access rule or active grant covers an operation.</div></div>
+</div>
+<label>Description <span class="mut">(optional)</span></label><input type="text" name="description" value="{{ res.description if res else '' }}">
+{% if kind == 'ssh' %}
+<div class="grid host-fields">
+<div><label>Host</label><input type="text" name="host" value="{{ res.config.host if res else '' }}" required></div>
+<div><label>Port</label><input type="number" name="port" value="{{ res.config.port if res else 22 }}"></div>
+<div><label>User</label><input type="text" name="user" value="{{ res.config.user if res else 'root' }}"></div>
+</div>
+{% if res %}
+<label>Private key path on the Keywright host</label><input type="text" name="key_path" value="{{ res.config.key_path if res else '' }}" placeholder="{{ keys_dir }}/&lt;name&gt;">
+<div class="help">{% if key and key.exists %}Key present{% if key.pub %}: <code>{{ key.pub }}</code>{% endif %}{% else %}No key yet. Save, then use <b>Generate key</b> below (recommended), or paste one here.{% endif %}</div>
+<details><summary class="small mut" style="cursor:pointer;margin-top:8px">Paste an existing private key instead</summary>
+<textarea name="private_key" placeholder="-----BEGIN OPENSSH PRIVATE KEY-----"></textarea></details>
+{% else %}
+<div class="help" style="margin-top:8px">Save first; then generate a key on this Keywright and enrol it on the host from the same page.</div>
+{% endif %}
+{% if res and res.config.host_key %}<label>Pinned host key</label><code>{{ res.config.host_key }}</code>
+<div class="row" style="margin-top:6px"><label class="inline"><input type="checkbox" name="forget_host_key" value="1"> forget host key (re-pin on next connect)</label></div>{% else %}<div class="help" style="margin-top:8px">Host key not pinned yet: the first successful connection or probe pins it.</div>{% endif %}
+{% elif kind == 'llm' %}
+{% set limits = (res.config.limits if res else {}) or {} %}{% set budget = (res.config.agent_budget if res else {}) or {} %}
+<label>LiteLLM URL <span class="mut">(reachable from this Keywright only; never published to agents)</span></label>
+<input type="url" name="url" value="{{ res.config.url if res else '' }}" placeholder="http://litellm:4000" required>
+<label>Master key <span class="mut">(mints and deletes virtual keys; stored here, shown as ***)</span></label>
+<input type="password" name="master_key" value="{{ '***' if res and res.config.master_key else '' }}" autocomplete="off" placeholder="sk-…" {% if not res %}required{% endif %}>
+<label style="margin-top:8px">Models agents may ask for <span class="mut">(comma or newline separated; <b>Test connection</b> refreshes this from the gateway)</span></label>
+<textarea name="models_text" rows="3" placeholder="claude-sonnet-5, gpt-5.6">{{ (res.config.models or []) | join(', ') if res else '' }}</textarea>
+<div class="help">Each model is a path: <code>llm/{{ res.name if res else 'litellm' }}/model/&lt;model&gt;</code> (slashes in a name become <code>_</code>). A rule on <code>llm/{{ res.name if res else 'litellm' }}/model/*</code> covers them all. Keys are minted by <b>approvals</b>; an <i>open</i> default or a standing allow rule mints nothing until the LLM proxy ships, so keep this on <i>approval</i> for now.</div>
+<h2 style="margin-top:14px">Per-lease ceiling</h2>
+<p class="small mut">Every approval becomes one LiteLLM virtual key with exactly these limits and the lease's lifetime. If the agent goes feral, this is all the money there is.</p>
+<div class="grid">
+<div><label>Max spend (USD)</label><input type="text" name="max_budget" value="{{ limits.get('max_budget', 2.0) if res else 2 }}" required inputmode="decimal"></div>
+<div><label>Requests / minute</label><input type="text" name="rpm_limit" value="{{ limits.get('rpm_limit', 30) if res else 30 }}" inputmode="numeric"></div>
+<div><label>Tokens / minute <span class="mut">(blank = none)</span></label><input type="text" name="tpm_limit" value="{{ limits.get('tpm_limit') or '' if res else '' }}" inputmode="numeric"></div>
+<div><label>Concurrent requests</label><input type="text" name="max_parallel_requests" value="{{ limits.get('max_parallel_requests', 4) if res else 4 }}" inputmode="numeric"></div>
+</div>
+<h2 style="margin-top:14px">Per-agent ceiling</h2>
+<p class="small mut">Each agent is a LiteLLM internal user; all of its keys on this gateway count against this window as well.</p>
+<div class="grid">
+<div><label>Max spend (USD)</label><input type="text" name="agent_max_budget" value="{{ budget.get('max_budget', 10.0) if res else 10 }}" required inputmode="decimal"></div>
+<div><label>Per</label><select name="agent_budget_duration">{% for d, l in [('1h', 'hour'), ('1d', 'day'), ('7d', 'week'), ('30d', '30 days')] %}<option value="{{ d }}" {{ 'selected' if (budget.get('budget_duration', '1d') if res else '1d') == d }}>{{ l }}</option>{% endfor %}</select></div>
+</div>
+<div class="help">Set a global ceiling too, in <code>litellm.yaml</code> (<code>litellm_settings.max_budget</code>), and keep the vendors' own spend limits on. Keywright is a wall, not the only wall.</div>
+{% else %}
+{% if adapter == 'keywright' %}
+<p class="help">Built-in tools for inventory, hosting and network topology, discovery observations, subnets and IP allocations. Agents use the same approval gate and access rules as other resources. No URL or credentials are needed.</p>
+{% elif adapter == 'omada' %}
+<p class="help">In Omada Global View, open <b>Settings → Platform Integration → Open API</b> and create an app in <b>Client</b> mode with access to the sites you want. This connector reads sites, devices and clients.</p>
+<label>Interface Access Address</label><input type="url" name="url" value="{{ res.config.url if res else '' }}" placeholder="https://omada.example:8043" required>
+<div class="help">Copy the address from Open API settings, including its port. Do not include an API path.</div>
+<label>Omada ID</label><input type="text" name="omada_id" value="{{ res.config.omada_id if res else '' }}" required>
+<label>Client ID</label><input type="text" name="client_id" value="{{ res.config.client_id if res else '' }}" required>
+<label>Client Secret</label><input type="password" name="client_secret" value="" autocomplete="new-password" placeholder="{{ 'Leave blank to keep the stored secret' if res else '' }}" {% if not res %}required{% endif %}>
+<div class="help">Stored on Keywright. Agents never receive this credential.</div>
+<label>TLS certificate verification</label><select name="verify_tls"><option value="1" {{ 'selected' if not res or res.config.get('verify_tls', True) }}>Verify certificate (recommended)</option><option value="0" {{ 'selected' if res and not res.config.get('verify_tls', True) }}>Skip verification for a self-signed controller</option></select>
+<label>Custom CA bundle path <span class="mut">(optional, on the Keywright server)</span></label><input type="text" name="ca_bundle" value="{{ res.config.get('ca_bundle', '') if res else '' }}">
+{% else %}
+{% if preset and preset.url %}
+<input type="hidden" name="url" value="{{ preset.url }}"><input type="hidden" name="auth_type" value="{{ preset.auth_type }}">
+<p class="help">You'll authorize access on {{ preset.title }}. Keywright keeps the connection credentials; your agents use the access rules you choose here.</p>
+<details class="integration-advanced"><summary>Advanced connection settings</summary>
+{% else %}
+<label>Streamable HTTP URL</label><input type="url" name="url" value="{{ res.config.url if res else '' }}" required>
+{% endif %}
+{% set oauth = res.config.get('oauth', {}) if res else {} %}
+{% if not (preset and preset.url) %}
+<label>Authentication</label><select name="auth_type">
+<option value="headers" {{ 'selected' if not res or res.config.get('auth_type') != 'oauth' }}>Headers / API token</option>
+<option value="oauth" {{ 'selected' if res and res.config.get('auth_type') == 'oauth' }}>OAuth — connect in your browser</option>
+</select>
+<div class="help">Choose the authentication method required by your server. For OAuth, save and then connect in your browser.</div>
+{% endif %}
+<details style="margin-top:12px"><summary>Advanced OAuth settings</summary>
+<label>Client ID (optional)</label><input name="oauth_client_id" value="{{ oauth.get('client_id', '') }}" autocomplete="off">
+<div class="help">Leave blank for automatic client registration. For a pre-registered client, use the callback <code>{{ oauth_callback }}</code> on your configured public HTTPS URL.</div>
+<label>Client authentication</label><select name="oauth_auth_method">
+{% for method in ['none', 'client_secret_basic', 'client_secret_post'] %}<option value="{{ method }}" {{ 'selected' if oauth.get('token_endpoint_auth_method', 'none') == method }}>{{ method }}</option>{% endfor %}
+</select>
+<label>Client secret (optional; leave blank to keep stored secret)</label><input type="password" name="oauth_client_secret" autocomplete="new-password">
+<label>Scopes (optional, space separated)</label><input name="oauth_scope" value="{{ oauth.get('scope', '') }}">
+<div class="help">Leave blank to use the MCP server's advertised scopes.</div>
+<label>Additional OAuth origins (optional, comma separated)</label><input name="oauth_origins" value="{{ oauth.get('origins', []) | join(', ') }}" placeholder="https://login.example.com">
+<div class="help">The MCP server's origin is trusted by default. Add an origin only when your provider uses a separate authorization server.</div>
+</details>
+<label>Headers (one per line, <code>Name: value</code>; stored secrets show as ***)</label>
+<textarea name="headers">{% if res %}{% for k, v in res.config.headers.items() %}{{ k }}: {{ '***' if ('auth' in k.lower() or 'token' in k.lower() or 'key' in k.lower()) else v }}
+{% endfor %}{% endif %}</textarea>
+{% if preset and preset.url %}</details>{% endif %}
+{% endif %}
+<details class="integration-advanced"><summary>Advanced access settings</summary>
+<label for="result-inspection">MCP result inspection</label>
+{% set inspection_mode = res.config.get('result_inspection', 'off') if res else 'off' %}
+<select id="result-inspection" name="result_inspection_mode">
+<option value="off" {{ 'selected' if inspection_mode == 'off' }}>Off</option>
+<option value="observe" {{ 'selected' if inspection_mode == 'observe' }}>Observe and report</option>
+<option value="redact" {{ 'selected' if inspection_mode == 'redact' }}>Redact detected credentials</option>
+</select>
+<div class="help">Start with Observe to check compatibility: it reports findings and delivers original output. Redact removes configured credentials and recognizable secrets. Suspicious instructions are advisory only. Scanning is local; no external AI receives results. Images, audio, binary resources, linked content and results over 256 KiB cannot be fully inspected and are withheld in Redact mode. Results needing changes to structured data are also withheld to preserve the tool's output schema. The tool has already run when a result is withheld. Findings appear in the audit log and result metadata.</div>
+<label>Argument keys that qualify a call <span class="mut">(comma-separated dotted names, optional)</span></label>
+<input type="text" name="arg_keys" value="{{ (res.config.arg_keys or []) | join(', ') if res else ('site_id' if adapter == 'omada' else '') }}" placeholder="service, entity_id, data.entity_id, identifier">
+<div class="help">Each key present in a call adds a path such as <code>mcp/{{ res.name if res else 'ha' }}/tools/call_service/service=light.turn_on</code>. A rule or grant on the bare tool still covers every call; a deny on one qualifier blocks just that value. Without keys, calls are gated per tool.</div>
+<label style="margin-top:8px">Bundles <span class="mut">(one per line: <code>name: tools/ha_get_*, tools/ha_search</code>; agents request <code>mcp/{{ res.name if res else 'ha' }}/bundle/&lt;name&gt;</code>)</span></label>
+<textarea name="bundles_text" rows="5" placeholder="read-only: tools/ha_get_*, tools/ha_search&#10;destructive: tools/ha_restart, tools/ha_call_service/service=turn_off">{{ bundles_text(res.config.get('bundles')) if res else bundles_text(inventory_bundles) if adapter == 'keywright' else '' }}</textarea>
+<label style="margin-top:8px">Hazard catalog <span class="mut">(one per line: <code>high: tools/ha_manage_app, tools/ha_call_service/service=homeassistant.*</code>; severities medium, high, critical)</span></label>
+<textarea name="hazard_tools_text" rows="3" placeholder="high: tools/ha_manage_app&#10;critical: tools/ha_call_service/service=homeassistant.stop">{{ bundles_text(res.config.get('hazard_tools')) if res else '' }}</textarea>
+<div class="help">A tool whose name says delete, restart, reset… is flagged <b>medium</b> on its own (shown to you; access unchanged). <b>High</b> needs a fresh once-only approval whatever access exists; <b>critical</b> is refused. A qualifier such as <code>service=…</code> needs that argument key listed above.</div>
+<label class="inline" style="margin-top:8px"><input type="checkbox" name="audit_handle" value="1" {{ 'checked' if not res or res.config.get('audit_handle', True) }}> append a <code>[keywright] audit #…</code> line and <code>_meta.keywright</code> to results so agents can cite the approval</label>
+</details>
+{% endif %}
+<div class="integration-actions">{% if preset and preset.auth_type == 'oauth' and not res %}<button class="btn p" name="setup_action" value="connect">Continue to {{ preset.title }}</button><p>Saves this resource, then opens {{ preset.title }} sign-in.</p>{% else %}<button class="btn p">{{ 'Save' if res else 'Add resource' }}</button>{% endif %}</div>
+</form>
+{% if res and kind == 'mcp' and res.config.get('auth_type') == 'oauth' %}
+<h2>OAuth connection</h2>
+<p>Status: <strong>{{ {'connected': 'Connected', 'connecting': 'Sign-in pending', 'needs_reconnect': 'Reconnect required', 'disconnected': 'Disconnected'}.get(oauth_status, 'Disconnected') }}</strong></p>
+<div class="row">
+<form method="post" action="/ui/mcp-oauth/{{ res.id }}/connect"><button class="btn p">{{ 'Reconnect' if oauth_status == 'connected' else 'Connect' }}</button></form>
+<form method="post" action="/ui/mcp-oauth/{{ res.id }}/disconnect"><button class="btn">Disconnect</button></form>
+</div>
+<div class="help">Disconnect removes Keywright's saved tokens. To revoke the provider's authorization too, remove Keywright in the provider's connection settings.</div>
+{% endif %}
+{% if res and kind == 'llm' and leases %}
+<h2>Gateway</h2>
+{% if leases.enforced %}<p class="small"><span class="pill ok">Budgets enforced</span> LiteLLM {{ leases.health.version }} · database connected · checked {{ leases.health.checked_at[:16] | replace('T', ' ') }}</p>
+{% elif leases.health %}<p class="small"><span class="pill deny">Budget enforcement unavailable</span> LiteLLM reports its database <code>{{ leases.health.db }}</code>. Budgets are read from that database; without it the proxy serves past every limit, so no key is minted until it is connected.</p>
+{% else %}<p class="small mut">Not probed yet. <b>Test connection</b> checks the database and refreshes the model list.</p>{% endif %}
+<h2>Active leases</h2>
+{% if leases.leases %}
+<table class="data-table"><thead><tr><th>Agent</th><th>Models</th><th>Spent / ceiling</th><th>Time left</th></tr></thead><tbody>
+{% for k in leases.leases %}<tr><td>{{ k.agent }}</td><td class="small">{{ k.row.models | join(', ') }}</td>
+<td>{% if k.spend %}${{ '%.2f' | format(k.spend.spend) }}{% else %}?{% endif %} / ${{ '%.2f' | format(k.row.limits.max_budget or 0) }}</td>
+<td class="small mut">{{ k.remaining }}{% if k.row.request_id %} · <a href="/ui/requests/{{ k.row.request_id }}">Approval</a>{% endif %}</td></tr>{% endfor %}
+</tbody></table>
+<p class="small"><b>Exposure remaining: ${{ '%.2f' | format(leases.exposure) }}</b> <span class="mut">· what every active lease on this gateway could still spend if it all went wrong right now</span></p>
+{% else %}<p class="small mut">No active leases. Nothing can be spent through this gateway until you approve a request.</p>{% endif %}
+{% endif %}
+{% if res and kind == 'mcp' %}
+<form method="post" action="/ui/resources/{{ res.id }}/suggest-bundles" class="row" style="margin-top:8px"><button class="btn">Suggest bundles from the tool list</button>
+<span class="small mut">groups upstream tools by verb (get/list → read-only, call/run → control, remove/restart → destructive, set/create → config-write); adds only names you don't have</span></form>
+{% endif %}
+{% if res and kind == 'ssh' %}
+<h2>Key &amp; enrolment</h2>
+{% if not (key and key.exists) %}
+<form method="post" action="/ui/resources/{{ res.id }}/keygen" class="row"><button class="btn p">Generate key on this Keywright</button>
+<span class="small mut">ed25519, stored at {{ keys_dir }}/{{ res.name }}, never leaves this machine</span></form>
+{% else %}
+<div class="grid">
+<details class="card enrollment-option">
+<summary>Enrol with a password <span class="small mut">(used once, not stored)</span></summary>
+<form method="post" action="/ui/resources/{{ res.id }}/enroll">
+<label>Log in as <span class="mut">(leave blank for {{ res.config.user }}; set this when root can't SSH with a password)</span></label>
+<input type="text" name="login_user" placeholder="{{ res.config.user }}" autocomplete="off">
+<label>That user's password</label><input type="password" name="password" required autocomplete="off">
+<label>Become {{ res.config.user }} via</label>
+<select name="escalate"><option value="">not needed (logging in as {{ res.config.user }})</option><option value="sudo">sudo</option><option value="su">su -</option></select>
+<label>Root password <span class="mut">(for su; for sudo only if it differs from the login password)</span></label>
+<input type="password" name="root_password" autocomplete="off">
+<label class="inline" style="margin-top:8px"><input type="checkbox" name="restrict" value="1" checked> restrict the key to this Keywright's IP (<code>from=</code>)</label>
+<div style="margin-top:10px"><button class="btn p">Install key &amp; verify</button></div>
+</form>
+<div class="help">Connects once, appends the public key to <code>~/.ssh/authorized_keys</code>, pins the host key, then re-connects with the key to prove it works.</div>
+</details>
+<details class="card enrollment-option" open>
+<summary>Run a command on the host</summary>
+<p class="small mut">As the login user; link valid 30 min.</p>
+<pre style="white-space:pre-wrap">{{ key.enroll_cmd }}</pre>
+<div class="help">Then press <b>Test connection</b> below to pin the host key. Set the Keywright outbound IP in Settings to have this script add a <code>from=</code> restriction.</div>
+</details>
+</div>
+{% endif %}
+{% endif %}
+{% if res %}
+<div class="row" style="margin-top:12px">
+<form method="post" action="/ui/resources/{{ res.id }}/probe"><button class="btn">Test connection</button></form>
+<form method="post" action="/ui/resources/{{ res.id }}/delete" onsubmit="return confirm('Delete this resource?')"><button class="btn bad">Delete</button></form>
+</div>{% endif %}
+</div>
+</div>
+{% endblock %}

keywright_server/web/templates/resources.html

@@ -0,0 +1,76 @@
+{% extends "base.html" %}{% from "_icons.html" import icon %}
+{% block title %}Resources{% endblock %}{% block body %}
+{% include "_infrastructure_nav.html" %}
+<div class="collection-heading">
+<h1>Resources</h1>
+<a class="btn p" href="/ui/resources/new">+ Add resource</a>
+</div>
+<p class="page-intro collection-intro">Manage the systems and endpoints your agents can reach.</p>
+{% if rows %}
+<form method="get" class="resource-organize row">
+<label for="resource-sort">Sort</label><select id="resource-sort" name="sort">{% for key,label in [('type','Type'),('name','Name'),('ip','IP address')] %}<option value="{{ key }}" {{ 'selected' if sort==key }}>{{ label }}</option>{% endfor %}</select>
+<label for="resource-group">Group</label><select id="resource-group" name="group">{% for key,label in [('none','None'),('host','Inventory host'),('network','Network')] %}<option value="{{ key }}" {{ 'selected' if group==key }}>{{ label }}</option>{% endfor %}</select><button class="btn sm">Apply</button>
+</form>
+<div id="resource-filters" hidden>
+<div class="resource-tabs" role="group" aria-label="Filter by resource type">
+{% for kind, label in [('all', 'All'), ('ssh', 'SSH'), ('mcp', 'MCP'), ('llm', 'LLM')] %}<button type="button" data-kind="{{ kind }}" aria-pressed="{{ 'true' if kind == 'all' else 'false' }}">{{ label }}</button>{% endfor %}
+</div>
+<div class="resource-search">{{ icon('search') }}<input type="search" id="resource-search" placeholder="Search resources…" aria-label="Search resources" autocomplete="off"></div>
+</div>
+{% endif %}
+<div class="resource-list">
+{% for r in rows %}
+{% if group!='none' and loop.changed(resource_groups[r.id]) %}<div class="resource-group-heading" data-group-heading="{{ resource_groups[r.id] }}">{{ resource_groups[r.id] }}</div>{% endif %}
+<article class="resource-card" data-group="{{ resource_groups[r.id] }}" data-resource-kind="{{ r.kind }}" data-search="{{ resource_groups[r.id] }} {{ resource_assets[r.id].name if resource_assets.get(r.id) else '' }} {{ r.name }} {{ r.description }} {{ r.kind }} {{ r.default_mode }} {% if r.kind == 'ssh' %}{{ r.config.user }} {{ r.config.host }} {{ r.config.get('port', 22) }}{% else %}{{ r.config.url }}{% endif %}">
+<a class="resource-link" href="/ui/resources/{{ r.id }}">
+<span class="resource-icon {{ r.kind }}">{{ icon(r.kind) }}</span>
+<div class="resource-copy"><h2>{{ r.name }}</h2><div class="resource-endpoint">{{ 'Omada' if r.config.get('adapter') == 'omada' else r.kind | upper }} · {% if r.kind == 'ssh' %}{{ r.config.user }}@{{ r.config.host }}:{{ r.config.get('port', 22) }}{% elif r.kind == 'llm' %}{{ r.config.url }} · {{ (r.config.models or []) | length }} models · ${{ '%.2f' | format((r.config.limits or {}).get('max_budget', 2.0)) }} per lease{% elif r.config.get('adapter') == 'keywright' %}Built-in inventory and topology{% else %}{{ r.config.url }}{% endif %}</div></div>
+<span class="resource-chevron">{{ icon('chevron') }}</span>
+</a>
+<div class="resource-labels">{% if resource_assets.get(r.id) %}<a class="resource-host" href="/ui/inventory/assets/{{ resource_assets[r.id].id }}">{{ resource_assets[r.id].name }}</a>{% endif %}<span class="resource-mode {{ r.default_mode }}"><span aria-hidden="true"></span>{{ {'open': 'Open access', 'approval': 'Approval required', 'locked': 'Locked'}.get(r.default_mode, r.default_mode) }}</span>{% if r.kind == 'mcp' and r.config.tools_drift %}<a class="resource-warning" href="/ui/access?resource={{ r.id }}">Tools changed · review</a>{% endif %}{% if r.kind == 'ssh' and not r.config.host_key %}<span class="resource-warning">Host key not pinned</span>{% endif %}{% if r.kind == 'llm' %}<span class="pill">Billable</span>{% if (r.config.health or {}).get('db') != 'connected' %}<span class="resource-warning">Budget enforcement unavailable · no key will be minted</span>{% endif %}{% endif %}</div>
+{% if r.description %}<p class="resource-description">{{ r.description }}</p>{% endif %}
+<details class="resource-actions action-menu"><summary aria-label="Actions for {{ r.name }}">{{ icon('more') }}</summary><div class="action-menu-items"><a href="/ui/resources/{{ r.id }}">Edit resource</a><a href="{{ '/ui/inventory/assets/' ~ resource_assets[r.id].id if resource_assets.get(r.id) else '/ui/inventory/assets/new?resource=' ~ r.id }}">{{ 'View inventory' if resource_assets.get(r.id) else 'Add to inventory' }}</a>{% if r.kind in ('mcp', 'llm') %}<a href="/ui/access?resource={{ r.id }}">Edit access</a>{% endif %}<form method="post" action="/ui/resources/{{ r.id }}/probe"><button type="submit">Test connection</button></form></div></details>
+</article>
+{% else %}<div class="collection-empty card">{{ icon('mcp') }}<h2>No resources yet</h2><p class="mut">Choose an integration or set up a custom connection.</p><a class="btn p" href="/ui/resources/new">+ Add resource</a></div>{% endfor %}
+</div>
+<div id="resource-empty" class="collection-empty card" hidden><h2>No matching resources</h2><p class="mut">Try a different name, endpoint, or resource type.</p><button type="button" class="btn" id="resource-reset">Clear filters</button></div>
+{% if rows %}<p class="resource-count mut small" id="resource-count" role="status">Showing {{ rows|length }} resource{{ '' if rows|length == 1 else 's' }}</p>{% endif %}
+<details class="resource-help"><summary>About resource access</summary><p class="small mut">Default <b>open</b> = allowed &amp; audited, <b>approval</b> = ask, <b>locked</b> = only explicit rules. Access modes do not indicate connection health. Use “Test connection” in a resource’s menu to check connectivity.</p><p class="small mut">Permission paths: <code>ssh/&lt;name&gt;/exec/&lt;command&gt;[/&lt;subcommand&gt;]</code>, <code>mcp/&lt;name&gt;/tools/&lt;tool&gt;</code> and <code>llm/&lt;name&gt;/model/&lt;model&gt;</code>.</p></details>
+{% endblock %}
+{% block scripts %}
+<script>
+(function () {
+  var controls = document.getElementById('resource-filters');
+  if (!controls) return;
+  controls.hidden = false;
+  var search = document.getElementById('resource-search');
+  var cards = Array.from(document.querySelectorAll('[data-resource-kind]'));
+  var buttons = Array.from(controls.querySelectorAll('[data-kind]'));
+  var kind = 'all';
+  function filter() {
+    var query = search.value.trim().toLowerCase();
+    var count = 0;
+    cards.forEach(function (card) {
+      var matches = (kind === 'all' || card.dataset.resourceKind === kind) && card.dataset.search.toLowerCase().includes(query);
+      card.hidden = !matches;
+      if (matches) count++;
+      else card.querySelector('details').open = false;
+    });
+    document.querySelectorAll('[data-group-heading]').forEach(function (heading) { heading.hidden = !cards.some(function (card) { return !card.hidden && card.dataset.group === heading.dataset.groupHeading; }); });
+    buttons.forEach(function (button) { button.setAttribute('aria-pressed', String(button.dataset.kind === kind)); });
+    document.getElementById('resource-count').textContent = 'Showing ' + count + ' of ' + cards.length + ' resource' + (cards.length === 1 ? '' : 's');
+    document.getElementById('resource-empty').hidden = count !== 0;
+  }
+  buttons.forEach(function (button) { button.addEventListener('click', function () { kind = button.dataset.kind; filter(); }); });
+  search.addEventListener('input', filter);
+  document.getElementById('resource-reset').addEventListener('click', function () { kind = 'all'; search.value = ''; filter(); search.focus(); });
+})();
+document.querySelectorAll('.action-menu').forEach(function (menu) {
+  menu.addEventListener('toggle', function () {
+    if (menu.open) document.querySelectorAll('.action-menu').forEach(function (other) { if (other !== menu) other.open = false; });
+  });
+  menu.addEventListener('keydown', function (event) { if (event.key === 'Escape') { menu.open = false; menu.querySelector('summary').focus(); } });
+  document.addEventListener('click', function (event) { if (!menu.contains(event.target)) menu.open = false; });
+});
+</script>
+{% endblock %}

keywright_server/web/templates/settings.html

@@ -0,0 +1,53 @@
+{% extends "base.html" %}{% block title %}Settings{% endblock %}{% block body %}
+<h1>Settings</h1>
+<div class="card"><h2 style="margin-top:0">General</h2>
+<form method="post" action="/ui/settings/general">
+<label>Public URL (used in notification links and enrol commands)</label><input type="url" name="public_url" value="{{ general.public_url }}" placeholder="http://keywright.lan:8700">
+<label>Outbound IP of this Keywright (optional; adds <code>from=</code> to keys enrolled with the paste-able script)</label><input type="text" name="outbound_ip" value="{{ general.outbound_ip or '' }}" placeholder="10.0.0.2">
+<div style="margin-top:10px"><button class="btn p">Save</button></div></form></div>
+
+<div class="card"><h2 style="margin-top:0">Jev second opinion</h2>
+<div class="help">Jev (TypeSafe) reads each operation that is about to ask you and answers what it does and whether the agent's stated reason fits. Commands, paths, tool arguments and the reason are sent to TypeSafe; resource names are not, and values that look like credentials stop the call. Nothing is sent for operations already allowed, denied or refused.</div>
+{% if not jev_configured %}<div class="hazard medium" style="margin-top:8px"><b>No key.</b> Set <code>KW_TYPESAFE_API_KEY</code> in the broker's environment to enable this.</div>{% endif %}
+<form method="post" action="/ui/settings/semantic" style="margin-top:8px">
+<label class="inline"><input type="radio" name="mode" value="off" {{ 'checked' if jev.mode == 'off' }} {{ 'disabled' if not jev_configured }}> Off</label>
+<label class="inline"><input type="radio" name="mode" value="shadow" {{ 'checked' if jev.mode == 'shadow' }} {{ 'disabled' if not jev_configured }}> Shadow: record the verdict and show it to me; I decide everything</label>
+<label class="inline mut"><input type="radio" name="mode" value="trust" {{ 'checked' if jev.mode == 'trust' }} {{ '' if jev_trust_selectable and jev_configured else 'disabled' }}> Trust: a clean verdict on an unflagged, exactly-bound read with a reason that fits is approved once in Jev's name; everything else asks me{% if not jev_trust_selectable %} <span class="small">(disabled until shadow data earns it)</span>{% endif %}</label>
+<div class="row" style="margin-top:8px"><div><label>Timeout (seconds)</label><input type="number" name="timeout_s" min="1" max="30" step="0.5" value="{{ jev.timeout_s }}"></div>
+<div><label>Daily call cap</label><input type="number" name="daily_cap" min="0" max="100000" value="{{ jev.daily_cap }}"></div></div>
+<div class="help">Past the timeout or the cap the request goes to you without a verdict. Under trust, no verdict is never an approval.</div>
+<div style="margin-top:10px"><button class="btn p" {{ 'disabled' if not jev_configured }}>Save</button></div></form>
+{% if jev_tally.verdicts %}<div class="help" style="margin-top:10px"><b>Shadow so far:</b> {{ jev_tally.verdicts }} verdicts ({{ jev_tally.no_verdict }} without an answer), {{ jev_tally.safe }} judged safe. Would have auto-approved {{ jev_tally.would_auto }}: you approved {{ jev_tally.would_auto_approved }} and denied <b>{{ jev_tally.would_auto_denied }}</b> of those. Judged unsafe but approved by you: {{ jev_tally.unsafe_approved }}.</div>{% endif %}
+</div>
+
+<div class="card"><h2 style="margin-top:0">Notifications</h2>
+<div class="small mut">Active: <b>{{ notifier.driver_id }}</b>{% if notifier.last_error %} · <span style="color:var(--bad)">{{ notifier.last_error }}</span>{% endif %}</div>
+<form method="post" action="/ui/settings/notifications">
+<label>Driver</label>
+<select name="driver" onchange="this.form.action='/ui/settings/notifications/probe';this.form.submit()">
+{% for id, cls in drivers.items() %}<option value="{{ id }}" {{ 'selected' if id == notif.driver }}>{{ cls.label }}</option>{% endfor %}</select>
+<div class="help">{{ driver.description }}</div>
+{% for f in driver.fields %}
+<label>{{ f.label }}{% if f.required %} *{% endif %}</label>
+{% set val = notif.config.get(f.name) %}
+{% if f.type == 'multiselect' %}
+  {% set opts = f.options or (notif.choices or {}).get(f.options_from_probe) or [] %}
+  {% if not opts %}<div class="help">No options yet: fill the fields above and press <b>Probe</b>.</div>{% endif %}
+  {% for o in opts %}<div><label class="inline"><input type="checkbox" name="{{ f.name }}" value="{{ o[0] }}" {{ 'checked' if val and o[0] in val }}> {{ o[1] }} <span class="mono mut small">{{ o[0] }}</span></label></div>{% endfor %}
+{% elif f.type == 'select' %}<select name="{{ f.name }}">{% for o in f.options %}<option value="{{ o[0] }}" {{ 'selected' if val == o[0] }}>{{ o[1] }}</option>{% endfor %}</select>
+{% elif f.type == 'checkbox' %}<label class="inline"><input type="checkbox" name="{{ f.name }}" {{ 'checked' if val }}> {{ f.help }}</label>
+{% elif f.type == 'textarea' %}<textarea name="{{ f.name }}">{{ val or '' }}</textarea>
+{% else %}<input type="{{ 'password' if f.type == 'password' else ('url' if f.type == 'url' else 'text') }}" name="{{ f.name }}" value="{{ ('***' if val else '') if f.type == 'password' else (val or '') }}" {{ 'required' if f.required }}>
+{% endif %}
+{% if f.help and f.type != 'checkbox' %}<div class="help">{{ f.help }}</div>{% endif %}
+{% endfor %}
+<label>Buttons on the notification (max {{ driver.max_actions }} for {{ driver.label }}; Always is UI-only on purpose)</label>
+{% for b in ['once','session','ttl15','path15','ttl30','ttl','deny'] %}<label class="inline" style="margin-right:14px"><input type="checkbox" name="buttons" value="{{ b }}" {{ 'checked' if b in (notif.buttons or default_buttons) }}> {{ scope_labels[b] }}</label>{% endfor %}
+<div class="row" style="margin-top:12px">
+<button class="btn p">Save</button>
+<button class="btn" formaction="/ui/settings/notifications/probe">Probe</button>
+</div>
+</form>
+<form method="post" action="/ui/settings/notifications/test" style="margin-top:8px"><button class="btn sm">Send a test request</button> <span class="small mut">creates a real pending request (10 min) in the first agent's name</span></form>
+</div>
+{% endblock %}

keywright_server/web/templates/setup.html

@@ -0,0 +1,8 @@
+{% extends "base.html" %}{% set hide_nav = True %}{% block title %}Keywright setup{% endblock %}{% block body %}
+<div class="card auth-card"><h1 class="brand">{{ icon('shield') }}Set up Keywright</h1>
+<p class="small">Set the admin password for this Keywright. Then add resources, create an agent, and pick a notification driver.</p>
+<form method="post" action="/ui/setup">
+<label>Password (8+ chars)</label><input type="password" name="password" required autofocus>
+<label>Repeat</label><input type="password" name="repeat" required>
+<div style="margin-top:12px"><button class="btn p">Set password</button></div></form></div>
+{% endblock %}

keywright_server/web/templates/usage.html

@@ -0,0 +1,84 @@
+{% extends "base.html" %}
+{% block title %}LLM usage · Keywright{% endblock %}
+{% macro number(value) %}{{ '{:,}'.format(value) }}{% endmacro %}
+{% macro counts(t) %}
+<td data-label="Requests">{{ number(t.requests) }}</td>
+<td data-label="Input">{{ number(t.input) }}</td>
+<td data-label="Output">{{ number(t.output) }}</td>
+<td data-label="Total tokens">{{ number(t.total) }}</td>
+<td data-label="Coverage">{{ number(t.reported) }}/{{ number(t.requests) }} reported{% if t.partial %}<div class="help">{{ t.partial }} partial</div>{% endif %}</td>
+<td data-label="Errors">{{ number(t.errors) }}</td>
+{% endmacro %}
+{% macro headings(first) %}<thead><tr><th>{{ first }}</th><th>Requests</th><th>Input</th><th>Output</th><th>Total tokens</th><th>Coverage</th><th>Errors</th></tr></thead>{% endmacro %}
+{% block body %}
+<h1>LLM usage</h1>
+<p class="page-intro">Track model activity across providers and see which agents and gateway keys drive it.</p>
+<form method="get" action="/ui/usage" class="card">
+  <div class="grid">
+    <div><label for="usage-start">From (UTC)</label><input id="usage-start" type="date" name="start" value="{{ filters.start }}" required></div>
+    <div><label for="usage-end">Through (UTC)</label><input id="usage-end" type="date" name="end" value="{{ filters.end }}" required></div>
+    {% for dimension, label in [('provider', 'Provider / gateway'), ('model', 'Model'), ('agent', 'Agent'), ('key', 'Gateway key')] %}
+    <div><label for="usage-{{ dimension }}">{{ label }}</label><select id="usage-{{ dimension }}" name="{{ dimension }}">
+      <option value="">All {{ {'provider': 'providers / gateways', 'model': 'models', 'agent': 'agents', 'key': 'gateway keys'}[dimension] }}</option>
+      {% for value, name in options[dimension] %}<option value="{{ value }}" {{ 'selected' if filters[dimension] == value }}>{{ name }}</option>{% endfor %}
+      {% if filters[dimension] and filters[dimension] not in dict(options[dimension]) %}<option value="{{ filters[dimension] }}" selected>Selected {{ label | lower }} (no usage in this period)</option>{% endif %}
+    </select></div>
+    {% endfor %}
+  </div>
+  <div class="row"><button class="btn p">Apply filters</button><a class="btn" href="/ui/usage">Reset</a><span class="mut">Dates are inclusive. Ranked by reported tokens, then requests.</span></div>
+</form>
+<div class="grid stats">
+  <div class="card"><div class="mut">Requests</div><div class="stat">{{ number(totals.requests) }}</div><div class="help">{{ totals.errors }} errors</div></div>
+  <div class="card"><div class="mut">Reported tokens</div><div class="stat">{{ number(totals.total) }}</div><div class="help">{{ number(totals.input) }} input · {{ number(totals.output) }} output</div></div>
+  <div class="card"><div class="mut">Provider / gateways</div><div class="stat">{{ providers | length }}</div><div class="help">{{ models | length }} model names</div></div>
+  <div class="card"><div class="mut">Requests with usage</div><div class="stat">{{ totals.reported }} / {{ totals.requests }}</div><div class="help">{{ totals.unreported }} unreported · {{ totals.partial }} partial</div></div>
+</div>
+<p class="help">Usage observed by the Keywright proxy, including failed upstream attempts. Denied requests and model listings are excluded. Missing usage is unknown, not zero; totals include only reported counts. Input includes cache reads and writes. Older streams, compressed responses, and streams without usage may be unreported. Direct provider calls and provider billing costs are not included.</p>
+{% if totals.requests %}
+<h2>Providers → models</h2>
+<p class="mut">Each provider is a configured gateway. The same model stays separate under each gateway.</p>
+{% for p in providers %}
+<details class="card usage-provider" {{ 'open' if filters.provider or providers | length == 1 }}>
+  <summary><strong>{{ p.name }}</strong><span>{{ number(p.totals.total) }} tokens · {{ number(p.totals.requests) }} requests</span></summary>
+  <p><a href="{{ usage_url(provider=p.id, key='') }}">Focus on {{ p.name }}</a></p>
+  <table class="data-table">{{ headings('Model') }}<tbody>
+    {% for m in p.models.values() | sort(attribute='totals.total', reverse=true) %}
+    <tr><td data-label="Model" class="wide"><a href="{{ usage_url(provider=p.id, model=m.name, key='') }}">{{ m.name }}</a></td>{{ counts(m.totals) }}</tr>
+    {% endfor %}
+  </tbody></table>
+</details>
+{% endfor %}
+<h2>Models across selected providers</h2>
+<div class="card"><table class="data-table">{{ headings('Model') }}<tbody>
+{% for name, t in models %}<tr><td data-label="Model" class="wide"><a href="{{ usage_url(model=name, key='') }}">{{ name }}</a></td>{{ counts(t) }}</tr>{% endfor %}
+</tbody></table></div>
+<h2>Keys driving usage</h2>
+<div class="card"><table class="data-table">{{ headings('Gateway key / agent') }}<tbody>
+{% for k in keys %}<tr><td data-label="Gateway key / agent" class="wide">
+  <a href="{{ usage_url(key=k.id) }}">{{ k.alias }}</a><div>{{ k.agent }} · {{ k.provider }}</div>
+  <div class="help">{{ k.models | sort | join(', ') }}</div>{% if not k.key_id.startswith('legacy:') %}<div class="help">{{ k.key_id }}</div>{% endif %}
+</td>{{ counts(k.totals) }}</tr>{% endfor %}
+</tbody></table></div>
+<h2>Daily usage (UTC)</h2>
+<div class="card"><table class="data-table">{{ headings('Date') }}<tbody>
+{% for day, t in days | reverse %}<tr><td data-label="Date"><a href="{{ usage_url(start=day, end=day) }}">{{ day }}</a></td>{{ counts(t) }}</tr>{% endfor %}
+</tbody></table></div>
+<details class="card"><summary>Recent requests · latest {{ recent | length }} matching calls</summary>
+<table class="data-table"><thead><tr><th>Time (UTC)</th><th>Provider / model</th><th>Agent / key</th><th>Tokens</th><th>Result</th></tr></thead><tbody>
+{% for event in recent %}<tr>
+  <td data-label="Time (UTC)"><a href="/ui/audit?q=%23{{ event.id }}">{{ event.ts.strftime('%Y-%m-%d %H:%M:%S') }}</a></td>
+  <td data-label="Provider / model">{{ event.provider }}<div>{{ event.model }}</div></td>
+  <td data-label="Agent / key">{{ event.agent }}<div class="help">{{ event.alias }}</div></td>
+  <td data-label="Tokens">{{ number(event.total) if event.total is not none else 'Unreported' }}</td>
+  <td data-label="Result"><span class="pill {{ event.decision }}">{{ event.decision }}</span></td>
+</tr>{% endfor %}</tbody></table></details>
+{% else %}
+<div class="card"><h2>No usage in this selection</h2><p>Try a wider date range or clear the filters. Model calls through Keywright will appear here after their responses finish.</p></div>
+{% endif %}
+<style>
+.usage-provider>summary{display:flex;flex-wrap:wrap;justify-content:space-between;gap:8px;cursor:pointer;min-height:36px;align-items:center}
+.usage-provider>summary strong::before{content:'▸';display:inline-block;margin-right:8px}.usage-provider[open]>summary strong::before{content:'▾'}
+input[type=date]{width:100%;padding:6px 8px;border:1px solid var(--line);border-radius:var(--r);background:var(--bg);color:var(--fg);font:inherit}
+@media(max-width:900px){input[type=date]{font-size:16px}}
+</style>
+{% endblock %}