Add Project Home, Auth Bridge, shared auth token, and Tier-1 polish

Project Home (DESIGN-REVIEW §B2): the project is promoted from a 280px
sidebar card to a first-class main-area view. ProjectCard.tsx (1,257
lines) is replaced by a select-only ProjectRow plus tabs for Overview,
Sessions, Automation, Config and Files. The PortMappings, FileManager
and ContainerProgress modals are absorbed rather than reimplemented.
Config gains a Saved/Saving/Failed indicator — save-on-blur failures
previously reached only console.error.

Tier-1 polish (DESIGN-REVIEW §A): new elevation, muted-accent, disabled
and focus-ring tokens; a global :focus-visible ring with every
focus:outline-none removed; filled buttons moved to --accent-emphasis
and white-on-success toggles retired, fixing three WCAG AA failures
(2.1:1, 2.5:1, 2.4:1); a shared Modal primitive with role="dialog",
focus trap and restore, adopted by all remaining modals; status
indicators that carry a glyph and word rather than colour alone.

Ctrl+Shift+W closes a tab, deliberately not Ctrl+W — that is readline's
kill-word, used constantly in the terminal this app is built around.

Auth Bridge: a general loopback-callback bridge so browser logins run
inside a container (aws sso login, Concourse fly login, claude login)
can complete against the host browser. Listeners are discovered from
/proc/net/tcp{,6} — ss/netstat/lsof are absent from the image — bound on
host 127.0.0.1 only, and tunnelled in over the Docker API via socat,
which keeps working on Docker Desktop where container IPs are not
routable. Falls back to [::1] because Node resolves localhost to IPv6
first, so claude login often binds ::1 alone. Opt-in per project.

This extracts create_attached_exec() and moves the existing terminal
session path onto it, so there is one attached-exec implementation
rather than two.

Shared auth token: `claude setup-token` is run in a container, the token
is stored in the OS keychain and injected as CLAUDE_CODE_OAUTH_TOKEN
into Anthropic-backend projects. Contrary to the initial design note,
setup-token uses an Anthropic-hosted redirect and blocks on a stdin
paste prompt rather than a loopback callback, so a stdin command is
required for the flow to complete.

The token is never logged, never returned to the frontend, and is
redacted from the streamed output with a stateful matcher that withholds
any tail that could still grow into a secret. Change detection uses a
random rotation id rather than a hash, since a hash in a docker-inspect
readable label would be an offline verification oracle.

Frontend 33 -> 51 tests; Rust 34 tests. Both builds clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/src/lib/tauri-commands.ts

@@ -1,5 +1,5 @@
 import { invoke } from "@tauri-apps/api/core";
-import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, SchedulerNotification } from "./types";
+import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, SchedulerNotification, AuthBridgeStatus } from "./types";
 
 // Docker
 export const checkDocker = () => invoke<boolean>("check_docker");
@@ -133,3 +133,30 @@ export const getSchedulerNotifications = (projectId: string) =>
   invoke<SchedulerNotification[]>("get_scheduler_notifications", { projectId });
 export const clearSchedulerNotifications = (projectId: string) =>
   invoke<void>("clear_scheduler_notifications", { projectId });
+
+// Auth bridge — mirrors container loopback listeners onto host loopback so
+// browser OAuth logins started inside the container can complete.
+export const setAuthBridgeEnabled = (projectId: string, enabled: boolean) =>
+  invoke<AuthBridgeStatus>("set_auth_bridge_enabled", { projectId, enabled });
+export const getAuthBridgeStatus = (projectId: string) =>
+  invoke<AuthBridgeStatus>("get_auth_bridge_status", { projectId });
+
+// Shared Claude Code auth token — one `claude setup-token` run authenticates
+// every Anthropic-backend project. The token itself is never exposed here: it
+// lives in the OS keychain and is injected as a container env var.
+//
+// `acquireClaudeToken` borrows the given project's running container to run the
+// login (temporarily enabling its auth bridge), and streams progress on the
+// `claude-token-progress` and `claude-token-output` events. It resolves only
+// once the whole flow finishes, so call it without awaiting the UI on it.
+//
+// Partway through, `claude setup-token` prints a sign-in URL and then waits at
+// a "Paste code here" prompt: the user signs in, copies the code shown by
+// Anthropic, and it is delivered with `submitClaudeTokenCode`. One flow at a
+// time — a second `acquireClaudeToken` call rejects while one is in progress.
+export const acquireClaudeToken = (projectId: string) =>
+  invoke<void>("acquire_claude_token", { projectId });
+export const submitClaudeTokenCode = (code: string) =>
+  invoke<void>("submit_claude_token_code", { code });
+export const hasClaudeToken = () => invoke<boolean>("has_claude_token");
+export const clearClaudeToken = () => invoke<void>("clear_claude_token");

app/src/lib/types.ts

@@ -27,6 +27,14 @@ export interface Project {
   allow_docker_access: boolean;
   sandbox_mode_enabled: boolean;
   mission_control_enabled: boolean;
+  /** Mirror container loopback listeners onto host loopback so in-container
+   *  browser OAuth logins can complete. Host-side only — no container recreate. */
+  auth_bridge_enabled: boolean;
+  /** Use the shared long-lived Claude Code token (from `claude setup-token`,
+   *  held in the OS keychain) instead of this project's own `claude login`.
+   *  Defaults to true; only applies when `backend` is "anthropic" and a token
+   *  has actually been stored. */
+  use_shared_auth_token: boolean;
   /** Legacy binary permission flag; superseded by `permission_mode`, kept for
    *  existing projects.json data. */
   full_permissions: boolean;
@@ -293,3 +301,51 @@ export interface SchedulerNotification {
   body: string;
   created_at: string;
 }
+
+// ── Auth bridge ──────────────────────────────────────────────────────────────
+
+/** Which loopback family the container-side listener was found on.
+ *  Mirrors Rust `PortFamily` (serde lowercase). */
+export type AuthBridgePortFamily = "v4" | "v6" | "dual";
+
+/** A container loopback port currently mirrored onto the host's loopback. */
+export interface BridgedPort {
+  port: number;
+  family: AuthBridgePortFamily;
+  /** RFC 3339 timestamp of when the host listener was bound. */
+  bridged_at: string;
+}
+
+/** A discovered loopback listener that could not be bridged (host port taken). */
+export interface PortConflict {
+  port: number;
+  reason: string;
+}
+
+export interface AuthBridgeStatus {
+  enabled: boolean;
+  active_ports: BridgedPort[];
+  conflicts: PortConflict[];
+}
+
+/** Payload of the `auth-bridge-changed` event, emitted whenever the bridged
+ *  port set or the conflict set changes for a project. */
+export interface AuthBridgeChangedEvent {
+  project_id: string;
+  status: AuthBridgeStatus;
+}
+
+/** Payload of the `claude-token-progress` event: milestones during
+ *  `acquire_claude_token`. Never contains the token. */
+export interface ClaudeTokenProgressEvent {
+  project_id: string;
+  message: string;
+}
+
+/** Payload of the `claude-token-output` event: output from
+ *  `claude setup-token`, so the UI can show the URL the user must visit.
+ *  Credentials are redacted backend-side before the event is emitted. */
+export interface ClaudeTokenOutputEvent {
+  project_id: string;
+  chunk: string;
+}