Let a project's container run a VPN client

A VPN client installed in a container today starts, runs, and then hangs
until its connection times out. Nothing reports an error: a default
container has no /dev/net/tun to open and no CAP_NET_ADMIN to add an
interface or a route with, and clients surface that as a generic timeout
rather than a permissions failure.

Add an opt-in per-project "VPN support" switch granting the three things
a tunnel needs. They are useless individually, which is why
vpn_host_config() defines the set in one place and the tests assert all
of it:

  * CAP_NET_ADMIN — Docker's default bounding set has net_raw but not
    net_admin, so a client can ping but never connect.
  * /dev/net/tun — passed through from the host so the kernel's tun
    module backs it, rather than mknod-ed inside.
  * net.ipv4.conf.all.src_valid_mark — WireGuard's wg-quick sets this and
    cannot from inside a container, /proc/sys being read-only, so its
    handshakes are dropped by reverse-path filtering.

Off by default and deliberately opt-in: NET_ADMIN lets anything in the
container reconfigure that container's network stack. It is namespaced —
no authority over the host's interfaces or any other container.

Capabilities and devices are fixed when a container is created, so this
is container state and takes the label-and-compare treatment.
triple-c.vpn-support is written unconditionally, false included, for the
usual docker commit reason: a true stamped once would ride the snapshot
image into every future container and make the switch impossible to turn
back off. A missing label reads as false and off is byte-identical to
today, so no existing project is churned.

Requesting the device fails at creation when the host kernel has no tun
module, which would otherwise surface as a project that simply refuses to
start. explain_create_failure() rewrites that one error to name the
switch and the Docker-Desktop-VM-versus-your-machine distinction, and
leaves every other failure untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-app-preview.yml

@@ -1,10 +1,67 @@
 name: Build App (Preview)
 
-# Builds the Tauri app for branches other than main and exposes the bundles as
+# Builds the Tauri app for branches other than main and publishes the bundles as
-# workflow artifacts. No Gitea release, no GitHub sync — intended for local
+# a **prerelease**, so they are downloadable from the Releases page. No GitHub
-# smoke-testing of feature branches before they merge.
+# sync.
+#
+# This is also the **PR build check**: it compiles Linux, macOS and Windows, so
+# a push that breaks any of them fails here. build-app.yml used to do that job
+# in parallel and publish nothing, which meant six OS builds per push and one
+# unreachable set of bundles; it is now releases-only.
+#
+# The cost of the swap, stated plainly: one prerelease per PR commit that
+# touches `app/**` — so the workflow prunes its own, keeping the newest
+# KEEP_PREVIEWS (see Lifecycle).
+#
+# ## Why not workflow artifacts
+#
+# Two attempts failed before this one, and both failure modes are worth knowing:
+#
+#  * `actions/upload-artifact@v4` cannot run here at all. It bundles
+#    `@actions/artifact` v2, whose `isGhes()` treats any GITHUB_SERVER_URL that
+#    is not github.com / *.ghe.com / *.localhost as GitHub Enterprise Server and
+#    throws before making a single request. act_runner sets that variable to this
+#    Gitea instance, so every platform died with "GHESNotSupportedError" — after
+#    the whole Tauri build had been paid for (run #265).
+#  * `@v3` uploads *succeed*, and the files are downloadable by direct URL — but
+#    Gitea does not **list** them: `/api/v1/…/runs/<id>/artifacts` reports
+#    `total_count: 0` and the run page shows nothing (verified on run #267).
+#    A build nobody can find is not a build.
+#
+# So previews publish the same way every other workflow here does: curl to the
+# Gitea releases API. One release per preview, tagged `preview-<sha>`.
+#
+# ## Lifecycle
+#
+# The `preview-` tag prefix is deliberate. `cleanup-releases.yml` keeps the most
+# recent `v<major>.<minor>.<patch>` releases and separately deletes every release
+# whose tag does *not* start with `v[0-9]` — so previews never crowd the real
+# release list, and a manual cleanup sweeps any this workflow missed.
+#
+# But that cleanup is a manual, dry-run-by-default action, and one prerelease per
+# pushed commit accumulates faster than anyone runs it. So the last job here
+# prunes previous previews itself, keeping the newest few. Bundles are ~130 MB a
+# release; the point of a preview is the build you are testing now.
+#
+# `sync-release.yml` is workflow_dispatch-only, so nothing here reaches GitHub.
+
+env:
+  GITEA_URL: ${{ gitea.server_url }}
+  REPO: ${{ gitea.repository }}
+  # How many preview releases survive a run, newest first — including the one
+  # just published.
+  KEEP_PREVIEWS: "2"
 
 on:
+  # Every push to an open PR: this *is* the branch's build check — it compiles
+  # Linux, macOS and Windows — and publishing the result costs nothing extra
+  # once they are built. build-app.yml deliberately no longer runs on PRs.
+  pull_request:
+    branches: [main]
+    paths:
+      - "app/**"
+      - "VERSION"
+      - ".gitea/workflows/build-app-preview.yml"
   workflow_dispatch:
 
 jobs:
@@ -12,6 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.VERSION }}
+      sha: ${{ steps.version.outputs.SHA }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -23,13 +81,88 @@ jobs:
         run: |
           MAJOR_MINOR=$(cat VERSION | tr -d '[:space:]')
           SHORT_SHA=$(git rev-parse --short HEAD)
-          VERSION="${MAJOR_MINOR}.0-preview.${SHORT_SHA}"
+          # From the checkout, not from `gitea.sha`: on a pull_request event
+          # that variable can be the merge ref, which is not the commit anyone
+          # is testing and not something to hang a tag on.
+          echo "SHA=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+
+          # The patch number is computed exactly as build-app.yml does it, so a
+          # preview is labelled with the version the release it previews would
+          # carry. This used to be hard-coded `.0`, which made every preview
+          # installer claim to be x.y.0 no matter what it contained.
+          LATEST_TAG=$(git tag -l "v${MAJOR_MINOR}.*" --sort=-v:refname | grep -E "^v${MAJOR_MINOR}\.[0-9]+$" | head -1 || true)
+          if [ -n "$LATEST_TAG" ]; then
+            PATCH=$(git rev-list --count "${LATEST_TAG}..HEAD")
+            echo "Latest matching tag: ${LATEST_TAG} (+${PATCH} commits)"
+          else
+            echo "No v${MAJOR_MINOR}.* tag yet — starting this line at .0"
+            PATCH=0
+          fi
+
+          VERSION="${MAJOR_MINOR}.${PATCH}-preview.${SHORT_SHA}"
           echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
           echo "Computed preview version: ${VERSION}"
 
-  build-linux:
+  # One release, created once. The three build jobs run concurrently, so
+  # get-or-create in each of them would race on the same tag: whoever loses gets
+  # a 409 and (the way the old build-app.yml parsed it) an empty release id that
+  # still reported success. Creating it in a job they all depend on removes the
+  # race rather than handling it.
+  create-release:
     runs-on: ubuntu-latest
     needs: [compute-version]
+    outputs:
+      release_id: ${{ steps.release.outputs.RELEASE_ID }}
+      tag: ${{ steps.release.outputs.TAG }}
+    steps:
+      - name: Create the preview release
+        id: release
+        env:
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          VERSION: ${{ needs.compute-version.outputs.version }}
+          SHA: ${{ needs.compute-version.outputs.sha }}
+          BRANCH: ${{ gitea.head_ref || gitea.ref_name }}
+        run: |
+          set -euo pipefail
+          TAG="preview-${VERSION##*.}"
+          echo "TAG=${TAG}" >> $GITHUB_OUTPUT
+
+          # Idempotent: re-dispatching the same commit must update the existing
+          # release rather than fail on the duplicate tag.
+          HTTP_CODE=$(curl -sS -o release.json -w '%{http_code}' \
+            -H "Authorization: token ${TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/releases/tags/${TAG}")
+          case "${HTTP_CODE}" in
+            200) echo "Release ${TAG} already exists, reusing" ;;
+            404)
+              echo "Creating release ${TAG}"
+              # prerelease: true keeps it off "latest" — this is a branch build,
+              # not something anyone should install by accident.
+              curl -fsS -X POST \
+                -H "Authorization: token ${TOKEN}" \
+                -H "Content-Type: application/json" \
+                -d "{\"tag_name\": \"${TAG}\", \"target_commitish\": \"${SHA}\", \"name\": \"Preview ${VERSION}\", \"prerelease\": true, \"body\": \"Unreleased build of \`${BRANCH}\` at ${SHA}. Not a release — pruned by Cleanup Old Releases.\"}" \
+                "${GITEA_URL}/api/v1/repos/${REPO}/releases" > release.json
+              ;;
+            *)
+              echo "Unexpected HTTP ${HTTP_CODE} from get-release-by-tag" >&2
+              cat release.json >&2 || true
+              exit 1
+              ;;
+          esac
+
+          RELEASE_ID=$(grep -o '"id":[0-9]*' release.json | head -1 | grep -o '[0-9]*' || true)
+          if [ -z "${RELEASE_ID}" ]; then
+            echo "Failed to parse release id; response was:" >&2
+            cat release.json >&2
+            exit 1
+          fi
+          echo "RELEASE_ID=${RELEASE_ID}" >> $GITHUB_OUTPUT
+          echo "Release ${TAG} is id ${RELEASE_ID}"
+
+  build-linux:
+    runs-on: ubuntu-latest
+    needs: [compute-version, create-release]
     steps:
       - name: Install Node.js 22
         run: |
@@ -128,17 +261,47 @@ jobs:
           cp app/src-tauri/target/release/bundle/rpm/*.rpm artifacts/ 2>/dev/null || true
           ls -la artifacts/
 
-      - name: Upload Linux artifacts
+      # Assets, not workflow artifacts — see the note at the top of this file.
-        uses: actions/upload-artifact@v4
+      # Delete-then-upload so a re-dispatch replaces rather than 409s, and the
-        with:
+      # retry/http1.1 hardening that build-app.yml learned from real macOS
-          name: triple-c-${{ needs.compute-version.outputs.version }}-linux
+      # upload failures (curl exit 92 and exit 28 mid-stream).
-          path: artifacts/
+      - name: Upload Linux bundles to the preview release
-          if-no-files-found: error
+        shell: bash
-          retention-days: 14
+        env:
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          files=(artifacts/*)
+          if [ ${#files[@]} -eq 0 ]; then
+            echo "No Linux bundles were produced" >&2
+            exit 1
+          fi
+          for file in "${files[@]}"; do
+            filename=$(basename "$file")
+            EXISTING_ID=$(curl -sS \
+              -H "Authorization: token ${TOKEN}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets" \
+              | python3 -c "import json,sys; t=sys.argv[1]; print(next((a['id'] for a in json.load(sys.stdin) if a.get('name')==t), ''))" "${filename}" || true)
+            if [ -n "${EXISTING_ID}" ]; then
+              echo "Replacing existing asset ${filename}"
+              curl -fsS -X DELETE \
+                -H "Authorization: token ${TOKEN}" \
+                "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets/${EXISTING_ID}"
+            fi
+            echo "Uploading ${filename}..."
+            curl -fsS --http1.1 --retry 5 --retry-all-errors --retry-delay 5 --max-time 600 \
+              -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@${file}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${filename}"
+          done
 
   build-macos:
     runs-on: macos-latest
-    needs: [compute-version]
+    needs: [compute-version, create-release]
     steps:
       - name: Install Node.js 22
         run: |
@@ -209,17 +372,47 @@ jobs:
           cp app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz artifacts/ 2>/dev/null || true
           ls -la artifacts/
 
-      - name: Upload macOS artifacts
+      # Assets, not workflow artifacts — see the note at the top of this file.
-        uses: actions/upload-artifact@v4
+      # Delete-then-upload so a re-dispatch replaces rather than 409s, and the
-        with:
+      # retry/http1.1 hardening that build-app.yml learned from real macOS
-          name: triple-c-${{ needs.compute-version.outputs.version }}-macos
+      # upload failures (curl exit 92 and exit 28 mid-stream).
-          path: artifacts/
+      - name: Upload macOS bundles to the preview release
-          if-no-files-found: error
+        shell: bash
-          retention-days: 14
+        env:
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          files=(artifacts/*)
+          if [ ${#files[@]} -eq 0 ]; then
+            echo "No macOS bundles were produced" >&2
+            exit 1
+          fi
+          for file in "${files[@]}"; do
+            filename=$(basename "$file")
+            EXISTING_ID=$(curl -sS \
+              -H "Authorization: token ${TOKEN}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets" \
+              | python3 -c "import json,sys; t=sys.argv[1]; print(next((a['id'] for a in json.load(sys.stdin) if a.get('name')==t), ''))" "${filename}" || true)
+            if [ -n "${EXISTING_ID}" ]; then
+              echo "Replacing existing asset ${filename}"
+              curl -fsS -X DELETE \
+                -H "Authorization: token ${TOKEN}" \
+                "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets/${EXISTING_ID}"
+            fi
+            echo "Uploading ${filename}..."
+            curl -fsS --http1.1 --retry 5 --retry-all-errors --retry-delay 5 --max-time 600 \
+              -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@${file}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${filename}"
+          done
 
   build-windows:
     runs-on: windows-latest
-    needs: [compute-version]
+    needs: [compute-version, create-release]
     defaults:
       run:
         shell: cmd
@@ -308,10 +501,78 @@ jobs:
           copy app\src-tauri\target\release\bundle\nsis\*.exe artifacts\ 2>nul
           dir artifacts\
 
-      - name: Upload Windows artifacts
+      # PowerShell, because this job's default shell is cmd. Same
-        uses: actions/upload-artifact@v4
+      # delete-then-upload shape as the other two.
-        with:
+      - name: Upload Windows bundles to the preview release
-          name: triple-c-${{ needs.compute-version.outputs.version }}-windows
+        shell: powershell
-          path: artifacts/
+        env:
-          if-no-files-found: error
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-          retention-days: 14
+          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
+        run: |
+          $ErrorActionPreference = "Stop"
+          $headers = @{ Authorization = "token $env:TOKEN" }
+          $api = "$env:GITEA_URL/api/v1/repos/$env:REPO"
+          $files = @(Get-ChildItem -File -Path artifacts\*)
+          if ($files.Count -eq 0) { throw "No Windows bundles were produced" }
+
+          $existing = Invoke-RestMethod -Method Get -Headers $headers -Uri "$api/releases/$env:RELEASE_ID/assets"
+          foreach ($file in $files) {
+            $name = $file.Name
+            $dupe = $existing | Where-Object { $_.name -eq $name }
+            if ($dupe) {
+              Write-Host "Replacing existing asset $name"
+              Invoke-RestMethod -Method Delete -Headers $headers -Uri "$api/releases/$env:RELEASE_ID/assets/$($dupe.id)" | Out-Null
+            }
+            Write-Host "Uploading $name..."
+            $uploadUri = "$api/releases/$env:RELEASE_ID/assets?name=$([uri]::EscapeDataString($name))"
+            curl.exe -fsS --retry 5 --retry-all-errors --retry-delay 5 --max-time 600 `
+              -X POST -H "Authorization: token $env:TOKEN" `
+              -H "Content-Type: application/octet-stream" `
+              --data-binary "@$($file.FullName)" $uploadUri
+            if ($LASTEXITCODE -ne 0) { throw "Upload of $name failed (curl exit $LASTEXITCODE)" }
+          }
+
+  # Keep the preview list short. Runs after the builds and only if all three
+  # succeeded: a half-published run must not be what evicts a good older build.
+  prune-previews:
+    runs-on: ubuntu-latest
+    needs: [create-release, build-linux, build-macos, build-windows]
+    steps:
+      - name: Delete all but the newest preview releases
+        env:
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          KEEP_TAG: ${{ needs.create-release.outputs.tag }}
+        run: |
+          set -euo pipefail
+          curl -fsS -H "Authorization: token ${TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/releases?limit=50" > releases.json
+
+          # Newest first by creation time, `preview-` only, and never the one
+          # this run just published — a clock skew must not delete it.
+          DOOMED=$(python3 - "${KEEP_PREVIEWS}" "${KEEP_TAG}" <<'PY'
+          import json, sys
+          keep, keep_tag = int(sys.argv[1]), sys.argv[2]
+          previews = [r for r in json.load(open("releases.json"))
+                      if r["tag_name"].startswith("preview-")]
+          previews.sort(key=lambda r: r["created_at"], reverse=True)
+          for r in previews[keep:]:
+              if r["tag_name"] != keep_tag:
+                  print(r["id"], r["tag_name"])
+          PY
+          )
+
+          if [ -z "${DOOMED}" ]; then
+            echo "Nothing to prune (keeping ${KEEP_PREVIEWS})"
+            exit 0
+          fi
+
+          echo "${DOOMED}" | while read -r ID TAG; do
+            [ -z "${ID}" ] && continue
+            echo "Deleting ${TAG} (id ${ID})"
+            # Best effort: a preview someone deleted by hand mid-run is not a
+            # reason to fail a build that otherwise succeeded.
+            curl -sS -X DELETE -H "Authorization: token ${TOKEN}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases/${ID}" || true
+            curl -sS -X DELETE -H "Authorization: token ${TOKEN}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/tags/${TAG}" || true
+          done

.gitea/workflows/build-app.yml

@@ -7,14 +7,14 @@ on:
       - "app/**"
       - "VERSION"
       - ".gitea/workflows/build-app.yml"
-  pull_request:
-    branches: [main]
-    paths:
-      - "app/**"
-      - "VERSION"
-      - ".gitea/workflows/build-app.yml"
   workflow_dispatch:
 
+# Deliberately **not** on pull_request. Every publishing step here is gated on
+# `gitea.event_name == 'push'`, so a PR run compiled all three platforms and
+# produced nothing — and it ran alongside build-app-preview.yml, which compiles
+# the same three and publishes them. Six OS builds per push, one set of which
+# was unreachable. Previews now carry the PR check; this workflow is releases.
+
 env:
   GITEA_URL: ${{ gitea.server_url }}
   REPO: ${{ gitea.repository }}
@@ -39,16 +39,55 @@ jobs:
           MAJOR_MINOR=$(cat VERSION | tr -d '[:space:]')
           echo "Major.Minor: ${MAJOR_MINOR}"
 
-          # Find the latest tag matching v{MAJOR_MINOR}.N (exclude -mac, -win suffixes)
+          # The patch number is **one past the highest patch already used**, and
-          # `|| true` so an empty grep result doesn't fail the step under pipefail.
+          # never a distance.
-          LATEST_TAG=$(git tag -l "v${MAJOR_MINOR}.*" --sort=-v:refname | grep -E "^v${MAJOR_MINOR}\.[0-9]+$" | head -1 || true)
+          #
+          # It used to be `git rev-list --count <highest tag>..HEAD`, which is
+          # not a counter at all: it measures how far HEAD has drifted from
+          # whichever tag sorts highest, and that resets to zero every time a
+          # tag is cut. The published history is the proof — each of these is
+          # exactly what the old formula returned at the time:
+          #
+          #   v0.4.0 -> 3 commits -> v0.4.3    looked fine
+          #   v0.4.3 -> 4 commits -> v0.4.4    fine by luck, 4 > 3
+          #   v0.4.4 -> 2 commits -> v0.4.2    went backwards
+          #   v0.4.4 -> 6 commits -> v0.4.6    jumped, skipping .5
+          #   v0.4.6 -> 3 commits -> v0.4.3    already taken; the upload failed
+          #
+          # Reusing a version is worse than failing to publish one: the macOS
+          # and Windows steps replace assets in place, so a duplicate silently
+          # rewrote a release that had been public for three days. Monotonic
+          # numbering is what stops that at the source.
+          #
+          # Suffixed tags count too. `create-tag` is skipped when any platform
+          # job fails, so a run can publish v0.4.7-mac and never create the
+          # plain v0.4.7 — reading only unsuffixed tags would then hand the
+          # same number out twice.
+          HIGHEST=$(git tag -l "v${MAJOR_MINOR}.*" \
+            | grep -E "^v${MAJOR_MINOR}\.[0-9]+(-mac|-win)?$" \
+            | sed -E "s/^v${MAJOR_MINOR}\.([0-9]+).*/\1/" \
+            | sort -n | tail -1 || true)
 
-          if [ -n "$LATEST_TAG" ]; then
+          # A re-run of a commit that already released must not mint a new
-            echo "Latest matching tag: ${LATEST_TAG}"
+          # version just because its own tag now exists.
-            PATCH=$(git rev-list --count "${LATEST_TAG}..HEAD")
+          EXISTING=$(git tag --points-at HEAD \
+            | grep -E "^v${MAJOR_MINOR}\.[0-9]+$" \
+            | sed -E "s/^v${MAJOR_MINOR}\.([0-9]+)$/\1/" \
+            | sort -n | tail -1 || true)
+
+          if [ -n "$EXISTING" ]; then
+            echo "HEAD is already tagged v${MAJOR_MINOR}.${EXISTING} — reusing it"
+            PATCH="${EXISTING}"
+          elif [ -n "$HIGHEST" ]; then
+            echo "Highest patch already used on this line: ${HIGHEST}"
+            PATCH=$((HIGHEST + 1))
           else
-            echo "No matching tag found for v${MAJOR_MINOR}.*, using total commit count"
+            # A minor line nobody has tagged yet is a *new* line, and a new line
-            PATCH=$(git rev-list --count HEAD)
+            # starts at .0 — that is what "we are moving to 0.4.x" means. The
+            # old fallback here counted every commit in the repository, which
+            # would have made the first 0.4 build 0.4.234.
+            echo "No v${MAJOR_MINOR}.* tag yet — starting this line at .0"
+            PATCH=0
           fi
 
           VERSION="${MAJOR_MINOR}.${PATCH}"
@@ -161,21 +200,70 @@ jobs:
         env:
           TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
+          set -euo pipefail
           TAG="v${{ needs.compute-version.outputs.version }}"
-          # Create release
+
-          curl -s -X POST \
+          # Idempotent get-or-create, matching build-macos. This step used to
+          # POST /releases unconditionally: against a tag that already existed
+          # Gitea answered 409, the grep below found no id, and the run died
+          # with a bare "exitcode '1'" and not one line of output explaining
+          # it — `curl -s` with no `-f` swallows the HTTP error, so nothing
+          # ever said "409" or "duplicate tag". Hence -fsS throughout, and
+          # pipefail so a failure cannot be stepped over.
+          HTTP_CODE=$(curl -sS -o release.json -w '%{http_code}' \
             -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/releases/tags/${TAG}")
-            -d "{\"tag_name\": \"${TAG}\", \"name\": \"Triple-C ${TAG} (Linux)\", \"body\": \"Automated build from commit ${{ gitea.sha }}\"}" \
+          case "${HTTP_CODE}" in
-            "${GITEA_URL}/api/v1/repos/${REPO}/releases" > release.json
+            200)
-          RELEASE_ID=$(cat release.json | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
+              echo "Release ${TAG} already exists, reusing"
+              ;;
+            404)
+              echo "Creating release ${TAG}"
+              curl -fsS -X POST \
+                -H "Authorization: token ${TOKEN}" \
+                -H "Content-Type: application/json" \
+                -d "{\"tag_name\": \"${TAG}\", \"name\": \"Triple-C ${TAG} (Linux)\", \"body\": \"Automated build from commit ${{ gitea.sha }}\"}" \
+                "${GITEA_URL}/api/v1/repos/${REPO}/releases" > release.json
+              ;;
+            *)
+              echo "Unexpected ${HTTP_CODE} looking up release ${TAG}:" >&2
+              cat release.json >&2
+              exit 1
+              ;;
+          esac
+
+          RELEASE_ID=$(python3 -c "import json,sys; print(json.load(open('release.json')).get('id',''))")
+          if [ -z "${RELEASE_ID}" ]; then
+            echo "No release id for ${TAG}; refusing to upload into nothing:" >&2
+            cat release.json >&2
+            exit 1
+          fi
           echo "Release ID: ${RELEASE_ID}"
-          # Upload each artifact
+
+          # Replace-not-conflict, so a retry after a partial upload succeeds.
+          # Versions are monotonic now (see compute-version), so this can only
+          # ever be replacing an asset from a failed run of this same commit —
+          # never one belonging to an already-published version.
           for file in artifacts/*; do
             [ -f "$file" ] || continue
             filename=$(basename "$file")
+
+            EXISTING_ID=$(curl -sS \
+              -H "Authorization: token ${TOKEN}" \
+              "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets" \
+              | python3 -c "import json,sys; t=sys.argv[1]; print(next((a['id'] for a in json.load(sys.stdin) if a.get('name')==t), ''))" "${filename}" || true)
+            if [ -n "${EXISTING_ID}" ]; then
+              echo "Deleting existing asset ${filename} (id ${EXISTING_ID})"
+              curl -fsS -X DELETE \
+                -H "Authorization: token ${TOKEN}" \
+                "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets/${EXISTING_ID}"
+            fi
+
             echo "Uploading ${filename}..."
-            curl -s -X POST \
+            curl -fsS --http1.1 \
+              --retry 5 --retry-all-errors --retry-delay 5 \
+              --max-time 600 \
+              -X POST \
               -H "Authorization: token ${TOKEN}" \
               -H "Content-Type: application/octet-stream" \
               --data-binary "@${file}" \

CLAUDE.md

@@ -59,6 +59,17 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
 - **`store/appState.ts`** — Single Zustand store for all app state (projects, sessions, UI). The
   main area is a single ordered tab strip holding two tab kinds, keyed `term:<id>` and
   `home:<id>`; `activeSessionId` is *derived* from `activeTabKey` so exactly one thing is current.
+  `tabOrder` is user-reorderable (drag, or `Ctrl+Shift+←/→` via `moveActiveTab`) — so **never
+  treat a tab's position as identity**: address tabs by key, and index only through `tabOrder`.
+  `moveTab` deliberately does not activate what it moves.
+  - **The tab drag is pointer events, not HTML5 drag-and-drop, and must stay that way.** Tauri's
+    `dragDropEnabled` blocks HTML5 drag inside the webview on Windows, and it cannot simply be
+    turned off: `TerminalView` needs Tauri's native drag-drop event because it is the only one
+    that carries dropped *file paths*. An HTML5 drag also carries a `DataTransfer`, which the
+    default handler types into any text field the drag is released over.
+  - **A new app-level shortcut must not swallow a text-editing chord.** `useKeyboardShortcuts`
+    binds on `document` in the capture phase, so `inTextField()` guards the arrow bindings —
+    excluding xterm's helper textarea, which is an input-method shim rather than a field.
 - **`hooks/`** — All Tauri IPC calls are encapsulated in hooks (`useTerminal`, `useProjects`, `useDocker`, `useSettings`)
 - **`lib/tauri-commands.ts`** — Typed `invoke()` wrappers; TypeScript types in `lib/types.ts` must match Rust models
 - **`components/terminal/TerminalView.tsx`** — xterm.js integration with WebGL rendering, URL detection for OAuth flow
@@ -84,8 +95,10 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
   Use `--text-disabled` rather than `disabled:opacity-50`.
 - **Never write `focus:outline-none`.** A global `:focus-visible` ring is defined in `index.css`.
 - **Status must not be encoded in colour alone** — `StatusIndicator` pairs a glyph with a word.
-- Keyboard: `Ctrl+T` new terminal, `Ctrl+Shift+W` close tab, `Ctrl+Tab` cycle, `Ctrl+1..9` jump.
+- Keyboard: `Ctrl+T` new terminal, `Ctrl+Shift+W` close tab, `Ctrl+Tab` cycle, `Ctrl+1..9` jump,
-  `Ctrl+W` is intentionally left alone — it is readline's `kill-word` inside the terminal.
+  `Ctrl+Shift+←/→` move the active tab. `Ctrl+W` is intentionally left alone — it is readline's
+  `kill-word` inside the terminal, and plain `Ctrl+←/→` is its word-wise cursor motion, which is
+  why tab-moving takes Shift.
 
 ### Backend Structure (`app/src-tauri/src/`)
 
@@ -104,6 +117,35 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
   OAuth listener, wrong for remote control of a browser. Host ports are confined to
   `47820..=47827` because CSP `frame-src` cannot express a port range and must enumerate them;
   a unit test asserts the Rust range matches `tauri.conf.json`. Opt-in per project.
+  - **`popout.rs` puts the same URL in a second OS window** (`WebviewUrl::External`), so the view
+    can be watched on another monitor or pinned on top while the main window is used for work.
+    Three things it rests on: no capability lists that window, so it has **no IPC surface** — do
+    not give it one; the app CSP does not apply, because it is a top-level document rather than a
+    frame, and the token gate is what protects the port in both cases; and the window is owned by
+    the *session*, so the supervisor's teardown closes it rather than leaving a window onto a
+    viewer that no longer exists. It closes with `destroy()`, never `close()`, to stay clear of
+    `CloseRequested`. The pane drops its iframe while popped out — two viewers can both *drive*
+    the browser.
+  - **`page.rs` opens a page, which is the one thing the pane could not do.** A URL plus a
+    viewport: launch a browser in the container, `browser.bind()` it so the pane shows it, and
+    keep the handle. Serves auth (the OAuth callback listener is *in* the container, so a
+    container-side browser closes the loop with no host round trip and no auth bridge) and dev
+    servers on container loopback. **Verified: a second client cannot join a bound browser** —
+    `chromium.connect()` against the published endpoint times out in every URL form, because that
+    socket speaks the dashboard's transport, not the public connect protocol. So whoever launches
+    is the only process that can drive, which is why the helper is resident and why live resize
+    applies to pages *we* opened and never to `@playwright/mcp`'s (those take `--viewport-size` /
+    `PLAYWRIGHT_MCP_VIEWPORT_SIZE` at launch). Control is a polled JSON file in `/tmp` — no port,
+    no second listener — and a re-open with a helper already up *navigates* rather than
+    relaunching, so a session signed in on one page survives to the next.
+  - **Resizing the window does not resize the page.** The viewer is a CDP screencast: a bigger
+    window is the same pixels drawn larger. `page.setViewportSize()` is what reflows (measured
+    against a `@media (max-width: 900px)` rule), and match-window mode pushes the pop-out's
+    settled `Resized` size into it — debounced by generation counter, since a drag emits
+    continuously and each one costs a container exec.
+  - **`lib.rs`'s `on_window_event` fires for every window and must stay guarded on
+    `label() == "main"`.** Without that guard, closing a pop-out runs the app's shutdown: every
+    container stopped, process exited.
   - **Detection has to look past `node_modules`.** `claude mcp add … npx @playwright/mcp@latest`
     installs into `~/.npm/_npx/<hash>/node_modules`, not any `node_modules`, so `detect.rs`
     globs that cache as well as `/workspace`, `$HOME/node_modules` and `npm root -g`. It also
@@ -231,6 +273,30 @@ migration and Reset. Four things here are not obvious:
   actively **removes** `triple-c-*.crt` when the setting is cleared — `/usr/local/share` rides the
   project's snapshot image, so turning the feature off has to undo, not merely stop.
 
+### VPN support (`vpn_support_enabled`, `docker/container.rs`)
+
+An opt-in per-project switch granting the container what a VPN client needs to build a tunnel.
+`vpn_host_config()` is the single definition of what that means, and it is unit-tested because a
+container is created once by a very long function where a dropped capability is invisible.
+
+- **All three pieces or none.** `CAP_NET_ADMIN` (Docker's default set has `net_raw` but *not*
+  `net_admin`, so a client can ping but never connect), the `/dev/net/tun` device (absent
+  entirely from a default container — nothing to open even with the capability), and
+  `net.ipv4.conf.all.src_valid_mark=1` (WireGuard's `wg-quick` sets it and cannot from inside a
+  container, since `/proc/sys` is read-only, so handshake packets die to reverse-path filtering).
+  Any two without the third still presents as a connection that hangs to a timeout, which is why
+  the tests assert the whole set.
+- **The device is passed through from the host, never `mknod`-ed inside.** The kernel's `tun`
+  module has to back it. When the host has no such device the failure lands at *creation* — the
+  project simply won't start — so `explain_create_failure()` rewrites that one error to name the
+  switch and the Docker-Desktop-VM-vs-your-machine distinction. Do not let it degrade to a raw
+  bollard string.
+- **`triple-c.vpn-support` is written unconditionally, including `false`.** The usual
+  `docker commit` reason: a `true` stamped once would ride the snapshot image into every future
+  container and make the switch impossible to turn off.
+- Off is byte-identical to a container created before the feature existed, and a missing label
+  reads as `false`, so no existing project is churned.
+
 ### Container Lifecycle
 
 Containers use a **stop/start** model (not create/destroy). Installed packages persist across stops. The `.claude` config dir uses a named Docker volume (`triple-c-claude-config-{projectId}`), nested inside the home volume (`triple-c-home-{projectId}`), so OAuth tokens and Claude Code config survive container stop/start *and* container recreation.

HOW-TO-USE.md

@@ -191,6 +191,12 @@ Anthropic-backend project uses that token without its own login. See
   terminal tab to rename it, jump to its project home, or close it; double-click to rename inline.
   There is no separate terminal tab bar and no "+" button — tabs appear when you open a project or
   a terminal.
+
+  **Drag a tab to reorder it.** A line shows where it will land; **Escape** abandons the drag.
+  Dropping does not change which tab you are looking at — so you can rearrange the strip without
+  pulling focus away from a terminal that is mid-run. `Ctrl+Shift+←` and `Ctrl+Shift+→` move the
+  *active* tab the same way without the mouse (they leave text fields alone, where that chord
+  still selects by word). The order is per-session: it is not saved when you quit.
 - **Status indicators (top right)** — Docker connection and container image availability. Each pairs
   a coloured dot with a word, so status is never conveyed by colour alone. The **?** button opens
   the built-in help.
@@ -211,7 +217,7 @@ for selecting a project and for two quick controls that appear on hover — star
 Claude terminal. Everything else about a project lives in Project Home.
 
 The header shows the project name, its status, how long the container has been up, and the action
-buttons. Below that are five tabs:
+buttons. Below that are six tabs:
 
 | Tab | What it's for |
 |---|---|
@@ -220,6 +226,7 @@ buttons. Below that are five tabs:
 | **Automation** | The scheduled tasks running inside this container — see [Automation & Scheduled Tasks](#automation--scheduled-tasks) |
 | **Config** | All per-project configuration — see [Project Configuration](#project-configuration) |
 | **Files** | Browse, download and upload files inside the container |
+| **Browser** | Watch — and take over — the browser Claude is driving with Playwright, see [The Browser Tab](#the-browser-tab) |
 
 ### Sessions
 
@@ -257,6 +264,61 @@ included, and each tile opens a list of what it found.
 
 The counts are only available while the container is running.
 
+### The Browser Tab
+
+When Claude drives a browser with Playwright inside the container, the **Browser** tab shows you
+that browser live — and lets you take it over with your own mouse and keyboard.
+
+It is **off by default and opted into per project**, and it never installs anything on its own.
+Opening the tab only *probes* the container, so it can tell you what is missing before you ask for
+a view; installing Playwright and downloading a browser are separate, labelled buttons that state
+what they cost before you press them. See
+[What's Inside the Container](#whats-inside-the-container) for why the browser itself is not
+pre-installed.
+
+Press **Start browser view** and the pane fills with Playwright's own dashboard, running inside the
+container and reached over a token-gated listener on your machine's loopback address. Nothing is
+exposed off the machine.
+
+#### Opening a page yourself
+
+**Open a page…** launches a browser inside the container at a URL and viewport you choose, and
+publishes it to this pane. Two uses:
+
+- **A sign-in page.** The callback the tool is waiting for is a listener *inside* the container, so
+  a container-side browser completes the login without anything crossing to your host browser.
+  When a long URL appears in a terminal, the prompt that offers to open it on your host now also
+  offers **In container**, which does the same thing in one click.
+- **A dev server.** `http://localhost:5173` inside the container is reachable with no port mapping
+  and nothing exposed to your network — which is how you watch a UI Claude is building, and click
+  around it yourself.
+
+The **viewport** is the page's own resolution, and it is not the same thing as the window size.
+The pane shows a video of the browser, so a bigger window draws the same pixels larger; changing
+the viewport is what makes the layout actually reflow. Pick a preset or type a size.
+
+Note the limit, because it is not obvious: a browser Claude opened through `@playwright/mcp` can
+be *watched* but not resized — a published browser admits only the client that launched it. Set
+its size with `PLAYWRIGHT_MCP_VIEWPORT_SIZE=1920x1080` in the project's environment variables
+instead.
+
+#### Watching it while you work
+
+Press **Open in own window** and the view moves out of the tab into a window of its own — put it on
+a second monitor, or turn on **Keep on top** and let it float above the app while you work in a
+terminal. **Match window** goes further: the page's viewport follows the window as you drag it, so
+the pop-out becomes a responsive-design ruler. It applies to pages opened with **Open a page…**,
+for the reason above. This is a window change only: the browser and the view keep running throughout, so
+popping out and back costs nothing and interrupts nothing.
+
+While the view is in its own window the tab shows a placeholder rather than a second copy of it —
+two viewers would both be able to *drive* the browser, and two cursors on one page is not useful.
+**Put back in tab**, or just closing the window, brings it back.
+
+The window belongs to the view, not to the tab: closing the project's home tab leaves it open, and
+stopping the view — by pressing **Stop**, stopping the container, or removing the project — closes
+it, because a window showing a viewer that no longer exists is worse than no window.
+
 ---
 
 ## Project Management
@@ -409,6 +471,32 @@ When enabled, the host Docker socket is mounted into the container so Claude Cod
 
 > Toggling this requires stopping and restarting the container to take effect.
 
+### VPN Support
+
+When enabled, the container is given the three things a VPN client needs to build a tunnel:
+the `NET_ADMIN` capability, the `/dev/net/tun` device, and the `net.ipv4.conf.all.src_valid_mark`
+sysctl that WireGuard requires. This is **off by default**.
+
+Without it, a client such as PIA, WireGuard, OpenVPN or Tailscale installs and its daemon starts
+normally, but the connection attempt **hangs until it times out** — a default container has no tun
+device to open and no permission to add an interface or a route, and most clients report that as a
+generic timeout rather than a permissions error.
+
+Things worth knowing:
+
+- `NET_ADMIN` applies to the container's **own** network namespace. It confers no authority over
+  the host's interfaces or over any other container. It does mean anything running in the
+  container can reconfigure that namespace, which is why it is opt-in.
+- The **Docker host's** kernel must have the `tun` module available. With Docker Desktop that is
+  the Linux VM, not your own machine. If it is missing, the container fails to create with an
+  error naming `/dev/net/tun` and pointing back at this setting.
+- A VPN client's kill switch applies to everything in the container, Claude Code included. If the
+  tunnel drops, expect API calls to fail until it reconnects or the kill switch is turned off.
+
+> This setting can only be changed when the container is stopped. Capabilities and devices are
+> fixed when a container is created, so toggling it recreates the container on the next start.
+> Recreation preserves the home and `.claude` volumes — it is not a Reset.
+
 ### Mission Control
 
 Toggle **Mission Control** to integrate Flight Control — an AI-first development methodology bundled with Triple-C — into the project. When enabled:
@@ -1077,13 +1165,23 @@ triple-c-scheduler list                    # List all tasks
 triple-c-scheduler enable --id abc123      # Enable a task
 triple-c-scheduler disable --id abc123     # Disable a task
 triple-c-scheduler remove --id abc123      # Delete a task
-triple-c-scheduler run --id abc123         # Trigger a task immediately
+triple-c-scheduler run --id abc123         # Trigger a task now, streaming its log
+triple-c-scheduler status                  # What is running right now, and for how long
+triple-c-scheduler status --id abc123 -w   # Watch one task until its run finishes
 triple-c-scheduler logs --id abc123        # View logs for a task
 triple-c-scheduler logs --tail 20          # View last 20 log entries (all tasks)
 triple-c-scheduler notifications           # View completion notifications
 triple-c-scheduler notifications --clear   # Clear notifications
 ```
 
+`list` carries a status column, and the Automation tab marks a task **Running** with
+its elapsed time, so a triggered run is visible rather than silent.
+
+Note that a log which has stopped growing is not evidence of a stall: `claude -p`
+writes its answer in one go when it finishes, so a healthy run shows nothing but its
+header for as long as it is thinking. `status` is what distinguishes a slow run from
+a dead one — it reports the run only while the runner's process is genuinely alive.
+
 ### Cron Schedule Format
 
 Standard 5-field cron: `minute hour day-of-month month day-of-week`
@@ -1119,6 +1217,7 @@ triple-c-scheduler add --name "test" --schedule "0 */6 * * *" --prompt "Run test
 | **Ctrl+Tab** | Switch to the next tab |
 | **Ctrl+Shift+Tab** | Switch to the previous tab |
 | **Ctrl+1** … **Ctrl+9** | Jump to the first through ninth tab |
+| **Ctrl+Shift+←** / **Ctrl+Shift+→** | Move the active tab one place along the strip (the mouse equivalent is dragging it) |
 
 > **Why Ctrl+Shift+W and not Ctrl+W?** `Ctrl+W` is readline's `kill-word` — it deletes the word
 > before the cursor, and it is used constantly in the terminal this app is built around. Binding it

README.md

@@ -1,7 +1,33 @@
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="branding/triple-c-lockup-dark.svg">
+  <img src="branding/triple-c-lockup-light.svg" alt="Triple-C — Coding Container" width="429" height="112">
+</picture>
+
 # Triple-C (Claude-Code-Container)
 
 Triple-C is a cross-platform desktop application that sandboxes Claude Code inside Docker containers. Each project chooses its own **permission mode** — from Plan (read-only) through to Bypass (`--dangerously-skip-permissions`), which gives Claude unrestricted access within the sandbox.
 
+This file is the architectural tour: what each subsystem is and why it works the way it does.
+
+| Document | For |
+|---|---|
+| [HOW-TO-USE.md](HOW-TO-USE.md) | Using the app — first launch, projects, settings, troubleshooting |
+| [BUILDING.md](BUILDING.md) | Building from source on Linux, macOS and Windows |
+| [TECHNICAL.md](TECHNICAL.md) | Technology choices and the dependency inventory |
+| [ROADMAP.md](ROADMAP.md) | Claude Code feature parity, gaps and sequencing |
+| [CLAUDE.md](CLAUDE.md) | Working *on* this repo, for Claude Code |
+| [branding/](branding/README.md) | The mark, the palette, and how the icons are generated |
+
+## Contents
+
+- [Architecture](#architecture) — layout, tabs, shortcuts, Project Home
+- [Permission Modes](#permission-modes)
+- [Containers](#containers) — lifecycle, base-image migration, mounts, CA certificates, sibling containers
+- [Models and Authentication](#models-and-authentication) — backends, model aliases, gateway, shared token
+- [Bridges to the Host](#bridges-to-the-host) — URL relay, auth bridge, browser view
+- [Inside a Project](#inside-a-project) — capability tiles, Mission Control, web terminal, speech-to-text
+- [Key Files](#key-files) · [CSS / Styling Notes](#css--styling-notes) · [Container Image](#container-image)
+
 ## Architecture
 
 - **Frontend**: React 19 + TypeScript + Tailwind CSS v4 + Zustand state management
@@ -29,6 +55,13 @@ two tab kinds: `home:<projectId>` (Project Home) and `term:<sessionId>` (a termi
 separate terminal tab bar. `activeSessionId` is derived from the active tab key, so exactly one
 thing is current at a time.
 
+Tabs are user-reorderable — drag one, or move the active tab with `Ctrl+Shift+←/→`. A tab's
+position is therefore never its identity: tabs are addressed by key, and indexed only through
+`tabOrder`. The drag is built on pointer events rather than HTML5 drag-and-drop, deliberately:
+Tauri's `dragDropEnabled` blocks HTML5 drag inside the webview on Windows, and it cannot simply be
+switched off because `TerminalView` needs Tauri's native drag-drop event — the only one that
+carries dropped *file paths*.
+
 ### Keyboard Shortcuts
 
 Implemented in `hooks/useKeyboardShortcuts.ts` (document-level, capture phase):
@@ -39,31 +72,34 @@ Implemented in `hooks/useKeyboardShortcuts.ts` (document-level, capture phase):
 | `Ctrl+Shift+W` | Close the active tab |
 | `Ctrl+Tab` / `Ctrl+Shift+Tab` | Cycle tabs forward / backward |
 | `Ctrl+1` … `Ctrl+9` | Jump to the nth tab |
+| `Ctrl+Shift+←` / `Ctrl+Shift+→` | Move the active tab left / right |
 
 `Ctrl+W` is deliberately **not** bound: it is readline's `kill-word`, used constantly in the
-terminal this app is built around. Terminal-scoped keys (`Ctrl+Shift+C`, `Ctrl+Shift+Alt+C`,
+terminal this app is built around. Plain `Ctrl+←/→` is readline's word-wise cursor motion, which is
+why moving a tab takes Shift as well. Terminal-scoped keys (`Ctrl+Shift+C`, `Ctrl+Shift+Alt+C`,
 `Ctrl+Shift+M`) are handled in `TerminalView.tsx`.
 
 ### Project Home
 
 Clicking a project row in the sidebar opens **Project Home** in the main area — the per-project
-view, with tabs **Overview · Sessions · Automation · Config · Files**. The sidebar row itself is
+view, with tabs **Overview · Sessions · Automation · Config · Files · Browser**. The sidebar row
-select-only (plus hover controls for start/stop and opening a terminal); it holds no configuration.
+itself is select-only (plus hover controls for start/stop and opening a terminal); it holds no
-Per-project configuration lives in the Config tab rather than in modals.
+configuration. Per-project configuration lives in the Config tab rather than in modals.
 
 | Tab | Contents |
 |---|---|
-| **Overview** | Permission mode control, sandbox/backend/Docker-access summary, capability tiles, recent sessions, scheduled tasks |
+| **Overview** | Permission mode control, sandbox/backend/Docker-access summary, capability tiles, recent sessions, scheduled tasks, base-image staleness banner |
 | **Sessions** | Past Claude Code conversations read from the config volume, with **Resume** |
-| **Automation** | The container's `triple-c-scheduler` tasks — enable/disable, run now, read logs, remove, and completion notifications |
+| **Automation** | The container's `triple-c-scheduler` tasks — create, edit, enable/disable, run now, read logs, remove, and completion notifications |
 | **Config** | Workspace (name, folders), Model (backend), Access (SSH, git, env vars, port mappings), Runtime (permission mode, sandbox, Docker access, Mission Control, instructions, Claude Code settings) |
 | **Files** | Browse, download and upload files inside the container |
+| **Browser** | Watch and take over the Playwright browser inside the container — see [Browser View](#browser-view) |
 
 Container start/stop progress is reported inline (on the sidebar row and in the Project Home
 header) via the `container-progress` event, and failures surface as toasts. There is no blocking
 progress modal.
 
-### Permission Modes
+## Permission Modes
 
 `PermissionMode` in `models/project.rs` replaces the old `full_permissions` boolean. Four states,
 mapped to CLI flags by `PermissionMode::cli_args()`:
@@ -87,15 +123,196 @@ back into flags for its headless `claude -p` run. Because it travels as containe
 only reaches the scheduler after the container is recreated on its next start (the label mismatch
 forces that).
 
-### Container Introspection (Capability Tiles)
+## Containers
 
-`list_container_capabilities` (`commands/inspect_commands.rs`) runs a read-only `find`/`jq` script
+### Container Lifecycle
-inside a running container and returns counts plus item lists for **skills, agents, commands, hooks,
-plugins and MCP servers**, at user scope (`/home/claude/.claude`) and project scope
-(`/workspace/*/.claude`, `/workspace/*/.mcp.json`). Overview renders these as tiles.
 
-Triple-C does not create or edit any of them — Claude Code owns that configuration, and the tiles
+1. **Create**: New container created with bind mounts, named volumes, env vars, and labels
-link out to a terminal where `/agents`, `/hooks`, `/plugins` and `/mcp` do the real work.
+2. **Start**: Container started, entrypoint remaps UID/GID, sets up SSH, configures Docker group, installs any CA certificates, injects Claude Code settings, rebuilds the scheduler crontab
+3. **Terminal**: `docker exec` launches Claude Code (with the project's permission-mode flags) or a bash login shell, with a PTY
+4. **Stop**: Container halted (its filesystem layer and both named volumes persist)
+5. **Restart**: Existing container restarted; if any `triple-c.*` label no longer matches the project's settings, the container is committed to a snapshot image, removed, and recreated from that snapshot — so installed packages survive
+6. **Migrate**: The project is moved onto a newer base image without losing its volumes — see below
+
+Each recreation moves the `triple-c-snapshot-{projectId}:latest` tag, leaving the image it pointed
+at before untagged but still on disk — multiple gigabytes per recreation. `sweep_orphaned_snapshots`
+clears those after a recreation and after a migration is accepted. It only ever removes images that
+are **both** untagged *and* labelled `triple-c.managed=true`, so a live snapshot tag and a
+migration's `pre-migration-*` rollback pin are structurally out of reach, and removal is unforced so
+Docker itself refuses while any container — including a stopped project's — is still built from the
+image.
+7. **Reset**: Container, snapshot image **and both named volumes** all removed, then recreated from the clean base image. `remove_project_volumes` deletes `triple-c-home-{projectId}` and `triple-c-claude-config-{projectId}`, so `~/.claude`, `~/.claude.json`, the OAuth login, installed skills, session transcripts and the scheduler's tasks are all lost.
+
+### Base-Image Migration
+
+A container is created from `triple-c-snapshot-{projectId}:latest` whenever that image exists, and
+every recreation re-commits it. So without an explicit act, a project stays on the base image it was
+first built from **forever** — it never picks up a new `/usr/local/bin` shim, a new `socat`, or a
+security update. **Update container base…** (Project Home → overflow menu) is the non-destructive
+way out; Reset is the destructive one. `docker/migration.rs` owns it.
+
+- **Staleness is surfaced, not acted on.** `triple-c.base-image-id` records the lineage and
+  `get_container_staleness` reports it as a banner, but it is deliberately *not* compared in
+  `container_needs_recreation`. Comparing it there would recreate every project *from its own
+  snapshot* on the next base bump: churn on the old base, and the "you should migrate" signal
+  consumed without migrating. A missing lineage label means "unknown, probe instead" — never
+  "stale".
+- **What comes across**: the apt package delta and user-authored files, computed by diffing two
+  filesystem manifests through dpkg ownership and presence-in-the-new-base. (`docker diff` is
+  useless here — on a snapshot-derived container it only reports changes since the last commit.
+  Measured on a real project, manifest diffing turned 8,677 raw path differences into 2 genuinely
+  user-authored ones.) Both named volumes are untouched at every step, so `$HOME`, the OAuth login,
+  skills, transcripts and scheduler tasks simply re-attach.
+- **What does not**: `/etc` is reported but never copied — the old lineage has
+  `/etc/apt/sources.list.d/nodesource.sources` where the current base has `nodesource.list`, and
+  having both breaks every `apt-get update`. `/var` is not copied either, and that is the one way
+  migration is *more* destructive than an ordinary recreate: a database under `/var/lib` rides along
+  on a recreate, but a migration builds from the base and the apt replay hands back an empty
+  cluster. `unpreserved_data()` names those directories in the pre-flight, the banner and the final
+  report.
+- **Crash-safety**: `:latest` keeps pointing at the old lineage until the final commit, so any
+  failure before that self-heals — the next start just recreates from the old snapshot. After the
+  container swap, a `triple-c.migration-state=in-progress` label plus a persisted state file let the
+  app offer **resume** or **rollback**. Rollback restores the system layer only; work done in
+  `$HOME` during a migrated session survives it.
+
+### Mounts
+
+| Target in Container | Source | Type | Notes |
+|---|---|---|---|
+| `/workspace/<mount-name>` | Each configured project folder | Bind | Read-write; one per folder |
+| `/home/claude` | `triple-c-home-{projectId}` | Named Volume | Home directory; survives stop/start and recreation |
+| `/home/claude/.claude` | `triple-c-claude-config-{projectId}` | Named Volume | Nested inside the home volume; Docker gives the more specific mount precedence |
+| `/tmp/.host-ssh` | SSH key directory | Bind | Read-only; entrypoint copies to `~/.ssh` |
+| `/tmp/.host-aws` | AWS config directory | Bind | Read-only; entrypoint copies to `~/.aws`; for Bedrock auth |
+| `/tmp/.host-ca` | CA certificate file or directory | Bind | Read-only; entrypoint installs into the system and NSS stores |
+| `/var/run/docker.sock` | Host Docker socket | Bind | If "Allow container spawning" is ON |
+
+These two named volumes are the only ones a project owns. Both are removed by Reset and by project
+removal, and by nothing else.
+
+### Corporate CA Certificates
+
+A global **Certificates** setting (`AppSettings::ca_cert_path`) with a per-project override
+(`Project::ca_cert_path`), accepting a single certificate file **or** a directory. It follows the
+SSH/AWS host-mount pattern — read-only bind mount at `/tmp/.host-ca`, applied by the entrypoint on
+every start — so it survives recreation, migration and Reset.
+
+- **Certificates are renamed to `.crt`.** `update-ca-certificates` globs `*.crt`, case-sensitively;
+  a `.pem` merely copied into `/usr/local/share/ca-certificates/` is ignored in total silence.
+  `container_cert_name()` in Rust does the renaming, mirrored in a few lines of shell in the
+  entrypoint. A single-file mount lands at `/tmp/.host-ca/<name>.crt`, so the entrypoint only ever
+  sees a directory.
+- **The system store is not enough.** Only curl, git and apt read it. Node — and therefore Claude
+  Code itself — needs `NODE_EXTRA_CA_CERTS`; Python and requests need
+  `REQUESTS_CA_BUNDLE`/`SSL_CERT_FILE`; Chromium reads neither and wants its own NSS database at
+  `~/.pki/nssdb`, seeded with `certutil` (from `libnss3-tools`). The NSS step warns and continues
+  rather than failing the start.
+- **Those env vars are set from Rust at creation, never exported by the entrypoint.** A terminal
+  session is a `docker exec`, which inherits the container's configured env and sees nothing the
+  entrypoint exported — the same lesson that made `$BROWSER` an image-level `ENV`. They are emitted
+  **empty** when no CA is configured, because `docker commit` bakes env into the snapshot image.
+- **`triple-c.ca-fingerprint` covers the certificate bytes, not the path.** Replacing a rotated CA
+  at the same location still forces the recreation that copies it in. Clearing the setting actively
+  **removes** `triple-c-*.crt` from the container — `/usr/local/share` rides the project's snapshot,
+  so turning the feature off has to undo, not merely stop.
+
+### Container Spawning (Sibling Containers)
+
+When "Allow container spawning" is enabled per-project, the host Docker socket is bind-mounted into the container. This allows Claude Code to create **sibling containers** (not nested Docker-in-Docker) that are visible to the host. The entrypoint detects the socket's GID and adds the `claude` user to the matching group.
+
+If the Docker access setting is toggled after a container already exists, the container is automatically recreated on next start to apply the mount change. The named config volume (keyed by project ID) is preserved across recreation.
+
+### Docker Socket Path
+
+The socket path is OS-aware:
+- **Linux/macOS**: `/var/run/docker.sock`
+- **Windows**: `//./pipe/docker_engine`
+
+Users can override this in Settings via the global `docker_socket_path` option.
+
+## Models and Authentication
+
+### Authentication Modes
+
+Each project can independently use one of:
+
+- **Anthropic** (OAuth or shared token): either the shared `claude setup-token` token injected as `CLAUDE_CODE_OAUTH_TOKEN` (see below), or a per-container `claude login`. An interactive login's token lives in the config volume and survives container stop/start and recreation — but **not** a Reset, which deletes the volumes.
+- **AWS Bedrock**: Per-project AWS credentials (static keys, profile, or bearer token). SSO sessions are validated before launching Claude for Profile auth.
+- **Ollama**: Connect to a local or remote Ollama server via `ANTHROPIC_BASE_URL` (e.g., `http://host.docker.internal:11434`). Requires a model ID, and the model must be pulled (or used via Ollama cloud) before starting the container.
+- **llama.cpp**: Connect to a local or remote `llama-server` via `ANTHROPIC_BASE_URL` (e.g., `http://host.docker.internal:8080` — 8080 is `llama-server`'s default port). `ANTHROPIC_AUTH_TOKEN` is set to a placeholder; `llama-server` ignores it unless it was started with `--api-key`.
+- **OpenAI Compatible**: Connect through a gateway that implements the **Anthropic Messages API**, via `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN`. API key stored securely in OS keychain. Triple-C can run that gateway for you — see [Model Gateway](#model-gateway-litellm-sibling-container).
+
+> **The endpoint must speak the Anthropic Messages API.** Claude Code only ever sends
+> `POST /v1/messages?beta=true` in Anthropic Messages format to `ANTHROPIC_BASE_URL` — it never
+> speaks OpenAI's `/v1/chat/completions`. So a server that exposes *only* an OpenAI-compatible API
+> (plain vLLM, text-generation-inference, LocalAI, OpenRouter, …) will **not** work behind any of
+> these backends. What does work: **LiteLLM**, which exposes an Anthropic-shaped route, and
+> **Ollama** and **llama.cpp**, both of which implement `POST /v1/messages` natively — which is why
+> they get first-class backends of their own rather than going through a translation layer.
+
+#### Model alias variables
+
+The `opus` / `sonnet` / `haiku` / `fable` aliases in Claude Code resolve to Anthropic model IDs by
+default. Against a local server those IDs do not exist, so anything that uses an alias fails —
+most visibly the **background** calls (conversation titles, summaries), which use `haiku`.
+
+For every backend that points at a custom endpoint (Ollama, llama.cpp, OpenAI Compatible),
+Triple-C therefore sets all four:
+
+| Variable | Value |
+|---|---|
+| `ANTHROPIC_DEFAULT_OPUS_MODEL` | the backend's configured model ID |
+| `ANTHROPIC_DEFAULT_SONNET_MODEL` | the backend's configured model ID |
+| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | the **Background model** override, else the configured model ID |
+| `ANTHROPIC_DEFAULT_FABLE_MODEL` | the backend's configured model ID |
+
+A local server usually serves exactly one model, so pointing every alias at it is the right
+default. If you run a second, smaller model for cheap background work, set **Background model**
+(Config → Model, and in global Backend settings) and only the Haiku alias moves.
+
+These are *not* set for the Anthropic or Bedrock backends, which reach servers that really do host
+the Anthropic model IDs. Triple-C manages all four names, so they cannot be set as custom
+environment variables. (`ANTHROPIC_SMALL_FAST_MODEL` is deprecated and is not used.)
+
+> **Note:** Ollama, llama.cpp and OpenAI Compatible support is best-effort. Claude Code is designed for Anthropic models, so some features (tool use, extended thinking, prompt caching, etc.) may not work as expected with non-Anthropic models behind these backends.
+
+### Model Gateway (LiteLLM sibling container)
+
+For providers that only speak OpenAI's API, Triple-C can run **LiteLLM** as a sibling container
+(`docker/gateway.rs`, `gateway-container/`) that gives Claude Code the Anthropic-format front end it
+requires. Settings → Gateway configures the provider prefix (`openai`, `azure`, `gemini`, `groq`,
+…), an optional API base override, the models to serve, and the host port (default `4000`). A
+project then consumes it with the OpenAI Compatible backend. It mirrors the STT container's
+lifecycle, including auto-start with the app.
+
+Its bind address is **detected, never `0.0.0.0`**. Unlike STT, the consumers are *project
+containers*, so loopback alone is not always enough: Docker Desktop binds `127.0.0.1` and advertises
+`host.docker.internal`; native Linux binds the default bridge gateway (`172.17.0.1`) and advertises
+the same literal. `GatewayBinding` derives the bind address and the advertised `base_url` together
+so the two cannot drift. A wildcard bind would be LAN-reachable — Docker's rules precede host
+firewalls — in front of a config file holding a billed provider key. A LiteLLM `master_key` is
+**always** set, because LiteLLM without one accepts any key.
+
+### Shared Claude Authentication Token
+
+Rather than running `claude login` in every container, `claude setup-token` can be run once
+(`commands/auth_token_commands.rs`). The flow borrows a running container, runs the CLI on a PTY,
+and the long-lived token it prints is stored in the OS keychain — it is never returned to the
+frontend and never logged. Streamed output passes through a chunk-boundary-safe redactor that masks
+anything resembling an `sk-ant-` secret.
+
+The token is injected as `CLAUDE_CODE_OAUTH_TOKEN` into every project where the backend is
+Anthropic, the project has not opted out (`use_shared_auth_token`, default `true`), and a token is
+actually stored. It is a reserved env key, so it cannot be hand-set as a custom variable.
+
+Rotation is tracked with a random id (not a hash of the token) mirrored into the
+`triple-c.claude-token-version` label — a hash in a `docker inspect`-readable label would be an
+offline verification oracle. Acquiring, rotating, revoking or opting out changes that label, which
+forces a container recreation on the next start; that is when a container picks the token up or has
+it cleared.
+
+## Bridges to the Host
 
 ### URL Relay (host browser)
 
@@ -175,96 +392,54 @@ recreates the container. The poller stops on its own when the container stops.
 unauthenticated service inside the container, so widening those addresses would publish container
 internals to the LAN. Nothing else on the network can reach a bridged port.
 
-### Shared Claude Authentication Token
+### Browser View
 
-Rather than running `claude login` in every container, `claude setup-token` can be run once
+Watch — and take over — the browser Claude is driving with Playwright inside the container. The
-(`commands/auth_token_commands.rs`). The flow borrows a running container, runs the CLI on a PTY,
+**Browser** tab runs Playwright's own dashboard (`browser.bind()` plus `playwright-cli show`) in the
-and the long-lived token it prints is stored in the OS keychain — it is never returned to the
+container and fronts it with a **token-gated** loopback proxy on the host (`browser_view/`). Opt-in
-frontend and never logged. Streamed output passes through a chunk-boundary-safe redactor that masks
+per project.
-anything resembling an `sk-ant-` secret.
 
-The token is injected as `CLAUDE_CODE_OAUTH_TOKEN` into every project where the backend is
+- **It deliberately does not reuse the auth bridge's `PortForward`**, which binds an
-Anthropic, the project has not opted out (`use_shared_auth_token`, default `true`), and a token is
+  unauthenticated port — fine for a throwaway OAuth listener, wrong for remote control of a browser.
-actually stored. It is a reserved env key, so it cannot be hand-set as a custom variable.
+  Host ports are confined to `47820..=47827` because CSP `frame-src` cannot express a port range and
+  has to enumerate them; a unit test asserts the Rust range matches `tauri.conf.json`.
+- **Pop out** puts the same URL in a second OS window (`popout.rs`), so the view can be watched on
+  another monitor or pinned on top while the main window is used for work. No capability lists that
+  window, so it has **no IPC surface**; the app CSP does not apply to it either, because it is a
+  top-level document rather than a frame — the token gate is what protects the port in both cases.
+  The window is owned by the *session*, so the supervisor's teardown closes it. The pane drops its
+  iframe while popped out, and both viewers can drive the browser.
+- **Open page…** launches a browser in the container at a URL and viewport you choose and binds it,
+  so the pane shows it (`page.rs`). This is what serves container-side auth — the OAuth callback
+  listener is *in* the container, so a container-side browser closes the loop with no host round
+  trip and no auth bridge — and dev servers on container loopback. Re-opening with a helper already
+  up *navigates* rather than relaunching, so a session signed in on one page survives to the next.
+- **Resizing the window does not resize the page.** The viewer is a CDP screencast: a bigger window
+  is the same pixels drawn larger. `page.setViewportSize()` is what reflows, and match-window mode
+  pushes the pop-out's settled size into it, debounced by generation counter because a drag emits
+  continuously and each event costs a container exec.
+- **Setup is two clicks, and nothing installs itself.** Detection has to look past `node_modules` —
+  `claude mcp add … npx @playwright/mcp@latest` installs into `~/.npm/_npx/<hash>/node_modules` — and
+  hops from a wrapper `playwright` to its **nested** `playwright-core`, because npm does not hoist
+  for global installs and the wrapper ships no type definitions to read a version from. Installing
+  puts Playwright in `/workspace` with `--no-save` (not a bind mount, so it touches nothing of
+  yours) and browsers in `~/.cache/ms-playwright`, which is inside the home volume and so survives
+  recreation *and* migration.
+- **`@playwright/mcp` can never satisfy this pane** on its own: it bundles a `playwright-core` that
+  binds, but never `@playwright/cli`, which is the viewer. It is what binds sessions automatically
+  once Playwright is present — not a setup route.
 
-Rotation is tracked with a random id (not a hash of the token) mirrored into the
+## Inside a Project
-`triple-c.claude-token-version` label — a hash in a `docker inspect`-readable label would be an
-offline verification oracle. Acquiring, rotating, revoking or opting out changes that label, which
-forces a container recreation on the next start; that is when a container picks the token up or has
-it cleared.
 
-### Container Lifecycle
+### Container Introspection (Capability Tiles)
 
-1. **Create**: New container created with bind mounts, named volumes, env vars, and labels
+`list_container_capabilities` (`commands/inspect_commands.rs`) runs a read-only `find`/`jq` script
-2. **Start**: Container started, entrypoint remaps UID/GID, sets up SSH, configures Docker group, injects Claude Code settings, rebuilds the scheduler crontab
+inside a running container and returns counts plus item lists for **skills, agents, commands, hooks,
-3. **Terminal**: `docker exec` launches Claude Code (with the project's permission-mode flags) or a bash login shell, with a PTY
+plugins and MCP servers**, at user scope (`/home/claude/.claude`) and project scope
-4. **Stop**: Container halted (its filesystem layer and both named volumes persist)
+(`/workspace/*/.claude`, `/workspace/*/.mcp.json`). Overview renders these as tiles.
-5. **Restart**: Existing container restarted; if any `triple-c.*` label no longer matches the project's settings, the container is committed to a snapshot image, removed, and recreated from that snapshot — so installed packages survive
-6. **Reset**: Container, snapshot image **and both named volumes** all removed, then recreated from the clean base image. `remove_project_volumes` deletes `triple-c-home-{projectId}` and `triple-c-claude-config-{projectId}`, so `~/.claude`, `~/.claude.json`, the OAuth login, installed skills, session transcripts and the scheduler's tasks are all lost.
 
-### Mounts
+Triple-C does not create or edit any of them — Claude Code owns that configuration, and the tiles
-
+link out to a terminal where `/agents`, `/hooks`, `/plugins` and `/mcp` do the real work.
-| Target in Container | Source | Type | Notes |
-|---|---|---|---|
-| `/workspace/<mount-name>` | Each configured project folder | Bind | Read-write; one per folder |
-| `/home/claude` | `triple-c-home-{projectId}` | Named Volume | Home directory; survives stop/start and recreation |
-| `/home/claude/.claude` | `triple-c-claude-config-{projectId}` | Named Volume | Nested inside the home volume; Docker gives the more specific mount precedence |
-| `/tmp/.host-ssh` | SSH key directory | Bind | Read-only; entrypoint copies to `~/.ssh` |
-| `/home/claude/.aws` | AWS config directory | Bind | Read-only; for Bedrock auth |
-| `/var/run/docker.sock` | Host Docker socket | Bind | If "Allow container spawning" is ON |
-
-These two named volumes are the only ones a project owns. Both are removed by Reset and by project
-removal, and by nothing else.
-
-### Authentication Modes
-
-Each project can independently use one of:
-
-- **Anthropic** (OAuth or shared token): either the shared `claude setup-token` token injected as `CLAUDE_CODE_OAUTH_TOKEN` (see below), or a per-container `claude login`. An interactive login's token lives in the config volume and survives container stop/start and recreation — but **not** a Reset, which deletes the volumes.
-- **AWS Bedrock**: Per-project AWS credentials (static keys, profile, or bearer token). SSO sessions are validated before launching Claude for Profile auth.
-- **Ollama**: Connect to a local or remote Ollama server via `ANTHROPIC_BASE_URL` (e.g., `http://host.docker.internal:11434`). Requires a model ID, and the model must be pulled (or used via Ollama cloud) before starting the container.
-- **llama.cpp**: Connect to a local or remote `llama-server` via `ANTHROPIC_BASE_URL` (e.g., `http://host.docker.internal:8080` — 8080 is `llama-server`'s default port). `ANTHROPIC_AUTH_TOKEN` is set to a placeholder; `llama-server` ignores it unless it was started with `--api-key`.
-- **OpenAI Compatible**: Connect through a gateway that implements the **Anthropic Messages API**, via `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN`. API key stored securely in OS keychain.
-
-> **The endpoint must speak the Anthropic Messages API.** Claude Code only ever sends
-> `POST /v1/messages?beta=true` in Anthropic Messages format to `ANTHROPIC_BASE_URL` — it never
-> speaks OpenAI's `/v1/chat/completions`. So a server that exposes *only* an OpenAI-compatible API
-> (plain vLLM, text-generation-inference, LocalAI, OpenRouter, …) will **not** work behind any of
-> these backends. What does work: **LiteLLM**, which exposes an Anthropic-shaped route, and
-> **Ollama** and **llama.cpp**, both of which implement `POST /v1/messages` natively — which is why
-> they get first-class backends of their own rather than going through a translation layer.
-
-#### Model alias variables
-
-The `opus` / `sonnet` / `haiku` / `fable` aliases in Claude Code resolve to Anthropic model IDs by
-default. Against a local server those IDs do not exist, so anything that uses an alias fails —
-most visibly the **background** calls (conversation titles, summaries), which use `haiku`.
-
-For every backend that points at a custom endpoint (Ollama, llama.cpp, OpenAI Compatible),
-Triple-C therefore sets all four:
-
-| Variable | Value |
-|---|---|
-| `ANTHROPIC_DEFAULT_OPUS_MODEL` | the backend's configured model ID |
-| `ANTHROPIC_DEFAULT_SONNET_MODEL` | the backend's configured model ID |
-| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | the **Background model** override, else the configured model ID |
-| `ANTHROPIC_DEFAULT_FABLE_MODEL` | the backend's configured model ID |
-
-A local server usually serves exactly one model, so pointing every alias at it is the right
-default. If you run a second, smaller model for cheap background work, set **Background model**
-(Config → Model, and in global Backend settings) and only the Haiku alias moves.
-
-These are *not* set for the Anthropic or Bedrock backends, which reach servers that really do host
-the Anthropic model IDs. Triple-C manages all four names, so they cannot be set as custom
-environment variables. (`ANTHROPIC_SMALL_FAST_MODEL` is deprecated and is not used.)
-
-> **Note:** Ollama, llama.cpp and OpenAI Compatible support is best-effort. Claude Code is designed for Anthropic models, so some features (tool use, extended thinking, prompt caching, etc.) may not work as expected with non-Anthropic models behind these backends.
-
-### Container Spawning (Sibling Containers)
-
-When "Allow container spawning" is enabled per-project, the host Docker socket is bind-mounted into the container. This allows Claude Code to create **sibling containers** (not nested Docker-in-Docker) that are visible to the host. The entrypoint detects the socket's GID and adds the `claude` user to the matching group.
-
-If the Docker access setting is toggled after a container already exists, the container is automatically recreated on next start to apply the mount change. The named config volume (keyed by project ID) is preserved across recreation.
 
 ### Mission Control Integration
 
@@ -289,87 +464,117 @@ Triple-C includes optional speech-to-text powered by [Faster Whisper](https://gi
 - **Hotkey**: `Ctrl+Shift+M` to toggle recording
 - **Models**: `tiny`, `small`, or `medium` (configurable in Settings)
 - **Port**: Default `9876` (configurable)
+- **Input device**: Selectable in Settings when the host exposes more than one microphone
 - **Language**: Optional language hint for transcription
 - **Auto-start**: When STT is enabled in Settings, the container starts automatically with the app — no need to manually start it after each restart
 - **On-demand fallback**: If not auto-started, the container starts automatically when you first click the mic button
 
 **How it works**: Audio is captured in the browser via the Web Audio API, encoded as WAV, and sent to the Faster Whisper container's `/transcribe` endpoint. The transcribed text is inserted directly into the active terminal. The STT container uses a named Docker volume (`triple-c-stt-model-cache`) to cache Whisper models across restarts.
 
-### Docker Socket Path
-
-The socket path is OS-aware:
-- **Linux/macOS**: `/var/run/docker.sock`
-- **Windows**: `//./pipe/docker_engine`
-
-Users can override this in Settings via the global `docker_socket_path` option.
-
 ## Key Files
 
+### Frontend — layout and projects
+
 | File | Purpose |
 |---|---|
 | `app/src/App.tsx` | Root layout (TopBar + Sidebar + Main + StatusBar + ToastHost) |
 | `app/src/index.css` | Global CSS variables, dark theme, `color-scheme: dark`, `:focus-visible` ring |
 | `app/src/components/layout/TopBar.tsx` | Hosts MainTabs + Docker/Image status indicators + Help |
-| `app/src/components/layout/MainTabs.tsx` | The single main-area tab strip (Project Home + terminal tabs) |
+| `app/src/components/layout/MainTabs.tsx` | The single main-area tab strip (Project Home + terminal tabs), pointer-event drag reordering |
 | `app/src/components/layout/Sidebar.tsx` | Responsive sidebar (25% width, min 224px, max 320px), collapsible to an icon rail |
 | `app/src/components/layout/StatusBar.tsx` | Project/terminal counts, Jump to Current, STT mic |
 | `app/src/components/projects/ProjectRow.tsx` | Select-only sidebar row; opens Project Home, with hover start/stop and terminal controls |
 | `app/src/components/projects/ProjectList.tsx` | Project list in sidebar |
 | `app/src/components/projects/PermissionModeControl.tsx` | Plan / Default / Accept Edits / Bypass segmented control |
+| `app/src/components/ui/` | Shared primitives: `Modal`, `Button`, `Toggle`, `Field`, `SegmentedControl`, `StatusIndicator`, `SaveIndicator`, `OverflowMenu`, `ToastHost`, `Tooltip` |
+| `app/src/hooks/useKeyboardShortcuts.ts` | `Ctrl+T`, `Ctrl+Shift+W`, `Ctrl+Tab`, `Ctrl+1..9`, `Ctrl+Shift+←/→` |
+| `app/src/hooks/useContainerProgress.ts` | `container-progress` event → inline progress lines |
+
+### Frontend — Project Home
+
+| File | Purpose |
+|---|---|
 | `app/src/components/projects/home/ProjectHome.tsx` | Project Home shell: header actions, overflow menu, tab strip |
 | `app/src/components/projects/home/OverviewTab.tsx` | Permission mode, summary, capability tiles, recent sessions and tasks |
 | `app/src/components/projects/home/SessionsTab.tsx` | Past Claude sessions with Resume |
-| `app/src/components/projects/home/AutomationTab.tsx` | Scheduler tasks: toggle, run now, logs, remove, notifications |
+| `app/src/components/projects/home/AutomationTab.tsx` | Scheduler tasks: create, toggle, run now, logs, remove, notifications |
+| `app/src/components/projects/home/TaskEditorModal.tsx` | Create/edit a scheduled task; `taskValidation.ts` holds the cron and schedule rules |
 | `app/src/components/projects/home/ConfigTab.tsx` | Config sections (Workspace, Model, Access, Runtime) |
 | `app/src/components/projects/home/FilesTab.tsx` | File browser (browse, download, upload) |
+| `app/src/components/projects/home/BrowserTab.tsx` | Browser view pane: detect, install, watch, take over, pop out |
+| `app/src/components/projects/home/OpenPageDialog.tsx` | Open a URL in the container's browser at a chosen viewport |
+| `app/src/components/projects/home/ContainerMigrationBanner.tsx` | Base-image staleness banner, migration progress, resume/rollback |
 | `app/src/components/projects/home/CapabilityTiles.tsx` | Read-only skills/agents/commands/hooks/plugins/MCP counts |
 | `app/src/components/projects/ClaudeCodeSettingsEditor.tsx` | Claude Code CLI settings (TUI mode, effort, focus, caching) |
-| `app/src/components/ui/` | Shared primitives: `Modal`, `Button`, `Toggle`, `Field`, `SegmentedControl`, `StatusIndicator`, `SaveIndicator`, `OverflowMenu`, `ToastHost`, `Tooltip` |
+
-| `app/src/hooks/useKeyboardShortcuts.ts` | `Ctrl+T`, `Ctrl+Shift+W`, `Ctrl+Tab`, `Ctrl+1..9` |
+### Frontend — settings, terminal and hooks
-| `app/src/hooks/useContainerProgress.ts` | `container-progress` event → inline progress lines |
+
-| `app/src/components/settings/SettingsPanel.tsx` | Docker, AWS, timezone, web terminal, shared auth, and global settings |
+| File | Purpose |
+|---|---|
+| `app/src/components/settings/SettingsPanel.tsx` | Docker, AWS, timezone, certificates, gateway, web terminal, STT, shared auth and global settings |
+| `app/src/components/settings/CertificateSettings.tsx` | Corporate CA certificate path (global), with `CaCertPathInput` |
+| `app/src/components/settings/GatewaySettings.tsx` | LiteLLM gateway: provider, API base, models, port, container controls |
 | `app/src/components/settings/SharedAuthSettings.tsx` | Acquire / revoke the shared Claude authentication token |
 | `app/src/components/settings/WebTerminalSettings.tsx` | Web terminal toggle, URL, token management |
-| `app/src/components/settings/SttSettings.tsx` | STT settings panel (model, port, language, container controls) |
+| `app/src/components/settings/SttSettings.tsx` | STT settings panel (model, port, language, device, container controls) |
+| `app/src/components/settings/UpdateDialog.tsx` | New-release notice with download links (`update_commands.rs`) |
 | `app/src/components/terminal/TerminalView.tsx` | xterm.js terminal with WebGL, URL detection, OSC 52 clipboard, OSC 7777 URL relay, image paste |
 | `app/src/components/terminal/SttButton.tsx` | Mic button with on-demand STT container start |
 | `app/src/hooks/useTerminal.ts` | Terminal session management (claude and bash modes) |
 | `app/src/hooks/useProjectActions.ts` | Start/stop/reset/backup and terminal-opening helpers |
+| `app/src/hooks/useContainerMigration.ts` | Staleness polling, migration run, resume and rollback |
 | `app/src/hooks/useFileManager.ts` | File manager operations (list, download, upload) |
 | `app/src/hooks/useClaudeAuth.ts` | Shared-token status and acquisition |
 | `app/src/hooks/useSTT.ts` | Speech-to-text recording, transcription, and container management |
+| `app/src/lib/urlRelay.ts` | Host-side relay validation: OSC 7777 parsing, http/https allowlist, rate limiting |
+| `app/src/lib/wav.ts` | WAV audio encoding for STT transcription |
+
+### Backend (Rust)
+
+| File | Purpose |
+|---|---|
 | `app/src-tauri/src/docker/container.rs` | Container creation, mounts, env vars, labels, recreation checks, `remove_project_volumes` |
 | `app/src-tauri/src/docker/exec.rs` | `create_attached_exec()` — the single attached-exec path; file upload/download via tar |
 | `app/src-tauri/src/docker/image.rs` | Image building/pulling |
+| `app/src-tauri/src/docker/migration.rs` | Base-image migration: manifest capture, delta computation, crash-recovery state machine |
+| `app/src-tauri/src/docker/ca_certs.rs` | CA certificate discovery, `.crt` renaming, fingerprinting |
+| `app/src-tauri/src/docker/gateway.rs` | LiteLLM sibling container: binding detection, config rendering, lifecycle |
 | `app/src-tauri/src/docker/stt.rs` | Speech-to-text container lifecycle |
 | `app/src-tauri/src/docker/legacy_cleanup.rs` | One-release migration shim removing leftovers from the deleted MCP feature |
 | `app/src-tauri/src/auth_bridge/` | Loopback callback bridge (`mod.rs`, `proc_net.rs`, `tunnel.rs`) |
+| `app/src-tauri/src/browser_view/` | Browser view: `detect.rs`, `install.rs`, `page.rs`, `popout.rs`, `proxy.rs`, `commands.rs` |
 | `app/src-tauri/src/commands/project_commands.rs` | Start/stop/rebuild Tauri command handlers |
+| `app/src-tauri/src/commands/migration_commands.rs` | Staleness, migrate, confirm, rollback, reconcile, `is_migrating` |
 | `app/src-tauri/src/commands/inspect_commands.rs` | Read-only container views: sessions, capabilities, scheduler tasks |
 | `app/src-tauri/src/commands/auth_token_commands.rs` | `claude setup-token` flow, redaction, keychain storage |
 | `app/src-tauri/src/commands/auth_bridge_commands.rs` | Auth bridge enable/status commands |
 | `app/src-tauri/src/commands/file_commands.rs` | File manager Tauri commands (list, download, upload) |
-| `app/src-tauri/src/models/project.rs` | Project struct (backend, `PermissionMode`, Docker access, Claude Code settings, Mission Control, auth bridge, shared-token opt-out) |
+| `app/src-tauri/src/commands/stt_commands.rs` | STT start/stop/transcribe Tauri commands |
-| `app/src-tauri/src/models/app_settings.rs` | Global settings (image source, Docker socket, AWS, Claude Code settings, web terminal, STT) |
+| `app/src-tauri/src/commands/web_terminal_commands.rs` | Web terminal start/stop/status Tauri commands |
+| `app/src-tauri/src/models/project.rs` | Project struct (backend, `PermissionMode`, Docker access, Claude Code settings, Mission Control, auth bridge, browser view, CA path, shared-token opt-out) |
+| `app/src-tauri/src/models/app_settings.rs` | Global settings (image source, Docker socket, AWS, CA path, Claude Code settings, web terminal, STT, gateway) |
+| `app/src-tauri/src/models/gateway_settings.rs` | Gateway provider, models, port and API base |
 | `app/src-tauri/src/web_terminal/server.rs` | Axum HTTP+WS server for remote terminal access |
 | `app/src-tauri/src/web_terminal/ws_handler.rs` | WebSocket connection handler and session management |
 | `app/src-tauri/src/web_terminal/terminal.html` | Embedded web UI (xterm.js, project picker, tabs) |
-| `app/src-tauri/src/commands/stt_commands.rs` | STT start/stop/transcribe Tauri commands |
+| `app/src-tauri/src/storage/secure.rs` | OS keychain access (per-project secrets, shared token, gateway keys, rotation id) |
-| `app/src-tauri/src/commands/web_terminal_commands.rs` | Web terminal start/stop/status Tauri commands |
+
-| `app/src-tauri/src/docker/stt.rs` | STT Docker container lifecycle (create, start, stop, build, pull) |
+### Container and packaging
-| `app/src/lib/wav.ts` | WAV audio encoding for STT transcription |
+
-| `stt-container/Dockerfile` | Faster Whisper STT container image (Python 3.11 + FastAPI) |
+| File | Purpose |
-| `stt-container/server.py` | STT HTTP server (POST /transcribe endpoint) |
+|---|---|
-| `container/Dockerfile` | Ubuntu 24.04 sandbox image with Claude Code + dev tools + clipboard/audio shims |
+| `container/Dockerfile` | Ubuntu 24.04 sandbox image with Claude Code + dev tools + clipboard/audio shims + browser runtime libraries |
-| `container/entrypoint.sh` | UID/GID remap, SSH setup, Docker group config, Claude Code settings injection, Mission Control setup |
+| `container/entrypoint.sh` | UID/GID remap, SSH setup, CA installation, Docker group config, Claude Code settings injection, Mission Control setup |
 | `container/osc52-clipboard` | Clipboard shim (xclip/xsel/pbcopy via OSC 52) |
 | `container/triple-c-open` | URL relay shim (xdg-open/`$BROWSER`/sensible-browser via OSC 7777); prints the URL when no terminal is attached |
-| `app/src/lib/urlRelay.ts` | Host-side relay validation: OSC 7777 parsing, http/https allowlist, rate limiting |
 | `container/audio-shim` | Audio capture shim (rec/arecord via FIFO) for voice mode |
 | `container/triple-c-scheduler` | Bash CLI managing scheduled task JSON and the crontab |
 | `container/triple-c-task-runner` | Cron entry point; maps `TRIPLE_C_PERMISSION_MODE` to flags and runs `claude -p` |
 | `container/triple-c-sso-refresh` | AWS SSO session refresh helper |
-| `app/src-tauri/src/storage/secure.rs` | OS keychain access (per-project secrets, shared token, rotation id) |
+| `gateway-container/` | LiteLLM image and rendered `config.yaml` for the model gateway |
+| `stt-container/Dockerfile` | Faster Whisper STT container image (Python 3.11 + FastAPI) |
+| `stt-container/server.py` | STT HTTP server (POST /transcribe endpoint) |
+| `branding/` | Logo sources, palette, and `build-icons.py`, which generates every packaged icon |
 
 ## CSS / Styling Notes
 
@@ -382,7 +587,7 @@ Users can override this in Settings via the global `docker_socket_path` option.
 
 **Base**: Ubuntu 24.04
 
-**Pre-installed tools**: Claude Code, Node.js 22 LTS + pnpm, Python 3.12 + uv + ruff, Rust (stable), Docker CLI, git + gh, AWS CLI v2, ripgrep, openssh-client, build-essential
+**Pre-installed tools**: Claude Code, Node.js 22 LTS + pnpm, Python 3.12 + uv + ruff, Rust (stable), Docker CLI, git + gh, AWS CLI v2, ripgrep, openssh-client, build-essential, `libnss3-tools` (for `certutil`, used to seed Chromium's CA store)
 
 **Shims**: `xclip`/`xsel`/`pbcopy` (OSC 52 clipboard forwarding), `xdg-open`/`sensible-browser`/`www-browser`/`x-www-browser`/`$BROWSER` (OSC 7777 URL relay to the host browser), `rec`/`arecord` (audio FIFO for voice mode)
 
@@ -406,4 +611,10 @@ The libraries are the opposite — a runtime `apt-get install` lands in the cont
 layer, is re-paid after every Reset, and is lost on migration (which replays apt from a manifest
 against the new base). Baking one and not the other puts each half where it already persists.
 
+**`/home/claude` in the image is seed-only.** It is the mount point of the `triple-c-home-{projectId}`
+volume, so after a project's *first* start the image's copy of that directory is masked permanently.
+A change made under `/home/claude` in the Dockerfile reaches **new projects only** — with or without
+a base-image migration. Anything that must stay upgradable belongs in `/usr/local/bin` or `/opt`, or
+must be seeded by `entrypoint.sh` on every start.
+
 **Default user**: `claude` (UID/GID 1000, remapped by entrypoint to match host)

VERSION

@@ -1 +1 @@
-0.3
+0.4

app/index.html

@@ -2,7 +2,7 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Triple-C</title>
   </head>

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "triple-c",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "triple-c",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "dependencies": {
         "@tauri-apps/api": "^2",
         "@tauri-apps/plugin-dialog": "^2.7.0",

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "triple-c",
   "private": true,
-  "version": "0.3.0",
+  "version": "0.4.0",
   "type": "module",
   "scripts": {
     "dev": "vite",

app/public/favicon.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Triple-C">
+  <title>Triple-C application icon, small-size variant</title>
+  <!-- Source for every raster ≤ 32 px: the small mark, drawn at 82% so the strokes
+       survive being resampled down to 16 px. See build-icons.py. -->
+  <rect width="128" height="128" rx="28.16" fill="#0D1117"/>
+  <g transform="translate(2.9236 2.9236) scale(0.95418)">
+    <g fill="none" stroke-linecap="round" stroke-linejoin="round">
+      <path d="M112 50 L112 38 A22 22 0 0 0 90 16 L38 16 A22 22 0 0 0 16 38 L16 90 A22 22 0 0 0 38 112 L90 112 A22 22 0 0 0 112 90 L112 78"
+            stroke="#58A6FF" stroke-width="14"/>
+      <path d="M46 50 L62 66 L46 82" stroke="#F0821E" stroke-width="13"/>
+    </g>
+  </g>
+</svg>

app/src-tauri/Cargo.lock

@@ -5163,7 +5163,7 @@ dependencies = [
 
 [[package]]
 name = "triple-c"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "axum",
  "base64 0.22.1",

app/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "triple-c"
-version = "0.3.0"
+version = "0.4.0"
 edition = "2021"
 
 [lib]

app/src-tauri/src/browser_view/commands.rs

@@ -5,7 +5,7 @@
 use tauri::{AppHandle, State};
 
 use crate::browser_view::install::{self, BrowserSetupOutcome};
-use crate::browser_view::{manager, BrowserViewStatus};
+use crate::browser_view::{manager, page, popout, BrowserViewState, BrowserViewStatus};
 use crate::AppState;
 
 /// Turn the pane on or off for a project.
@@ -97,6 +97,220 @@ pub async fn install_browser_view_browser(
     install::install_browser(&app_handle, &project_id, &container_id, target).await
 }
 
+/// Detach the view into a window of its own, or raise the one already open.
+///
+/// Host-side and window-only: the viewer keeps running exactly as it was, and
+/// this touches neither the container nor the proxy. Requires a *live* view,
+/// because a window with nothing behind it is not worth opening — the pane
+/// only offers the button in that state, and this enforces it.
+#[tauri::command]
+pub async fn open_browser_view_popout(
+    project_id: String,
+    always_on_top: bool,
+    app_handle: AppHandle,
+    state: State<'_, AppState>,
+) -> Result<(), String> {
+    let status = manager().status(&project_id).await;
+    let (BrowserViewState::Running, Some(url)) = (status.state, status.url.as_deref()) else {
+        return Err(
+            "The browser view isn't running. Start it before opening it in its own window."
+                .to_string(),
+        );
+    };
+
+    let name = state
+        .projects_store
+        .get(&project_id)
+        .map(|p| p.name)
+        .unwrap_or_else(|| "Triple-C".to_string());
+
+    popout::open(&app_handle, &project_id, &name, url, always_on_top)
+}
+
+/// Close the pop-out, putting the view back in the tab. No-op if it is closed.
+///
+/// Propagates a failed close rather than reporting success: the pane restores
+/// its iframe on success, and doing that with the window still up puts two
+/// viewers on one browser.
+#[tauri::command]
+pub async fn close_browser_view_popout(
+    project_id: String,
+    app_handle: AppHandle,
+) -> Result<(), String> {
+    popout::close(&app_handle, &project_id)
+}
+
+/// Whether the pop-out is open, and whether it is pinned on top.
+///
+/// Read on every pane mount: the window outlives the pane — which is unmounted
+/// whenever another Project Home sub-tab is selected — so neither fact can be
+/// carried in component state.
+#[tauri::command]
+pub async fn get_browser_view_popout_state(
+    project_id: String,
+    app_handle: AppHandle,
+) -> Result<popout::PopoutState, String> {
+    Ok(popout::state(&app_handle, &project_id))
+}
+
+/// Pin the pop-out above other windows, so it can be watched while working in
+/// the main one.
+#[tauri::command]
+pub async fn set_browser_view_popout_always_on_top(
+    project_id: String,
+    on_top: bool,
+    app_handle: AppHandle,
+) -> Result<(), String> {
+    popout::set_always_on_top(&app_handle, &project_id, on_top)
+}
+
+/// Open a URL in a browser *inside* the container, published so the pane shows
+/// it.
+///
+/// Two uses, one action: an auth URL — where the OAuth callback listener is in
+/// the container too, so the loop closes without the host being involved at all
+/// — and a dev server on container loopback, which is how you watch a UI Claude
+/// is building.
+///
+/// The scheme allow-list mirrors the URL relay's: `http`/`https` only, so this
+/// can never be talked into opening `file:` on the container's filesystem.
+#[tauri::command]
+pub async fn open_page_in_container_browser(
+    project_id: String,
+    url: String,
+    width: u32,
+    height: u32,
+    show_window: bool,
+    app_handle: AppHandle,
+    state: State<'_, AppState>,
+) -> Result<page::PageState, String> {
+    let trimmed = url.trim();
+    if !(trimmed.starts_with("http://") || trimmed.starts_with("https://")) {
+        return Err("Only http:// and https:// URLs can be opened in the browser.".to_string());
+    }
+    let container_id = running_container(&state, &project_id, "opening a page").await?;
+    crate::commands::project_commands::emit_progress(
+        &app_handle,
+        &project_id,
+        "Checking the container for Playwright…",
+    );
+    let detection = crate::browser_view::detect::detect(&container_id).await?;
+    let opened = page::open(
+        &app_handle,
+        &project_id,
+        &container_id,
+        &detection,
+        trimmed,
+        page::Viewport::sane(width, height),
+    )
+    .await?;
+
+    // A page nobody can see is not an opened page. Opening one used to leave
+    // the user to go and press Start in the Browser tab themselves — and from
+    // the terminal's URL prompt, with no indication that was even needed.
+    // Asking for a page *is* asking to watch it, so the viewer comes up too.
+    let status = manager().status(&project_id).await;
+    if status.state != BrowserViewState::Running {
+        crate::commands::project_commands::emit_progress(
+            &app_handle,
+            &project_id,
+            "Starting the viewer…",
+        );
+        manager()
+            .start(
+                project_id.clone(),
+                container_id,
+                app_handle.clone(),
+                state.projects_store.clone(),
+            )
+            .await?;
+    }
+
+    // From the terminal there is no pane on screen to fill, so the page needs a
+    // window of its own or it lands somewhere the user isn't looking.
+    if show_window {
+        let status = manager().status(&project_id).await;
+        if let Some(url) = status.url.as_deref() {
+            let name = state
+                .projects_store
+                .get(&project_id)
+                .map(|p| p.name)
+                .unwrap_or_else(|| "Triple-C".to_string());
+            popout::open(&app_handle, &project_id, &name, url, false)?;
+        }
+    }
+
+    crate::commands::project_commands::emit_progress(&app_handle, &project_id, "");
+    Ok(opened)
+}
+
+/// Resize the page this opened. The pop-out's "match window" mode calls this on
+/// every settled resize, so it is deliberately cheap: one control-file write.
+#[tauri::command]
+pub async fn set_container_page_viewport(
+    project_id: String,
+    width: u32,
+    height: u32,
+    state: State<'_, AppState>,
+) -> Result<(), String> {
+    let container_id = running_container(&state, &project_id, "resizing the page").await?;
+    page::set_viewport(&container_id, page::Viewport::sane(width, height)).await
+}
+
+/// State of the page this opened, if any. Never fails: "no page" is an answer.
+#[tauri::command]
+pub async fn get_container_page_state(
+    project_id: String,
+    state: State<'_, AppState>,
+) -> Result<page::PageState, String> {
+    let Ok(container_id) = running_container(&state, &project_id, "reading the page").await else {
+        return Ok(page::PageState::default());
+    };
+    Ok(page::state(&container_id).await)
+}
+
+/// Close the page this opened, leaving the view itself running.
+#[tauri::command]
+pub async fn close_container_page(
+    project_id: String,
+    state: State<'_, AppState>,
+) -> Result<(), String> {
+    let container_id = running_container(&state, &project_id, "closing the page").await?;
+    page::close(&container_id).await;
+    Ok(())
+}
+
+/// Make the page track the pop-out window's size as it is dragged.
+///
+/// Only affects a page **this app opened**: a bound browser admits no second
+/// client, so one `@playwright/mcp` launched keeps the viewport it was given.
+/// Turning it on applies the window's current size immediately, so the toggle
+/// has a visible effect without waiting for a drag.
+#[tauri::command]
+pub async fn set_browser_view_match_window(
+    project_id: String,
+    enabled: bool,
+    app_handle: AppHandle,
+    state: State<'_, AppState>,
+) -> Result<(), String> {
+    popout::set_match_window(&project_id, enabled);
+    if !enabled {
+        return Ok(());
+    }
+    let Some((width, height)) = popout::inner_size(&app_handle, &project_id) else {
+        return Ok(());
+    };
+    let container_id = running_container(&state, &project_id, "matching the window").await?;
+    page::set_viewport(&container_id, page::Viewport::sane(width, height)).await
+}
+
+/// Whether match-window mode is on. Read on mount, like the rest of the
+/// pop-out's state — the pane is unmounted whenever another sub-tab is shown.
+#[tauri::command]
+pub async fn get_browser_view_match_window(project_id: String) -> Result<bool, String> {
+    Ok(popout::match_window(&project_id))
+}
+
 /// The project's container, or a sentence saying why there isn't one.
 ///
 /// Every command here needs a *running* container, and every one of them used

app/src-tauri/src/browser_view/detect.rs

@@ -93,6 +93,32 @@ pub struct PlaywrightDetection {
     /// user's own scripts and not for the MCP plugin.
     #[serde(default)]
     pub chrome_channel: Option<String>,
+    /// The Chromium binary the *resolved* Playwright would launch, asked of the
+    /// build itself rather than derived from the cache listing.
+    #[serde(default)]
+    pub chromium_executable: Option<String>,
+    /// Whether that binary is actually on disk.
+    ///
+    /// False with a non-empty [`Self::browsers`] is the revision-skew case: two
+    /// Playwright copies in one container pin different revisions, so the cache
+    /// can be full of browsers and every launch still fail.
+    #[serde(default)]
+    pub chromium_executable_exists: bool,
+    /// The version a *script's* `require("playwright")` resolves to.
+    ///
+    /// Tracked separately from [`Self::playwright_version`] because they are
+    /// routinely different in one directory: `@playwright/cli` pins its own
+    /// `playwright-core`, npm hoists that, and a separately-installed
+    /// `playwright` then nests a second core beside it. The viewer uses one,
+    /// Claude's scripts use the other.
+    #[serde(default)]
+    pub script_playwright_version: Option<String>,
+    /// The Chromium that copy would launch, and whether it is there. This is
+    /// the pair that decides whether a script Claude writes actually runs.
+    #[serde(default)]
+    pub script_chromium_executable: Option<String>,
+    #[serde(default)]
+    pub script_chromium_executable_exists: bool,
     /// Where the probe looked, echoed back for the "not found" message.
     #[serde(default)]
     pub searched: Vec<String>,
@@ -155,13 +181,82 @@ impl PlaywrightDetection {
         None
     }
 
+    /// The revision-skew sentence, for the pane's browser step.
+    ///
+    /// Separate from [`Self::blocker`] because it does not block the *viewer* —
+    /// the dashboard runs fine; it is the browser that cannot start. Names both
+    /// halves, because "install a browser" over a cache that visibly already
+    /// has one reads as nonsense without them.
+    pub fn skew_message(&self) -> Option<String> {
+        if !self.revision_skew() {
+            return None;
+        }
+        // Which half is broken changes what the user sees, so say the one that
+        // is. The scripts case is the one that looks like a lie: the pane is
+        // green, the viewer works, and every script Claude writes dies.
+        if self.scripts_cannot_launch() {
+            return Some(format!(
+                "This container has {}, and the viewer works — but `require(\"playwright\")` \
+                 resolves Playwright {}, which launches {}. That file isn't there, so every \
+                 script Claude writes fails with “Executable doesn't exist”. Two copies ended \
+                 up in one tree: `@playwright/cli` pins its own `playwright-core`, and a \
+                 separately-installed `playwright` nests a second one beside it. “Set up \
+                 Playwright” below reinstalls them as one consistent set.",
+                self.browsers.join(", "),
+                self.script_playwright_version.as_deref().unwrap_or("?"),
+                self.script_chromium_executable.as_deref().unwrap_or("?"),
+            ));
+        }
+        Some(format!(
+            "This container has {}, but Playwright {} launches {} — which isn't there, so \
+             every `chromium.launch()` fails with “Executable doesn't exist”. That happens \
+             when two Playwright copies share a container (typically an npx `@playwright/mcp` \
+             alongside this one); each pins its own browser revision. “Install Chromium” below \
+             fetches the revision this build needs — it runs that build's own installer, so it \
+             cannot pick the wrong one again.",
+            self.browsers.join(", "),
+            self.playwright_version.as_deref().unwrap_or("?"),
+            self.chromium_executable.as_deref().unwrap_or("?"),
+        ))
+    }
+
     /// Whether Playwright is present but has no browser at all to drive —
     /// neither a downloaded bundle nor the Chrome channel. Advisory: the viewer
     /// still runs, it just has nothing to show until a browser is bound.
     pub fn needs_browser(&self) -> bool {
         self.playwright_version.is_some()
-            && self.browsers.is_empty()
             && self.chrome_channel.is_none()
+            && (self.browsers.is_empty() || self.revision_skew())
+    }
+
+    /// Browsers are installed, but not the revision this Playwright launches.
+    ///
+    /// The container looks equipped and every `chromium.launch()` fails with
+    /// "Executable doesn't exist". It happens whenever two Playwright copies
+    /// share a container — the npx `@playwright/mcp` one and a `/workspace`
+    /// one — because each pins its own revision and installs into the same
+    /// cache. The install action fixes it: it runs the *resolved* build's own
+    /// CLI, so it fetches exactly the revision that was missing.
+    ///
+    /// Requires the probe to have answered: an older container image, or a
+    /// Playwright too broken to `require`, leaves `chromium_executable` unset,
+    /// and "didn't answer" must not read as "skewed".
+    pub fn revision_skew(&self) -> bool {
+        !self.browsers.is_empty() && (self.viewer_cannot_launch() || self.scripts_cannot_launch())
+    }
+
+    /// The copy serving the viewer would not find its browser.
+    fn viewer_cannot_launch(&self) -> bool {
+        self.chromium_executable.is_some() && !self.chromium_executable_exists
+    }
+
+    /// `require("playwright")` — what every script Claude writes uses — would
+    /// not find its browser. Independent of the above, and the more common of
+    /// the two: `@playwright/cli` pins a `playwright-core`, npm hoists it, and
+    /// a separately-installed `playwright` nests a second one that no browser
+    /// was ever downloaded for.
+    fn scripts_cannot_launch(&self) -> bool {
+        self.script_chromium_executable.is_some() && !self.script_chromium_executable_exists
     }
 
     /// The searched roots as prose, so a message never trails off into "Looked
@@ -277,6 +372,30 @@ const PROBE: &str = concat!(
     // the pane claim a browser is present when none is.
     r#"try{const bd=process.env.PLAYWRIGHT_BROWSERS_PATH||(home?path.join(home,".cache","ms-playwright"):null);"#,
     r#"if(bd)out.browsers=fs.readdirSync(bd).filter((n)=>/^(chromium|firefox|webkit)/.test(n)).sort();}catch(e){}"#,
+    // What this Playwright would *actually launch*, and whether it is there.
+    //
+    // A cache listing is not the same question. Two Playwright copies in one
+    // container — the npx `@playwright/mcp` one and a `/workspace` one — pin
+    // different browser revisions, and each installs its own. So the cache can
+    // hold `chromium-1237` while the resolved build wants `chromium-1234` and
+    // every `chromium.launch()` dies with "Executable doesn't exist", *while
+    // the pane reports a browser installed*. Asking the build itself sidesteps
+    // revision arithmetic entirely: this is the path a launch would use.
+    r#"const exe=(dir)=>{try{const bt=require(dir).chromium;"#,
+    r#"const ep=bt&&bt.executablePath?bt.executablePath():null;"#,
+    r#"return ep?[ep,fs.existsSync(ep)]:null;}catch(e){return null;}};"#,
+    r#"if(core){const r=exe(path.dirname(core));"#,
+    r#"if(r){out.chromium_executable=r[0];out.chromium_executable_exists=r[1];}}"#,
+    // And separately: what a *script* gets. `require("playwright")` is what
+    // every Playwright example writes, and it resolves the wrapper — which
+    // carries its own nested `playwright-core` whenever npm could not settle on
+    // one version. That copy can want a different browser revision than the one
+    // the viewer's copy installed, so it is asked its own question.
+    r#"try{const w=res("playwright/package.json");"#,
+    r#"if(w){const j=JSON.parse(fs.readFileSync(w,"utf8"));out.script_playwright_version=j.version;"#,
+    r#"const wc=at("playwright-core/package.json",path.dirname(w));"#,
+    r#"const r=exe(path.dirname(wc||w));"#,
+    r#"if(r){out.script_chromium_executable=r[0];out.script_chromium_executable_exists=r[1];}}}catch(e){}"#,
     // The Chrome *channel* is an apt package, not a Playwright download, so it
     // is looked for where apt puts it.
     r#"try{for(const p of ["/usr/bin/google-chrome-stable","/usr/bin/google-chrome","/opt/google/chrome/chrome"]){"#,
@@ -467,6 +586,66 @@ mod tests {
         assert!(PROBE.contains("/opt/google/chrome/chrome"), "{}", PROBE);
     }
 
+    #[test]
+    fn the_probe_asks_playwright_what_it_would_launch() {
+        // Not derived from the cache listing — asked of the build, because the
+        // cache can hold a browser this build will never launch.
+        assert!(PROBE.contains("executablePath"), "{}", PROBE);
+        assert!(PROBE.contains("out.chromium_executable_exists"), "{}", PROBE);
+    }
+
+    /// A container carrying browsers from a *different* Playwright copy.
+    fn skewed() -> PlaywrightDetection {
+        parse_probe_output(&payload(concat!(
+            r#"{"node_version":"22.11.0","playwright_version":"1.62.1","has_bind":true,"#,
+            r#""cli_version":"0.1.18","cli_entry":"/g/cli.js","browsers":["chromium-1237"],"#,
+            r#""chromium_executable":"/home/claude/.cache/ms-playwright/chromium-1234/chrome-linux64/chrome","#,
+            r#""chromium_executable_exists":false}"#,
+        )))
+        .unwrap()
+    }
+
+    #[test]
+    fn a_browser_cache_full_of_the_wrong_revision_counts_as_no_browser() {
+        let d = skewed();
+        // The viewer still serves — it is the browser that cannot start.
+        assert!(d.is_usable());
+        assert_eq!(d.blocker(), None);
+        assert!(d.revision_skew());
+        assert!(d.needs_browser(), "a browser that cannot launch is not a browser");
+    }
+
+    #[test]
+    fn the_skew_message_names_both_revisions_and_the_way_out() {
+        let msg = skewed().skew_message().unwrap();
+        assert!(msg.contains("chromium-1237"), "{}", msg); // what is there
+        assert!(msg.contains("chromium-1234"), "{}", msg); // what it wants
+        assert!(msg.contains("Install Chromium"), "{}", msg); // what fixes it
+    }
+
+    #[test]
+    fn the_chrome_channel_covers_a_skewed_cache() {
+        // The channel is an apt binary at a fixed path, so a revision mismatch
+        // cannot affect it: there is still something to drive.
+        let mut d = skewed();
+        d.chrome_channel = Some("/usr/bin/google-chrome-stable".to_string());
+        assert!(!d.needs_browser());
+    }
+
+    #[test]
+    fn a_probe_that_could_not_answer_is_not_reported_as_skew() {
+        // Older container, or a Playwright too broken to `require`: unset is
+        // "unknown", and unknown must never render as "your browsers are wrong".
+        let d = parse_probe_output(&payload(concat!(
+            r#"{"node_version":"22.11.0","playwright_version":"1.62.1","has_bind":true,"#,
+            r#""cli_version":"0.1.18","cli_entry":"/g/cli.js","browsers":["chromium-1237"]}"#,
+        )))
+        .unwrap();
+        assert!(!d.revision_skew());
+        assert!(!d.needs_browser());
+        assert_eq!(d.skew_message(), None);
+    }
+
     #[test]
     fn a_missing_viewer_package_is_reported_separately() {
         let d = parse_probe_output(&payload(

app/src-tauri/src/browser_view/install.rs

@@ -73,14 +73,33 @@ use crate::docker::exec::{
 
 use super::detect::{self, PlaywrightDetection};
 
-/// The two packages the pane genuinely needs, pinned to `@latest` because
+/// The viewer package — installed **first**, and it decides the version of
-/// `browser.bind()` is recent and the viewer tracks it.
+/// `playwright` installed after it.
 ///
-/// This is the *minimum* set. A user who followed the old guidance ended up
+/// `@playwright/mcp` is deliberately not part of the set: it is Claude's MCP
-/// with a global install as well as these; only these are required. Note what
+/// configuration to make, and it contributes nothing to serving a viewer.
-/// is not here: `@playwright/mcp` is Claude's MCP configuration to make, not
+///
-/// this pane's, and it contributes nothing to serving a viewer.
+/// **Order matters here, and `playwright` is deliberately not `@latest`.**
-pub const PACKAGES: [&str; 2] = ["playwright@latest", "@playwright/cli@latest"];
+///
+/// Installing both at `@latest` produces a tree that looks right and is broken.
+/// Verified on a real container: `@playwright/cli@0.1.18` pins
+/// `playwright-core@1.63.0-alpha`, npm hoists that to the root, and
+/// `playwright@latest` (1.62.1) then nests its own `playwright-core@1.62.1`
+/// beside it. The two cores want *different browser revisions*. The browser
+/// step runs the resolved — hoisted — CLI, so it downloads 1237; every script
+/// Claude writes says `require("playwright")`, gets the nested 1.62.1, and dies
+/// with "Executable doesn't exist … chromium_headless_shell-1234". The pane
+/// meanwhile reports a browser installed, because one is.
+///
+/// So the viewer package goes first and its own pinned `playwright` version is
+/// what gets installed second — one core, one browser revision, both halves
+/// agreeing. See [`pinned_playwright_spec`].
+pub const VIEWER_PACKAGE: &str = "@playwright/cli@latest";
+
+/// Fallback when the viewer's manifest can't be read: better a possibly-skewed
+/// tree than no Playwright at all, and [`detect`](super::detect) reports the
+/// skew either way.
+pub const PLAYWRIGHT_FALLBACK: &str = "playwright@latest";
 
 /// Where the packages are installed. Container storage, not a bind mount — see
 /// the module docs.
@@ -175,11 +194,24 @@ impl BrowserTarget {
         }
     }
 
-    /// The `channel` a launch check must pass. `None` means the bundled build.
+    /// Every `channel` a launch check must pass, comma-separated, where
-    fn channel(self) -> Option<&'static str> {
+    /// `default` means "no channel — the bundled build".
+    ///
+    /// Chromium is checked twice because the two consumers of this install do
+    /// not launch the same binary. A script calling `chromium.launch()` with
+    /// no channel gets `chromium-headless-shell`; the viewer reads
+    /// `~/.playwright/cli.config.json`, which pins channel
+    /// `chrome-for-testing`, and that resolves to the *full* `chromium-<rev>`
+    /// build — a separate download under the same `install chromium`.
+    ///
+    /// Checking only the first is how a container reaches "verified" and then
+    /// fails in the pane with `Browser "chrome-for-testing" is not installed`.
+    /// Observed on a real project, where a stale `chromium-1217` satisfied the
+    /// headless-shell launch while the viewer wanted `chromium-1237`.
+    fn channels(self) -> &'static str {
         match self {
-            Self::Chromium => None,
+            Self::Chromium => "default,chrome-for-testing",
-            Self::Chrome => Some("chrome"),
+            Self::Chrome => "chrome",
         }
     }
 }
@@ -213,49 +245,39 @@ pub async fn install_packages(
     emit_progress(
         app,
         project_id,
-        &format!(
+        &format!("Installing @playwright/cli into {}/node_modules…", INSTALL_DIR),
-            "Installing playwright and @playwright/cli into {}/node_modules…",
-            INSTALL_DIR
-        ),
     );
 
-    // `env VAR=… cmd` rather than an exec env: it keeps the one exec path in
+    let mut step = npm_install(app, project_id, container_id, &[VIEWER_PACKAGE]).await?;
-    // `docker/exec.rs` untouched, and `env` is a real binary so no shell is
-    // involved. The guard matters because these are `@latest`: current
-    // Playwright has no postinstall (verified — `playwright@1.62.1` declares no
-    // `scripts` at all), but if a future release brings the browser download
-    // back, this step must stay small and the download must stay the step the
-    // user explicitly asked for.
-    let mut cmd = vec![
-        "env".to_string(),
-        "PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1".to_string(),
-        "npm".to_string(),
-        "install".to_string(),
-        // Leaves any package.json and lockfile at /workspace untouched.
-        "--no-save".to_string(),
-        "--no-fund".to_string(),
-        "--no-audit".to_string(),
-    ];
-    cmd.extend(PACKAGES.iter().map(|p| p.to_string()));
-
-    let step = run_step(
-        app,
-        project_id,
-        container_id,
-        "claude",
-        INSTALL_DIR,
-        cmd,
-        NPM_TIMEOUT,
-    )
-    .await?;
     if step.exit_code != 0 {
         return Err(format!(
-            "npm couldn't install Playwright in this container (exit {}).\n\nnpm said:\n{}",
+            "npm couldn't install the viewer package in this container (exit {}).\n\nnpm said:\n{}",
             step.exit_code,
             step.log_or("it produced no output at all")
         ));
     }
 
+    // Second, `playwright` at the version the viewer package pins — see
+    // `VIEWER_PACKAGE`. Installing it as `@latest` is what splits the tree.
+    //
+    // The viewer package is named *again* here. It is already installed, so
+    // this adds no work, but omitting it is what made npm prune it back out —
+    // see the note on `npm_install`. The pin can only be read after the first
+    // install has written the manifest, which is why this stays two commands
+    // rather than one.
+    let spec = pinned_playwright_spec(container_id).await;
+    emit_progress(app, project_id, &format!("Installing {}…", spec));
+    let second = npm_install(app, project_id, container_id, &[VIEWER_PACKAGE, &spec]).await?;
+    if second.exit_code != 0 {
+        return Err(format!(
+            "npm couldn't install {} in this container (exit {}).\n\nnpm said:\n{}",
+            spec,
+            second.exit_code,
+            second.log_or("it produced no output at all")
+        ));
+    }
+    step.log = merge_logs(step.log, second.log);
+
     emit_progress(app, project_id, "Re-checking what the container has…");
     let detection = detect::detect(container_id).await?;
 
@@ -265,7 +287,12 @@ pub async fn install_packages(
     // saying so here is what stops someone walking away from a pane that will
     // never show them anything.
     let mut warning = detection.blocker();
-    if detection.needs_browser() {
+    // Skew outranks "no browser": a container in that state *has* browsers, and
+    // telling someone to install one they can see already installed is how a
+    // real user ends up doing it three times.
+    if let Some(skew) = detection.skew_message() {
+        warning = merge(warning, skew);
+    } else if detection.needs_browser() {
         warning = merge(
             warning,
             "Playwright is installed, but this container has no browser to drive yet. Install \
@@ -282,6 +309,98 @@ pub async fn install_packages(
     })
 }
 
+/// One `npm install` of one or more specs, into [`INSTALL_DIR`], as `claude`.
+///
+/// `env VAR=… cmd` rather than an exec env: it keeps the one exec path in
+/// `docker/exec.rs` untouched, and `env` is a real binary so no shell is
+/// involved. The guard matters because these are `@latest`: current Playwright
+/// has no postinstall (verified — `playwright@1.62.1` declares no `scripts` at
+/// all), but if a future release brings the browser download back, this step
+/// must stay small and the download must stay the step the user asked for.
+///
+/// **Every package that must survive has to appear in `specs`.** `--no-save`
+/// in a directory with no `package.json` — which [`INSTALL_DIR`] is — leaves
+/// npm with the command line as its only statement of what the tree should
+/// contain, and npm ≥7 reconciles the tree against that on every run by
+/// removing whatever it now considers extraneous. Installing `@playwright/cli`
+/// and then installing `playwright` in a second command therefore *deletes the
+/// first one*: verified in a container, `removed 3 packages`, leaving an empty
+/// `node_modules/@playwright/` behind `playwright` and `playwright-core`. That
+/// empty directory is why a fresh setup could report success and still leave
+/// the pane saying `@playwright/cli` was not installed.
+async fn npm_install(
+    app: &AppHandle,
+    project_id: &str,
+    container_id: &str,
+    specs: &[&str],
+) -> Result<StepResult, String> {
+    let mut cmd = vec![
+        "env".to_string(),
+        "PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1".to_string(),
+        "npm".to_string(),
+        "install".to_string(),
+        // Leaves any package.json and lockfile at /workspace untouched.
+        "--no-save".to_string(),
+        "--no-fund".to_string(),
+        "--no-audit".to_string(),
+    ];
+    cmd.extend(specs.iter().map(|s| s.to_string()));
+    run_step(
+        app,
+        project_id,
+        container_id,
+        "claude",
+        INSTALL_DIR,
+        cmd,
+        NPM_TIMEOUT,
+    )
+    .await
+}
+
+/// The `playwright` spec to install: the exact version `@playwright/cli`
+/// depends on, so both halves share one `playwright-core`.
+///
+/// Read from the manifest npm just wrote rather than guessed, and falling back
+/// to `@latest` when it can't be read — an unreadable manifest is a reason to
+/// install something, not nothing.
+async fn pinned_playwright_spec(container_id: &str) -> String {
+    let script = format!(
+        "try{{const d=require('{}/node_modules/@playwright/cli/package.json').dependencies||{{}};\
+         process.stdout.write(d.playwright||'');}}catch(e){{}}",
+        INSTALL_DIR
+    );
+    let (out, _code) = exec_oneshot_as(
+        container_id,
+        "claude",
+        vec!["node".to_string(), "-e".to_string(), script],
+        Vec::new(),
+    )
+    .await
+    .unwrap_or_default();
+
+    let version: &str = out.trim();
+    // A version, not a range or a URL: anything else goes to the fallback
+    // rather than into an npm command line.
+    if !version.is_empty()
+        && version
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '+'))
+    {
+        format!("playwright@{}", version)
+    } else {
+        PLAYWRIGHT_FALLBACK.to_string()
+    }
+}
+
+/// Keep both npm runs' output, so a failure in either is diagnosable.
+fn merge_logs(first: String, second: String) -> String {
+    match (first.trim().is_empty(), second.trim().is_empty()) {
+        (true, _) => second,
+        (_, true) => first,
+        _ => format!("{}\n{}", first.trim_end(), second),
+    }
+}
+
 /// Install a browser: its system libraries first, then the browser, then prove
 /// one actually starts.
 ///
@@ -615,7 +734,7 @@ async fn verify_launch(
         ],
         vec![
             format!("TRIPLE_C_PW_DIR={}", dir),
-            format!("TRIPLE_C_PW_CHANNEL={}", target.channel().unwrap_or("")),
+            format!("TRIPLE_C_PW_CHANNELS={}", target.channels()),
             format!("TRIPLE_C_PW_URL={}", REACHABILITY_URL),
         ],
     );
@@ -706,27 +825,43 @@ fn parse_launch_output(output: &str) -> LaunchVerdict {
 /// The launch check. One `argv` element, no newlines, same contract as the
 /// detection probe.
 ///
-/// Playwright leaves the Chromium sandbox disabled by default, which is what
+/// `chromiumSandbox` is set explicitly rather than left to Playwright's
-/// makes this work in a container at all. The timeout exists so a browser that
+/// default, so this check states the same thing the seeded
-/// hangs on a missing library still returns a verdict rather than sitting there
+/// `cli.config.json` does instead of agreeing with it by coincidence. The
-/// until the exec is torn down. The navigation is best-effort and never decides
+/// containers forbid unprivileged user namespaces, so a sandboxed Chromium
-/// `ok` — it exists to tell a TLS-intercepted network apart from a broken
+/// aborts on launch; nothing here should be able to drift back into testing a
-/// install.
+/// configuration the viewer will not use.
+///
+/// Each channel in `TRIPLE_C_PW_CHANNELS` is launched in turn — see
+/// [`BrowserTarget::channels`] for why Chromium needs two — and a failure
+/// names the channel that failed, because "is not installed" is meaningless
+/// without it. Only the last launch loads a page: the navigation is
+/// best-effort, never decides `ok`, and exists to tell a TLS-intercepted
+/// network apart from a broken install, so doing it once is enough.
+///
+/// The timeout exists so a browser that hangs on a missing library still
+/// returns a verdict rather than sitting there until the exec is torn down.
 const LAUNCH_PROBE: &str = concat!(
-    r#"const d=process.env.TRIPLE_C_PW_DIR,ch=process.env.TRIPLE_C_PW_CHANNEL||undefined,u=process.env.TRIPLE_C_PW_URL;"#,
+    r#"const d=process.env.TRIPLE_C_PW_DIR,chs=process.env.TRIPLE_C_PW_CHANNELS||"default",u=process.env.TRIPLE_C_PW_URL;"#,
     r#"let done=false;const say=(ok,detail,nav)=>{if(done)return;done=true;"#,
     r#"process.stdout.write("\n__TRIPLE_C_BROWSER_LAUNCH__"+JSON.stringify({ok,detail,nav:nav||null})+"\n");};"#,
     r#"const one=(e)=>String((e&&e.message)||e).split("\n").slice(0,8).join(" | ");"#,
     r#"const t=setTimeout(()=>{say(false,"the browser did not finish starting within 90s");process.exit(0);},90000);"#,
-    r#"(async()=>{let b=null;try{const {chromium}=require(d);b=await chromium.launch(ch?{channel:ch}:{});"#,
+    r#"(async()=>{let b=null,cur="";try{const {chromium}=require(d);"#,
-    r#"let v="";try{v=b.version();}catch(e){}"#,
+    r#"const list=chs.split(",").map(s=>s.trim()).filter(Boolean);"#,
-    r#"let nav={ok:true,cert:false,detail:""};"#,
+    r#"let v="",nav={ok:true,cert:false,detail:""};"#,
+    r#"for(let i=0;i<list.length;i++){cur=list[i];const c=cur==="default"?undefined:cur;"#,
+    r#"b=await chromium.launch(Object.assign({chromiumSandbox:false},c?{channel:c}:{}));"#,
+    r#"try{v=b.version();}catch(e){}"#,
+    r#"if(i===list.length-1){"#,
     r#"try{const p=await b.newPage();await p.goto(u,{timeout:20000});}"#,
     // A certificate failure is classified here, next to the message, because
     // Chromium's wording is the only place the distinction exists.
-    r#"catch(e){const m=one(e);nav={ok:false,cert:/ERR_CERT|CERT_AUTHORITY|ERR_SSL|SSL_ERROR|self.signed/i.test(m),detail:m};}"#,
+    r#"catch(e){const m=one(e);nav={ok:false,cert:/ERR_CERT|CERT_AUTHORITY|ERR_SSL|SSL_ERROR|self.signed/i.test(m),detail:m};}}"#,
-    r#"await b.close();clearTimeout(t);say(true,v,nav);}"#,
+    r#"await b.close();b=null;}"#,
-    r#"catch(e){clearTimeout(t);try{if(b)await b.close();}catch(e2){}say(false,one(e));}"#,
+    r#"clearTimeout(t);say(true,v,nav);}"#,
+    r#"catch(e){clearTimeout(t);try{if(b)await b.close();}catch(e2){}"#,
+    r#"say(false,(cur&&cur!=="default"?"channel "+cur+": ":"")+one(e));}"#,
     r#"process.exit(0);})();"#,
 );
 
@@ -865,10 +1000,20 @@ mod tests {
     fn the_package_set_is_the_minimum_that_satisfies_the_probe() {
         // The viewer package is not optional, and `@playwright/mcp` is not a
         // member: it can bind sessions, it can never serve the UI.
-        assert!(PACKAGES.iter().any(|p| p.starts_with("playwright@")));
+        assert!(VIEWER_PACKAGE.starts_with("@playwright/cli@"));
-        assert!(PACKAGES.iter().any(|p| p.starts_with("@playwright/cli@")));
+        assert!(PLAYWRIGHT_FALLBACK.starts_with("playwright@"));
-        assert!(!PACKAGES.iter().any(|p| p.contains("@playwright/mcp")));
+        assert!(!VIEWER_PACKAGE.contains("@playwright/mcp"));
-        assert_eq!(PACKAGES.len(), 2);
+    }
+
+    #[test]
+    fn playwright_is_not_installed_at_latest_alongside_the_viewer() {
+        // `@latest` for both is exactly what splits the tree into two
+        // `playwright-core`s wanting different browser revisions — the viewer
+        // green, every `require("playwright")` dead. The version comes from the
+        // viewer's own manifest instead; `@latest` is only the fallback for an
+        // unreadable one.
+        assert!(!VIEWER_PACKAGE.contains("playwright@latest"));
+        assert_eq!(PLAYWRIGHT_FALLBACK, "playwright@latest");
     }
 
     #[test]
@@ -885,8 +1030,10 @@ mod tests {
         // `@playwright/mcp` asks for the chrome channel specifically, so the UI
         // must be able to say so.
         assert!(BrowserTarget::Chrome.needed_for().contains("@playwright/mcp"));
-        assert_eq!(BrowserTarget::Chrome.channel(), Some("chrome"));
+        assert_eq!(BrowserTarget::Chrome.channels(), "chrome");
-        assert_eq!(BrowserTarget::Chromium.channel(), None);
+        // Both of Chromium's consumers, or the check passes for a browser the
+        // viewer cannot open — see `channels`.
+        assert_eq!(BrowserTarget::Chromium.channels(), "default,chrome-for-testing");
         // And a size, before the click, for both.
         for t in [BrowserTarget::Chromium, BrowserTarget::Chrome] {
             assert!(t.download_note().to_lowercase().contains("mb"), "{:?}", t);

app/src-tauri/src/browser_view/mod.rs

@@ -64,6 +64,8 @@
 pub mod commands;
 pub mod detect;
 pub mod install;
+pub mod page;
+pub mod popout;
 pub mod proxy;
 
 use std::collections::HashMap;
@@ -467,13 +469,34 @@ async fn supervise(
     let _ = kill_dashboard(&container_id, &cli_entry).await;
 
     // Deregister, unless a newer session has already taken this project's slot.
-    {
+    let superseded = {
         let mut map = sessions.lock().await;
-        if map.get(&project_id).is_some_and(|s| s.epoch == epoch) {
+        match map.get(&project_id) {
-            map.remove(&project_id);
+            Some(session) if session.epoch == epoch => {
+                map.remove(&project_id);
+                false
+            }
+            // Someone else owns this project now: `stop` removes the session
+            // from the map *before* awaiting this task, and teardown below is
+            // seconds of Docker work, so a restart in that window is ordinary.
+            Some(_) => true,
+            None => false,
         }
+    };
+
+    // Everything past here speaks for the project as a whole, so a superseded
+    // supervisor must say nothing: closing the pop-out would destroy the *new*
+    // session's window, and the off-status would report a running view as
+    // stopped.
+    if superseded {
+        return;
     }
 
+    // A pop-out outlives the tab, so nothing else would take it down: the
+    // window would sit there showing a frozen last frame of a viewer that no
+    // longer exists. The session owns it, and this is where the session ends.
+    let _ = popout::close(&app, &project_id);
+
     let enabled = manager().is_enabled(&project_id).await;
     emit(&app, &project_id, &BrowserViewStatus::off(enabled));
 }

app/src-tauri/src/browser_view/page.rs

@@ -0,0 +1,375 @@
+//! Open a page in the container's browser, and resize it while it runs.
+//!
+//! The pane [watches](super) browsers something else published. This opens one:
+//! the user hands it a URL, it launches a browser inside the container,
+//! publishes it with `browser.bind()` so the pane picks it up, and holds the
+//! handle so the page can be navigated and **resized** afterwards.
+//!
+//! ## Why the handle has to be held
+//!
+//! Verified against a real bound browser: a second client cannot join one.
+//! `chromium.connect()` against the published endpoint times out in every URL
+//! form — the descriptor's socket speaks the dashboard's own transport, not the
+//! public connect protocol. So whoever launches the browser is the only process
+//! that can ever drive it. That is the whole reason this helper is a resident
+//! process rather than a one-shot `node -e` that exits.
+//!
+//! It also draws the line for the feature: pages *this* opens can be resized
+//! live; a browser `@playwright/mcp` launched can only be watched, and its size
+//! is whatever `--viewport-size` it was given.
+//!
+//! ## Control channel
+//!
+//! A JSON file in `/tmp`, polled by the helper. No port, no second listener, no
+//! addition to the proxy's attack surface — and it composes with the one exec
+//! path this codebase already has. Writes go through `node -e` rather than
+//! shell redirection so a URL never touches a shell.
+//!
+//! ## Viewport, and why it is the interesting part
+//!
+//! `page.setViewportSize()` genuinely reflows: measured on a page carrying a
+//! `@media (max-width: 900px)` rule, the rule fires at 800×600 and clears at
+//! 1440×900. Resizing the *window* the pane lives in does nothing of the sort —
+//! the viewer is a CDP screencast, so a bigger window is the same pixels drawn
+//! larger. This is what makes the pop-out usable as a responsive-design ruler.
+
+use serde::{Deserialize, Serialize};
+use tauri::AppHandle;
+
+use crate::commands::project_commands::emit_progress;
+use crate::docker::exec::exec_oneshot_as;
+
+use super::detect::PlaywrightDetection;
+
+/// Control file the helper polls, and the state file it writes back.
+const CONTROL_PATH: &str = "/tmp/triple-c-page-control.json";
+const STATE_PATH: &str = "/tmp/triple-c-page-state.json";
+/// Where the detached helper's own output goes, so a failed start has a trail.
+const HELPER_LOG: &str = "/tmp/triple-c-page.log";
+
+/// How long to wait for the helper to report that the page is up.
+const READY_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(45);
+/// Navigating a browser that is already up. One page load, not a cold start.
+const REUSE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(35);
+const READY_POLL: std::time::Duration = std::time::Duration::from_millis(400);
+
+/// A viewport, in CSS pixels.
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+pub struct Viewport {
+    pub width: u32,
+    pub height: u32,
+}
+
+impl Viewport {
+    /// Clamped to something a browser will accept. A window dragged to nothing
+    /// must not ask Chromium for a zero-width page.
+    pub fn sane(width: u32, height: u32) -> Self {
+        Self {
+            width: width.clamp(200, 7680),
+            height: height.clamp(200, 4320),
+        }
+    }
+}
+
+/// What the helper reports about itself.
+#[derive(Debug, Clone, Deserialize, Serialize, Default)]
+pub struct PageState {
+    #[serde(default)]
+    pub ready: bool,
+    #[serde(default)]
+    pub url: Option<String>,
+    #[serde(default)]
+    pub viewport: Option<Viewport>,
+    #[serde(default)]
+    pub error: Option<String>,
+}
+
+/// Open `url` in a freshly launched, bound browser.
+///
+/// Replaces any page this opened before: one helper per container, because the
+/// pane shows one browser and a second would just compete for the pane.
+pub async fn open(
+    app: &AppHandle,
+    project_id: &str,
+    container_id: &str,
+    detection: &PlaywrightDetection,
+    url: &str,
+    viewport: Viewport,
+) -> Result<PageState, String> {
+    let core = detection.playwright_path.as_deref().ok_or_else(|| {
+        "Playwright isn't installed in this container — set it up from the Browser tab first."
+            .to_string()
+    })?;
+    // The directory of the resolved manifest is what `require()` wants.
+    let core_dir = core.trim_end_matches("/package.json");
+
+    // The executable is passed explicitly rather than left to Playwright's
+    // revision lookup: a container can hold browsers a given copy will not
+    // launch (see `detect::revision_skew`), and this is the one place we know
+    // which binary is actually on disk.
+    let executable = detection
+        .chromium_executable
+        .as_deref()
+        .filter(|_| detection.chromium_executable_exists);
+
+    // Reuse a helper that is already up. Relaunching would throw away the
+    // browser's cookies and storage — which for the auth case means signing in
+    // again to reach the second page, having just signed in on the first.
+    if state(container_id).await.ready {
+        emit_progress(app, project_id, "Navigating the container's browser…");
+        set_viewport(container_id, viewport).await?;
+        navigate(container_id, url).await?;
+        if let Some(state) = wait_for_url(container_id, url).await {
+            return Ok(state);
+        }
+        // It stopped answering; fall through and start a fresh one.
+    }
+
+    close(container_id).await;
+    // Cold start: a browser launch plus a page load, which is the several
+    // seconds the user would otherwise spend wondering whether the click
+    // registered.
+    emit_progress(app, project_id, "Launching a browser in the container…");
+
+    let config = serde_json::json!({
+        "core": core_dir,
+        "executable": executable,
+        "url": url,
+        "viewport": viewport,
+        "control": CONTROL_PATH,
+        "state": STATE_PATH,
+    });
+    let script = format!("const CFG={};{}", config, HELPER);
+
+    // Detached, for the same reason the viewer is: the process has to outlive
+    // the exec that started it, or the page closes the moment we return.
+    let launcher = format!(
+        "cd /workspace 2>/dev/null || true; rm -f {} {}; nohup node -e {} >{} 2>&1 &",
+        STATE_PATH,
+        CONTROL_PATH,
+        shell_quote(&script),
+        HELPER_LOG
+    );
+    exec_oneshot_as(
+        container_id,
+        "claude",
+        vec!["sh".to_string(), "-c".to_string(), launcher],
+        Vec::new(),
+    )
+    .await
+    .map_err(|e| format!("Could not start the browser helper: {}", e))?;
+
+    emit_progress(app, project_id, "Waiting for the page to load…");
+    wait_until_ready(container_id).await
+}
+
+/// Resize the open page. Cheap enough to call from a window-resize handler.
+pub async fn set_viewport(container_id: &str, viewport: Viewport) -> Result<(), String> {
+    write_control(
+        container_id,
+        serde_json::json!({ "viewport": viewport }).to_string(),
+    )
+    .await
+}
+
+/// Navigate the open page without relaunching the browser.
+pub async fn navigate(container_id: &str, url: &str) -> Result<(), String> {
+    write_control(container_id, serde_json::json!({ "url": url }).to_string()).await
+}
+
+/// Ask the helper to shut down. Best effort: a container that has none is the
+/// normal case, and the caller is usually about to start one anyway.
+pub async fn close(container_id: &str) {
+    let _ = write_control(container_id, serde_json::json!({ "close": true }).to_string()).await;
+}
+
+/// Current state, or a default when no helper has ever run here.
+pub async fn state(container_id: &str) -> PageState {
+    let script = format!(
+        "try{{process.stdout.write(require('fs').readFileSync('{}','utf8'));}}catch(e){{}}",
+        STATE_PATH
+    );
+    let Ok((out, _)) = exec_oneshot_as(
+        container_id,
+        "claude",
+        vec!["node".to_string(), "-e".to_string(), script],
+        Vec::new(),
+    )
+    .await
+    else {
+        return PageState::default();
+    };
+    serde_json::from_str(out.trim()).unwrap_or_default()
+}
+
+/// Write the control file through Node rather than a shell redirect, so a URL
+/// is never interpreted by `sh`.
+async fn write_control(container_id: &str, json: String) -> Result<(), String> {
+    let script = format!(
+        "require('fs').writeFileSync('{}',process.argv[1]);",
+        CONTROL_PATH
+    );
+    exec_oneshot_as(
+        container_id,
+        "claude",
+        vec!["node".to_string(), "-e".to_string(), script, json],
+        Vec::new(),
+    )
+    .await
+    .map(|_| ())
+    .map_err(|e| format!("Could not reach the browser helper: {}", e))
+}
+
+/// Wait for a *running* helper to report the URL we just asked it for.
+///
+/// Bounded much tighter than a cold start: the browser is already up, so this
+/// is one navigation. `None` means it stopped answering, and the caller starts
+/// a fresh helper rather than reporting a page that isn't there.
+async fn wait_for_url(container_id: &str, url: &str) -> Option<PageState> {
+    let deadline = std::time::Instant::now() + REUSE_TIMEOUT;
+    loop {
+        let state = state(container_id).await;
+        if state.ready && state.url.as_deref() == Some(url) {
+            return Some(state);
+        }
+        if std::time::Instant::now() >= deadline {
+            return None;
+        }
+        tokio::time::sleep(READY_POLL).await;
+    }
+}
+
+/// Poll the state file until the helper says the page is up, or says why not.
+async fn wait_until_ready(container_id: &str) -> Result<PageState, String> {
+    let deadline = std::time::Instant::now() + READY_TIMEOUT;
+    loop {
+        let state = state(container_id).await;
+        if let Some(error) = state.error.clone() {
+            return Err(error);
+        }
+        if state.ready {
+            return Ok(state);
+        }
+        if std::time::Instant::now() >= deadline {
+            return Err(format!(
+                "The browser didn't come up within {}s. Its log is at {} inside the container.",
+                READY_TIMEOUT.as_secs(),
+                HELPER_LOG
+            ));
+        }
+        tokio::time::sleep(READY_POLL).await;
+    }
+}
+
+/// Single-quote for `sh`, the same way [`super`] does for the viewer's paths.
+fn shell_quote(s: &str) -> String {
+    format!("'{}'", s.replace('\'', r"'\''"))
+}
+
+/// The resident helper, appended to a `const CFG={…};` prelude.
+///
+/// Deliberately one string passed as a single `argv` element — no shell parsing
+/// of any part of it, exactly like `detect`'s probe. It launches, binds, and
+/// then polls the control file; every failure path writes the state file, so a
+/// helper that dies during startup is reported rather than waited out.
+const HELPER: &str = concat!(
+    r#"const fs=require('fs');"#,
+    r#"const {chromium}=require(CFG.core);"#,
+    r#"const write=(o)=>{try{fs.writeFileSync(CFG.state,JSON.stringify(o));}catch(e){}};"#,
+    r#"const fail=(e)=>{write({ready:false,error:String(e&&e.message||e)});process.exit(1);};"#,
+    r#"process.on('unhandledRejection',fail);"#,
+    r#"(async()=>{"#,
+    // `chromiumSandbox:false` because the container has no user namespaces to
+    // give Chromium; headless because there is no display, which is also the
+    // only mode the dashboard can screencast anyway.
+    r#"const opts={headless:true,chromiumSandbox:false};"#,
+    r#"if(CFG.executable)opts.executablePath=CFG.executable;"#,
+    r#"const browser=await chromium.launch(opts);"#,
+    r#"const ctx=await browser.newContext({viewport:CFG.viewport});"#,
+    r#"const page=await ctx.newPage();"#,
+    // Bind before navigating: the pane should show the page loading rather than
+    // appearing once it is done.
+    r#"await browser.bind('claude',{metadata:{source:'triple-c'}});"#,
+    r#"let current=CFG.url,viewport=CFG.viewport;"#,
+    r#"const report=()=>write({ready:true,url:current,viewport});"#,
+    r#"try{await page.goto(CFG.url,{waitUntil:'domcontentloaded',timeout:30000});}catch(e){}"#,
+    r#"report();"#,
+    // The control loop. A poll, not a watcher: `fs.watch` misses writes on some
+    // filesystems and this costs nothing at 4 Hz.
+    r#"setInterval(async()=>{let c;try{c=JSON.parse(fs.readFileSync(CFG.control,'utf8'));}catch(e){return;}"#,
+    r#"try{fs.unlinkSync(CFG.control);}catch(e){}"#,
+    r#"if(c.close){await browser.close().catch(()=>{});write({ready:false});process.exit(0);}"#,
+    r#"if(c.viewport){viewport=c.viewport;await page.setViewportSize(c.viewport).catch(()=>{});}"#,
+    r#"if(c.url&&c.url!==current){current=c.url;await page.goto(c.url,{waitUntil:'domcontentloaded',timeout:30000}).catch(()=>{});}"#,
+    r#"report();},250);"#,
+    // A browser that dies (crash, or the user closing the last page) must not
+    // leave a helper claiming a live page.
+    r#"browser.on('disconnected',()=>{write({ready:false});process.exit(0);});"#,
+    r#"})().catch(fail);"#,
+);
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_helper_is_one_argv_element_with_no_shell_hazards() {
+        // Same rule as the detect probe: it is passed as a single argument, so
+        // it must contain neither a newline nor a single quote that would end
+        // the quoting `open` wraps it in.
+        assert!(!HELPER.contains('\n'), "{}", HELPER);
+        assert!(HELPER.contains("chromium.launch"), "{}", HELPER);
+    }
+
+    #[test]
+    fn the_helper_binds_so_the_pane_can_see_the_page() {
+        // Without this the page opens and the pane shows nothing — the whole
+        // feature hinges on the browser being published.
+        assert!(HELPER.contains("browser.bind('claude'"), "{}", HELPER);
+    }
+
+    #[test]
+    fn the_helper_reports_startup_failures_instead_of_hanging() {
+        // `wait_until_ready` polls the state file; a helper that dies silently
+        // would turn every failure into a 45-second timeout.
+        assert!(HELPER.contains("unhandledRejection"), "{}", HELPER);
+        assert!(HELPER.contains("error:String"), "{}", HELPER);
+    }
+
+    #[test]
+    fn a_viewport_is_clamped_to_something_a_browser_accepts() {
+        assert_eq!(Viewport::sane(0, 0), Viewport { width: 200, height: 200 });
+        assert_eq!(
+            Viewport::sane(99_999, 99_999),
+            Viewport { width: 7680, height: 4320 }
+        );
+        assert_eq!(
+            Viewport::sane(1440, 900),
+            Viewport { width: 1440, height: 900 }
+        );
+    }
+
+    #[test]
+    fn a_url_is_never_parsed_by_a_shell() {
+        // The launcher runs through `sh -c`, so the script is quoted with the
+        // POSIX close-escape-reopen form: the embedded quote becomes `'\''`,
+        // which leaves the `;rm` inside the string rather than starting a new
+        // command. (A naive "the output must not contain ';rm'" check fails
+        // here and would be wrong — that substring is *inside* the quoting.)
+        assert_eq!(
+            shell_quote("http://x/?a=1&b=2';rm -rf /"),
+            r"'http://x/?a=1&b=2'\'';rm -rf /'"
+        );
+        // The control channel doesn't go near a shell at all: the JSON travels
+        // as an argv element to `node`.
+        assert!(!HELPER.contains("exec("), "{}", HELPER);
+    }
+
+    #[test]
+    fn state_defaults_to_not_ready_rather_than_failing() {
+        // An empty/absent state file is the normal case before anything runs.
+        let s: PageState = serde_json::from_str("{}").unwrap();
+        assert!(!s.ready);
+        assert!(s.error.is_none());
+    }
+}

app/src-tauri/src/browser_view/popout.rs

@@ -0,0 +1,338 @@
+//! The browser view in a window of its own.
+//!
+//! Watching a browser and working in a terminal are the same task done at the
+//! same time, and a tab can only be one of them. So the pane can be detached
+//! into a second OS window — put on the other monitor, or pinned on top of
+//! whatever else is in front.
+//!
+//! ## Why this is a native window and not a second iframe
+//!
+//! The window loads the *same* token-bearing loopback URL the pane's iframe
+//! uses ([`crate::browser_view::BrowserViewStatus::url`]), as its top-level
+//! document. That has two consequences worth stating:
+//!
+//! - It is a **remote-origin** webview. No capability lists this window, so it
+//!   has no IPC surface at all — `invoke` is not reachable from it, which is
+//!   exactly right for a page served out of a container. Do not add one.
+//! - The app CSP does not apply, and does not need to: `frame-src` exists to
+//!   constrain what the *app's* document may embed, and this is not embedded.
+//!   The port is still confined to [`crate::browser_view::proxy`]'s range and
+//!   still gated by the session token, which is what actually protects it.
+//!
+//! ## Lifetime
+//!
+//! The window is owned by the session, not by the user's patience: when a view
+//! stops — the user pressed Stop, the container went away, the viewer died —
+//! the supervisor's teardown calls [`close`], because a window left showing a
+//! dead viewer is worse than no window. The reverse is not true; closing the
+//! window leaves the view running, and the pane takes it back into the tab.
+
+use std::collections::HashMap;
+use std::sync::{Mutex, OnceLock};
+use std::time::Duration;
+
+use serde::Serialize;
+use tauri::{AppHandle, Emitter, Manager, WebviewUrl, WebviewWindowBuilder, WindowEvent};
+
+/// Emitted when a pop-out opens or closes. Payload: [`PopoutState`] plus the
+/// project id.
+///
+/// The window can close without the app asking it to — the user hits its X, or
+/// a teardown takes it — so the pane learns about it the same way it learns
+/// about everything else here, by listening.
+const POPOUT_EVENT: &str = "browser-view-popout-changed";
+
+/// What the pane needs to render its pop-out controls.
+///
+/// Both fields are read from the window itself rather than remembered on either
+/// side: the pane is unmounted whenever another Project Home sub-tab is
+/// selected, so anything it merely *remembers* about the window is gone by the
+/// time the user comes back, while the window is still there.
+#[derive(Debug, Clone, Copy, Serialize)]
+pub struct PopoutState {
+    pub open: bool,
+    pub always_on_top: bool,
+}
+
+impl PopoutState {
+    const CLOSED: Self = Self {
+        open: false,
+        always_on_top: false,
+    };
+}
+
+/// Tauri window labels admit `[a-zA-Z0-9-/:_]` only. Project ids are UUIDs, so
+/// this never fires in practice; it exists so a hand-edited `projects.json`
+/// cannot produce a label Tauri rejects at build time.
+pub fn window_label(project_id: &str) -> String {
+    let id: String = project_id
+        .chars()
+        .map(|c| if c.is_ascii_alphanumeric() || c == '-' || c == '_' { c } else { '_' })
+        .collect();
+    format!("browser-view-{}", id)
+}
+
+/// Open the pop-out, or raise it if it is already open.
+///
+/// `url` is the live session's URL; the caller has already established that the
+/// view is running, because there is nothing to show otherwise.
+pub fn open(
+    app: &AppHandle,
+    project_id: &str,
+    project_name: &str,
+    url: &str,
+    always_on_top: bool,
+) -> Result<(), String> {
+    let label = window_label(project_id);
+
+    if let Some(window) = app.get_webview_window(&label) {
+        // Asking twice means "I can't see it", not "open another".
+        let _ = window.unminimize();
+        let _ = window.set_focus();
+        let _ = window.set_always_on_top(always_on_top);
+        emit(app, project_id, state(app, project_id));
+        return Ok(());
+    }
+
+    let parsed = url
+        .parse()
+        .map_err(|e| format!("The browser view's address is not a URL: {}", e))?;
+
+    let project_id_owned = project_id.to_string();
+    let app_for_event = app.clone();
+
+    let window = WebviewWindowBuilder::new(app, &label, WebviewUrl::External(parsed))
+        .title(format!("{} — browser", project_name))
+        .inner_size(1100.0, 820.0)
+        .min_inner_size(480.0, 360.0)
+        .always_on_top(always_on_top)
+        .build()
+        .map_err(|e| format!("Could not open the browser window: {}", e))?;
+
+    // Closed from its own titlebar, this is the only thing that tells the pane
+    // to take the view back into the tab. `Resized` drives match-window mode —
+    // see `set_match_window`.
+    window.on_window_event(move |event| match event {
+        WindowEvent::Destroyed => {
+            set_match_window(&project_id_owned, false);
+            emit(&app_for_event, &project_id_owned, PopoutState::CLOSED);
+        }
+        WindowEvent::Resized(size) => {
+            on_resized(&app_for_event, &project_id_owned, size.width, size.height);
+        }
+        _ => {}
+    });
+
+    log::info!("Browser view: popped out for project {}", project_id);
+    emit(app, project_id, state(app, project_id));
+    Ok(())
+}
+
+/// Close the pop-out if there is one. Safe to call when there isn't.
+///
+/// `destroy`, not `close`: `close` raises `CloseRequested`, and the app's
+/// window-event handler treats that as a request to quit for the main window.
+/// Nothing here should ever be able to be mistaken for that.
+///
+/// A failure is **returned, not logged and forgotten**. The pane puts its
+/// iframe back the moment it believes the window is gone, so reporting a close
+/// that did not happen is how you end up with two viewers driving one browser —
+/// the exact state the iframe is dropped to prevent.
+pub fn close(app: &AppHandle, project_id: &str) -> Result<(), String> {
+    if let Some(window) = app.get_webview_window(&window_label(project_id)) {
+        window.destroy().map_err(|e| {
+            log::warn!(
+                "Browser view: could not close the pop-out for project {}: {}",
+                project_id,
+                e
+            );
+            format!("Could not close the browser window: {}", e)
+        })?;
+    }
+    // `Destroyed` covers the normal path; a window that was already gone still
+    // owes the pane an answer.
+    emit(app, project_id, PopoutState::CLOSED);
+    Ok(())
+}
+
+/// Whether the window exists and how it is stacked, read from the window.
+pub fn state(app: &AppHandle, project_id: &str) -> PopoutState {
+    match app.get_webview_window(&window_label(project_id)) {
+        Some(window) => PopoutState {
+            open: true,
+            // A window that cannot answer is not a reason to fail the call; the
+            // pin is a preference, and "not pinned" is the safe reading.
+            always_on_top: window.is_always_on_top().unwrap_or(false),
+        },
+        None => PopoutState::CLOSED,
+    }
+}
+
+/// Pin the pop-out above other windows, or unpin it. No-op when it is closed.
+pub fn set_always_on_top(app: &AppHandle, project_id: &str, on_top: bool) -> Result<(), String> {
+    let Some(window) = app.get_webview_window(&window_label(project_id)) else {
+        return Ok(());
+    };
+    window
+        .set_always_on_top(on_top)
+        .map_err(|e| format!("Could not change the window's stacking: {}", e))?;
+    emit(app, project_id, state(app, project_id));
+    Ok(())
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Match-window mode
+// ─────────────────────────────────────────────────────────────────────────────
+
+/// Projects whose pop-out is driving the page's viewport, and the generation of
+/// the latest resize for each — the debounce is "did anything else arrive while
+/// I slept?", which needs no timer to cancel.
+static MATCH_WINDOW: OnceLock<Mutex<HashMap<String, (bool, u64)>>> = OnceLock::new();
+
+/// How long the window has to stop moving before the page is resized.
+///
+/// A drag emits `Resized` continuously; each one costs a container exec, and
+/// Chromium relayouts the page. Settling first turns a drag into one resize.
+const RESIZE_SETTLE: Duration = Duration::from_millis(300);
+
+fn match_window_map() -> &'static Mutex<HashMap<String, (bool, u64)>> {
+    MATCH_WINDOW.get_or_init(|| Mutex::new(HashMap::new()))
+}
+
+/// Turn match-window mode on or off for a project.
+///
+/// Only ever affects a page **Triple-C opened** — a bound browser cannot be
+/// joined by a second client, so a page `@playwright/mcp` launched keeps
+/// whatever viewport it was given. See [`super::page`].
+pub fn set_match_window(project_id: &str, enabled: bool) {
+    let mut map = match_window_map().lock().unwrap_or_else(|e| e.into_inner());
+    let entry = map.entry(project_id.to_string()).or_insert((false, 0));
+    entry.0 = enabled;
+}
+
+pub fn match_window(project_id: &str) -> bool {
+    match_window_map()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(project_id)
+        .map(|(on, _)| *on)
+        .unwrap_or(false)
+}
+
+/// The pop-out's current inner size, for applying match-window immediately
+/// rather than only on the next drag.
+pub fn inner_size(app: &AppHandle, project_id: &str) -> Option<(u32, u32)> {
+    let window = app.get_webview_window(&window_label(project_id))?;
+    let size = window.inner_size().ok()?;
+    Some((size.width, size.height))
+}
+
+/// Debounce a resize, then push the settled size into the page's viewport.
+fn on_resized(app: &AppHandle, project_id: &str, width: u32, height: u32) {
+    let generation = {
+        let mut map = match_window_map().lock().unwrap_or_else(|e| e.into_inner());
+        let Some(entry) = map.get_mut(project_id) else {
+            return;
+        };
+        if !entry.0 {
+            return;
+        }
+        entry.1 += 1;
+        entry.1
+    };
+
+    let app = app.clone();
+    let project_id = project_id.to_string();
+    tauri::async_runtime::spawn(async move {
+        tokio::time::sleep(RESIZE_SETTLE).await;
+        // Superseded by a later resize: that one will do the work.
+        {
+            let map = match_window_map().lock().unwrap_or_else(|e| e.into_inner());
+            match map.get(&project_id) {
+                Some((true, latest)) if *latest == generation => {}
+                _ => return,
+            }
+        }
+
+        let state = app.state::<crate::AppState>();
+        let Some(container_id) = state
+            .projects_store
+            .get(&project_id)
+            .and_then(|p| p.container_id)
+        else {
+            return;
+        };
+        if let Err(e) = super::page::set_viewport(
+            &container_id,
+            super::page::Viewport::sane(width, height),
+        )
+        .await
+        {
+            log::debug!("Browser view: could not match the page to the window: {}", e);
+        }
+    });
+}
+
+fn emit(app: &AppHandle, project_id: &str, state: PopoutState) {
+    let _ = app.emit(
+        POPOUT_EVENT,
+        serde_json::json!({
+            "project_id": project_id,
+            "open": state.open,
+            "always_on_top": state.always_on_top,
+        }),
+    );
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn labels_are_derived_from_the_project_and_are_tauri_safe() {
+        assert_eq!(
+            window_label("6b1f4a2c-0d5e-4f9a-9c11-2f0b7d3e8a44"),
+            "browser-view-6b1f4a2c-0d5e-4f9a-9c11-2f0b7d3e8a44"
+        );
+        assert_eq!(window_label("a b/c.d"), "browser-view-a_b_c_d");
+    }
+
+    #[test]
+    fn distinct_projects_get_distinct_windows() {
+        assert_ne!(window_label("alpha"), window_label("beta"));
+    }
+
+    #[test]
+    fn match_window_is_off_until_asked_for_and_is_per_project() {
+        assert!(!match_window("mw-a"));
+        set_match_window("mw-a", true);
+        assert!(match_window("mw-a"));
+        // Another project's window must not start driving its page too.
+        assert!(!match_window("mw-b"));
+        set_match_window("mw-a", false);
+        assert!(!match_window("mw-a"));
+    }
+
+    #[test]
+    fn a_resize_supersedes_the_one_before_it() {
+        // The debounce is a generation counter, not a cancellable timer: only
+        // the newest resize of a drag survives to touch the container.
+        set_match_window("mw-gen", true);
+        let read = || {
+            match_window_map()
+                .lock()
+                .unwrap()
+                .get("mw-gen")
+                .map(|(_, g)| *g)
+                .unwrap()
+        };
+        let before = read();
+        {
+            let mut map = match_window_map().lock().unwrap();
+            let entry = map.get_mut("mw-gen").unwrap();
+            entry.1 += 1;
+        }
+        assert!(read() > before);
+        set_match_window("mw-gen", false);
+    }
+}

app/src-tauri/src/commands/inspect_commands.rs

@@ -164,6 +164,11 @@ pub struct ScheduledTask {
     /// Only known for enabled one-shot tasks (their `at` time). Recurring cron
     /// expressions are not evaluated here.
     pub next_run: Option<String>,
+    /// Whether a run is in flight right now, from the runner's state file in
+    /// `~/.claude/scheduler/running/<id>.json` with its pid verified live.
+    pub running: bool,
+    /// When the in-flight run started, ISO 8601 (UTC). `None` unless `running`.
+    pub running_since: Option<String>,
 }
 
 /// A completion notice written by `triple-c-task-runner` after a task ran.
@@ -614,13 +619,25 @@ const SCHEDULER_LIST_SCRIPT: &str = r#"exec 2>/dev/null
 set -u
 TASKS="$HOME/.claude/scheduler/tasks"
 LOGS="$HOME/.claude/scheduler/logs"
+RUNNING="$HOME/.claude/scheduler/running"
 [ -d "$TASKS" ] || { echo '[]'; exit 0; }
 for f in "$TASKS"/*.json; do
   [ -f "$f" ] || continue
   id=$(jq -r '.id // ""' "$f") || continue
   [ -n "$id" ] || id=$(basename "$f" .json)
   last=$(find "$LOGS/$id" -name '*.log' -type f -printf '%T@\n' | sort -rn | head -1)
-  jq -c --arg fallback_id "$id" --arg lr "${last%%.*}" '{
+  # Live-run state. The pid is checked, not trusted: a container stopped
+  # mid-run cannot fire the runner's cleanup trap, and a task stuck on
+  # "running" forever is a worse lie than showing nothing.
+  started=""
+  state="$RUNNING/$id.json"
+  if [ -f "$state" ]; then
+    pid=$(jq -r '.pid // empty' "$state")
+    if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
+      started=$(jq -r '.started_epoch // empty' "$state")
+    fi
+  fi
+  jq -c --arg fallback_id "$id" --arg lr "${last%%.*}" --arg started "$started" '{
       id: (if (.id // "") == "" then $fallback_id else .id end),
       name: (.name // ""),
       prompt: (.prompt // ""),
@@ -630,7 +647,8 @@ for f in "$TASKS"/*.json; do
       enabled: (.enabled == true),
       working_dir: (.working_dir // "/workspace"),
       created_at: (.created_at // null),
-      last_run_epoch: (if $lr == "" then null else ($lr | tonumber) end)
+      last_run_epoch: (if $lr == "" then null else ($lr | tonumber) end),
+      running_since_epoch: (if $started == "" then null else ($started | tonumber) end)
     }' "$f"
 done | jq -s 'sort_by(.name, .id)'
 "#;
@@ -673,6 +691,7 @@ struct RawScheduledTask {
     working_dir: String,
     created_at: Option<String>,
     last_run_epoch: Option<i64>,
+    running_since_epoch: Option<i64>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -723,6 +742,8 @@ pub async fn list_scheduled_tasks(
                 created_at: t.created_at,
                 last_run: t.last_run_epoch.map(epoch_to_iso),
                 next_run,
+                running: t.running_since_epoch.is_some(),
+                running_since: t.running_since_epoch.map(epoch_to_iso),
             }
         })
         .collect())

app/src-tauri/src/commands/migration_commands.rs

@@ -73,6 +73,25 @@ use crate::AppState;
 /// Report how far behind the current base image a project's container is, and
 /// what migrating it would actually carry across.
 ///
+/// Choose the recorded lineage from the two places it can be written, most
+/// authoritative first: the live container's label, then the snapshot image's.
+///
+/// **An empty label is absence, not an answer.** `create_container` always
+/// writes `triple-c.base-image-id`, even when the value is unknown — that is
+/// deliberate, because Docker merges an image's labels into a container's and
+/// an inherited value would otherwise ride a snapshot forever. The consequence
+/// is that `Some("")` is the *common* reading from a container whose lineage
+/// was never established, so treating it as an answer silently skips the
+/// snapshot, which may well have recorded a real one.
+fn pick_recorded_lineage(
+    from_container: Option<String>,
+    from_snapshot: Option<String>,
+) -> Option<String> {
+    from_container
+        .filter(|v| !v.is_empty())
+        .or_else(|| from_snapshot.filter(|v| !v.is_empty()))
+}
+
 /// Read-only. Runs two filesystem probes (~3 s each) and is therefore meant to
 /// be called on demand, not polled.
 #[tauri::command]
@@ -98,20 +117,24 @@ pub async fn get_container_staleness(
     // Lineage, most authoritative source first: the live container's label,
     // then the snapshot image's. Both are written by `create_container` and
     // propagated onto the snapshot by `docker commit`.
+    // Each source is filtered for emptiness *before* it is allowed to satisfy
+    // the lookup. `create_container` always writes this label, even when the
+    // value is unknown — deliberately, so an inherited image label cannot ride
+    // a snapshot forever — which means the container's copy is very often
+    // `Some("")`. Filtering only the final result let that empty string count
+    // as an answer and skip the snapshot entirely, so a snapshot that *did*
+    // record a lineage was never consulted and the project reported "unknown"
+    // with the information sitting one lookup away.
     let container_id = docker::find_existing_container(&project).await.unwrap_or(None);
-    let recorded = match &container_id {
+    let from_container = match &container_id {
         Some(id) => container_label(id, mig::LABEL_BASE_IMAGE_ID).await,
         None => None,
-    }
+    };
-    .or_else(|| None);
+    let from_snapshot = mig::image_labels(&snapshot_image)
-    let recorded = match recorded {
+        .await
-        Some(v) => Some(v),
+        .get(mig::LABEL_BASE_IMAGE_ID)
-        None => mig::image_labels(&snapshot_image)
+        .cloned();
-            .await
+    let recorded = pick_recorded_lineage(from_container, from_snapshot);
-            .get(mig::LABEL_BASE_IMAGE_ID)
-            .cloned(),
-    }
-    .filter(|v| !v.is_empty());
 
     out.base_image_id = recorded.clone();
     out.known = recorded.is_some();
@@ -833,6 +856,16 @@ pub async fn confirm_migration(
     migration_store::clear_staging(&project_id)?;
     migration_store::clear(&project_id)?;
     log::info!("Migration confirmed for project {}", project_id);
+
+    // Dropping the pin above is what turns the pre-migration image into an
+    // orphan: it was the only tag holding a multi-gigabyte pre-migration
+    // snapshot. Accepting the update is therefore the moment to sweep, and
+    // waiting for the project's next recreation would leave it lying around
+    // indefinitely.
+    tauri::async_runtime::spawn(async {
+        crate::docker::sweep_orphaned_snapshots().await;
+    });
+
     Ok(())
 }
 
@@ -1661,6 +1694,32 @@ fn summarize(
 mod tests {
     use super::*;
 
+    #[test]
+    fn an_empty_lineage_label_is_absence_and_falls_through_to_the_snapshot() {
+        let some = |s: &str| Some(s.to_string());
+
+        // The regression: the container always carries the label, so an
+        // unknown lineage reads as `Some("")`. Letting that satisfy the lookup
+        // skipped a snapshot that had recorded the real thing.
+        assert_eq!(
+            pick_recorded_lineage(some(""), some("sha256:base")),
+            some("sha256:base")
+        );
+
+        // Ordinary precedence still holds: the container wins when it has one.
+        assert_eq!(
+            pick_recorded_lineage(some("sha256:container"), some("sha256:snapshot")),
+            some("sha256:container")
+        );
+        assert_eq!(pick_recorded_lineage(None, some("sha256:snap")), some("sha256:snap"));
+
+        // Genuinely unknown stays unknown — "probe instead", never a lineage
+        // invented to make the comparison succeed.
+        assert_eq!(pick_recorded_lineage(None, None), None);
+        assert_eq!(pick_recorded_lineage(some(""), some("")), None);
+        assert_eq!(pick_recorded_lineage(some(""), None), None);
+    }
+
     #[test]
     fn byte_sizes_read_the_way_a_disk_warning_should() {
         assert_eq!(human_bytes(512), "512 B");

app/src-tauri/src/commands/project_commands.rs

@@ -450,6 +450,18 @@ pub async fn start_project_container(
                 ).await?;
                 emit_progress(&app_handle, &project_id, "Starting container...");
                 docker::start_container(&new_id).await?;
+
+                // The commit above moved `:latest` and orphaned the image it
+                // used to point at; the container holding that image open was
+                // removed a few lines up, so now is when Docker will actually
+                // let it go. Detached because this is housekeeping and the
+                // project is already running — and it sweeps every orphan, not
+                // just this one, so recreations that happened before the sweep
+                // existed are cleaned up too.
+                tauri::async_runtime::spawn(async {
+                    docker::sweep_orphaned_snapshots().await;
+                });
+
                 new_id
             } else {
                 emit_progress(&app_handle, &project_id, "Starting container...");

app/src-tauri/src/docker/container.rs

@@ -18,11 +18,12 @@ This container supports scheduled tasks via `triple-c-scheduler`. You can set up
 ### Commands
 - `triple-c-scheduler add --name "NAME" --schedule "CRON" --prompt "TASK"` — Add a recurring task
 - `triple-c-scheduler add --name "NAME" --at "YYYY-MM-DD HH:MM" --prompt "TASK"` — Add a one-time task
-- `triple-c-scheduler list` — List all scheduled tasks
+- `triple-c-scheduler list` — List all scheduled tasks, with a running/idle status column
 - `triple-c-scheduler remove --id ID` — Remove a task
 - `triple-c-scheduler enable --id ID` / `triple-c-scheduler disable --id ID` — Toggle tasks
+- `triple-c-scheduler status [--id ID] [--watch]` — Show what is running right now, and for how long
 - `triple-c-scheduler logs [--id ID] [--tail N]` — View execution logs
-- `triple-c-scheduler run --id ID` — Manually trigger a task immediately
+- `triple-c-scheduler run --id ID` — Manually trigger a task immediately (streams its log)
 - `triple-c-scheduler notifications [--clear]` — View or clear completion notifications
 
 ### Cron format
@@ -36,7 +37,7 @@ Use `--at "YYYY-MM-DD HH:MM"` instead of `--schedule`. The task automatically re
 Use `--working-dir /workspace/project` to set where the task runs (default: /workspace).
 
 ### Checking results
-After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.
+While a task is running, `triple-c-scheduler status` reports it with elapsed time — a log that has stopped growing is normal, because `claude -p` writes its answer only at the end, so use `status` rather than log silence to tell a slow run from a dead one. After tasks run, check notifications with `triple-c-scheduler notifications` and detailed output with `triple-c-scheduler logs`.
 
 ### Timezone
 Scheduled times use the container's configured timezone (check with `date`). If no timezone is configured, UTC is used."#;
@@ -211,6 +212,12 @@ pub const SECRET_ENV_KEYS: &[&str] = &[
 ];
 
 /// Env var name prefixes Triple-C manages itself; users cannot set these by hand.
+/// The label every container Triple-C creates carries — and, because
+/// `docker commit` copies a container's labels onto the image, every snapshot it
+/// commits. [`sweep_orphaned_snapshots`] treats it as the mark of provenance,
+/// which is what keeps the sweep away from the user's own images.
+const LABEL_MANAGED: &str = "triple-c.managed";
+
 const RESERVED_ENV_PREFIXES: &[&str] = &["ANTHROPIC_", "AWS_", "GIT_", "HOST_", "TRIPLE_C_"];
 
 /// Exact env var names Triple-C manages itself. Not covered by
@@ -318,8 +325,19 @@ fn is_reserved_env_key(key: &str) -> bool {
         || RESERVED_ENV_EXACT.iter().any(|e| upper == *e)
 }
 
-/// Compute a fingerprint string for the custom environment variables.
+/// Compute a fingerprint for the custom environment variables.
-/// Sorted alphabetically so order changes do not cause spurious recreation.
+///
+/// Sorted alphabetically so order changes do not cause spurious recreation, and
+/// **hashed**, because this value is written as the
+/// `triple-c.custom-env-fingerprint` label. Labels are readable by anything on
+/// the host through `docker inspect`, `docker commit` copies them onto the
+/// project's snapshot image, and `container_needs_recreation` logs both sides on
+/// a mismatch — so a plaintext `KEY=VALUE` join published every custom
+/// variable's *value*, API tokens included, to all three places. Same treatment
+/// as `triple-c.git-token-hash`.
+///
+/// Empty stays empty rather than becoming the hash of the empty string: an empty
+/// label is how every other `triple-c.*` key says "nothing configured".
 fn compute_env_fingerprint(custom_env_vars: &[EnvVar]) -> String {
     let mut parts: Vec<String> = Vec::new();
     for env_var in custom_env_vars {
@@ -330,7 +348,10 @@ fn compute_env_fingerprint(custom_env_vars: &[EnvVar]) -> String {
         parts.push(format!("{}={}", key, env_var.value));
     }
     parts.sort();
-    parts.join(",")
+    if parts.is_empty() {
+        return String::new();
+    }
+    sha256_hex(&parts.join(","))
 }
 
 /// The shared Claude Code OAuth token to inject for this project, paired with
@@ -777,6 +798,92 @@ async fn resolve_base_image_id(image_name: &str, base_image_name: &str) -> Strin
         .unwrap_or_default()
 }
 
+/// The `/dev/net/tun` character device, as it is named on both sides.
+const TUN_DEVICE: &str = "/dev/net/tun";
+
+/// The `HostConfig` fields "VPN support" contributes: `CapAdd`, `Devices`,
+/// `Sysctls` — in that order.
+type VpnHostConfigParts = (
+    Option<Vec<String>>,
+    Option<Vec<bollard::models::DeviceMapping>>,
+    Option<HashMap<String, String>>,
+);
+
+/// The three host-config pieces a VPN client needs, or all-`None` when the
+/// project has not opted in.
+///
+/// Returned as a triple rather than set inline so the exact shape is unit
+/// testable — a container is created once, by a very long async function, and a
+/// silently-dropped capability looks identical to a VPN server that is simply
+/// unreachable.
+///
+/// All three are required together and each fails differently on its own:
+/// * **`CAP_NET_ADMIN`** — without it the client cannot create an interface or
+///   write a route. Docker's default bounding set grants `net_raw` but not
+///   `net_admin`, which is why a client can ping but never connect.
+/// * **`/dev/net/tun`** — the device is absent from a default container, so
+///   there is nothing to open even with the capability. It is passed through
+///   from the host rather than `mknod`-ed inside, so the kernel's `tun` module
+///   backs it.
+/// * **`net.ipv4.conf.all.src_valid_mark`** — WireGuard's own `wg-quick` sets
+///   this, and cannot from inside a container (`/proc/sys` is read-only), so
+///   its handshake packets are dropped by reverse-path filtering. Harmless for
+///   OpenVPN-based clients, so it is set unconditionally with the rest.
+///
+/// This is namespaced to the container's own network stack: `NET_ADMIN` confers
+/// no authority over the host's interfaces or over any other container.
+fn vpn_host_config(enabled: bool) -> VpnHostConfigParts {
+    if !enabled {
+        return (None, None, None);
+    }
+
+    let devices = vec![bollard::models::DeviceMapping {
+        path_on_host: Some(TUN_DEVICE.to_string()),
+        path_in_container: Some(TUN_DEVICE.to_string()),
+        cgroup_permissions: Some("rwm".to_string()),
+    }];
+
+    let sysctls = HashMap::from([(
+        "net.ipv4.conf.all.src_valid_mark".to_string(),
+        "1".to_string(),
+    )]);
+
+    (
+        Some(vec!["NET_ADMIN".to_string()]),
+        Some(devices),
+        Some(sysctls),
+    )
+}
+
+/// Turn the daemon's device-passthrough failure into an explanation.
+///
+/// Requesting `/dev/net/tun` fails at *creation* when the host kernel has no
+/// `tun` module — and the raw bollard error names a path the user will look for
+/// on the wrong machine, since with Docker Desktop the relevant host is the
+/// Linux VM rather than their own. Left unmapped this surfaces as a project
+/// that simply refuses to start, with nothing pointing back at the switch that
+/// caused it.
+fn explain_create_failure(err: &str, vpn_enabled: bool) -> String {
+    let device_missing = vpn_enabled
+        && err.contains(TUN_DEVICE)
+        && (err.contains("no such file or directory")
+            || err.contains("No such file or directory")
+            || err.contains("error gathering device information"));
+
+    if device_missing {
+        return format!(
+            "Failed to create container: the Docker host has no {} device, which \
+             \"VPN support\" requires. The host kernel needs the `tun` module \
+             loaded (on Docker Desktop that is the Linux VM, not your own \
+             machine). Turn VPN support off in Config → Runtime to start this \
+             project without it. Original error: {}",
+            TUN_DEVICE, err
+        );
+    }
+
+    format!("Failed to create container: {}", err)
+}
+
 pub async fn create_container(
     project: &Project,
     docker_socket_path: &str,
@@ -1341,7 +1448,7 @@ pub async fn create_container(
     }
 
     let mut labels = HashMap::new();
-    labels.insert("triple-c.managed".to_string(), "true".to_string());
+    labels.insert(LABEL_MANAGED.to_string(), "true".to_string());
     labels.insert("triple-c.project-id".to_string(), project.id.clone());
     labels.insert("triple-c.project-name".to_string(), project.name.clone());
     labels.insert("triple-c.backend".to_string(), format!("{:?}", project.backend));
@@ -1354,6 +1461,13 @@ pub async fn create_container(
     labels.insert("triple-c.image".to_string(), image_name.to_string());
     labels.insert("triple-c.timezone".to_string(), timezone.unwrap_or("").to_string());
     labels.insert("triple-c.mission-control".to_string(), project.mission_control_enabled.to_string());
+    // Capabilities, devices and sysctls are fixed at creation, so this is
+    // container state and gets the label-and-compare treatment. Written
+    // unconditionally (`false`, not omitted) because `docker commit` copies
+    // container labels onto the snapshot image: a `true` stamped once would
+    // otherwise ride that snapshot into every future container and make the
+    // switch impossible to turn back off.
+    labels.insert("triple-c.vpn-support".to_string(), project.vpn_support_enabled.to_string());
     labels.insert("triple-c.permission-mode".to_string(),
         project.effective_permission_mode().as_env_value().to_string());
     labels.insert("triple-c.custom-env-fingerprint".to_string(), custom_env_fingerprint.clone());
@@ -1422,10 +1536,15 @@ pub async fn create_container(
         labels.insert((*key).to_string(), (*value).to_string());
     }
 
+    let (cap_add, devices, sysctls) = vpn_host_config(project.vpn_support_enabled);
+
     let host_config = HostConfig {
         mounts: Some(mounts),
         port_bindings: if port_bindings.is_empty() { None } else { Some(port_bindings) },
         init: Some(true),
+        cap_add,
+        devices,
+        sysctls,
         ..Default::default()
     };
 
@@ -1455,7 +1574,7 @@ pub async fn create_container(
     let response = docker
         .create_container(Some(options), config)
         .await
-        .map_err(|e| format!("Failed to create container: {}", e))?;
+        .map_err(|e| explain_create_failure(&e.to_string(), project.vpn_support_enabled))?;
 
     Ok(response.id)
 }
@@ -1689,6 +1808,128 @@ fn env_holds_a_secret(env: &[String]) -> bool {
     })
 }
 
+/// Outcome of [`sweep_orphaned_snapshots`].
+#[derive(Debug, Default, Clone, serde::Serialize)]
+pub struct SnapshotSweepReport {
+    /// Image ids that were removed.
+    pub removed: Vec<String>,
+    /// Bytes the removed images accounted for, as Docker reported them. A
+    /// shared-layer estimate, not a disk-usage measurement.
+    pub reclaimed_bytes: i64,
+    /// Orphans Docker refused to delete because a container is still built
+    /// from them. Normal, not a failure — the next sweep gets them.
+    pub in_use: usize,
+    /// Orphans that could not be removed for any other reason, with the error.
+    pub failed: Vec<(String, String)>,
+    /// Set when the engine could not be reached or listed at all.
+    pub unavailable: Option<String>,
+}
+
+/// The filter every sweep runs under. Extracted so a test can hold the two
+/// conditions in place: **dangling** and **labelled as ours**. Losing either
+/// one turns a snapshot sweep into a prune of the user's whole image store.
+fn orphan_sweep_filters() -> HashMap<String, Vec<String>> {
+    HashMap::from([
+        ("dangling".to_string(), vec!["true".to_string()]),
+        (
+            "label".to_string(),
+            vec![format!("{}=true", LABEL_MANAGED)],
+        ),
+    ])
+}
+
+/// Remove the untagged snapshot commits left behind by recreation.
+///
+/// Every recreation commits the container to `triple-c-snapshot-{id}:latest`
+/// and moves that tag; the image the tag pointed at before keeps its layers and
+/// loses its name. Nothing else deletes those, so a project that has been
+/// recreated a dozen times leaves a dozen multi-gigabyte orphans behind.
+///
+/// Two conditions, and the safety of this whole function rests on them:
+///
+/// * **Dangling** — untagged. Every image the app relies on carries a tag:
+///   `triple-c-snapshot-{id}:latest` is what a project is rebuilt from, and a
+///   migration's `pre-migration-*` pin is the only copy of a rollback target.
+///   Neither can ever match this filter, so neither can be swept.
+/// * **`triple-c.managed=true`** — only images Triple-C itself committed.
+///   `docker commit` copies the container's labels onto the image, which is what
+///   makes the label a reliable mark of provenance. The user's own dangling
+///   images are none of our business.
+///
+/// Removal is not forced, so Docker refuses (409) while any container is still
+/// built from the image — including the stopped containers of projects that are
+/// not running. That refusal is the third safety net and it is the daemon's,
+/// not ours; those orphans are simply counted and left for a later sweep.
+///
+/// Never fails the caller: this is housekeeping, and a full disk is a better
+/// outcome than a project that will not start.
+pub async fn sweep_orphaned_snapshots() -> SnapshotSweepReport {
+    use bollard::image::ListImagesOptions;
+
+    let mut report = SnapshotSweepReport::default();
+
+    let docker = match get_docker() {
+        Ok(d) => d,
+        Err(e) => {
+            report.unavailable = Some(e);
+            return report;
+        }
+    };
+
+    let images = match docker
+        .list_images(Some(ListImagesOptions {
+            all: false,
+            filters: orphan_sweep_filters(),
+            ..Default::default()
+        }))
+        .await
+    {
+        Ok(images) => images,
+        Err(e) => {
+            report.unavailable = Some(format!("Could not list orphaned snapshots: {}", e));
+            return report;
+        }
+    };
+
+    for summary in images {
+        match docker
+            .remove_image(
+                &summary.id,
+                Some(RemoveImageOptions {
+                    force: false,
+                    noprune: false,
+                }),
+                None,
+            )
+            .await
+        {
+            Ok(_) => {
+                report.reclaimed_bytes += summary.size;
+                report.removed.push(summary.id);
+            }
+            Err(bollard::errors::Error::DockerResponseServerError {
+                status_code: 409, ..
+            }) => {
+                report.in_use += 1;
+            }
+            Err(e) => {
+                report.failed.push((summary.id, e.to_string()));
+            }
+        }
+    }
+
+    if !report.removed.is_empty() || report.in_use > 0 {
+        log::info!(
+            "Snapshot sweep: removed {} orphan(s) ({:.2} GB), {} still in use by a container",
+            report.removed.len(),
+            report.reclaimed_bytes as f64 / 1_073_741_824.0,
+            report.in_use
+        );
+    }
+
+    report
+}
+
 /// Outcome of [`scrub_secrets_from_snapshots`], so callers can tell the user
 /// what actually happened rather than guessing.
 #[derive(Debug, Default, Clone, serde::Serialize)]
@@ -2224,6 +2465,19 @@ pub async fn container_needs_recreation(
         return Ok(true);
     }
 
+    // ── VPN support (NET_ADMIN + /dev/net/tun + sysctl) ───────────────────
+    // A container's capabilities, devices and sysctls are set at creation and
+    // cannot be changed on a running or stopped container, so recreation is the
+    // only way a toggle here takes effect. A missing label means the container
+    // predates the feature, which is the same thing as having it off — so
+    // existing projects are not churned until someone actually turns it on.
+    let expected_vpn = project.vpn_support_enabled.to_string();
+    let container_vpn = get_label("triple-c.vpn-support").unwrap_or_else(|| "false".to_string());
+    if container_vpn != expected_vpn {
+        log::info!("VPN support mismatch (container={:?}, expected={:?})", container_vpn, expected_vpn);
+        return Ok(true);
+    }
+
     // ── Permission mode ────────────────────────────────────────────────────
     // The mode is injected as the TRIPLE_C_PERMISSION_MODE env var, and
     // container env can only change by recreating the container. A missing
@@ -2352,7 +2606,7 @@ pub async fn list_sibling_containers() -> Result<Vec<ContainerSummary>, String>
         .into_iter()
         .filter(|c| {
             if let Some(labels) = &c.labels {
-                !labels.contains_key("triple-c.managed")
+                !labels.contains_key(LABEL_MANAGED)
             } else {
                 true
             }
@@ -2473,6 +2727,115 @@ mod tests {
         assert_eq!(fp, "");
     }
 
+    #[test]
+    fn vpn_support_off_touches_nothing_in_the_host_config() {
+        // The default must stay byte-identical to a container created before the
+        // feature existed, or every project recreates on the next start.
+        let (cap_add, devices, sysctls) = vpn_host_config(false);
+        assert_eq!(cap_add, None);
+        assert_eq!(devices, None);
+        assert_eq!(sysctls, None);
+    }
+
+    #[test]
+    fn vpn_support_on_grants_all_three_pieces() {
+        // Each is useless without the others — a client with the capability but
+        // no device, or the device but no capability, still times out — so this
+        // asserts the whole set rather than any one of them.
+        let (cap_add, devices, sysctls) = vpn_host_config(true);
+
+        assert_eq!(cap_add, Some(vec!["NET_ADMIN".to_string()]));
+
+        let devices = devices.expect("the tun device must be passed through");
+        assert_eq!(devices.len(), 1);
+        assert_eq!(devices[0].path_on_host.as_deref(), Some(TUN_DEVICE));
+        assert_eq!(devices[0].path_in_container.as_deref(), Some(TUN_DEVICE));
+        assert_eq!(devices[0].cgroup_permissions.as_deref(), Some("rwm"));
+
+        assert_eq!(
+            sysctls
+                .expect("wireguard needs src_valid_mark")
+                .get("net.ipv4.conf.all.src_valid_mark")
+                .map(String::as_str),
+            Some("1")
+        );
+    }
+
+    #[test]
+    fn vpn_support_never_grants_more_than_net_admin() {
+        // NET_ADMIN is already a step out of the sandbox. Anything else added
+        // here (SYS_ADMIN, or a blanket privileged flag) would be a much larger
+        // one, so pin the set.
+        let (cap_add, _, _) = vpn_host_config(true);
+        assert_eq!(cap_add.unwrap(), vec!["NET_ADMIN"]);
+    }
+
+    #[test]
+    fn a_missing_tun_device_is_explained_rather_than_echoed() {
+        let raw = "error gathering device information while adding custom device \
+                   \"/dev/net/tun\": no such file or directory";
+        let msg = explain_create_failure(raw, true);
+        assert!(msg.contains("VPN support"), "should name the switch: {}", msg);
+        assert!(msg.contains("tun` module"), "should name the cause: {}", msg);
+        assert!(msg.contains(raw), "should keep the original error: {}", msg);
+    }
+
+    #[test]
+    fn unrelated_failures_are_left_alone() {
+        // Including a tun error on a project that never asked for VPN support —
+        // that came from somewhere else and must not be misattributed.
+        let name_clash = "Conflict. The container name \"/triple-c-x\" is already in use";
+        assert_eq!(
+            explain_create_failure(name_clash, true),
+            format!("Failed to create container: {}", name_clash)
+        );
+
+        let tun_err = "no such file or directory: /dev/net/tun";
+        assert_eq!(
+            explain_create_failure(tun_err, false),
+            format!("Failed to create container: {}", tun_err)
+        );
+    }
+
+    #[test]
+    fn the_orphan_sweep_only_ever_looks_at_our_own_untagged_images() {
+        // Both conditions are load-bearing. Without `dangling` the sweep would
+        // match `triple-c-snapshot-{id}:latest` — what every project is rebuilt
+        // from — and a migration's `pre-migration-*` pin, which is the only copy
+        // of a rollback target. Without the label it would match every dangling
+        // image on the user's machine.
+        let filters = orphan_sweep_filters();
+        assert_eq!(filters.get("dangling"), Some(&vec!["true".to_string()]));
+        assert_eq!(
+            filters.get("label"),
+            Some(&vec!["triple-c.managed=true".to_string()])
+        );
+        assert_eq!(filters.len(), 2, "an extra filter widens or narrows the sweep");
+    }
+
+    #[test]
+    fn the_custom_env_fingerprint_never_carries_the_value() {
+        // It goes into `triple-c.custom-env-fingerprint`, which `docker inspect`
+        // hands to anything on the host, `docker commit` copies onto the
+        // project's snapshot image, and the recreation check logs on a mismatch.
+        let secret = "33da01c1b320644920c20d6b5e0a1c6b3c3451c2";
+        let fp = compute_env_fingerprint(&[EnvVar {
+            key: "TEA_TOKEN".to_string(),
+            value: secret.to_string(),
+        }]);
+        assert!(!fp.contains(secret), "fingerprint leaked the value: {}", fp);
+        assert!(!fp.contains("TEA_TOKEN"), "fingerprint leaked the key: {}", fp);
+        assert_eq!(fp.len(), 64, "expected a sha256 hex digest, got {:?}", fp);
+
+        // It still has to move when the value does, or a rotated token would
+        // never reach the container.
+        let rotated = compute_env_fingerprint(&[EnvVar {
+            key: "TEA_TOKEN".to_string(),
+            value: "rotated".to_string(),
+        }]);
+        assert_ne!(fp, rotated);
+    }
+
     #[test]
     fn the_deprecated_small_fast_model_var_is_never_emitted() {
         let rendered: Vec<String> = aliases(Some("m"), Some("h"))

app/src-tauri/src/lib.rs

@@ -328,6 +328,14 @@ pub fn run() {
         })
         .on_window_event(|window, event| {
             if let tauri::WindowEvent::CloseRequested { api, .. } = event {
+                // This handler fires for *every* window, and what follows stops
+                // containers and exits the process. Only the main window means
+                // that. Secondary windows — the browser view's pop-out — are
+                // closed and reopened freely and must just close.
+                if window.label() != "main" {
+                    return;
+                }
+
                 let state = window.state::<AppState>();
                 let lifecycle = state.lifecycle.clone();
 
@@ -428,6 +436,16 @@ pub fn run() {
             browser_view::commands::check_browser_view_support,
             browser_view::commands::install_browser_view_support,
             browser_view::commands::install_browser_view_browser,
+            browser_view::commands::open_browser_view_popout,
+            browser_view::commands::close_browser_view_popout,
+            browser_view::commands::get_browser_view_popout_state,
+            browser_view::commands::set_browser_view_popout_always_on_top,
+            browser_view::commands::open_page_in_container_browser,
+            browser_view::commands::set_container_page_viewport,
+            browser_view::commands::get_container_page_state,
+            browser_view::commands::close_container_page,
+            browser_view::commands::set_browser_view_match_window,
+            browser_view::commands::get_browser_view_match_window,
             // Shared Claude Code auth token
             commands::auth_token_commands::acquire_claude_token,
             commands::auth_token_commands::submit_claude_token_code,

app/src-tauri/src/models/project.rs

@@ -145,6 +145,21 @@ pub struct Project {
     /// container-recreation label.
     #[serde(default)]
     pub browser_view_enabled: bool,
+    /// Grant the container what a VPN client needs to build a tunnel:
+    /// `CAP_NET_ADMIN`, the `/dev/net/tun` device, and the WireGuard
+    /// `src_valid_mark` sysctl. Without all three a client (PIA, WireGuard,
+    /// OpenVPN, Tailscale) installs and runs but its connection attempt hangs
+    /// until it times out, because it cannot create the tunnel interface or
+    /// touch the routing table.
+    ///
+    /// Off by default and deliberately opt-in: `NET_ADMIN` lets anything in the
+    /// container reconfigure its own network stack, which is a meaningful step
+    /// out of the default sandbox. Unlike `auth_bridge_enabled` this *is*
+    /// container state, so it carries a `triple-c.vpn-support` label and is
+    /// compared in `container_needs_recreation` — capabilities and devices are
+    /// fixed at creation and can only change by recreating the container.
+    #[serde(default)]
+    pub vpn_support_enabled: bool,
     /// Use the shared, long-lived Claude Code OAuth token (from
     /// `claude setup-token`, held in the OS keychain) for this project instead
     /// of requiring its own `claude login`. Only consulted when `backend` is
@@ -366,6 +381,7 @@ impl Project {
             mission_control_enabled: false,
             auth_bridge_enabled: false,
             browser_view_enabled: false,
+            vpn_support_enabled: false,
             use_shared_auth_token: default_use_shared_auth_token(),
             full_permissions: false,
             permission_mode: None,

app/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/tauri-apps/tauri/dev/crates/tauri-cli/schema.json",
   "productName": "Triple-C",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "identifier": "com.triple-c.desktop",
   "build": {
     "beforeDevCommand": "npm run dev",
@@ -33,6 +33,7 @@
       "icons/128x128.png",
       "icons/128x128@2x.png",
       "icons/icon.ico",
+      "icons/icon.icns",
       "icons/icon.png"
     ]
   },

app/src/components/layout/MainTabs.test.tsx

@@ -0,0 +1,267 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { fireEvent, render, screen } from "@testing-library/react";
+import MainTabs from "./MainTabs";
+import { useAppState, homeTabKey, terminalTabKey } from "../../store/appState";
+import type { Project, TerminalSession } from "../../lib/types";
+
+const close = vi.fn();
+
+const sessions: TerminalSession[] = [
+  {
+    id: "s1",
+    projectId: "p1",
+    projectName: "api-server",
+    sessionName: "claude",
+    sessionType: "claude",
+  },
+  {
+    id: "s2",
+    projectId: "p1",
+    projectName: "api-server",
+    sessionName: "shell",
+    sessionType: "bash",
+  },
+] as unknown as TerminalSession[];
+
+const projects: Project[] = [
+  {
+    id: "p1",
+    name: "api-server",
+    status: "running",
+    permission_mode: "bypass",
+    renamed_session_names: {},
+  },
+] as unknown as Project[];
+
+vi.mock("../../hooks/useTerminal", () => ({
+  useTerminal: () => ({ sessions, close }),
+}));
+vi.mock("../../hooks/useProjects", () => ({
+  useProjects: () => ({ projects, update: vi.fn() }),
+}));
+
+const HOME = homeTabKey("p1");
+const S1 = terminalTabKey("s1");
+const S2 = terminalTabKey("s2");
+
+/**
+ * A pointer event carrying a real `clientX`.
+ *
+ * jsdom implements no `PointerEvent`, so Testing Library's synthesized one has
+ * no coordinates — and the coordinate is the whole point here, since it decides
+ * which slot the drop lands in. `MouseEvent` has one, and React dispatches on
+ * the event's type name either way.
+ */
+function pointer(el: Element, type: string, clientX: number) {
+  fireEvent(el, new MouseEvent(type, { bubbles: true, cancelable: true, clientX, button: 0 }));
+}
+
+/** Press, move past the drag threshold, and release over `endX`. */
+function dragTab(el: Element, fromX: number, endX: number) {
+  pointer(el, "pointerdown", fromX);
+  pointer(el, "pointermove", endX);
+  pointer(el, "pointerup", endX);
+}
+
+/** Pin a tab's geometry so "past the midpoint" means something in jsdom. */
+function place(el: Element, left: number, width = 100) {
+  el.getBoundingClientRect = () =>
+    ({ left, width, right: left + width, top: 0, bottom: 30, height: 30, x: left, y: 0 }) as DOMRect;
+}
+
+/** Lay the strip out as three 100px tabs starting at x=0. */
+function laidOut() {
+  const tabs = screen.getAllByRole("tab");
+  tabs.forEach((tab, i) => place(tab, i * 100));
+  return tabs;
+}
+
+const order = () => useAppState.getState().tabOrder;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  useAppState.setState({
+    tabOrder: [HOME, S1, S2],
+    activeTabKey: HOME,
+    activeSessionId: null,
+    projects,
+  });
+});
+
+describe("MainTabs reordering", () => {
+  it("drags a tab to the front", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+
+    // Left half of the first tab — the tab lands before it.
+    dragTab(tabs[2], 250, 10);
+
+    expect(order()).toEqual([S2, HOME, S1]);
+  });
+
+  it("drops after the tab when the pointer is past its midpoint", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+
+    dragTab(tabs[0], 50, 190);
+
+    expect(order()).toEqual([S1, HOME, S2]);
+  });
+
+  it("drops at the end when released past the last tab", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+
+    dragTab(tabs[0], 50, 800);
+
+    expect(order()).toEqual([S1, S2, HOME]);
+  });
+
+  it("dragging does not steal the selection", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+
+    dragTab(tabs[1], 150, 290);
+
+    expect(order()).toEqual([HOME, S2, S1]);
+    expect(useAppState.getState().activeTabKey).toBe(HOME);
+  });
+
+  it("does not let a drag select the tab's text", () => {
+    // A pointer-driven drag is still a mouse drag as far as the browser is
+    // concerned, so without this the label highlights blue while you move it.
+    // The rename field is exempt — selecting there is the whole point.
+    render(<MainTabs />);
+    for (const tab of screen.getAllByRole("tab")) {
+      expect(tab.className).toContain("select-none");
+    }
+
+    fireEvent.doubleClick(screen.getAllByRole("tab")[1]);
+    expect(screen.getByLabelText("Rename tab").className).toContain("select-text");
+  });
+
+  it("shows the tab itself under the cursor while dragging", () => {
+    // A dimmed source tab and a thin line do not read as "I am holding this
+    // tab" — the dragged copy is what makes the gesture legible.
+    render(<MainTabs />);
+    const tabs = laidOut();
+    expect(screen.queryByTestId("tab-drag-ghost")).toBeNull();
+
+    pointer(tabs[2], "pointerdown", 250);
+    pointer(tabs[2], "pointermove", 120);
+
+    const ghost = screen.getByTestId("tab-drag-ghost");
+    expect(ghost).toHaveTextContent("shell (bash)");
+    expect(ghost).toHaveTextContent("▣");
+
+    pointer(tabs[2], "pointerup", 120);
+    expect(screen.queryByTestId("tab-drag-ghost")).toBeNull();
+  });
+
+  it("carries the project name when a home tab is dragged", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+
+    pointer(tabs[0], "pointerdown", 50);
+    pointer(tabs[0], "pointermove", 250);
+
+    expect(screen.getByTestId("tab-drag-ghost")).toHaveTextContent("api-server");
+    expect(screen.getByTestId("tab-drag-ghost")).toHaveTextContent("⌂");
+  });
+
+  it("drops the dragged copy when the drag is abandoned", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+
+    pointer(tabs[2], "pointerdown", 250);
+    pointer(tabs[2], "pointermove", 10);
+    fireEvent.keyDown(window, { key: "Escape" });
+
+    expect(screen.queryByTestId("tab-drag-ghost")).toBeNull();
+  });
+
+  it("shows the drop marker only while a drag is under way", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+    expect(screen.queryByTestId("tab-drop-marker")).toBeNull();
+
+    pointer(tabs[2], "pointerdown", 250);
+    pointer(tabs[2], "pointermove", 10);
+    expect(screen.getByTestId("tab-drop-marker")).toBeInTheDocument();
+
+    pointer(tabs[2], "pointerup", 10);
+    expect(screen.queryByTestId("tab-drop-marker")).toBeNull();
+  });
+
+  it("abandons the drag on Escape, leaving the order alone", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+
+    pointer(tabs[2], "pointerdown", 250);
+    pointer(tabs[2], "pointermove", 10);
+    fireEvent.keyDown(window, { key: "Escape" });
+
+    expect(screen.queryByTestId("tab-drop-marker")).toBeNull();
+    pointer(tabs[2], "pointerup", 10);
+    expect(order()).toEqual([HOME, S1, S2]);
+  });
+
+  it("treats a press that barely moves as a click, not a drag", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+
+    // Two pixels of tremble, under the threshold.
+    pointer(tabs[2], "pointerdown", 250);
+    pointer(tabs[2], "pointermove", 252);
+    pointer(tabs[2], "pointerup", 252);
+    fireEvent.click(tabs[2]);
+
+    expect(order()).toEqual([HOME, S1, S2]);
+    expect(useAppState.getState().activeTabKey).toBe(S2);
+  });
+
+  it("does not select the tab it just dropped", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+
+    dragTab(tabs[2], 250, 10);
+    // The browser fires a click after the pointerup that ended the drag.
+    fireEvent.click(tabs[2]);
+
+    expect(order()).toEqual([S2, HOME, S1]);
+    expect(useAppState.getState().activeTabKey).toBe(HOME);
+  });
+
+  it("ignores a press that starts on the close button", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+    const close = screen.getByRole("button", { name: "Close shell (bash)" });
+
+    fireEvent(close, new MouseEvent("pointerdown", { bubbles: true, clientX: 290, button: 0 }));
+    pointer(tabs[2], "pointermove", 10);
+
+    expect(screen.queryByTestId("tab-drop-marker")).toBeNull();
+    expect(order()).toEqual([HOME, S1, S2]);
+  });
+
+  it("does not drag a tab that is being renamed — that drag selects text", () => {
+    render(<MainTabs />);
+    const tabs = laidOut();
+    fireEvent.doubleClick(tabs[1]);
+    expect(screen.getByLabelText("Rename tab")).toBeInTheDocument();
+
+    dragTab(screen.getAllByRole("tab")[1], 150, 10);
+
+    expect(order()).toEqual([HOME, S1, S2]);
+  });
+
+  it("carries no drag payload that another element could receive", () => {
+    // An HTML5 drag would put the tab key in a DataTransfer, and releasing over
+    // any text field in the app would type `term:…` into it. Pointer events
+    // have nothing to hand over, and the tabs are not draggable at all.
+    render(<MainTabs />);
+    for (const tab of screen.getAllByRole("tab")) {
+      expect(tab).not.toHaveAttribute("draggable", "true");
+    }
+  });
+});

app/src/components/layout/MainTabs.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from "react";
+import { Fragment, useEffect, useRef, useState } from "react";
 import { useShallow } from "zustand/react/shallow";
 import { useTerminal } from "../../hooks/useTerminal";
 import { useProjects } from "../../hooks/useProjects";
@@ -18,6 +18,9 @@ interface ContextMenuState {
   y: number;
 }
 
+/** Pixels of horizontal travel before a press becomes a drag rather than a click. */
+const DRAG_THRESHOLD = 4;
+
 const MODE_BADGE: Record<PermissionMode, { text: string; className: string }> = {
   plan: { text: "plan", className: "bg-[var(--bg-tertiary)] text-[var(--text-secondary)]" },
   default: { text: "ask", className: "bg-[var(--bg-tertiary)] text-[var(--text-secondary)]" },
@@ -28,22 +31,46 @@ const MODE_BADGE: Record<PermissionMode, { text: string; className: string }> =
 /**
  * One strip for both main-area tab kinds: Project Home views (⌂) and
  * terminals (▣).
+ *
+ * Tabs are draggable, on pointer events rather than HTML5 drag-and-drop — see
+ * `pointerProps` for why neither of the two obvious alternatives works.
+ * `Ctrl+Shift+←/→` does the same thing without a mouse.
  */
 export default function MainTabs() {
   const { sessions, close } = useTerminal();
   const { projects, update } = useProjects();
-  const { tabOrder, activeTabKey, setActiveTabKey, closeHomeTab } = useAppState(
+  const { tabOrder, activeTabKey, setActiveTabKey, closeHomeTab, moveTab } = useAppState(
     useShallow((s) => ({
       tabOrder: s.tabOrder,
       activeTabKey: s.activeTabKey,
       setActiveTabKey: s.setActiveTabKey,
       closeHomeTab: s.closeHomeTab,
+      moveTab: s.moveTab,
     })),
   );
   const [menu, setMenu] = useState<ContextMenuState | null>(null);
   const [renamingId, setRenamingId] = useState<string | null>(null);
   const [renameDraft, setRenameDraft] = useState("");
   const renameInputRef = useRef<HTMLInputElement>(null);
+  /** The tab being dragged, and the slot it would drop into. */
+  const [dragKey, setDragKey] = useState<string | null>(null);
+  const [dropIndex, setDropIndex] = useState<number | null>(null);
+  /** Where the dragged tab is drawn, and how it looked when the drag started. */
+  const [ghost, setGhost] = useState<{ x: number; y: number; label: string; icon: string } | null>(
+    null,
+  );
+  const stripRef = useRef<HTMLDivElement>(null);
+  /** A press that has not yet moved far enough to be a drag. */
+  const pending = useRef<{
+    key: string;
+    startX: number;
+    dragging: boolean;
+    offsetX: number;
+    width: number;
+    height: number;
+    top: number;
+  } | null>(null);
+  const suppressClick = useRef(false);
 
   useEffect(() => {
     if (!menu) return;
@@ -63,6 +90,21 @@ export default function MainTabs() {
     }
   }, [renamingId]);
 
+  // Escape abandons a drag — the one affordance a pointer-event drag has to
+  // supply for itself, since the OS is not running this one.
+  useEffect(() => {
+    if (!dragKey) return;
+    const onKeyDown = (e: KeyboardEvent) => {
+      if (e.key !== "Escape") return;
+      pending.current = null;
+      setDragKey(null);
+      setDropIndex(null);
+      setGhost(null);
+    };
+    window.addEventListener("keydown", onKeyDown);
+    return () => window.removeEventListener("keydown", onKeyDown);
+  }, [dragKey]);
+
   if (tabOrder.length === 0) {
     return (
       <div className="px-3 text-xs text-[var(--text-secondary)] leading-10">
@@ -135,136 +177,307 @@ export default function MainTabs() {
     }
   };
 
-  const tabClass = (active: boolean) =>
+  const tabClass = (active: boolean, dragging: boolean) =>
-    `flex items-center gap-1.5 pl-3 pr-1.5 h-full text-xs cursor-pointer border-r border-[var(--border-color)] transition-colors ${
+    `flex items-center gap-1.5 pl-3 pr-1.5 h-full text-xs cursor-pointer select-none border-r border-[var(--border-color)] transition-colors ${
       active
         ? "bg-[var(--bg-primary)] text-[var(--text-primary)]"
         : "text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
-    }`;
+    }${dragging ? " opacity-40" : ""}`;
+
+  /**
+   * What a tab reads as, for the dragged copy. Same sources the tab itself
+   * uses — a ghost showing a different name from the tab it came from would be
+   * worse than no ghost.
+   */
+  const tabLabel = (key: string): string => {
+    if (isHomeTab(key)) {
+      return projects.find((p) => p.id === tabKeyId(key))?.name ?? "";
+    }
+    const session = sessions.find((s) => s.id === tabKeyId(key));
+    if (!session) return "";
+    const custom = getCustomName(session.projectId, session.id);
+    return custom
+      ? `${session.projectName}: ${custom}`
+      : (session.sessionName ?? session.projectName) +
+          (session.sessionType === "bash" ? " (bash)" : "");
+  };
+
+  const endDrag = () => {
+    pending.current = null;
+    setDragKey(null);
+    setDropIndex(null);
+    setGhost(null);
+  };
+
+  /**
+   * Which slot the pointer is currently over, as an insertion index into
+   * `tabOrder`.
+   *
+   * Measured from the tabs actually on screen rather than from the event's
+   * target, so the answer is the same whatever the pointer happens to be over —
+   * including the drop marker itself, and including a `tabOrder` entry whose
+   * session has already gone and which therefore renders nothing.
+   */
+  const dropIndexAt = (clientX: number): number => {
+    const strip = stripRef.current;
+    if (!strip) return tabOrder.length;
+    for (const el of strip.querySelectorAll<HTMLElement>("[data-tab-index]")) {
+      const rect = el.getBoundingClientRect();
+      if (clientX < rect.left + rect.width / 2) return Number(el.dataset.tabIndex);
+    }
+    return tabOrder.length;
+  };
+
+  /**
+   * Dragging is done with pointer events, not HTML5 drag-and-drop.
+   *
+   * Two reasons, both load-bearing. Tauri's `dragDropEnabled` — which the
+   * terminal needs left on, because only the native drag-drop event carries
+   * dropped *file paths* — blocks HTML5 drag inside the webview on Windows, so
+   * an HTML5 implementation is simply dead there. And an HTML5 drag carries a
+   * `DataTransfer`: released over any text field in the app, the default
+   * handler types the payload into it.
+   */
+  const pointerProps = (key: string, renaming: boolean) => ({
+    onPointerDown: (e: React.PointerEvent<HTMLDivElement>) => {
+      // Left button only, never from the close button, and never while the
+      // rename input is up — that drag is a text selection.
+      if (e.button !== 0 || renaming) return;
+      if ((e.target as HTMLElement).closest("button, input")) return;
+      const rect = e.currentTarget.getBoundingClientRect();
+      pending.current = {
+        key,
+        startX: e.clientX,
+        dragging: false,
+        // Where inside the tab the pointer grabbed it, so the ghost sits under
+        // the cursor exactly where the real tab was — the thing that makes a
+        // drag feel like moving an object rather than nudging a setting.
+        offsetX: e.clientX - rect.left,
+        width: rect.width,
+        height: rect.height,
+        top: rect.top,
+      };
+      e.currentTarget.setPointerCapture?.(e.pointerId);
+    },
+    onPointerMove: (e: React.PointerEvent<HTMLDivElement>) => {
+      const drag = pending.current;
+      if (!drag) return;
+      // A few pixels of slop, so a click that trembles stays a click.
+      if (!drag.dragging && Math.abs(e.clientX - drag.startX) < DRAG_THRESHOLD) return;
+      drag.dragging = true;
+      setDragKey(drag.key);
+      setDropIndex(dropIndexAt(e.clientX));
+      setGhost({
+        x: e.clientX - drag.offsetX,
+        y: drag.top,
+        label: tabLabel(drag.key),
+        icon: isHomeTab(drag.key) ? "⌂" : "▣",
+      });
+    },
+    onPointerUp: (e: React.PointerEvent<HTMLDivElement>) => {
+      const drag = pending.current;
+      e.currentTarget.releasePointerCapture?.(e.pointerId);
+      if (!drag?.dragging) {
+        pending.current = null;
+        return; // a plain click: leave it to `onClick` to select the tab
+      }
+      const to = dropIndexAt(e.clientX);
+      const from = tabOrder.indexOf(drag.key);
+      // `to` is a slot in the strip as it looks *now*; `moveTab` places the tab
+      // after pulling it out, so every slot past its own shifts down one.
+      if (from !== -1) moveTab(drag.key, to > from ? to - 1 : to);
+      // The click that follows this pointerup is the drag's, not a selection.
+      suppressClick.current = true;
+      endDrag();
+    },
+    onPointerCancel: endDrag,
+  });
+
+  /** A drag in progress swallows the click it ends with. */
+  const activateTab = (key: string) => {
+    if (suppressClick.current) {
+      suppressClick.current = false;
+      return;
+    }
+    setActiveTabKey(key);
+  };
+
+  const dropMarker = (
+    <div
+      aria-hidden="true"
+      data-testid="tab-drop-marker"
+      className="w-0.5 -mx-px h-full bg-[var(--accent)] flex-shrink-0 pointer-events-none"
+    />
+  );
+
+  const renderTab = (key: string, index: number) => {
+    const active = activeTabKey === key;
+
+    if (isHomeTab(key)) {
+      const projectId = tabKeyId(key);
+      const project = projects.find((p) => p.id === projectId);
+      if (!project) return null;
+      return (
+        <div
+          role="tab"
+          aria-selected={active}
+          tabIndex={0}
+          data-tab-index={index}
+          onClick={() => activateTab(key)}
+          onKeyDown={(e) => {
+            if (e.key === "Enter" || e.key === " ") {
+              e.preventDefault();
+              setActiveTabKey(key);
+            }
+          }}
+          {...pointerProps(key, false)}
+          className={tabClass(active, dragKey === key)}
+        >
+          <span aria-hidden="true" className="text-[var(--text-secondary)]">⌂</span>
+          <span className="truncate max-w-[160px]" title={`${project.name} — project home`}>
+            {project.name}
+          </span>
+          <ProjectStatusIndicator status={project.status} iconOnly />
+          <button
+            type="button"
+            onClick={(e) => {
+              e.stopPropagation();
+              closeHomeTab(projectId);
+            }}
+            aria-label={`Close ${project.name} home tab`}
+            title="Close tab"
+            className="w-6 h-6 flex items-center justify-center rounded-[var(--radius-control)] text-[var(--text-secondary)] hover:text-[var(--error)] hover:bg-[var(--bg-tertiary)] transition-colors"
+          >
+            <span aria-hidden="true">×</span>
+          </button>
+        </div>
+      );
+    }
+
+    const sessionId = tabKeyId(key);
+    const session = sessions.find((s) => s.id === sessionId);
+    if (!session) return null;
+    const project = projects.find((p) => p.id === session.projectId);
+    const customName = getCustomName(session.projectId, session.id);
+    const baseLabel =
+      (session.sessionName ?? session.projectName) +
+      (session.sessionType === "bash" ? " (bash)" : "");
+    const displayLabel = customName
+      ? `${session.projectName}: ${customName}`
+      : baseLabel;
+    const isRenaming = renamingId === session.id;
+    const badge = project ? MODE_BADGE[effectivePermissionMode(project)] : null;
+
+    return (
+      <div
+        role="tab"
+        aria-selected={active}
+        tabIndex={0}
+        data-tab-index={index}
+        onClick={() => activateTab(terminalTabKey(session.id))}
+        onKeyDown={(e) => {
+          if (e.key === "Enter" || e.key === " ") {
+            e.preventDefault();
+            setActiveTabKey(terminalTabKey(session.id));
+          }
+        }}
+        onContextMenu={(e) => {
+          e.preventDefault();
+          setMenu({ sessionId: session.id, x: e.clientX, y: e.clientY });
+        }}
+        onDoubleClick={() => startRename(session.id)}
+        {...pointerProps(key, isRenaming)}
+        className={tabClass(active, dragKey === key)}
+      >
+        <span aria-hidden="true" className="text-[var(--text-secondary)]">▣</span>
+        {isRenaming ? (
+          <input
+            ref={renameInputRef}
+            value={renameDraft}
+            aria-label="Rename tab"
+            onChange={(e) => setRenameDraft(e.target.value)}
+            onClick={(e) => e.stopPropagation()}
+            onBlur={() => commitRename(session.id)}
+            onKeyDown={(e) => {
+              if (e.key === "Enter") (e.target as HTMLInputElement).blur();
+              if (e.key === "Escape") setRenamingId(null);
+            }}
+            className="max-w-[180px] px-1 py-0 select-text bg-[var(--bg-primary)] border border-[var(--accent)] rounded-[var(--radius-control)] text-xs text-[var(--text-primary)]"
+          />
+        ) : (
+          <span className="truncate max-w-[180px]" title={displayLabel}>
+            {displayLabel}
+          </span>
+        )}
+        {badge && (
+          <span
+            className={`px-1 py-0.5 rounded-[4px] text-[10px] leading-none font-medium ${badge.className}`}
+            title={`Permission mode: ${badge.text}`}
+          >
+            {badge.text}
+          </span>
+        )}
+        <button
+          type="button"
+          onClick={(e) => {
+            e.stopPropagation();
+            close(session.id);
+          }}
+          aria-label={`Close ${displayLabel}`}
+          title="Close terminal"
+          className="w-6 h-6 flex items-center justify-center rounded-[var(--radius-control)] text-[var(--text-secondary)] hover:text-[var(--error)] hover:bg-[var(--bg-tertiary)] transition-colors"
+        >
+          <span aria-hidden="true">×</span>
+        </button>
+      </div>
+    );
+  };
+
+  // The marker goes before the first tab that is *actually on screen* at or
+  // past the drop slot. Addressing it by raw index would lose it whenever a
+  // `tabOrder` entry renders nothing — the window between a session ending and
+  // the store dropping its key — leaving the drag with no visible target.
+  let markerPending = dragKey !== null && dropIndex !== null;
 
   return (
-    <div className="flex items-center h-full" role="tablist" aria-label="Open tabs">
+    <div ref={stripRef} className="flex items-center h-full" role="tablist" aria-label="Open tabs">
-      {tabOrder.map((key) => {
+      {tabOrder.map((key, index) => {
-        const active = activeTabKey === key;
+        const tab = renderTab(key, index);
-
+        if (!tab) return null;
-        if (isHomeTab(key)) {
+        const marker = markerPending && index >= (dropIndex ?? 0);
-          const projectId = tabKeyId(key);
+        if (marker) markerPending = false;
-          const project = projects.find((p) => p.id === projectId);
-          if (!project) return null;
-          return (
-            <div
-              key={key}
-              role="tab"
-              aria-selected={active}
-              tabIndex={0}
-              onClick={() => setActiveTabKey(key)}
-              onKeyDown={(e) => {
-                if (e.key === "Enter" || e.key === " ") {
-                  e.preventDefault();
-                  setActiveTabKey(key);
-                }
-              }}
-              className={tabClass(active)}
-            >
-              <span aria-hidden="true" className="text-[var(--text-secondary)]">⌂</span>
-              <span className="truncate max-w-[160px]" title={`${project.name} — project home`}>
-                {project.name}
-              </span>
-              <ProjectStatusIndicator status={project.status} iconOnly />
-              <button
-                type="button"
-                onClick={(e) => {
-                  e.stopPropagation();
-                  closeHomeTab(projectId);
-                }}
-                aria-label={`Close ${project.name} home tab`}
-                title="Close tab"
-                className="w-6 h-6 flex items-center justify-center rounded-[var(--radius-control)] text-[var(--text-secondary)] hover:text-[var(--error)] hover:bg-[var(--bg-tertiary)] transition-colors"
-              >
-                <span aria-hidden="true">×</span>
-              </button>
-            </div>
-          );
-        }
-
-        const sessionId = tabKeyId(key);
-        const session = sessions.find((s) => s.id === sessionId);
-        if (!session) return null;
-        const project = projects.find((p) => p.id === session.projectId);
-        const customName = getCustomName(session.projectId, session.id);
-        const baseLabel =
-          (session.sessionName ?? session.projectName) +
-          (session.sessionType === "bash" ? " (bash)" : "");
-        const displayLabel = customName
-          ? `${session.projectName}: ${customName}`
-          : baseLabel;
-        const isRenaming = renamingId === session.id;
-        const badge = project ? MODE_BADGE[effectivePermissionMode(project)] : null;
-
         return (
-          <div
+          <Fragment key={key}>
-            key={key}
+            {marker && dropMarker}
-            role="tab"
+            {tab}
-            aria-selected={active}
+          </Fragment>
-            tabIndex={0}
-            onClick={() => setActiveTabKey(terminalTabKey(session.id))}
-            onKeyDown={(e) => {
-              if (e.key === "Enter" || e.key === " ") {
-                e.preventDefault();
-                setActiveTabKey(terminalTabKey(session.id));
-              }
-            }}
-            onContextMenu={(e) => {
-              e.preventDefault();
-              setMenu({ sessionId: session.id, x: e.clientX, y: e.clientY });
-            }}
-            onDoubleClick={() => startRename(session.id)}
-            className={tabClass(active)}
-          >
-            <span aria-hidden="true" className="text-[var(--text-secondary)]">▣</span>
-            {isRenaming ? (
-              <input
-                ref={renameInputRef}
-                value={renameDraft}
-                aria-label="Rename tab"
-                onChange={(e) => setRenameDraft(e.target.value)}
-                onClick={(e) => e.stopPropagation()}
-                onBlur={() => commitRename(session.id)}
-                onKeyDown={(e) => {
-                  if (e.key === "Enter") (e.target as HTMLInputElement).blur();
-                  if (e.key === "Escape") setRenamingId(null);
-                }}
-                className="max-w-[180px] px-1 py-0 bg-[var(--bg-primary)] border border-[var(--accent)] rounded-[var(--radius-control)] text-xs text-[var(--text-primary)]"
-              />
-            ) : (
-              <span className="truncate max-w-[180px]" title={displayLabel}>
-                {displayLabel}
-              </span>
-            )}
-            {badge && (
-              <span
-                className={`px-1 py-0.5 rounded-[4px] text-[10px] leading-none font-medium ${badge.className}`}
-                title={`Permission mode: ${badge.text}`}
-              >
-                {badge.text}
-              </span>
-            )}
-            <button
-              type="button"
-              onClick={(e) => {
-                e.stopPropagation();
-                close(session.id);
-              }}
-              aria-label={`Close ${displayLabel}`}
-              title="Close terminal"
-              className="w-6 h-6 flex items-center justify-center rounded-[var(--radius-control)] text-[var(--text-secondary)] hover:text-[var(--error)] hover:bg-[var(--bg-tertiary)] transition-colors"
-            >
-              <span aria-hidden="true">×</span>
-            </button>
-          </div>
         );
       })}
 
+      {/* The empty run after the last tab is a drop target too — it is where
+          the hand naturally goes to say "put it at the end". */}
+      <div className="flex-1 self-stretch">{markerPending && dropMarker}</div>
+
+      {ghost && (
+        // A copy of the tab, following the pointer. Without it the only
+        // feedback is a dimmed source and a thin line, which reads as "some
+        // setting changed" rather than "I am holding this tab".
+        <div
+          aria-hidden="true"
+          data-testid="tab-drag-ghost"
+          className="fixed z-50 flex items-center gap-1.5 px-3 h-8 text-xs rounded-[var(--radius-control)] bg-[var(--bg-primary)] text-[var(--text-primary)] border border-[var(--accent)] pointer-events-none select-none"
+          style={{
+            left: ghost.x,
+            top: ghost.y,
+            boxShadow: "var(--shadow-overlay)",
+            opacity: 0.9,
+          }}
+        >
+          <span className="text-[var(--text-secondary)]">{ghost.icon}</span>
+          <span className="truncate max-w-[180px]">{ghost.label}</span>
+        </div>
+      )}
+
       {menu && (() => {
         const session = sessions.find((s) => s.id === menu.sessionId);
         const hasCustom = session

app/src/components/projects/EnvVarsEditor.tsx

@@ -43,26 +43,36 @@ export default function EnvVarsEditor({
         </p>
       )}
 
+      {/* The row's widths live on wrapper divs, not on the inputs. `inputClass`
+          carries `w-full`, and a width utility on the input itself does not beat
+          it — class-attribute order is not what resolves the conflict, stylesheet
+          order is. Sizing the key input directly left it asking for the whole row
+          and collapsed the value input, whose `flex-1` basis of 0 gave it only the
+          leftover space, to an unusable sliver. */}
       {vars.map((ev, i) => (
         <div key={i} className="flex gap-2 items-center">
-          <input
+          <div className="w-2/5 shrink-0">
-            value={ev.key}
+            <input
-            onChange={(e) => updateVar(i, "key", e.target.value)}
+              value={ev.key}
-            onBlur={() => onSave(vars)}
+              onChange={(e) => updateVar(i, "key", e.target.value)}
-            placeholder="KEY"
+              onBlur={() => onSave(vars)}
-            aria-label={`Environment variable ${i + 1} name`}
+              placeholder="KEY"
-            disabled={disabled}
+              aria-label={`Environment variable ${i + 1} name`}
-            className={`w-2/5 ${monoInputClass}`}
+              disabled={disabled}
-          />
+              className={monoInputClass}
-          <input
+            />
-            value={ev.value}
+          </div>
-            onChange={(e) => updateVar(i, "value", e.target.value)}
+          <div className="flex-1 min-w-0">
-            onBlur={() => onSave(vars)}
+            <input
-            placeholder="value"
+              value={ev.value}
-            aria-label={`Environment variable ${i + 1} value`}
+              onChange={(e) => updateVar(i, "value", e.target.value)}
-            disabled={disabled}
+              onBlur={() => onSave(vars)}
-            className={`flex-1 ${monoInputClass}`}
+              placeholder="value"
-          />
+              aria-label={`Environment variable ${i + 1} value`}
+              disabled={disabled}
+              className={monoInputClass}
+            />
+          </div>
           <Button
             variant="danger"
             disabled={disabled}

app/src/components/projects/home/AutomationTab.test.tsx

@@ -0,0 +1,112 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { render, screen, fireEvent, act } from "@testing-library/react";
+import AutomationTab from "./AutomationTab";
+import type { Project, ScheduledTask } from "../../../lib/types";
+
+const listScheduledTasks = vi.fn(async () => tasks);
+const getSchedulerNotifications = vi.fn(async () => []);
+const runScheduledTaskNow = vi.fn(async () => "started");
+const pushToast = vi.fn();
+
+vi.mock("../../../lib/tauri-commands", () => ({
+  listScheduledTasks: () => listScheduledTasks(),
+  getSchedulerNotifications: () => getSchedulerNotifications(),
+  runScheduledTaskNow: (p: string, t: string) => runScheduledTaskNow(p, t),
+  clearSchedulerNotifications: vi.fn(async () => {}),
+  getScheduledTaskLog: vi.fn(async () => ""),
+  removeScheduledTask: vi.fn(async () => {}),
+  setScheduledTaskEnabled: vi.fn(async () => {}),
+}));
+
+vi.mock("../../../store/appState", () => ({
+  useAppState: (selector: (s: unknown) => unknown) => selector({ pushToast }),
+}));
+
+const project = { id: "p1", name: "api", status: "running" } as unknown as Project;
+
+const baseTask: ScheduledTask = {
+  id: "a1b2c3d4",
+  name: "nightly",
+  prompt: "Run the suite",
+  schedule: "0 3 * * *",
+  task_type: "recurring",
+  at: null,
+  enabled: true,
+  working_dir: "/workspace",
+  created_at: null,
+  last_run: null,
+  next_run: null,
+  running: false,
+  running_since: null,
+};
+
+let tasks: ScheduledTask[] = [];
+
+async function renderTab() {
+  render(<AutomationTab project={project} />);
+  await act(async () => {
+    await Promise.resolve();
+  });
+}
+
+beforeEach(() => {
+  vi.useFakeTimers({ shouldAdvanceTime: true });
+  tasks = [baseTask];
+  listScheduledTasks.mockClear();
+  runScheduledTaskNow.mockClear();
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe("AutomationTab run state", () => {
+  it("offers Run now for an idle task and says nothing about running", async () => {
+    await renderTab();
+    expect(screen.getByRole("button", { name: "Run now" })).toBeEnabled();
+    expect(screen.queryByText(/Running/)).toBeNull();
+  });
+
+  it("shows a running task as running, with elapsed time, and blocks a second trigger", async () => {
+    const startedSecondsAgo = new Date(Date.now() - 90_000).toISOString();
+    tasks = [{ ...baseTask, running: true, running_since: startedSecondsAgo }];
+    await renderTab();
+
+    // The whole point: a detached run is visible rather than silent.
+    expect(screen.getByText(/Running for 1m/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Running…" })).toBeDisabled();
+  });
+
+  it("keeps polling after a trigger, so a run that has not registered yet still appears", async () => {
+    await renderTab();
+    const callsAfterLoad = listScheduledTasks.mock.calls.length;
+
+    // The runner needs a moment to write its state file; until then the task
+    // still reads as idle, which is exactly the window that used to look dead.
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: "Run now" }));
+      await Promise.resolve();
+    });
+    expect(runScheduledTaskNow).toHaveBeenCalledWith("p1", "a1b2c3d4");
+
+    tasks = [{ ...baseTask, running: true, running_since: new Date().toISOString() }];
+    await act(async () => {
+      vi.advanceTimersByTime(2000);
+      await Promise.resolve();
+    });
+
+    expect(listScheduledTasks.mock.calls.length).toBeGreaterThan(callsAfterLoad);
+    expect(screen.getByRole("button", { name: "Running…" })).toBeDisabled();
+  });
+
+  it("stops polling once nothing is running", async () => {
+    await renderTab();
+    // No trigger, nothing running: the interval must not be armed at all.
+    const before = listScheduledTasks.mock.calls.length;
+    await act(async () => {
+      vi.advanceTimersByTime(30_000);
+      await Promise.resolve();
+    });
+    expect(listScheduledTasks.mock.calls.length).toBe(before);
+  });
+});

app/src/components/projects/home/AutomationTab.tsx

@@ -15,7 +15,7 @@ import Toggle from "../../ui/Toggle";
 import Modal from "../../ui/Modal";
 import StatusIndicator from "../../ui/StatusIndicator";
 import TaskEditorModal from "./TaskEditorModal";
-import { formatAge } from "./format";
+import { formatAge, formatRunningFor } from "./format";
 
 interface Props {
   project: Project;
@@ -59,6 +59,22 @@ export default function AutomationTab({ project }: Props) {
 
   useEffect(load, [load]);
 
+  // A task in flight is the one state this view cannot sit still for: runs are
+  // detached, so without polling "Run now" looks like it did nothing until the
+  // user reaches for Refresh. Polling stops as soon as nothing is running.
+  //
+  // `justTriggered` covers the gap between firing a run and the runner writing
+  // its state file — a second or two in which the task still reads as idle, and
+  // where giving up on polling would reproduce the exact silence this fixes.
+  const anyTaskRunning = tasks.some((t) => t.running);
+  const [justTriggered, setJustTriggered] = useState(0);
+  useEffect(() => {
+    if (!running) return;
+    if (!anyTaskRunning && Date.now() - justTriggered > 20_000) return;
+    const timer = setInterval(load, anyTaskRunning ? 5000 : 1500);
+    return () => clearInterval(timer);
+  }, [running, anyTaskRunning, justTriggered, load]);
+
   const withTask = async (taskId: string, label: string, fn: () => Promise<unknown>) => {
     setBusyTaskId(taskId);
     try {
@@ -185,6 +201,12 @@ export default function AutomationTab({ project }: Props) {
                     <span className="text-[10px] uppercase tracking-wide px-1.5 py-0.5 rounded-[var(--radius-control)] bg-[var(--bg-tertiary)] text-[var(--text-secondary)]">
                       {task.task_type}
                     </span>
+                    {task.running && (
+                      <StatusIndicator
+                        tone="busy"
+                        label={`Running ${formatRunningFor(task.running_since) ?? ""}`.trim()}
+                      />
+                    )}
                   </div>
                   <div className="text-xs text-[var(--text-secondary)] font-mono truncate">
                     {task.at ?? task.schedule}
@@ -202,14 +224,15 @@ export default function AutomationTab({ project }: Props) {
                   }
                 />
                 <Button
-                  disabled={busyTaskId === task.id}
+                  disabled={busyTaskId === task.id || task.running}
                   onClick={() =>
-                    withTask(task.id, "Run now", () =>
+                    withTask(task.id, "Run now", async () => {
-                      runScheduledTaskNow(project.id, task.id),
+                      await runScheduledTaskNow(project.id, task.id);
-                    )
+                      setJustTriggered(Date.now());
+                    })
                   }
                 >
-                  Run now
+                  {task.running ? "Running…" : "Run now"}
                 </Button>
                 <Button disabled={busyTaskId === task.id} onClick={() => setEditing(task)}>
                   Edit

app/src/components/projects/home/BrowserTab.test.tsx

@@ -13,6 +13,15 @@ const setBrowserViewEnabled = vi.fn<() => Promise<BrowserViewStatus>>();
 const checkBrowserViewSupport = vi.fn<() => Promise<PlaywrightDetection>>();
 const installBrowserViewSupport = vi.fn<() => Promise<BrowserSetupOutcome>>();
 const installBrowserViewBrowser = vi.fn<(id: string, b: string) => Promise<BrowserSetupOutcome>>();
+const openBrowserViewPopout = vi.fn<(id: string, onTop: boolean) => Promise<void>>();
+const closeBrowserViewPopout = vi.fn<(id: string) => Promise<void>>();
+const getBrowserViewPopoutState =
+  vi.fn<() => Promise<{ open: boolean; always_on_top: boolean }>>();
+const setBrowserViewPopoutAlwaysOnTop = vi.fn<(id: string, onTop: boolean) => Promise<void>>();
+const openPageInContainerBrowser =
+  vi.fn<(id: string, url: string, w: number, h: number) => Promise<{ error: string | null }>>();
+const setBrowserViewMatchWindow = vi.fn<(id: string, on: boolean) => Promise<void>>();
+const getBrowserViewMatchWindow = vi.fn<() => Promise<boolean>>();
 const pushToast = vi.fn();
 const setContainerProgress = vi.fn();
 
@@ -22,6 +31,15 @@ vi.mock("../../../lib/tauri-commands", () => ({
   checkBrowserViewSupport: () => checkBrowserViewSupport(),
   installBrowserViewSupport: () => installBrowserViewSupport(),
   installBrowserViewBrowser: (id: string, b: string) => installBrowserViewBrowser(id, b),
+  openBrowserViewPopout: (id: string, onTop: boolean) => openBrowserViewPopout(id, onTop),
+  closeBrowserViewPopout: (id: string) => closeBrowserViewPopout(id),
+  getBrowserViewPopoutState: () => getBrowserViewPopoutState(),
+  setBrowserViewPopoutAlwaysOnTop: (id: string, onTop: boolean) =>
+    setBrowserViewPopoutAlwaysOnTop(id, onTop),
+  openPageInContainerBrowser: (id: string, url: string, w: number, h: number) =>
+    openPageInContainerBrowser(id, url, w, h),
+  setBrowserViewMatchWindow: (id: string, on: boolean) => setBrowserViewMatchWindow(id, on),
+  getBrowserViewMatchWindow: () => getBrowserViewMatchWindow(),
 }));
 
 vi.mock("@tauri-apps/api/event", () => ({
@@ -59,6 +77,11 @@ const NOTHING: PlaywrightDetection = {
   cli_entry: null,
   browsers: [],
   chrome_channel: null,
+  chromium_executable: null,
+  chromium_executable_exists: false,
+  script_playwright_version: null,
+  script_chromium_executable: null,
+  script_chromium_executable_exists: false,
   searched: [
     "/workspace",
     "/usr/lib/node_modules",
@@ -111,8 +134,37 @@ beforeEach(() => {
   storeState.containerProgress = {};
   getBrowserViewStatus.mockResolvedValue(OFF);
   checkBrowserViewSupport.mockResolvedValue(READY);
+  getBrowserViewPopoutState.mockResolvedValue({ open: false, always_on_top: false });
+  openBrowserViewPopout.mockResolvedValue(undefined);
+  closeBrowserViewPopout.mockResolvedValue(undefined);
+  setBrowserViewPopoutAlwaysOnTop.mockResolvedValue(undefined);
+  setBrowserViewMatchWindow.mockResolvedValue(undefined);
+  getBrowserViewMatchWindow.mockResolvedValue(false);
+  openPageInContainerBrowser.mockResolvedValue({ error: null });
 });
 
+const LIVE: BrowserViewStatus = {
+  ...OFF,
+  enabled: true,
+  state: "running",
+  url: "http://127.0.0.1:47820/index.html?ws=abc&token=SEKRIT",
+  host_port: 47820,
+  container_port: 39321,
+  started_at: "2026-08-09T10:00:00Z",
+};
+
+/** Render with the view already live, which is the only state that pops out. */
+async function renderLive() {
+  checkBrowserViewSupport.mockResolvedValue({ ...READY, browsers: ["chromium-1200"] });
+  setBrowserViewEnabled.mockResolvedValue(LIVE);
+  render(<BrowserTab project={project} active />);
+  await waitFor(() => expect(getBrowserViewStatus).toHaveBeenCalled());
+  await act(async () => {
+    fireEvent.click(screen.getByRole("button", { name: /start browser view/i }));
+  });
+  await screen.findByTitle("Playwright browser view for api-server");
+}
+
 describe("BrowserTab", () => {
   it("does not offer to start anything while the container is stopped", async () => {
     render(<BrowserTab project={{ ...project, status: "stopped" }} active />);
@@ -325,4 +377,198 @@ describe("BrowserTab", () => {
     expect(await screen.findByText("Off")).toBeInTheDocument();
     expect(screen.queryByTitle(/browser view for/i)).toBeNull();
   });
+
+  it("names both halves when the installed browser isn\u2019t the one Playwright launches", async () => {
+    // The cache is full and every script fails \u2014 "install a browser" alone
+    // would read as nonsense, so the copy has to say which copy wants what.
+    checkBrowserViewSupport.mockResolvedValue({
+      ...READY,
+      browsers: ["chromium-1237"],
+      chromium_executable: "/home/claude/.cache/ms-playwright/chromium-1237/chrome-linux64/chrome",
+      chromium_executable_exists: true,
+      script_playwright_version: "1.62.1",
+      script_chromium_executable:
+        "/home/claude/.cache/ms-playwright/chromium-1234/chrome-linux64/chrome",
+      script_chromium_executable_exists: false,
+    });
+
+    render(<BrowserTab project={project} active />);
+
+    expect(await screen.findByText(/isn\u2019t the one Playwright launches/i)).toBeInTheDocument();
+    // Both revisions appear in the explanation: what is installed, and what
+    // the failing copy actually wants.
+    expect(screen.getAllByText(/chromium-1237/).length).toBeGreaterThan(0);
+    expect(screen.getAllByText(/chromium-1234/).length).toBeGreaterThan(0);
+    expect(screen.getAllByText(/Set up Playwright/).length).toBeGreaterThan(0);
+  });
+
+  it("does not call an unanswered probe a skew", async () => {
+    // A container older than these fields omits them; unknown is not broken.
+    checkBrowserViewSupport.mockResolvedValue({ ...READY, browsers: ["chromium-1200"] });
+    getBrowserViewStatus.mockResolvedValue(LIVE);
+
+    render(<BrowserTab project={project} active />);
+
+    expect(await screen.findByTitle("Playwright browser view for api-server")).toBeInTheDocument();
+    expect(screen.queryByText(/isn\u2019t the one Playwright launches/i)).toBeNull();
+  });
+
+  it("only offers a window of its own once there is something to watch", async () => {
+    checkBrowserViewSupport.mockResolvedValue({ ...READY, browsers: ["chromium-1200"] });
+    render(<BrowserTab project={project} active />);
+    await waitFor(() => expect(getBrowserViewStatus).toHaveBeenCalled());
+    expect(screen.queryByRole("button", { name: /own window/i })).toBeNull();
+  });
+
+  it("pops the live view out, and drops the iframe so only one viewer drives", async () => {
+    await renderLive();
+
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /own window/i }));
+    });
+
+    expect(openBrowserViewPopout).toHaveBeenCalledWith("p1", false);
+    // The window is showing it now — a second copy here would be a second
+    // cursor on the same page.
+    expect(screen.queryByTitle(/browser view for/i)).toBeNull();
+    expect(await screen.findByText(/in its own window/i)).toBeInTheDocument();
+    // Still live, and still stoppable from the tab.
+    expect(screen.getByText("Live")).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "Stop" })).toBeInTheDocument();
+  });
+
+  it("puts the view back in the tab when the window is closed from here", async () => {
+    await renderLive();
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /own window/i }));
+    });
+
+    await act(async () => {
+      fireEvent.click(screen.getAllByRole("button", { name: /put back in tab/i })[0]);
+    });
+
+    expect(closeBrowserViewPopout).toHaveBeenCalledWith("p1");
+    expect(await screen.findByTitle("Playwright browser view for api-server")).toBeInTheDocument();
+  });
+
+  it("pins the window on top on request", async () => {
+    await renderLive();
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /own window/i }));
+    });
+
+    await act(async () => {
+      // The accessible name is the visible text, as with every other Toggle.
+      fireEvent.click(screen.getByRole("switch", { name: "Keep on top" }));
+    });
+
+    expect(setBrowserViewPopoutAlwaysOnTop).toHaveBeenCalledWith("p1", true);
+  });
+
+  it("keeps a pop-out that outlived the tab, rather than showing an empty pane", async () => {
+    // The window belongs to the backend, so remounting the pane has to read its
+    // state back — otherwise the pane would render an iframe alongside it.
+    getBrowserViewPopoutState.mockResolvedValue({ open: true, always_on_top: true });
+    checkBrowserViewSupport.mockResolvedValue({ ...READY, browsers: ["chromium-1200"] });
+    getBrowserViewStatus.mockResolvedValue(LIVE);
+
+    render(<BrowserTab project={project} active />);
+
+    expect(await screen.findByText(/in its own window/i)).toBeInTheDocument();
+    expect(screen.queryByTitle(/browser view for/i)).toBeNull();
+    // The pin is read from the window too — the pane is unmounted every time
+    // another sub-tab is selected, so remembering it would show Off over a
+    // window that is still floating on top.
+    expect(screen.getByRole("switch", { name: "Keep on top" })).toBeChecked();
+  });
+
+  it("never mounts the iframe before the window's state is known", async () => {
+    // The status and the pop-out state are two separate round trips. If the
+    // status wins the race, guessing "not popped out" would flash a second
+    // viewer onto a browser the window is already driving.
+    checkBrowserViewSupport.mockResolvedValue({ ...READY, browsers: ["chromium-1200"] });
+    getBrowserViewStatus.mockResolvedValue(LIVE);
+    let answer: (s: { open: boolean; always_on_top: boolean }) => void = () => {};
+    getBrowserViewPopoutState.mockReturnValue(
+      new Promise((resolve) => {
+        answer = resolve;
+      }),
+    );
+
+    render(<BrowserTab project={project} active />);
+    await waitFor(() => expect(screen.getByText("Live")).toBeInTheDocument());
+    expect(screen.queryByTitle(/browser view for/i)).toBeNull();
+
+    await act(async () => {
+      answer({ open: false, always_on_top: false });
+    });
+    expect(await screen.findByTitle("Playwright browser view for api-server")).toBeInTheDocument();
+  });
+
+  it("opens a page in the container’s browser at the chosen viewport", async () => {
+    await renderLive();
+
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /open a page/i }));
+    });
+    fireEvent.change(screen.getByLabelText(/^URL$/i), {
+      target: { value: "http://localhost:5173" },
+    });
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: "1920 × 1080" }));
+    });
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /open page/i }));
+    });
+
+    expect(openPageInContainerBrowser).toHaveBeenCalledWith(
+      "p1",
+      "http://localhost:5173",
+      1920,
+      1080,
+    );
+  });
+
+  it("refuses a URL scheme the backend would reject, before the round trip", async () => {
+    await renderLive();
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /open a page/i }));
+    });
+    fireEvent.change(screen.getByLabelText(/^URL$/i), {
+      target: { value: "file:///etc/passwd" },
+    });
+
+    expect(screen.getByRole("button", { name: /open page/i })).toBeDisabled();
+    expect(screen.getByText(/Only http:\/\/ and https:\/\//)).toBeInTheDocument();
+    expect(openPageInContainerBrowser).not.toHaveBeenCalled();
+  });
+
+  it("offers match-window only once the view is in its own window", async () => {
+    await renderLive();
+    expect(screen.queryByRole("switch", { name: "Match window" })).toBeNull();
+
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /own window/i }));
+    });
+    await act(async () => {
+      fireEvent.click(screen.getByRole("switch", { name: "Match window" }));
+    });
+
+    expect(setBrowserViewMatchWindow).toHaveBeenCalledWith("p1", true);
+  });
+
+  it("says why the window wouldn’t open instead of pretending it did", async () => {
+    await renderLive();
+    openBrowserViewPopout.mockRejectedValue("no display");
+
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /own window/i }));
+    });
+
+    expect(pushToast).toHaveBeenCalledWith(
+      expect.objectContaining({ kind: "error", detail: "no display" }),
+    );
+    // The view is still in the tab, where it was.
+    expect(screen.getByTitle("Playwright browser view for api-server")).toBeInTheDocument();
+  });
 });

app/src/components/projects/home/BrowserTab.tsx

@@ -4,21 +4,31 @@ import type {
   BrowserInstallTarget,
   BrowserSetupOutcome,
   BrowserViewChangedEvent,
+  BrowserViewPopoutChangedEvent,
   BrowserViewStatus,
   PlaywrightDetection,
   Project,
 } from "../../../lib/types";
 import {
   checkBrowserViewSupport,
+  closeBrowserViewPopout,
   getBrowserViewStatus,
   installBrowserViewBrowser,
   installBrowserViewSupport,
+  getBrowserViewMatchWindow,
+  getBrowserViewPopoutState,
+  openBrowserViewPopout,
+  openPageInContainerBrowser,
   setBrowserViewEnabled,
+  setBrowserViewMatchWindow,
+  setBrowserViewPopoutAlwaysOnTop,
 } from "../../../lib/tauri-commands";
 import { useAppState } from "../../../store/appState";
+import OpenPageDialog from "./OpenPageDialog";
 import AccordionSection from "../../ui/AccordionSection";
 import Button from "../../ui/Button";
 import StatusIndicator from "../../ui/StatusIndicator";
+import Toggle from "../../ui/Toggle";
 
 interface Props {
   project: Project;
@@ -66,6 +76,18 @@ export default function BrowserTab({ project, active }: Props) {
   const [job, setJob] = useState<SetupJob>(null);
   const [outcome, setOutcome] = useState<BrowserSetupOutcome | null>(null);
   const [setupError, setSetupError] = useState<string | null>(null);
+  /**
+   * Whether the view is in its own window instead of this pane, and whether
+   * that window is pinned. `null` means "not asked yet" — a distinct state from
+   * "not popped out", because rendering the iframe on a guess is what puts a
+   * second viewer on the browser.
+   */
+  const [poppedOut, setPoppedOut] = useState<boolean | null>(null);
+  const [onTop, setOnTop] = useState(false);
+  /** The "open a page" dialog, and the request it is running. */
+  const [matchWindow, setMatchWindow] = useState(false);
+  const [askPage, setAskPage] = useState(false);
+  const [openingPage, setOpeningPage] = useState(false);
   const pushToast = useAppState((s) => s.pushToast);
   const setContainerProgress = useAppState((s) => s.setContainerProgress);
   const progress = useAppState((s) => s.containerProgress[project.id]);
@@ -95,8 +117,37 @@ export default function BrowserTab({ project, active }: Props) {
     return () => dispose?.();
   }, [projectId]);
 
+  // The window is the backend's, not this component's: it survives the tab
+  // being closed, the pane being unmounted and the view being torn down from
+  // elsewhere. So its state is listened for, never assumed.
+  useEffect(() => {
+    let dispose: (() => void) | undefined;
+    listen<BrowserViewPopoutChangedEvent>("browser-view-popout-changed", (event) => {
+      if (event.payload.project_id === projectId && mounted.current) {
+        setPoppedOut(event.payload.open);
+        setOnTop(event.payload.always_on_top);
+      }
+    }).then((un) => {
+      if (mounted.current) dispose = un;
+      else un();
+    });
+    return () => dispose?.();
+  }, [projectId]);
+
   useEffect(() => {
     if (!active || !running) return;
+    getBrowserViewPopoutState(projectId)
+      .then((s) => {
+        if (!mounted.current) return;
+        setPoppedOut(s.open);
+        setOnTop(s.always_on_top);
+      })
+      // Unreachable in practice, but a pane stuck at "not asked yet" would
+      // never show the view at all — so fail towards the tab.
+      .catch(() => mounted.current && setPoppedOut(false));
+    getBrowserViewMatchWindow(projectId)
+      .then((on) => mounted.current && setMatchWindow(on))
+      .catch(() => {});
     getBrowserViewStatus(projectId)
       .then((s) => mounted.current && setStatus(s))
       .catch(() => {});
@@ -129,6 +180,105 @@ export default function BrowserTab({ project, active }: Props) {
     [projectId, pushToast],
   );
 
+  /**
+   * Pop the view out, or pull it back.
+   *
+   * Both are window operations only — the viewer keeps running either way — so
+   * this is cheap enough to toggle freely and never interrupts what the agent
+   * is doing in the browser.
+   */
+  const popOut = useCallback(async () => {
+    try {
+      await openBrowserViewPopout(projectId, onTop);
+      if (mounted.current) setPoppedOut(true);
+    } catch (e) {
+      pushToast({
+        kind: "error",
+        message: "Could not open the browser in its own window",
+        detail: String(e),
+      });
+    }
+  }, [projectId, onTop, pushToast]);
+
+  const popIn = useCallback(async () => {
+    try {
+      await closeBrowserViewPopout(projectId);
+      if (mounted.current) setPoppedOut(false);
+    } catch (e) {
+      pushToast({
+        kind: "error",
+        message: "Could not close the browser window",
+        detail: String(e),
+      });
+    }
+  }, [projectId, pushToast]);
+
+  const toggleOnTop = useCallback(
+    async (next: boolean) => {
+      setOnTop(next);
+      try {
+        await setBrowserViewPopoutAlwaysOnTop(projectId, next);
+      } catch (e) {
+        if (mounted.current) setOnTop(!next);
+        pushToast({
+          kind: "error",
+          message: "Could not change the window's stacking",
+          detail: String(e),
+        });
+      }
+    },
+    [projectId, pushToast],
+  );
+
+  /**
+   * Open a URL in a browser inside the container.
+   *
+   * The pane only ever *watched* browsers something else published; this is the
+   * one action that opens one. It also means the page can be resized later —
+   * whoever launches a bound browser is the only process that can drive it.
+   */
+  const openPage = useCallback(
+    async (url: string, width: number, height: number) => {
+      setOpeningPage(true);
+      try {
+        const result = await openPageInContainerBrowser(projectId, url, width, height);
+        if (!mounted.current) return;
+        setAskPage(false);
+        if (result.error) {
+          pushToast({ kind: "error", message: "The page didn’t open", detail: result.error });
+        } else {
+          pushToast({ kind: "success", message: `Opened ${url} at ${width}×${height}` });
+        }
+      } catch (e) {
+        pushToast({
+          kind: "error",
+          message: "Could not open the page in the container’s browser",
+          detail: String(e),
+        });
+      } finally {
+        if (mounted.current) setOpeningPage(false);
+      }
+    },
+    [projectId, pushToast],
+  );
+
+  const toggleMatchWindow = useCallback(
+    async (next: boolean) => {
+      setMatchWindow(next);
+      try {
+        await setBrowserViewMatchWindow(projectId, next);
+      } catch (e) {
+        if (mounted.current) setMatchWindow(!next);
+        pushToast({
+          kind: "error",
+          message: "Could not match the page to the window",
+          detail: String(e),
+        });
+      }
+    },
+    [projectId, pushToast],
+  );
+
   /** Run one install. Every path clears the progress line it started. */
   const install = useCallback(
     async (which: Exclude<SetupJob, null>) => {
@@ -193,7 +343,9 @@ export default function BrowserTab({ project, active }: Props) {
   // apt package, so it never shows up in `browsers`, and a container that has
   // it is not missing a browser.
   const needsBrowser =
-    probed !== null && probed.browsers.length === 0 && probed.chrome_channel === null;
+    probed !== null &&
+    probed.chrome_channel === null &&
+    (probed.browsers.length === 0 || revisionSkew(probed));
   const needsSetup = probed !== null && (!ready || needsBrowser);
 
   return (
@@ -225,11 +377,48 @@ export default function BrowserTab({ project, active }: Props) {
           </span>
         )}
         <div className="flex-1" />
-        {live && (
+        {progress && (
+          <span
+            className="flex items-center gap-1.5 text-xs text-[var(--text-secondary)] min-w-0"
+            aria-live="polite"
+          >
+            <StatusIndicator tone="busy" label="" />
+            <span className="truncate">{progress}</span>
+          </span>
+        )}
+        {live && poppedOut === true && (
+          <span className="flex items-center gap-1.5 text-xs text-[var(--text-secondary)]">
+            Keep on top
+            {/* The accessible name matches the visible text, as everywhere else
+                a Toggle is used — a `<label>` around it would be inert anyway,
+                since a Toggle renders a button. */}
+            <Toggle checked={onTop} onChange={toggleOnTop} label="Keep on top" />
+          </span>
+        )}
+        {live && poppedOut === true && (
+          <span
+            className="flex items-center gap-1.5 text-xs text-[var(--text-secondary)]"
+            title="Resize the page itself as the window is dragged, so the layout actually reflows. Applies to pages opened from here."
+          >
+            Match window
+            <Toggle checked={matchWindow} onChange={toggleMatchWindow} label="Match window" />
+          </span>
+        )}
+        {live && poppedOut === false && (
           <Button size="md" onClick={() => setReloadKey((k) => k + 1)}>
             Reload
           </Button>
         )}
+        {live && (
+          <Button size="md" onClick={() => setAskPage(true)}>
+            Open a page…
+          </Button>
+        )}
+        {live && poppedOut !== null && (
+          <Button size="md" onClick={poppedOut ? popIn : popOut}>
+            {poppedOut ? "Put back in tab" : "Open in own window"}
+          </Button>
+        )}
         <Button
           size="md"
           variant={live ? "secondary" : "primary"}
@@ -240,7 +429,28 @@ export default function BrowserTab({ project, active }: Props) {
         </Button>
       </div>
 
-      {live ? (
+      {live && poppedOut === true ? (
+        // The iframe is unmounted while the window is up, on purpose. Two
+        // viewers on one browser both work, but both also *drive* it — two
+        // cursors taking over the same page is not a feature.
+        <div className="flex-1 min-h-0 flex items-center justify-center p-6">
+          <div className="max-w-[28rem] text-center">
+            <h2 className="text-[13px] font-semibold text-[var(--text-primary)]">
+              This view is in its own window.
+            </h2>
+            <p className="mt-1 text-[13px] text-[var(--text-secondary)] leading-relaxed">
+              Move it to another screen, or keep it on top, and watch the browser while
+              you work here. The view keeps running either way — closing the window
+              brings it back into this tab.
+            </p>
+            <div className="mt-3 flex items-center justify-center gap-2">
+              <Button size="md" variant="primary" onClick={popIn}>
+                Put back in tab
+              </Button>
+            </div>
+          </div>
+        </div>
+      ) : live && poppedOut === false ? (
         <iframe
           key={reloadKey}
           // Loopback only, and the URL carries the one-time session token the
@@ -249,6 +459,11 @@ export default function BrowserTab({ project, active }: Props) {
           title={`Playwright browser view for ${project.name}`}
           className="flex-1 min-h-0 w-full border-0 bg-[var(--bg-primary)]"
         />
+      ) : live ? (
+        // Live, but the window's state hasn't come back yet. An instant, and
+        // deliberately empty: guessing "not popped out" here is what would
+        // flash a second viewer onto the browser.
+        <div className="flex-1 min-h-0" />
       ) : (
         <div className="flex-1 min-h-0 overflow-y-auto">
           {/* Setup stays on screen while an install is running and after it
@@ -283,6 +498,14 @@ export default function BrowserTab({ project, active }: Props) {
           )}
         </div>
       )}
+
+      {askPage && (
+        <OpenPageDialog
+          busy={openingPage}
+          onOpen={openPage}
+          onClose={() => setAskPage(false)}
+        />
+      )}
     </div>
   );
 }
@@ -292,6 +515,47 @@ function isUsable(d: PlaywrightDetection | null): boolean {
   return d !== null && d.playwright_version !== null && d.has_bind && d.cli_entry !== null;
 }
 
+/**
+ * Mirrors Rust `PlaywrightDetection::revision_skew`.
+ *
+ * Browsers are installed, but not the revision one of the two Playwright copies
+ * would launch — so the cache looks full and launches fail. A probe that didn't
+ * answer leaves the executable null, and "unknown" must not read as "broken".
+ */
+function revisionSkew(d: PlaywrightDetection | null): boolean {
+  if (!d || d.browsers.length === 0) return false;
+  // `!= null`, not `!== null`: a probe from a container that predates these
+  // fields omits them entirely, and `undefined` is "didn't answer" — which must
+  // never render as "your browsers are wrong".
+  const viewerBroken = d.chromium_executable != null && !d.chromium_executable_exists;
+  const scriptsBroken =
+    d.script_chromium_executable != null && !d.script_chromium_executable_exists;
+  return viewerBroken || scriptsBroken;
+}
+
+/**
+ * The skew sentence, naming both halves.
+ *
+ * "Install a browser" over a cache that visibly already holds one reads as
+ * nonsense, so the copy has to say which copy of Playwright wants what.
+ */
+function skewText(d: PlaywrightDetection | null): string {
+  if (!d) return "";
+  const scriptsBroken =
+    d.script_chromium_executable !== null && !d.script_chromium_executable_exists;
+  const [version, wanted] = scriptsBroken
+    ? [d.script_playwright_version, d.script_chromium_executable]
+    : [d.playwright_version, d.chromium_executable];
+  return (
+    `This container has ${d.browsers.join(", ")}, but ` +
+    `${scriptsBroken ? 'the Playwright a script gets from require("playwright")' : "the Playwright serving the viewer"}` +
+    ` — ${version ?? "?"} — launches ${wanted ?? "?"}, which isn’t there. ` +
+    (scriptsBroken
+      ? "Two copies ended up in one tree, each pinning its own browser revision, so the viewer works and every script Claude writes fails. Re-run “Set up Playwright” to reinstall them as one consistent set."
+      : "Install Chromium below: it runs that build’s own installer, so it fetches exactly the revision that is missing.")
+  );
+}
+
 /** What the container is short of, as a list rather than as prose. */
 function missingParts(d: PlaywrightDetection | null): string[] {
   if (!d) return [];
@@ -339,6 +603,10 @@ function Setup({
   const browsers = detection?.browsers ?? [];
   const chrome = detection?.chrome_channel ?? null;
   const noBrowser = browsers.length === 0 && chrome === null;
+  // Installed browsers that cannot be launched. Handled apart from `noBrowser`
+  // because the fix is the same button but the sentence must not be "install a
+  // browser" over a cache that visibly has one.
+  const skew = revisionSkew(detection) && chrome === null;
 
   return (
     <div className="p-4 max-w-[46rem] space-y-4">
@@ -346,17 +614,21 @@ function Setup({
         <h2 className="text-[13px] font-semibold text-[var(--text-primary)]">
           {!havePackages
             ? "This container can’t serve a browser view yet"
-            : noBrowser
+            : skew
-              ? "Playwright is ready — but there’s no browser to drive yet"
+              ? "The installed browser isn’t the one Playwright launches"
-              : "This container is set up"}
+              : noBrowser
+                ? "Playwright is ready — but there’s no browser to drive yet"
+                : "This container is set up"}
         </h2>
         <p className="mt-1 text-[13px] text-[var(--text-secondary)] leading-relaxed">
           {message ??
             (missing.length > 0
               ? `Missing: ${missing.join(", ")}.`
-              : noBrowser
+              : skew
-                ? "Playwright and the viewer are installed. Install a browser below so there is something to watch."
+                ? skewText(detection)
-                : "Start the view from the button above once Claude has a browser open.")}
+                : noBrowser
+                  ? "Playwright and the viewer are installed. Install a browser below so there is something to watch."
+                  : "Start the view from the button above once Claude has a browser open.")}
         </p>
       </div>
 

app/src/components/projects/home/ContainerMigrationBanner.test.tsx

@@ -127,6 +127,46 @@ describe("ContainerMigrationBanner", () => {
     expect(container).toBeEmptyDOMElement();
   });
 
+  it("speaks up when an unlabelled container could not be probed at all", () => {
+    // The probe is the only signal a container with no lineage label has. If
+    // it fails and the banner stays silent, that is indistinguishable from
+    // "up to date" — the exact reading that let an out-of-date project go
+    // unnoticed indefinitely.
+    renderBanner(
+      migration({
+        staleness: {
+          ...FRESH,
+          known: false,
+          stale: false,
+          probe_error: "output exceeded the inspection limit",
+        },
+        probeSettled: false,
+      }),
+    );
+    expect(
+      screen.getByText(/Container base could not be checked/i),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(/output exceeded the inspection limit/i),
+    ).toBeInTheDocument();
+    // And it must not pose as a finding about the container itself.
+    expect(
+      screen.queryByText(/Container is missing things/i),
+    ).not.toBeInTheDocument();
+  });
+
+  it("stays quiet when a labelled container's probe fails but its lineage is current", () => {
+    // `known` means the version comparison already answered the question, so
+    // a failed probe is not grounds to raise anything.
+    const { container } = renderBanner(
+      migration({
+        staleness: { ...FRESH, probe_error: "could not exec in the container" },
+        probeSettled: false,
+      }),
+    );
+    expect(container).toBeEmptyDOMElement();
+  });
+
   it("disables the action and explains why while the container is running", () => {
     renderBanner(migration({ staleness: STALE }), false);
     expect(

app/src/components/projects/home/ContainerMigrationBanner.tsx

@@ -131,7 +131,15 @@ export default function ContainerMigrationBanner({
   const probeFoundGaps =
     !staleness.known &&
     (staleness.missing_features.length > 0 || staleness.missing_paths.length > 0);
-  if (!staleness.stale && !probeFoundGaps) return null;
+
+  // The probe is the *only* signal a container with no lineage label has, so
+  // when it fails there is nothing left to be quiet about. Staying silent here
+  // is indistinguishable from "everything is fine" — and it is the likeliest
+  // outcome for the oldest, largest projects, whose manifests are the ones apt
+  // to exceed the inspection limit. Say that the check did not run instead.
+  const probeUnavailable = !staleness.known && !!staleness.probe_error;
+
+  if (!staleness.stale && !probeFoundGaps && !probeUnavailable) return null;
 
   const snapshot = formatSnapshotDate(staleness.snapshot_created_at);
   const features = joinFeatures(staleness.missing_features);
@@ -139,16 +147,25 @@ export default function ContainerMigrationBanner({
   return (
     <section
       className={`${SHELL} border-[var(--warning)]/40 bg-[var(--warning-muted)]`}
-      aria-label="Container base is out of date"
+      aria-label={
+        probeUnavailable
+          ? "Container base could not be checked"
+          : "Container base is out of date"
+      }
     >
       <div className="flex items-start justify-between gap-3">
         <div className="min-w-0 space-y-1">
           <StatusIndicator
-            tone="error"
+            // A check that could not run is not a finding: it gets the
+            // "unresolved" tone rather than the one that says something is
+            // wrong with the container.
+            tone={probeUnavailable ? "unknown" : "error"}
             label={
               staleness.known
                 ? "Container base is out of date"
-                : "Container is missing things the current base ships"
+                : probeUnavailable
+                  ? "Container base could not be checked"
+                  : "Container is missing things the current base ships"
             }
             className="text-[13px] font-semibold"
           />
@@ -158,7 +175,9 @@ export default function ContainerMigrationBanner({
               ? snapshot
                 ? `Running on a saved image from ${snapshot}.`
                 : "Running on a saved image older than the current base."
-              : "This container predates base-image tracking, so it was probed directly."}
+              : probeUnavailable
+                ? "This container predates base-image tracking, so probing it is the only way to tell whether it is behind — and that did not complete."
+                : "This container predates base-image tracking, so it was probed directly."}
           </p>
 
           {staleness.missing_features.length > 0 && (

app/src/components/projects/home/OpenPageDialog.tsx

@@ -0,0 +1,148 @@
+import { useState } from "react";
+import Modal from "../../ui/Modal";
+import Button from "../../ui/Button";
+
+/**
+ * Viewport presets. These are the *page's* resolution, not the window's — the
+ * pane is a screencast, so a bigger window shows the same pixels drawn larger
+ * while this is what actually reflows the layout.
+ */
+const PRESETS: { label: string; width: number; height: number }[] = [
+  { label: "1280 × 720", width: 1280, height: 720 },
+  { label: "1920 × 1080", width: 1920, height: 1080 },
+  { label: "1440 × 900", width: 1440, height: 900 },
+  { label: "390 × 844 (phone)", width: 390, height: 844 },
+];
+
+interface Props {
+  /** Prefilled URL — an auth URL from the terminal, or the last one used. */
+  initialUrl?: string;
+  initialWidth?: number;
+  initialHeight?: number;
+  busy?: boolean;
+  onOpen: (url: string, width: number, height: number) => void;
+  onClose: () => void;
+}
+
+/**
+ * Ask for a URL and a viewport, then open it in the container's browser.
+ *
+ * Deliberately modal and short-lived — the convention for a task with one
+ * question and one button. The URL is not opened here; the caller runs the
+ * command so failures land in its toast.
+ */
+export default function OpenPageDialog({
+  initialUrl = "",
+  initialWidth = 1280,
+  initialHeight = 720,
+  busy = false,
+  onOpen,
+  onClose,
+}: Props) {
+  const [url, setUrl] = useState(initialUrl);
+  const [width, setWidth] = useState(initialWidth);
+  const [height, setHeight] = useState(initialHeight);
+
+  const trimmed = url.trim();
+  // Mirrors the backend's allow-list, so the error arrives before the click
+  // rather than after a round trip.
+  const valid = /^https?:\/\/\S+$/i.test(trimmed);
+
+  return (
+    <Modal
+      title="Open a page in the container's browser"
+      onClose={onClose}
+      footer={
+        <>
+          <Button size="md" onClick={onClose} disabled={busy}>
+            Cancel
+          </Button>
+          <Button
+            size="md"
+            variant="primary"
+            disabled={!valid || busy}
+            onClick={() => onOpen(trimmed, width, height)}
+          >
+            {busy ? "Opening…" : "Open page"}
+          </Button>
+        </>
+      }
+    >
+      <div className="space-y-4">
+        <p className="text-[13px] text-[var(--text-secondary)] leading-relaxed">
+          Launches a browser <em>inside</em> this container and publishes it to the
+          Browser tab. Use it for a sign-in page — the callback listener is in the
+          container too, so the login completes without involving your host browser —
+          or for a dev server on container loopback.
+        </p>
+
+        <label className="block">
+          <span className="text-xs text-[var(--text-secondary)]">URL</span>
+          <input
+            autoFocus
+            value={url}
+            onChange={(e) => setUrl(e.target.value)}
+            onKeyDown={(e) => {
+              if (e.key === "Enter" && valid && !busy) onOpen(trimmed, width, height);
+            }}
+            placeholder="http://localhost:5173"
+            spellCheck={false}
+            className="mt-1 w-full px-2 py-1.5 bg-[var(--bg-primary)] border border-[var(--border-color)] rounded-[var(--radius-control)] text-[13px] font-mono text-[var(--text-primary)]"
+          />
+          {trimmed !== "" && !valid && (
+            <span className="mt-1 block text-xs text-[var(--error)]">
+              Only http:// and https:// URLs can be opened.
+            </span>
+          )}
+        </label>
+
+        <div>
+          <span className="text-xs text-[var(--text-secondary)]">Viewport</span>
+          <div className="mt-1 flex flex-wrap gap-1.5">
+            {PRESETS.map((p) => {
+              const active = p.width === width && p.height === height;
+              return (
+                <button
+                  key={p.label}
+                  type="button"
+                  aria-pressed={active}
+                  onClick={() => {
+                    setWidth(p.width);
+                    setHeight(p.height);
+                  }}
+                  className={`px-2 py-1 text-xs rounded-[var(--radius-control)] border transition-colors ${
+                    active
+                      ? "border-[var(--accent)] bg-[var(--accent-muted)] text-[var(--accent)]"
+                      : "border-[var(--border-color)] text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
+                  }`}
+                >
+                  {p.label}
+                </button>
+              );
+            })}
+          </div>
+          <div className="mt-2 flex items-center gap-2">
+            <input
+              type="number"
+              aria-label="Viewport width"
+              value={width}
+              min={200}
+              onChange={(e) => setWidth(Number(e.target.value))}
+              className="w-24 px-2 py-1 bg-[var(--bg-primary)] border border-[var(--border-color)] rounded-[var(--radius-control)] text-xs text-[var(--text-primary)]"
+            />
+            <span aria-hidden="true" className="text-xs text-[var(--text-secondary)]">×</span>
+            <input
+              type="number"
+              aria-label="Viewport height"
+              value={height}
+              min={200}
+              onChange={(e) => setHeight(Number(e.target.value))}
+              className="w-24 px-2 py-1 bg-[var(--bg-primary)] border border-[var(--border-color)] rounded-[var(--radius-control)] text-xs text-[var(--text-primary)]"
+            />
+            <span className="text-xs text-[var(--text-secondary)]">CSS pixels</span>
+          </div>
+        </div>
+      </div>
+    </Modal>
+  );
+}

app/src/components/projects/home/OverviewTab.tsx

@@ -120,6 +120,15 @@ export default function OverviewTab({
               {project.mission_control_enabled ? "ON" : "OFF"}
             </span>
           </span>
+          {/* Only when granted. It is off for nearly every project and an
+              always-present "VPN OFF" would be noise, but where it *is* on the
+              container holds NET_ADMIN, which is worth seeing at a glance. */}
+          {project.vpn_support_enabled && (
+            <span className="text-[var(--text-secondary)]">
+              VPN support{" "}
+              <span className="text-[var(--text-primary)] font-medium">ON</span>
+            </span>
+          )}
           <button
             type="button"
             onClick={() => onOpenTab("config")}

app/src/components/projects/home/ProjectHome.tsx

@@ -43,6 +43,16 @@ export default function ProjectHome({ projectId, active }: Props) {
   const { projects, remove } = useProjects();
   const project = projects.find((p) => p.id === projectId);
   const [tab, setTab] = useState<ProjectHomeTabId>("overview");
+
+  // Somewhere else asked for this project on a particular sub-tab — currently
+  // "I opened a page in the container's browser, show me it". Consumed once, so
+  // it cannot fight the user's own clicking afterwards.
+  const pendingHomeTab = useAppState((s) => s.pendingHomeTab);
+  useEffect(() => {
+    if (pendingHomeTab?.projectId !== projectId) return;
+    setTab(pendingHomeTab.tab as ProjectHomeTabId);
+    useAppState.getState().clearPendingHomeTab();
+  }, [pendingHomeTab, projectId]);
   const [confirmRemove, setConfirmRemove] = useState(false);
   const [confirmReset, setConfirmReset] = useState(false);
   const [showMigration, setShowMigration] = useState(false);

app/src/components/projects/home/TaskEditorModal.test.tsx

@@ -60,6 +60,8 @@ const existingTask: ScheduledTask = {
   created_at: null,
   last_run: null,
   next_run: null,
+  running: false,
+  running_since: null,
 };
 
 async function renderEditor(task: ScheduledTask | null = null, project = baseProject) {

app/src/components/projects/home/config/RuntimeSection.tsx

@@ -57,6 +57,19 @@ export default function RuntimeSection({
           }
         />
 
+        <SwitchRow
+          label="VPN support"
+          hint="Grants NET_ADMIN and the /dev/net/tun device so a VPN client (PIA, WireGuard, OpenVPN, Tailscale) can build a tunnel inside the container. Without it a client installs and runs but its connection hangs until it times out. Anything in the container can then reconfigure the container's own network stack; the host's is untouched."
+          control={
+            <Toggle
+              label="VPN support"
+              checked={project.vpn_support_enabled}
+              disabled={disabled}
+              onChange={(v) => save({ vpn_support_enabled: v })}
+            />
+          }
+        />
+
         <SwitchRow
           label="Mission Control"
           hint="A web dashboard for monitoring and managing Claude sessions remotely."

app/src/components/projects/home/format.ts

@@ -26,6 +26,21 @@ export function formatElapsed(ms: number): string {
   return `${days}d ago`;
 }
 
+/** "for 42s" / "for 4m" / "for 1h 12m" — elapsed phrasing for a run in flight.
+ *  Seconds are kept below a minute because the first thing anyone wants from a
+ *  freshly triggered run is evidence that it started at all. */
+export function formatRunningFor(iso: string | null | undefined): string | null {
+  if (!iso) return null;
+  const started = Date.parse(iso);
+  if (Number.isNaN(started)) return null;
+  const seconds = Math.max(0, Math.floor((Date.now() - started) / 1000));
+  if (seconds < 60) return `for ${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return `for ${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  return `for ${hours}h ${minutes % 60}m`;
+}
+
 /** Uptime phrasing for a known start timestamp. */
 export function formatUptime(startedAtMs: number | undefined): string | null {
   if (startedAtMs === undefined) return null;

app/src/components/terminal/TerminalView.tsx

@@ -7,7 +7,11 @@ import { openUrl } from "@tauri-apps/plugin-opener";
 import "@xterm/xterm/css/xterm.css";
 import { useTerminal } from "../../hooks/useTerminal";
 import { useAppState } from "../../store/appState";
-import { awsSsoRefresh, uploadHostFileToTerminal } from "../../lib/tauri-commands";
+import {
+  awsSsoRefresh,
+  openPageInContainerBrowser,
+  uploadHostFileToTerminal,
+} from "../../lib/tauri-commands";
 import { getCurrentWebview } from "@tauri-apps/api/webview";
 import { UrlDetector } from "../../lib/urlDetector";
 import {
@@ -370,8 +374,12 @@ export default function TerminalView({ sessionId, active }: Props) {
     // Handle backend output -> terminal
     let aborted = false;
 
-    const detector = new UrlDetector((url) =>
+    // The width is read per scan, not captured: only a break the terminal
-      promptUrl(url, "Long URL detected"),
+    // itself inserted may be deleted, and where that is moves with every
+    // resize.
+    const detector = new UrlDetector(
+      (url) => promptUrl(url, "Long URL detected"),
+      () => termRef.current?.cols ?? 0,
     );
     detectorRef.current = detector;
 
@@ -529,6 +537,51 @@ export default function TerminalView({ sessionId, active }: Props) {
     openUrl(safe).catch((e) => console.error("Failed to open URL:", e));
   }, [urlPrompt]);
 
+  /**
+   * Open the prompted URL in the container's own browser instead of the host's.
+   *
+   * For a sign-in this is the shorter path: the callback listener the tool is
+   * waiting on is inside the container, so a container-side browser closes the
+   * loop with nothing crossing to the host. The page is published to the
+   * project's Browser tab, which is where the user completes it by hand.
+   */
+  const handleOpenUrlInContainer = useCallback(() => {
+    if (!urlPrompt) return;
+    const safe = sanitizeRelayUrl(urlPrompt.url);
+    setUrlPrompt(null);
+    if (!safe) {
+      console.warn("Refusing to open a URL that failed validation");
+      return;
+    }
+    if (!projectId) return;
+    // Land on the pane that will show it, before the work starts: opening takes
+    // several seconds, and the progress line lives there.
+    useAppState.getState().openProjectHomeTab(projectId, "browser");
+    // A sign-in page is the one case where the *window* size matters least and
+    // the layout matters most, so it gets the ordinary desktop viewport.
+    // `true`: from a terminal there is no Browser pane on screen, so the page
+    // needs a window of its own or it opens somewhere the user isn't looking.
+    openPageInContainerBrowser(projectId, safe, 1280, 720, true)
+      .then((result) => {
+        const push = useAppState.getState().pushToast;
+        if (result.error) {
+          push({ kind: "error", message: "The page didn’t open", detail: result.error });
+        } else {
+          push({
+            kind: "success",
+            message: "Opened in the container’s browser",
+          });
+        }
+      })
+      .catch((e) =>
+        useAppState.getState().pushToast({
+          kind: "error",
+          message: "Could not open it in the container’s browser",
+          detail: String(e),
+        }),
+      );
+  }, [urlPrompt, projectId]);
+
   const handleScrollToBottom = useCallback(() => {
     const term = termRef.current;
     if (term) {
@@ -606,6 +659,7 @@ export default function TerminalView({ sessionId, active }: Props) {
           url={urlPrompt.url}
           label={urlPrompt.label}
           onOpen={handleOpenUrl}
+          onOpenInContainer={handleOpenUrlInContainer}
           onDismiss={() => setUrlPrompt(null)}
         />
       )}

app/src/components/terminal/UrlToast.tsx

@@ -6,6 +6,9 @@ interface Props {
   /** Heading above the URL. Says why the toast appeared. */
   label?: string;
   onOpen: () => void;
+  /** Open it in the container's own browser instead of the host's. Omitted when
+   *  the project has no browser to open it in. */
+  onOpenInContainer?: () => void;
   onDismiss: () => void;
 }
 
@@ -30,6 +33,7 @@ export default function UrlToast({
   url,
   label = "Long URL detected",
   onOpen,
+  onOpenInContainer,
   onDismiss,
 }: Props) {
   const origin = urlOrigin(url);
@@ -131,6 +135,30 @@ export default function UrlToast({
         Open
       </button>
 
+      {onOpenInContainer && (
+        // A sign-in completed in the *container's* browser lands its callback
+        // on the container's own loopback, which is where the tool waiting for
+        // it is listening — no host round trip, no auth bridge.
+        <button
+          onClick={onOpenInContainer}
+          title="Open in a browser inside the container, and watch it in the Browser tab"
+          style={{
+            padding: "4px 10px",
+            fontSize: 12,
+            fontWeight: 600,
+            color: "var(--text-primary)",
+            background: "transparent",
+            border: "1px solid var(--border-color)",
+            borderRadius: 4,
+            cursor: "pointer",
+            whiteSpace: "nowrap",
+            flexShrink: 0,
+          }}
+        >
+          In container
+        </button>
+      )}
+
       <button
         onClick={onDismiss}
         style={{

app/src/hooks/useKeyboardShortcuts.test.tsx

@@ -0,0 +1,88 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { renderHook } from "@testing-library/react";
+import { useKeyboardShortcuts } from "./useKeyboardShortcuts";
+import { useAppState, homeTabKey, terminalTabKey } from "../store/appState";
+
+vi.mock("./useTerminal", () => ({
+  useTerminal: () => ({ open: vi.fn(), close: vi.fn() }),
+}));
+
+const HOME = homeTabKey("p1");
+const S1 = terminalTabKey("s1");
+const S2 = terminalTabKey("s2");
+
+const order = () => useAppState.getState().tabOrder;
+
+/** Press a chord, from whatever is focused. */
+function press(key: string, { shift = false } = {}) {
+  document.dispatchEvent(
+    new KeyboardEvent("keydown", { key, ctrlKey: true, shiftKey: shift, bubbles: true }),
+  );
+}
+
+/** Focus a real element of the given kind, inside `parent` if given. */
+function focus(tag: "input" | "textarea", parentClass?: string): HTMLElement {
+  const el = document.createElement(tag);
+  if (parentClass) {
+    const parent = document.createElement("div");
+    parent.className = parentClass;
+    parent.appendChild(el);
+    document.body.appendChild(parent);
+  } else {
+    document.body.appendChild(el);
+  }
+  el.focus();
+  return el;
+}
+
+beforeEach(() => {
+  useAppState.setState({ tabOrder: [HOME, S1, S2], activeTabKey: S1, activeSessionId: "s1" });
+});
+
+afterEach(() => {
+  document.body.innerHTML = "";
+});
+
+describe("Ctrl+Shift+←/→", () => {
+  it("moves the active tab along the strip", () => {
+    renderHook(() => useKeyboardShortcuts());
+
+    press("ArrowLeft", { shift: true });
+    expect(order()).toEqual([S1, HOME, S2]);
+
+    press("ArrowRight", { shift: true });
+    expect(order()).toEqual([HOME, S1, S2]);
+  });
+
+  it("leaves word-wise selection alone in a text field", () => {
+    // Ctrl+Shift+←/→ already means "extend the selection by a word" in every
+    // input in the app — the rename field, Config fields, Settings fields.
+    // Taking it there would break selection *and* silently reorder tabs.
+    renderHook(() => useKeyboardShortcuts());
+    focus("input");
+
+    press("ArrowLeft", { shift: true });
+
+    expect(order()).toEqual([HOME, S1, S2]);
+  });
+
+  it("still moves tabs from the terminal, whose focus lives in a textarea", () => {
+    // xterm keeps a hidden textarea focused as its input-method shim. It is
+    // not a field anyone edits word-wise, and the terminal is where these
+    // shortcuts matter most, so it is not treated as one.
+    renderHook(() => useKeyboardShortcuts());
+    focus("textarea", "xterm xterm-helper-textarea-host");
+
+    press("ArrowLeft", { shift: true });
+
+    expect(order()).toEqual([S1, HOME, S2]);
+  });
+
+  it("does nothing without Shift — that chord is readline's word motion", () => {
+    renderHook(() => useKeyboardShortcuts());
+
+    press("ArrowLeft");
+
+    expect(order()).toEqual([HOME, S1, S2]);
+  });
+});

app/src/hooks/useKeyboardShortcuts.ts

@@ -2,6 +2,22 @@ import { useEffect } from "react";
 import { useAppState, isTerminalTab, tabKeyId } from "../store/appState";
 import { useTerminal } from "./useTerminal";
 
+/**
+ * Whether the focus is in something the user is editing text in.
+ *
+ * xterm's hidden textarea is deliberately excluded: it is an input-method
+ * shim, not a field anyone edits word-wise, and the terminal is exactly where
+ * the tab shortcuts need to keep working.
+ */
+function inTextField(el: Element | null): boolean {
+  if (!el || el.closest(".xterm")) return false;
+  return (
+    el.tagName === "INPUT" ||
+    el.tagName === "TEXTAREA" ||
+    (el as HTMLElement).isContentEditable === true
+  );
+}
+
 /**
  * App-level shortcuts. Registered on `document` in the *capture* phase so they
  * win over xterm.js, which would otherwise forward them to the shell inside
@@ -11,6 +27,7 @@ import { useTerminal } from "./useTerminal";
  *   Ctrl+Shift+W  close the active tab
  *   Ctrl+Tab      next tab (Ctrl+Shift+Tab for previous)
  *   Ctrl+1..9     jump to the nth tab
+ *   Ctrl+Shift+←/→  move the active tab along the strip
  */
 export function useKeyboardShortcuts() {
   const { open: openTerminal, close: closeTerminal } = useTerminal();
@@ -51,6 +68,22 @@ export function useKeyboardShortcuts() {
         return;
       }
 
+      // Ctrl+Shift+←/→ — move the active tab, the keyboard route to what
+      // dragging a tab does. Shift is what keeps it clear of the terminal:
+      // Ctrl+←/→ is readline's word-wise cursor motion.
+      //
+      // In a text field this chord already means "extend the selection by a
+      // word", which is not ours to take: swallowing it would make word-wise
+      // selection impossible in every input in the app *and* silently reorder
+      // the strip each time someone tried it.
+      if (e.shiftKey && (e.key === "ArrowLeft" || e.key === "ArrowRight")) {
+        if (!state.activeTabKey || inTextField(document.activeElement)) return;
+        e.preventDefault();
+        e.stopPropagation();
+        state.moveActiveTab(e.key === "ArrowLeft" ? -1 : 1);
+        return;
+      }
+
       if (e.shiftKey) return;
 
       // Ctrl+1..9 — jump to tab

app/src/lib/tauri-commands.ts

@@ -1,5 +1,5 @@
 import { invoke } from "@tauri-apps/api/core";
-import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, GatewayStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus, BrowserViewStatus, PlaywrightDetection, BrowserSetupOutcome, BrowserInstallTarget, ContainerStaleness, MigrationOptions, MigrationReport, MigrationState, ClearTokenOutcome, CaCertInfo } from "./types";
+import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, GatewayStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus, BrowserViewStatus, BrowserViewPopoutState, BrowserPageState, PlaywrightDetection, BrowserSetupOutcome, BrowserInstallTarget, ContainerStaleness, MigrationOptions, MigrationReport, MigrationState, ClearTokenOutcome, CaCertInfo } from "./types";
 
 // Docker
 export const checkDocker = () => invoke<boolean>("check_docker");
@@ -201,6 +201,77 @@ export const installBrowserViewBrowser = (
   browser: BrowserInstallTarget,
 ) => invoke<BrowserSetupOutcome>("install_browser_view_browser", { projectId, browser });
 
+/**
+ * Detach the live view into its own OS window, or raise it if already open.
+ *
+ * Window-only: the viewer, the proxy and the container are untouched, so
+ * popping out and back costs nothing. The window loads the same token-bearing
+ * loopback URL as the pane, and has no IPC access.
+ */
+export const openBrowserViewPopout = (projectId: string, alwaysOnTop: boolean) =>
+  invoke<void>("open_browser_view_popout", { projectId, alwaysOnTop });
+/** Close the pop-out and put the view back in the tab. No-op if it isn't open. */
+export const closeBrowserViewPopout = (projectId: string) =>
+  invoke<void>("close_browser_view_popout", { projectId });
+/**
+ * Whether the pop-out is open and whether it is pinned, read from the window.
+ *
+ * Asked on every mount: the pane is unmounted whenever another Project Home
+ * sub-tab is selected, while the window carries on — so neither fact can live
+ * in component state and survive.
+ */
+export const getBrowserViewPopoutState = (projectId: string) =>
+  invoke<BrowserViewPopoutState>("get_browser_view_popout_state", { projectId });
+/**
+ * Open a URL in a browser *inside* the container, published so the pane shows it.
+ *
+ * The same action serves an auth URL — the OAuth callback listener is in the
+ * container too, so the loop closes without the host — and a dev server on
+ * container loopback, which is how you watch a UI Claude is building. Only
+ * http/https; the backend rejects anything else.
+ *
+ * The viewer is started if it isn't already: asking for a page is asking to
+ * watch it, and leaving the user to go and press Start themselves — with no
+ * hint that they had to — is what the first version did.
+ */
+export const openPageInContainerBrowser = (
+  projectId: string,
+  url: string,
+  width: number,
+  height: number,
+  /** Also raise the pop-out window — for callers with no pane on screen. */
+  showWindow = false,
+) =>
+  invoke<BrowserPageState>("open_page_in_container_browser", {
+    projectId,
+    url,
+    width,
+    height,
+    showWindow,
+  });
+/** Resize that page. Real reflow, not a scaled screencast — see BrowserTab. */
+export const setContainerPageViewport = (projectId: string, width: number, height: number) =>
+  invoke<void>("set_container_page_viewport", { projectId, width, height });
+export const getContainerPageState = (projectId: string) =>
+  invoke<BrowserPageState>("get_container_page_state", { projectId });
+export const closeContainerPage = (projectId: string) =>
+  invoke<void>("close_container_page", { projectId });
+
+/**
+ * Make the page track the pop-out window's size as it is dragged.
+ *
+ * Only affects a page this app opened: a bound browser admits no second client,
+ * so one `@playwright/mcp` launched keeps the viewport it was given.
+ */
+export const setBrowserViewMatchWindow = (projectId: string, enabled: boolean) =>
+  invoke<void>("set_browser_view_match_window", { projectId, enabled });
+export const getBrowserViewMatchWindow = (projectId: string) =>
+  invoke<boolean>("get_browser_view_match_window", { projectId });
+
+/** Pin the pop-out above other windows — the point of popping it out at all. */
+export const setBrowserViewPopoutAlwaysOnTop = (projectId: string, onTop: boolean) =>
+  invoke<void>("set_browser_view_popout_always_on_top", { projectId, onTop });
+
 // Shared Claude Code auth token — one `claude setup-token` run authenticates
 // every Anthropic-backend project. The token itself is never exposed here: it
 // lives in the OS keychain and is injected as a container env var.

app/src/lib/types.ts

@@ -33,6 +33,10 @@ export interface Project {
   auth_bridge_enabled: boolean;
   /** Opt in to the browser-view pane. Host-side only, like `auth_bridge_enabled`. */
   browser_view_enabled: boolean;
+  /** Grant NET_ADMIN, /dev/net/tun and the WireGuard `src_valid_mark` sysctl so
+   *  a VPN client inside the container can build a tunnel. Unlike the two flags
+   *  above this is container state — changing it recreates the container. */
+  vpn_support_enabled: boolean;
   /** Use the shared long-lived Claude Code token (from `claude setup-token`,
    *  held in the OS keychain) instead of this project's own `claude login`.
    *  Defaults to true; only applies when `backend` is "anthropic" and a token
@@ -388,6 +392,10 @@ export interface ScheduledTask {
   last_run: string | null;
   /** Known only for enabled one-shot tasks; cron is not evaluated. */
   next_run: string | null;
+  /** A run is in flight right now (the runner's pid was verified live). */
+  running: boolean;
+  /** When that run started. Null unless `running`. */
+  running_since: string | null;
 }
 
 /** Mirrors Rust `ScheduleKind` — which of the scheduler's two `add` flags to
@@ -469,6 +477,15 @@ export interface PlaywrightDetection {
   /** Path to Google Chrome when the `chrome` channel — what `@playwright/mcp`
    *  asks for — is installed. It is an apt package, so it is never in `browsers`. */
   chrome_channel: string | null;
+  /** The Chromium the *viewer's* Playwright would launch, and whether it exists. */
+  chromium_executable: string | null;
+  chromium_executable_exists: boolean;
+  /** What a script's `require("playwright")` resolves to — routinely a different
+   *  copy, pinning a different browser revision. If its Chromium is missing,
+   *  every script Claude writes fails while the pane still looks green. */
+  script_playwright_version: string | null;
+  script_chromium_executable: string | null;
+  script_chromium_executable_exists: boolean;
   /** Module roots the probe searched, echoed back for the "not found" message.
    *  Includes the npx cache (`~/.npm/_npx/*​/node_modules`), which is where a
    *  Playwright installed through Claude Code's MCP setup actually lives. */
@@ -514,6 +531,47 @@ export interface BrowserViewChangedEvent {
   status: BrowserViewStatus;
 }
 
+/**
+ * Mirrors Rust `PopoutState` — read from the window, never remembered.
+ *
+ * The pane is unmounted whenever another Project Home sub-tab is selected while
+ * the window carries on, so anything it holds in component state is stale by
+ * the time the user comes back.
+ */
+export interface BrowserViewPopoutState {
+  open: boolean;
+  always_on_top: boolean;
+}
+
+/** Mirrors Rust `page::Viewport` — CSS pixels, clamped backend-side. */
+export interface BrowserPageViewport {
+  width: number;
+  height: number;
+}
+
+/**
+ * Mirrors Rust `page::PageState`: what the container-side helper reports about
+ * the page Triple-C opened. `ready: false` with no error means there is none.
+ */
+export interface BrowserPageState {
+  ready: boolean;
+  url: string | null;
+  viewport: BrowserPageViewport | null;
+  error: string | null;
+}
+
+/**
+ * Payload of the `browser-view-popout-changed` event: a `BrowserViewPopoutState`
+ * plus the project it belongs to.
+ *
+ * The pop-out window can close without the pane asking — the user hits its X,
+ * or the session tears down and takes it — so this is the only reliable way to
+ * know whether it is on screen.
+ */
+export interface BrowserViewPopoutChangedEvent extends BrowserViewPopoutState {
+  project_id: string;
+}
+
 /** Payload of the `claude-token-progress` event: milestones during
  *  `acquire_claude_token`. Never contains the token. */
 /**

app/src/lib/urlDetector.test.ts

@@ -0,0 +1,118 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { UrlDetector, flatten } from "./urlDetector";
+
+const COLS = 80;
+const enc = new TextEncoder();
+
+/** Feed text and let the debounce + confirmation timers run. */
+function feed(detector: UrlDetector, text: string) {
+  detector.feed(enc.encode(text));
+  vi.advanceTimersByTime(2000);
+}
+
+/** Hard-wrap the way a PTY does: a break every `cols` characters, nothing lost. */
+function ptyWrap(text: string, cols = COLS): string {
+  const lines: string[] = [];
+  for (let i = 0; i < text.length; i += cols) lines.push(text.slice(i, i + cols));
+  return lines.join("\r\n");
+}
+
+beforeEach(() => vi.useFakeTimers());
+afterEach(() => vi.useRealTimers());
+
+describe("flatten", () => {
+  it("rejoins a break the terminal inserted at the width", () => {
+    expect(flatten("abcde\nfghij", 5)).toBe("abcdefghij");
+  });
+
+  it("keeps a break that arrived before the width as a separator", () => {
+    expect(flatten("abc\ndef", 5)).toBe("abc def");
+  });
+
+  it("rejoins nothing when the width isn't known", () => {
+    // Better to lose a wrapped URL than to invent one.
+    expect(flatten("abcde\nfghij", 0)).toBe("abcde fghij");
+  });
+});
+
+describe("UrlDetector", () => {
+  it("reconstructs a URL the PTY hard-wrapped mid-token", () => {
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+    const url =
+      "https://accounts.example.com/o/oauth2/auth?client_id=1234567890-abcdefghijklmnop.apps.example.com&redirect_uri=http%3A%2F%2Flocalhost%3A45678&scope=openid+email+profile";
+
+    feed(d, "Open this link:\r\n" + ptyWrap(url) + "\r\nWaiting for the browser…\r\n");
+
+    expect(seen).toEqual([url]);
+  });
+
+  it("does not glue the text that follows a link onto it", () => {
+    // The bug this file exists for. A terminal wrapping a paragraph emits the
+    // break *instead of* the space, so deleting every break produced
+    // `…/tag/preview-63f3c54Butitprovesyournitpick…` — a different host and
+    // path from the one on screen, opened on the user's machine.
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+    const url =
+      "https://repo.anhonesthost.net/CyberCoveLLC/Triple-C/releases/tag/preview-63f3c54-with-a-long-enough-suffix-to-scan";
+
+    feed(
+      d,
+      [
+        url,
+        "But it proves your nitpick perfectly: every file in it says 0.3.0.",
+        "That is the hard-coded patch number.",
+      ].join("\r\n") + "\r\n",
+    );
+
+    expect(seen).toEqual([url]);
+    expect(seen[0]).not.toContain("But");
+    // And the host is exactly what was printed — no characters lost.
+    expect(new URL(seen[0]).host).toBe("repo.anhonesthost.net");
+  });
+
+  it("stops at the end of a short line even when more output follows", () => {
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+    const url = "https://example.com/" + "a".repeat(90);
+
+    feed(d, `${url}\r\nnext line of output\r\n`);
+
+    expect(seen).toEqual([url]);
+  });
+
+  it("joins the next line when a token ends exactly at the width", () => {
+    // The one case the width rule cannot decide: a URL whose length is an exact
+    // multiple of the column count looks identical to one that was cut. Pinned
+    // as known behaviour rather than pretended away — the toast still shows the
+    // whole candidate, and nothing opens without the user pressing Open.
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+    const url = "https://example.com/" + "c".repeat(2 * COLS - 20); // exactly 2 lines
+
+    feed(d, `${ptyWrap(url)}\r\nTAIL\r\n`);
+
+    expect(seen).toEqual([url + "TAIL"]);
+  });
+
+  it("ignores anything under the length threshold", () => {
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+
+    feed(d, "see https://example.com/short\r\nmore text\r\n");
+
+    expect(seen).toEqual([]);
+  });
+
+  it("emits a wrapped URL once, not once per chunk", () => {
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+    const url = "https://example.com/" + "b".repeat(120);
+
+    feed(d, ptyWrap(url));
+    feed(d, "\r\ndone\r\n");
+
+    expect(seen).toEqual([url]);
+  });
+});

app/src/lib/urlDetector.ts

@@ -3,8 +3,23 @@
  *
  * The Linux PTY hard-wraps long lines with \r\n at the terminal column width,
  * which breaks xterm.js WebLinksAddon URL detection. This class flattens
- * the buffer (stripping PTY wraps, converting blank lines to spaces) and
+ * the buffer (rejoining hard wraps, treating every other break as a
- * matches URLs with a single regex, firing a callback for ones >= 100 chars.
+ * terminator) and matches URLs with a single regex, firing a callback for ones
+ * >= 100 chars.
+ *
+ * ## Which line breaks may be deleted
+ *
+ * Only the ones the *terminal* inserted. A hard wrap happens at exactly the
+ * column width, so a line that reached the width was cut mid-token and its
+ * break must be removed to put the token back together; a line that stopped
+ * short ended for its own reasons and its break is a real separator.
+ *
+ * Deleting every break instead — which this did — glues unrelated output onto
+ * the end of a URL. Observed for real: a wrapped paragraph following a link
+ * became `…/tag/preview-63f3c54Butitprovesyournitpick…`, because a terminal
+ * that wraps at a space emits the break *instead of* the space, so removing
+ * the break removes the separator too. That candidate is a different URL from
+ * the one on screen, and the user is the one who has to notice.
  *
  * When a URL match extends to the end of the flattened buffer, emission is
  * deferred (more chunks may still be arriving). A confirmation timer emits
@@ -21,6 +36,45 @@ const MIN_URL_LENGTH = 100;
 
 export type UrlCallback = (url: string) => void;
 
+/**
+ * How wide the terminal is right now.
+ *
+ * A getter, not a number: the width changes with every window resize, and a
+ * stale one silently turns joining back into guesswork.
+ */
+export type ColumnsGetter = () => number;
+
+/**
+ * Rejoin the line breaks the terminal inserted; turn the rest into spaces.
+ *
+ * A line of exactly `columns` visible characters was cut by the terminal, so
+ * its break is deleted and the two halves are put back together. Anything
+ * shorter ended on its own and becomes a space — a URL cannot contain one, so
+ * that is also what stops a match running into whatever followed.
+ *
+ * `columns` of 0 or less means "not known yet"; nothing is rejoined, which
+ * costs a wrapped URL rather than inventing one.
+ *
+ * One case stays ambiguous and cannot be resolved here: a token that happens to
+ * end exactly at the width is indistinguishable from one the terminal cut, so
+ * the following line is joined to it. The candidate is still shown in full and
+ * confirmed by the user before anything opens.
+ */
+export function flatten(clean: string, columns: number): string {
+  const lines = clean.split(/\r?\n/);
+  let out = "";
+  for (let i = 0; i < lines.length; i++) {
+    out += lines[i];
+    if (i === lines.length - 1) break;
+    // `===`, not `>=`. A line *longer* than the width was never cut by the
+    // terminal — the stream simply contained no break there, so the break that
+    // follows it is the application's own and separates two things.
+    const wrapped = columns > 0 && lines[i].length === columns;
+    if (!wrapped) out += " ";
+  }
+  return out;
+}
+
 export class UrlDetector {
   private decoder = new TextDecoder();
   private buffer = "";
@@ -29,9 +83,11 @@ export class UrlDetector {
   private lastEmitted = "";
   private pendingUrl: string | null = null;
   private callback: UrlCallback;
+  private columns: ColumnsGetter;
 
-  constructor(callback: UrlCallback) {
+  constructor(callback: UrlCallback, columns: ColumnsGetter) {
     this.callback = callback;
+    this.columns = columns;
   }
 
   /** Feed raw PTY output chunks. */
@@ -61,12 +117,8 @@ export class UrlDetector {
     // 1. Strip ANSI escape sequences
     const clean = this.buffer.replace(ANSI_RE, "");
 
-    // 2. Flatten the buffer:
+    // 2. Flatten the buffer: rejoin hard wraps, terminate on everything else.
-    //    - Blank lines (2+ consecutive line breaks) → space (real paragraph break / URL terminator)
+    const flat = flatten(clean, this.columns());
-    //    - Remaining \r and \n → removed (PTY hard-wrap artifacts)
-    const flat = clean
-      .replace(/(\r?\n){2,}/g, " ")
-      .replace(/[\r\n]/g, "");
 
     if (!flat) return;
 

app/src/store/appState.test.ts

@@ -0,0 +1,79 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { useAppState, homeTabKey, terminalTabKey } from "./appState";
+
+const A = homeTabKey("a");
+const B = terminalTabKey("b");
+const C = terminalTabKey("c");
+
+function seed(tabOrder: string[], activeTabKey: string | null = null) {
+  useAppState.setState({
+    tabOrder,
+    activeTabKey,
+    activeSessionId: null,
+    selectedProjectId: null,
+  });
+}
+
+const order = () => useAppState.getState().tabOrder;
+
+describe("tab reordering", () => {
+  beforeEach(() => seed([A, B, C]));
+
+  it("moves a tab to an earlier slot", () => {
+    useAppState.getState().moveTab(C, 0);
+    expect(order()).toEqual([C, A, B]);
+  });
+
+  it("moves a tab to a later slot", () => {
+    useAppState.getState().moveTab(A, 2);
+    expect(order()).toEqual([B, C, A]);
+  });
+
+  it("clamps a destination past the ends rather than dropping the tab", () => {
+    useAppState.getState().moveTab(A, 99);
+    expect(order()).toEqual([B, C, A]);
+    useAppState.getState().moveTab(A, -5);
+    expect(order()).toEqual([A, B, C]);
+  });
+
+  it("ignores a tab that isn't in the strip", () => {
+    useAppState.getState().moveTab("term:gone", 0);
+    expect(order()).toEqual([A, B, C]);
+  });
+
+  it("does not change what's active — dragging a tab is not selecting it", () => {
+    seed([A, B, C], B);
+    useAppState.getState().moveTab(C, 0);
+    const state = useAppState.getState();
+    expect(state.tabOrder).toEqual([C, A, B]);
+    expect(state.activeTabKey).toBe(B);
+  });
+
+  it("nudges the active tab with the keyboard, in both directions", () => {
+    seed([A, B, C], B);
+    useAppState.getState().moveActiveTab(-1);
+    expect(order()).toEqual([B, A, C]);
+    useAppState.getState().moveActiveTab(1);
+    expect(order()).toEqual([A, B, C]);
+  });
+
+  it("stops the active tab at the ends instead of wrapping it around", () => {
+    seed([A, B, C], A);
+    useAppState.getState().moveActiveTab(-1);
+    // A held-down key must not teleport the tab to the far end.
+    expect(order()).toEqual([A, B, C]);
+  });
+
+  it("does nothing when no tab is active", () => {
+    seed([A, B, C], null);
+    useAppState.getState().moveActiveTab(1);
+    expect(order()).toEqual([A, B, C]);
+  });
+
+  it("keeps Ctrl+1..9 addressing the strip as reordered", () => {
+    seed([A, B, C], A);
+    useAppState.getState().moveTab(C, 0);
+    useAppState.getState().focusTabIndex(0);
+    expect(useAppState.getState().activeTabKey).toBe(C);
+  });
+});

app/src/store/appState.ts

@@ -71,10 +71,26 @@ interface AppState {
   tabOrder: string[];
   activeTabKey: string | null;
   openProjectHome: (projectId: string) => void;
+  /**
+   * Open a project's home tab *on a particular sub-tab*.
+   *
+   * The sub-tab is local state inside `ProjectHome`, so this parks a request
+   * here for it to pick up: an action taken somewhere else entirely — opening a
+   * page in the container's browser from a terminal — has to be able to land
+   * the user on the pane that shows the result.
+   */
+  openProjectHomeTab: (projectId: string, tab: string) => void;
+  /** Consumed once by `ProjectHome`, then cleared. */
+  pendingHomeTab: { projectId: string; tab: string } | null;
+  clearPendingHomeTab: () => void;
   closeHomeTab: (projectId: string) => void;
   setActiveTabKey: (key: string) => void;
   cycleTab: (delta: number) => void;
   focusTabIndex: (index: number) => void;
+  /** Reorder: put `key` at `toIndex` in the strip. Never changes what's active. */
+  moveTab: (key: string, toIndex: number) => void;
+  /** Nudge the active tab left/right — the keyboard route to the same thing. */
+  moveActiveTab: (delta: number) => void;
 
   // Inline container progress, replacing the blocking progress modal.
   containerProgress: Record<string, string>;
@@ -231,6 +247,20 @@ export const useAppState = create<AppState>((set) => ({
         ...activation(key),
       };
     }),
+  openProjectHomeTab: (projectId, tab) =>
+    set((state) => {
+      const key = homeTabKey(projectId);
+      return {
+        selectedProjectId: projectId,
+        tabOrder: state.tabOrder.includes(key)
+          ? state.tabOrder
+          : [...state.tabOrder, key],
+        pendingHomeTab: { projectId, tab },
+        ...activation(key),
+      };
+    }),
+  pendingHomeTab: null,
+  clearPendingHomeTab: () => set({ pendingHomeTab: null }),
   closeHomeTab: (projectId) =>
     set((state) => {
       const key = homeTabKey(projectId);
@@ -274,6 +304,35 @@ export const useAppState = create<AppState>((set) => ({
         ? { ...patch, selectedProjectId: tabKeyId(key) }
         : patch;
     }),
+  // Reordering is deliberately *only* a reordering: dragging a tab does not
+  // select it, so a drag can be aimed at a background tab without yanking the
+  // main area (and a running terminal's focus) away mid-gesture.
+  moveTab: (key, toIndex) =>
+    set((state) => {
+      const from = state.tabOrder.indexOf(key);
+      if (from === -1) return {};
+      const to = Math.max(0, Math.min(toIndex, state.tabOrder.length - 1));
+      if (from === to) return {};
+      const tabOrder = [...state.tabOrder];
+      tabOrder.splice(from, 1);
+      tabOrder.splice(to, 0, key);
+      return { tabOrder };
+    }),
+  moveActiveTab: (delta) =>
+    set((state) => {
+      const key = state.activeTabKey;
+      if (!key) return {};
+      const from = state.tabOrder.indexOf(key);
+      if (from === -1) return {};
+      // Clamped, not wrapped: a tab dragged off the end would otherwise
+      // reappear at the other end, which reads as a bug on a held-down key.
+      const to = Math.max(0, Math.min(from + delta, state.tabOrder.length - 1));
+      if (from === to) return {};
+      const tabOrder = [...state.tabOrder];
+      tabOrder.splice(from, 1);
+      tabOrder.splice(to, 0, key);
+      return { tabOrder };
+    }),
 
   // Container progress
   containerProgress: {},

app/src/test/icon-config.test.ts

@@ -33,4 +33,33 @@ describe("Window icon configuration", () => {
     expect(config.bundle.icon).toContain("icons/icon.ico");
     expect(config.bundle.icon).toContain("icons/icon.png");
   });
+
+  it("icon.ico carries the small sizes Windows draws in the taskbar", () => {
+    // A single-image .ico is the taskbar bug: Windows upscales 16x16 into every
+    // other slot. Regenerate with `python3 branding/build-icons.py`.
+    const ico = readFileSync(resolve(srcTauriDir, "icons/icon.ico"));
+    const count = ico.readUInt16LE(4);
+    expect(count).toBeGreaterThan(1);
+
+    // Directory entries start at byte 6; width/height of 0 means 256.
+    const widths = new Set<number>();
+    for (let i = 0; i < count; i++) {
+      const w = ico[6 + i * 16];
+      widths.add(w === 0 ? 256 : w);
+    }
+    for (const size of [16, 24, 32, 48, 256]) {
+      expect(widths).toContain(size);
+    }
+  });
+
+  it("icon.icns exists and is bundled for macOS", () => {
+    const icnsPath = resolve(srcTauriDir, "icons/icon.icns");
+    expect(existsSync(icnsPath)).toBe(true);
+    expect(readFileSync(icnsPath).subarray(0, 4).toString("ascii")).toBe("icns");
+
+    const config = JSON.parse(
+      readFileSync(resolve(srcTauriDir, "tauri.conf.json"), "utf-8")
+    );
+    expect(config.bundle.icon).toContain("icons/icon.icns");
+  });
 });

branding/README.md

@@ -0,0 +1,58 @@
+# Branding
+
+The mark is a container with its right wall opened, so the enclosure itself is the letter **C**,
+holding a `>_` prompt. Container plus shell, in one closed shape — no type inside the icon, so
+nothing goes illegible when the app is 16 px tall in a taskbar.
+
+## Files
+
+| File | What it is |
+|---|---|
+| `triple-c-mark.svg` | The mark alone, transparent. Use on any ground. |
+| `triple-c-mark-small.svg` | Optical variant for 32 px and below. |
+| `triple-c-icon.svg` | The app icon: mark at 70% on a `#0D1117` tile, 22% corner radius. |
+| `triple-c-icon-small.svg` | The app icon at small sizes — small mark, drawn at 82%. |
+| `triple-c-lockup-dark.svg` | Horizontal lockup for dark backgrounds. Wordmark is outlined, so no font is needed to render it. |
+| `triple-c-lockup-light.svg` | The same for light backgrounds. |
+| `triple-c-icon-1024.png` | Master raster, generated. |
+| `build-icons.py` | Regenerates every packaged icon from the SVGs. |
+
+## Palette
+
+| Role | Dark ground | Light ground |
+|---|---|---|
+| Frame | `#58A6FF` (`--accent`) | `#1F6FEB` (`--accent-emphasis`) |
+| Prompt | `#F0821E` | `#C4610F` |
+| Tile | `#0D1117` (`--bg-primary`) | — |
+| Wordmark | `#E6EDF3` (`--text-primary`) | `#131C25` |
+
+The frame and prompt colours are the app's own accent tokens from `app/src/index.css`, which is why
+the icon sits on the app's chrome instead of fighting it. Orange is the only equity carried over
+from the previous marks, and it is now an accent rather than a background.
+
+## Two sources, not one
+
+`build-icons.py` renders sizes ≥ 48 px from `triple-c-icon.svg` and sizes ≤ 32 px from
+`triple-c-icon-small.svg`. At small sizes the cursor bar closes up against the chevron and a 12 px
+frame stroke resamples to a grey smear, so the small variant drops the cursor, widens the mouth,
+thickens the strokes and draws the mark larger inside the tile.
+
+This matters most for `icon.ico`: Windows picks the 16 px entry for the window corner and 24/32 px
+for the taskbar. The previous `.ico` contained a *single* 16 px image, which Windows then upscaled
+everywhere else — the likely cause of `screenshot_for_fix/task_bar_icon_not_correct.png`. The
+current one carries 16, 24, 32, 48, 64, 128 and 256, each rendered from vector rather than
+downsampled from one bitmap.
+
+## Regenerating
+
+```bash
+pip install cairosvg pillow
+python3 branding/build-icons.py
+```
+
+Writes `app/src-tauri/icons/{32x32,128x128,128x128@2x,icon}.png`, `icon.ico`, `icon.icns`,
+`app/public/favicon.svg` and `branding/triple-c-icon-1024.png`. Do not hand-edit those — edit the
+SVG and re-run.
+
+The lockups are committed sources, not generated: their wordmark is Liberation Mono Bold converted
+to outlines (`-1.6` tracking, 44 px cap height), so re-cutting it needs the font and `fonttools`.

branding/archive/README.md

@@ -0,0 +1,11 @@
+# Archive
+
+The marks Triple-C shipped before the current one, kept for reference.
+
+| File | Notes |
+|---|---|
+| `triple-c-app-logo.png` | First mark: orange tile, overlapping C letterforms, "TRIPLE-C / CONTAINERIZED CODING" set inside the icon. |
+| `triple-c-app-logov2.png` | Second mark: orange sunburst with "Triple-C / Coding Container" over it, transparent ground. |
+
+Both were drawn at poster size and carried type inside the icon, so nothing in them survived the
+16–32 px range where an app icon actually lives. Neither is referenced by the app or the build.

branding/build-icons.py

@@ -0,0 +1,122 @@
+#!/usr/bin/env python3
+"""Render every packaged icon from the SVG sources in this directory.
+
+    pip install cairosvg pillow
+    python3 branding/build-icons.py
+
+The SVGs are the source of truth; everything under app/src-tauri/icons/ and the
+favicon are generated. Two sources, not one, on purpose:
+
+    triple-c-icon.svg        used for 48 px and up
+    triple-c-icon-small.svg  used for 32 px and down
+
+At 16-32 px the cursor bar closes up against the chevron and the frame's 12 px
+stroke resamples to a grey smear, so the small source drops the cursor, widens
+the mouth and draws the mark larger in the tile. Windows picks the 16 and 24 px
+entries out of the .ico for the taskbar and window corner, which is exactly
+where the old single-size .ico was falling over.
+"""
+
+import io
+import struct
+from pathlib import Path
+
+import cairosvg
+from PIL import Image
+
+BRANDING = Path(__file__).resolve().parent
+REPO = BRANDING.parent
+ICONS = REPO / "app" / "src-tauri" / "icons"
+PUBLIC = REPO / "app" / "public"
+
+FULL_SRC = BRANDING / "triple-c-icon.svg"
+SMALL_SRC = BRANDING / "triple-c-icon-small.svg"
+
+# Below this, render from the small source.
+SMALL_MAX = 32
+
+# .ico entries. Windows uses 16 in the window corner and 24/32 in the taskbar,
+# 48 in list views and 256 in the "extra large icons" view.
+ICO_SIZES = [16, 24, 32, 48, 64, 128, 256]
+
+# .icns entries: (chunk type, pixel size). PNG-backed chunks, macOS 10.7+.
+ICNS_ENTRIES = [
+    (b"ic11", 32),    # 16pt @2x
+    (b"ic12", 64),    # 32pt @2x
+    (b"ic07", 128),   # 128pt
+    (b"ic13", 256),   # 128pt @2x
+    (b"ic08", 256),   # 256pt
+    (b"ic14", 512),   # 256pt @2x
+    (b"ic09", 512),   # 512pt
+    (b"ic10", 1024),  # 512pt @2x
+]
+
+
+def render(size: int) -> Image.Image:
+    """Rasterise the right source at `size` px square."""
+    src = SMALL_SRC if size <= SMALL_MAX else FULL_SRC
+    png = cairosvg.svg2png(url=str(src), output_width=size, output_height=size)
+    return Image.open(io.BytesIO(png)).convert("RGBA")
+
+
+def write_png(size: int, path: Path) -> None:
+    render(size).save(path, "PNG", optimize=True)
+    print(f"  {path.relative_to(REPO)}  {size}x{size}")
+
+
+def write_ico(path: Path) -> None:
+    """Hand-assemble the .ico so each entry can come from its own source.
+
+    Pillow's save(sizes=...) downsamples one image, which would put the
+    12 px-stroke artwork into the 16 px entry — the thing this avoids.
+    """
+    images = [render(s) for s in ICO_SIZES]
+    payloads = []
+    for img in images:
+        buf = io.BytesIO()
+        img.save(buf, "PNG", optimize=True)  # PNG-compressed entries, Vista+
+        payloads.append(buf.getvalue())
+
+    offset = 6 + 16 * len(images)
+    header = struct.pack("<HHH", 0, 1, len(images))
+    entries, blob = b"", b""
+    for img, data in zip(images, payloads):
+        w = 0 if img.width >= 256 else img.width
+        h = 0 if img.height >= 256 else img.height
+        entries += struct.pack("<BBBBHHII", w, h, 0, 0, 1, 32, len(data), offset)
+        blob += data
+        offset += len(data)
+    path.write_bytes(header + entries + blob)
+    print(f"  {path.relative_to(REPO)}  {', '.join(str(s) for s in ICO_SIZES)}")
+
+
+def write_icns(path: Path) -> None:
+    chunks = b""
+    for kind, size in ICNS_ENTRIES:
+        buf = io.BytesIO()
+        render(size).save(buf, "PNG", optimize=True)
+        data = buf.getvalue()
+        chunks += kind + struct.pack(">I", len(data) + 8) + data
+    path.write_bytes(b"icns" + struct.pack(">I", len(chunks) + 8) + chunks)
+    print(f"  {path.relative_to(REPO)}  {', '.join(str(s) for _, s in ICNS_ENTRIES)}")
+
+
+def main() -> None:
+    print("branding/")
+    write_png(1024, BRANDING / "triple-c-icon-1024.png")
+
+    print("app/src-tauri/icons/")
+    write_png(32, ICONS / "32x32.png")
+    write_png(128, ICONS / "128x128.png")
+    write_png(256, ICONS / "128x128@2x.png")
+    write_png(512, ICONS / "icon.png")
+    write_ico(ICONS / "icon.ico")
+    write_icns(ICONS / "icon.icns")
+
+    print("app/public/")
+    (PUBLIC / "favicon.svg").write_text(SMALL_SRC.read_text())
+    print(f"  {(PUBLIC / 'favicon.svg').relative_to(REPO)}  (copy of {SMALL_SRC.name})")
+
+
+if __name__ == "__main__":
+    main()

branding/triple-c-icon-small.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Triple-C">
+  <title>Triple-C application icon, small-size variant</title>
+  <!-- Source for every raster ≤ 32 px: the small mark, drawn at 82% so the strokes
+       survive being resampled down to 16 px. See build-icons.py. -->
+  <rect width="128" height="128" rx="28.16" fill="#0D1117"/>
+  <g transform="translate(2.9236 2.9236) scale(0.95418)">
+    <g fill="none" stroke-linecap="round" stroke-linejoin="round">
+      <path d="M112 50 L112 38 A22 22 0 0 0 90 16 L38 16 A22 22 0 0 0 16 38 L16 90 A22 22 0 0 0 38 112 L90 112 A22 22 0 0 0 112 90 L112 78"
+            stroke="#58A6FF" stroke-width="14"/>
+      <path d="M46 50 L62 66 L46 82" stroke="#F0821E" stroke-width="13"/>
+    </g>
+  </g>
+</svg>

branding/triple-c-icon.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Triple-C">
+  <title>Triple-C application icon</title>
+  <!-- App icon: the mark on the app's own ground (bg-primary), at 70% of the tile.
+       Source for every raster ≥ 48 px. See build-icons.py. -->
+  <rect width="128" height="128" rx="28.16" fill="#0D1117"/>
+  <g transform="translate(10.8988 10.8988) scale(0.82963)">
+    <g fill="none" stroke-linecap="round" stroke-linejoin="round">
+      <path d="M112 46 L112 38 A22 22 0 0 0 90 16 L38 16 A22 22 0 0 0 16 38 L16 90 A22 22 0 0 0 38 112 L90 112 A22 22 0 0 0 112 90 L112 82"
+            stroke="#58A6FF" stroke-width="12"/>
+      <path d="M42 50 L58 66 L42 82" stroke="#F0821E" stroke-width="11"/>
+      <path d="M68 82 L88 82" stroke="#F0821E" stroke-width="11"/>
+    </g>
+  </g>
+</svg>

branding/triple-c-mark-small.svg

@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Triple-C">
+  <title>Triple-C mark, small-size variant</title>
+  <!-- Optical variant for 32 px and below: heavier strokes, wider mouth, no cursor bar.
+       Below ~40 px the cursor closes up against the chevron and the frame goes to mush. -->
+  <g fill="none" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M112 50 L112 38 A22 22 0 0 0 90 16 L38 16 A22 22 0 0 0 16 38 L16 90 A22 22 0 0 0 38 112 L90 112 A22 22 0 0 0 112 90 L112 78"
+          stroke="#58A6FF" stroke-width="14"/>
+    <path d="M46 50 L62 66 L46 82" stroke="#F0821E" stroke-width="13"/>
+  </g>
+</svg>

branding/triple-c-mark.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Triple-C">
+  <title>Triple-C mark</title>
+  <!-- The container frame, opened on the right so the enclosure itself is the letter C. -->
+  <g fill="none" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M112 46 L112 38 A22 22 0 0 0 90 16 L38 16 A22 22 0 0 0 16 38 L16 90 A22 22 0 0 0 38 112 L90 112 A22 22 0 0 0 112 90 L112 82"
+          stroke="#58A6FF" stroke-width="12"/>
+    <!-- The prompt: chevron and cursor. -->
+    <path d="M42 50 L58 66 L42 82" stroke="#F0821E" stroke-width="11"/>
+    <path d="M68 82 L88 82" stroke="#F0821E" stroke-width="11"/>
+  </g>
+</svg>

container/Dockerfile

@@ -318,6 +318,13 @@ COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh
 COPY triple-c-scheduler /usr/local/bin/triple-c-scheduler
 RUN chmod +x /usr/local/bin/triple-c-scheduler
+# Lives in /usr/local/bin rather than under /home/claude on purpose: the home
+# directory is the mount point of the project's home volume, so an image copy
+# of it is masked after the project's first start and can never be updated
+# again. /usr/local/bin rides the snapshot and is replaced on migration, which
+# is what lets a fix to this script reach an existing project at all.
+COPY triple-c-playwright-heal /usr/local/bin/triple-c-playwright-heal
+RUN chmod +x /usr/local/bin/triple-c-playwright-heal
 COPY triple-c-task-runner /usr/local/bin/triple-c-task-runner
 RUN chmod +x /usr/local/bin/triple-c-task-runner
 

container/entrypoint.sh

@@ -425,6 +425,32 @@ if [ -x /usr/local/bin/triple-c-open ]; then
     export BROWSER=/usr/local/bin/triple-c-open
 fi
 
+# ── Playwright browser config ───────────────────────────────────────────────
+# Seed ~/.playwright/cli.config.json on every start.
+#
+# Without it `playwright-cli` resolves to channel `chrome` — system Google
+# Chrome — with the Chromium sandbox ON, and these containers do not permit
+# unprivileged user namespaces, so the browser aborts with "Failed to move to
+# new namespace ... Operation not permitted". On a base image that no longer
+# ships Google Chrome the same default fails the other way, with "Chromium
+# distribution 'chrome' is not found". One cause, two error messages, and
+# neither of them looks like a configuration problem.
+#
+# Seeded here rather than baked into the image because ~/.playwright is inside
+# the home volume: an image copy would reach new projects only, and every
+# existing project would stay broken forever. Written on every start from a
+# source outside the volume, the way CLAUDE_INSTRUCTIONS and the Mission
+# Control skills already are.
+#
+# --seed-config-only is the cheap path: no npm install, no browser download, no
+# apt, no verify launch, nothing over the network. It writes one small file if
+# it is absent and returns. Measured at ~2 ms. The heavier repairs stay
+# on-demand — run `triple-c-playwright-heal` with no arguments for those.
+if [ -x /usr/local/bin/triple-c-playwright-heal ]; then
+    /usr/local/bin/triple-c-playwright-heal --seed-config-only --quiet || \
+        echo "entrypoint: warning — playwright config seeding failed (browser view may not launch)"
+fi
+
 # ── Scheduler setup ─────────────────────────────────────────────────────────
 SCHEDULER_DIR="/home/claude/.claude/scheduler"
 mkdir -p "$SCHEDULER_DIR/tasks" "$SCHEDULER_DIR/logs" "$SCHEDULER_DIR/notifications"
@@ -434,17 +460,26 @@ chown -R claude:claude "$SCHEDULER_DIR"
 cron
 
 # Save environment variables for cron jobs (cron runs with a minimal env)
+#
+# HOME is deliberately NOT captured here. This entrypoint runs as root, so the
+# snapshot would record HOME=/root — and the task runner sources this file with
+# `set -a`, which would overwrite the HOME cron gives the job. Claude Code then
+# looks for its OAuth credential at /root/.claude/.credentials.json instead of
+# /home/claude/.claude/.credentials.json and every scheduled task dies with
+# "Not logged in · Please run /login". Cron still needs a HOME, so it is written
+# explicitly below with the value the `claude` user actually has.
 ENV_FILE="$SCHEDULER_DIR/.env"
 : > "$ENV_FILE"
 env | while IFS='=' read -r key value; do
     case "$key" in
-        ANTHROPIC_*|AWS_*|CLAUDE_CODE_*|TRIPLE_C_PERMISSION_MODE|PATH|HOME|LANG|TZ|COLORTERM|BROWSER|NODE_EXTRA_CA_CERTS|REQUESTS_CA_BUNDLE|SSL_CERT_FILE)
+        ANTHROPIC_*|AWS_*|CLAUDE_CODE_*|TRIPLE_C_PERMISSION_MODE|PATH|LANG|TZ|COLORTERM|BROWSER|NODE_EXTRA_CA_CERTS|REQUESTS_CA_BUNDLE|SSL_CERT_FILE)
             # Escape single quotes in value and write as KEY='VALUE'
             escaped_value=$(printf '%s' "$value" | sed "s/'/'\\\\''/g")
             printf "%s='%s'\n" "$key" "$escaped_value" >> "$ENV_FILE"
             ;;
     esac
 done
+printf "HOME='/home/claude'\n" >> "$ENV_FILE"
 chown claude:claude "$ENV_FILE"
 chmod 600 "$ENV_FILE"
 

container/triple-c-playwright-heal

@@ -0,0 +1,272 @@
+#!/bin/bash
+# triple-c-playwright-heal — make Playwright usable in a Triple-C container.
+#
+# Idempotent: safe to run on every start and safe to re-run after a partial
+# failure. Each step checks for its own result first, so a healthy container is
+# a fast no-op that still prints why it is healthy. The last step is the only
+# one that means anything: it launches a browser for real.
+#
+# The things that go wrong, in the order they bite:
+#
+#   1. @playwright/cli missing — including the case where it was installed and
+#      then silently removed again. `npm install --no-save <pkg>` in /workspace,
+#      which has no package.json, prunes packages npm considers extraneous, so
+#      installing @playwright/cli and then installing playwright wipes the
+#      first one and leaves an empty node_modules/@playwright/. That directory
+#      reads as "installed" to a naive check, which is why this script tests
+#      the package *entry point*.
+#
+#   2. Bundled chromium missing or the wrong revision. Browsers live in the
+#      home volume and outlive any single @playwright/cli install, so a stale
+#      chromium-<old> is routinely present while the installed playwright-core
+#      wants a newer one. Must be installed AS claude: run as root it lands in
+#      /root/.cache/ms-playwright where the agent cannot see it.
+#
+#   3. No cli.config.json — the one that breaks an otherwise clean install.
+#      With no config, playwright-cli resolves to channel `chrome` (system
+#      Google Chrome) with the sandbox ON. These containers forbid unprivileged
+#      user namespaces, so Chrome aborts with "Failed to move to new namespace
+#      ... Operation not permitted". On newer base images Chrome is not present
+#      at all and it fails with "Chromium distribution 'chrome' is not found".
+#      Same root cause both ways: the default channel is wrong here.
+#
+#   4. The storage-state file the config points at is missing. Playwright
+#      treats an unreadable storageState as a hard error on every launch, not
+#      as "no saved state", so the file has to exist from the very first run.
+#
+#   5. xvfb or socat missing (older base images only). Headless Playwright
+#      needs neither; the `playwright-cli show` dashboard needs xvfb, and the
+#      browser-view pane needs socat — without it the pane reports
+#      "127.0.0.1 sent an invalid response" while the container side is fine.
+#
+# Usage: triple-c-playwright-heal [--seed-config-only] [--force-config] [--quiet]
+#   --seed-config-only  only ensure the config and its storage-state file
+#                       exist. No npm install, no browser download, no apt, no
+#                       verify launch. Cheap and offline — this is the mode
+#                       entrypoint.sh runs on every container start.
+#   --force-config      overwrite an existing config instead of keeping it
+#   --quiet             print only problems and repairs, not healthy no-ops
+
+set -u
+
+TARGET_USER=claude
+TARGET_HOME=/home/claude
+PW_DIR=/workspace
+CONFIG_DIR="$TARGET_HOME/.playwright"
+CONFIG_FILE="$CONFIG_DIR/cli.config.json"
+STATE_FILE="$CONFIG_DIR/storage-state.json"
+CLI_ENTRY="$PW_DIR/node_modules/@playwright/cli/playwright-cli.js"
+
+FORCE_CONFIG=0
+QUIET=0
+SEED_ONLY=0
+for arg in "$@"; do
+    case "$arg" in
+        --force-config)     FORCE_CONFIG=1 ;;
+        --quiet)            QUIET=1 ;;
+        --seed-config-only) SEED_ONLY=1 ;;
+        *) echo "playwright-heal: unknown option: $arg" >&2; exit 2 ;;
+    esac
+done
+
+changed=0
+failed=0
+
+say()  { [ "$QUIET" = 1 ] || echo "playwright-heal: $*"; }
+warn() { echo "playwright-heal: $*" >&2; }
+did()  { changed=1; echo "playwright-heal: $*"; }
+
+# Run as claude whether we were invoked as root (docker exec / entrypoint) or
+# as claude (terminal session). Nothing user-visible may end up root-owned.
+as_claude() {
+    if [ "$(id -u)" = 0 ]; then
+        su "$TARGET_USER" -s /bin/sh -c "$1"
+    else
+        sh -c "$1"
+    fi
+}
+
+# ── 1. @playwright/cli ───────────────────────────────────────────────────────
+if [ "$SEED_ONLY" = 1 ]; then
+    :
+elif [ -f "$CLI_ENTRY" ]; then
+    say "@playwright/cli present"
+else
+    # An empty leftover @playwright/ can make npm consider the tree settled.
+    if [ -d "$PW_DIR/node_modules/@playwright" ]; then
+        say "clearing partial @playwright install"
+        rm -rf "$PW_DIR/node_modules/@playwright"
+    fi
+    say "installing @playwright/cli..."
+    if as_claude "cd $PW_DIR && npm install --no-save --no-audit --no-fund @playwright/cli" >/tmp/pw-heal-npm.log 2>&1; then
+        did "installed @playwright/cli"
+    else
+        warn "npm install failed; see /tmp/pw-heal-npm.log"
+        failed=1
+    fi
+fi
+
+# ── 2. bundled chromium ──────────────────────────────────────────────────────
+# Ask Playwright where *this* version's chromium belongs rather than globbing
+# chromium-*, which would call a stale revision "present" and then fail at
+# launch with 'Browser "chrome-for-testing" is not installed'. --dry-run prints
+# the install location for the installed version and downloads nothing.
+if [ "$SEED_ONLY" = 1 ]; then
+    :
+else
+    chromium_dir=""
+    if [ -f "$PW_DIR/node_modules/playwright-core/cli.js" ]; then
+        chromium_dir=$(as_claude "cd $PW_DIR && node node_modules/playwright-core/cli.js install --dry-run chromium 2>/dev/null" \
+                       | awk '/Install location:/ { print $3; exit }')
+    fi
+
+    if [ -n "$chromium_dir" ] && [ -d "$chromium_dir" ]; then
+        say "chromium present ($(basename "$chromium_dir"))"
+    elif [ -f "$PW_DIR/node_modules/playwright-core/cli.js" ]; then
+        say "downloading chromium (~300 MB)..."
+        if as_claude "cd $PW_DIR && node node_modules/playwright-core/cli.js install chromium" >/tmp/pw-heal-browser.log 2>&1; then
+            did "installed chromium"
+        else
+            warn "chromium install failed; see /tmp/pw-heal-browser.log"
+            failed=1
+        fi
+    else
+        warn "playwright-core missing, cannot install chromium"
+        failed=1
+    fi
+fi
+
+# ── 3. cli.config.json ───────────────────────────────────────────────────────
+# The *global* config, not a project-level .playwright/, because the project
+# one resolves relative to the current working directory and silently stops
+# applying the moment you cd elsewhere.
+#
+# `chrome-for-testing` is the only recognised chromium alias — "chromium" is
+# not one and falls back to system Chrome. chromiumSandbox:false is what
+# actually appends --no-sandbox.
+write_config() {
+    mkdir -p "$CONFIG_DIR" || return 1
+    cat > "$CONFIG_FILE" <<EOF
+{
+  "browser": {
+    "browserName": "chromium",
+    "launchOptions": {
+      "channel": "chrome-for-testing",
+      "chromiumSandbox": false,
+      "args": ["--no-sandbox", "--disable-dev-shm-usage"]
+    },
+    "contextOptions": {
+      "storageState": "$STATE_FILE"
+    }
+  }
+}
+EOF
+    chown -R "$TARGET_USER:$TARGET_USER" "$CONFIG_DIR" 2>/dev/null || true
+}
+
+# storageState is a *load* path, and Playwright reads it at context creation.
+# A path that does not exist is not treated as "no saved state" — it is a hard
+# error, "Error reading storage state from …", on every single launch. So the
+# file has to exist before the config that names it can be used at all, and it
+# has to be recreated if anything deletes it. An empty state is valid and
+# behaves exactly like no state.
+#
+# The path is read back out of the config rather than assumed, so a
+# hand-edited config pointing somewhere else still gets its file created
+# instead of being silently broken by ours.
+ensure_state_file() {
+    [ -f "$CONFIG_FILE" ] || return 0
+    state_path=$(grep -o '"storageState"[[:space:]]*:[[:space:]]*"[^"]*"' "$CONFIG_FILE" 2>/dev/null \
+                 | sed 's/.*"\([^"]*\)"[[:space:]]*$/\1/')
+    [ -n "$state_path" ] || return 0
+    [ -f "$state_path" ] && return 0
+    mkdir -p "$(dirname "$state_path")" 2>/dev/null
+    printf '{\n  "cookies": [],\n  "origins": []\n}\n' > "$state_path" || return 1
+    chown "$TARGET_USER:$TARGET_USER" "$state_path" 2>/dev/null || true
+    did "created empty $state_path (storageState needs it to exist)"
+}
+
+if [ ! -f "$CONFIG_FILE" ]; then
+    if write_config; then did "wrote $CONFIG_FILE"; else warn "could not write $CONFIG_FILE"; failed=1; fi
+elif [ "$FORCE_CONFIG" = 1 ]; then
+    if write_config; then did "overwrote $CONFIG_FILE (--force-config)"; else warn "could not write $CONFIG_FILE"; failed=1; fi
+elif grep -q '"chromiumSandbox"[[:space:]]*:[[:space:]]*false' "$CONFIG_FILE" 2>/dev/null; then
+    say "config present and disables the sandbox"
+else
+    # Present but hand-edited into a state that will not launch. Do not clobber
+    # deliberate config silently; say what is wrong and how to replace it.
+    warn "config at $CONFIG_FILE does not set chromiumSandbox:false — the browser will likely fail to launch. Re-run with --force-config to replace it."
+fi
+
+# Unconditional: the config may name a storageState this run did not write —
+# one seeded by an older version of this script, or edited by hand — and a
+# missing file there breaks every launch.
+ensure_state_file || { warn "could not create the storage-state file"; failed=1; }
+
+if [ "$SEED_ONLY" = 1 ]; then
+    [ "$failed" = 1 ] && exit 1
+    exit 0
+fi
+
+# ── 4. xvfb (headed dashboard only) ──────────────────────────────────────────
+# Current base images get this from `playwright install-deps` (its `tools`
+# group); older ones predate that layer. Headless never needs it, so a missing
+# xvfb is a note, not a failure.
+if command -v Xvfb >/dev/null 2>&1; then
+    say "xvfb present"
+elif [ "$(id -u)" = 0 ]; then
+    say "installing xvfb (needed only for the headed dashboard)..."
+    if (apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq xvfb) >/tmp/pw-heal-xvfb.log 2>&1; then
+        did "installed xvfb"
+    else
+        warn "xvfb install failed (headless still works); see /tmp/pw-heal-xvfb.log"
+    fi
+else
+    say "xvfb missing and not running as root — skipping (headless still works)"
+fi
+
+# ── 4b. socat (the browser-view pane's tunnel) ───────────────────────────────
+# Not Playwright's, but the same class of failure and it presents as a
+# Playwright problem: the pane's host-side proxy reaches the dashboard by
+# running `socat` *inside* the container over a Docker exec. On a container old
+# enough to predate socat in the base image, that exec produces something that
+# is not an HTTP response, and the webview reports "127.0.0.1 sent an invalid
+# response" — with the container side working perfectly. A project keeps the
+# base image it was first built from until it is migrated, so this is the
+# normal case on an older project, not an exotic one.
+if command -v socat >/dev/null 2>&1; then
+    say "socat present"
+elif [ "$(id -u)" = 0 ]; then
+    say "installing socat (needed by the browser-view pane)..."
+    if (apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq socat) >/tmp/pw-heal-socat.log 2>&1; then
+        did "installed socat"
+    else
+        warn "socat install failed; the browser-view pane will report an invalid response. See /tmp/pw-heal-socat.log"
+        failed=1
+    fi
+else
+    warn "socat missing and not running as root — the browser-view pane will report an invalid response"
+fi
+
+# ── 5. verify by actually launching ──────────────────────────────────────────
+# Every step above can report success while the browser still refuses to
+# start — that is precisely how this broke. A dedicated session name keeps
+# this clear of whatever the agent already has open.
+if [ -f "$CLI_ENTRY" ]; then
+    verify_out=$(as_claude "cd /tmp && timeout 90 node $CLI_ENTRY -s=heal-verify open 'data:text/html,<h1>ok</h1>' 2>&1")
+    if printf '%s' "$verify_out" | grep -q 'opened with pid'; then
+        say "verified: browser launches"
+        as_claude "cd /tmp && timeout 30 node $CLI_ENTRY -s=heal-verify close" >/dev/null 2>&1
+    else
+        warn "browser still fails to launch:"
+        printf '%s\n' "$verify_out" | grep -m4 -E 'namespace|Check failed|is not installed|is not found|missing dependencies|Error' >&2
+        failed=1
+    fi
+else
+    warn "@playwright/cli not installed — nothing to verify"
+    failed=1
+fi
+
+[ "$failed" = 1 ] && exit 1
+[ "$changed" = 1 ] && say "done — repairs applied" || say "done — nothing to repair"
+exit 0

container/triple-c-scheduler

@@ -8,17 +8,59 @@ SCHEDULER_DIR="${HOME}/.claude/scheduler"
 TASKS_DIR="${SCHEDULER_DIR}/tasks"
 LOGS_DIR="${SCHEDULER_DIR}/logs"
 NOTIFICATIONS_DIR="${SCHEDULER_DIR}/notifications"
+RUNNING_DIR="${SCHEDULER_DIR}/running"
 
 # ── Helpers ──────────────────────────────────────────────────────────────────
 
 ensure_dirs() {
-    mkdir -p "$TASKS_DIR" "$LOGS_DIR" "$NOTIFICATIONS_DIR"
+    mkdir -p "$TASKS_DIR" "$LOGS_DIR" "$NOTIFICATIONS_DIR" "$RUNNING_DIR"
 }
 
 generate_id() {
     head -c 4 /dev/urandom | od -An -tx1 | tr -d ' \n'
 }
 
+# Live run state for a task: prints "pid<TAB>started_epoch<TAB>log" and returns
+# 0 when the task is genuinely running, returns 1 otherwise.
+#
+# triple-c-task-runner writes the file and removes it from an EXIT trap, but a
+# trap cannot fire for SIGKILL or a container stop mid-run. So the pid is
+# checked rather than believed, and a state file whose process is gone is
+# cleared here — otherwise one hard stop leaves a task reading as "running"
+# forever, which is worse than no indicator at all.
+run_state() {
+    local id="$1"
+    local state_file="${RUNNING_DIR}/${id}.json"
+    [ -f "$state_file" ] || return 1
+
+    local pid
+    pid=$(jq -r '.pid // empty' "$state_file" 2>/dev/null)
+    if [ -z "$pid" ] || ! kill -0 "$pid" 2>/dev/null; then
+        rm -f "$state_file"
+        return 1
+    fi
+
+    printf '%s\t%s\t%s\n' \
+        "$pid" \
+        "$(jq -r '.started_epoch // 0' "$state_file")" \
+        "$(jq -r '.log // ""' "$state_file")"
+}
+
+# Compact elapsed time since an epoch, e.g. "8s", "4m12s", "1h07m".
+elapsed_since() {
+    local start="$1" now delta
+    now=$(date +%s)
+    delta=$(( now - start ))
+    [ "$delta" -lt 0 ] && delta=0
+    if [ "$delta" -ge 3600 ]; then
+        printf '%dh%02dm' $(( delta / 3600 )) $(( (delta % 3600) / 60 ))
+    elif [ "$delta" -ge 60 ]; then
+        printf '%dm%02ds' $(( delta / 60 )) $(( delta % 60 ))
+    else
+        printf '%ds' "$delta"
+    fi
+}
+
 # Reject a malformed cron expression at the point of entry.
 #
 # Without this an invalid schedule is written to a task file, and the next
@@ -85,8 +127,9 @@ Commands:
   enable       Enable a disabled task
   disable      Disable a task
   list         List all tasks
+  status       Show which tasks are running right now
   logs         Show execution logs
-  run          Manually trigger a task now
+  run          Manually trigger a task now (streams its log)
   notifications  Show or clear completion notifications
 
 Add options:
@@ -99,6 +142,10 @@ Add options:
 Remove/Enable/Disable/Run options:
   --id ID              Task ID (required)
 
+Status options:
+  --id ID              Show one task, including its last result when idle
+  --watch, -w          Refresh every 5s until the run finishes
+
 Logs options:
   --id ID              Show logs for a specific task (optional)
   --tail N             Show last N lines (default: 50)
@@ -313,8 +360,8 @@ cmd_disable() {
 
 cmd_list() {
     local found=false
-    printf "%-10s %-20s %-10s %-9s %-20s %s\n" "ID" "NAME" "TYPE" "ENABLED" "SCHEDULE" "PROMPT"
+    printf "%-10s %-20s %-10s %-9s %-20s %-12s %s\n" "ID" "NAME" "TYPE" "ENABLED" "SCHEDULE" "STATUS" "PROMPT"
-    printf "%-10s %-20s %-10s %-9s %-20s %s\n" "──────────" "────────────────────" "──────────" "─────────" "────────────────────" "──────────────────────────────"
+    printf "%-10s %-20s %-10s %-9s %-20s %-12s %s\n" "──────────" "────────────────────" "──────────" "─────────" "────────────────────" "────────────" "──────────────────────────────"
 
     for task_file in "$TASKS_DIR"/*.json; do
         [ -f "$task_file" ] || continue
@@ -333,12 +380,21 @@ cmd_list() {
             display_schedule="at $at"
         fi
 
+        local status state started
+        if state=$(run_state "$id"); then
+            started=$(printf '%s' "$state" | cut -f2)
+            status="running $(elapsed_since "$started")"
+        else
+            status="idle"
+        fi
+
         # Truncate long fields for display
         [ ${#name} -gt 20 ] && name="${name:0:17}..."
         [ ${#display_schedule} -gt 20 ] && display_schedule="${display_schedule:0:17}..."
         [ ${#prompt} -gt 30 ] && prompt="${prompt:0:27}..."
 
-        printf "%-10s %-20s %-10s %-9s %-20s %s\n" "$id" "$name" "$type" "$enabled" "$display_schedule" "$prompt"
+        printf "%-10s %-20s %-10s %-9s %-20s %-12s %s\n" \
+            "$id" "$name" "$type" "$enabled" "$display_schedule" "$status" "$prompt"
     done
 
     if [ "$found" = "false" ]; then
@@ -346,6 +402,78 @@ cmd_list() {
     fi
 }
 
+# Is anything running, and how far along is it?
+#
+# This is the command for the question "did my `run` do anything, or has it
+# stalled?" — `logs` alone cannot answer it, because a log that stops growing
+# looks identical whether Claude is thinking or the run is dead.
+cmd_status() {
+    local id="" watch=false
+
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --id)    id="$2"; shift 2 ;;
+            --watch|-w) watch=true; shift ;;
+            *) echo "Unknown option: $1" >&2; return 1 ;;
+        esac
+    done
+
+    while true; do
+        local any=false
+        for task_file in "$TASKS_DIR"/*.json; do
+            [ -f "$task_file" ] || continue
+            local tid
+            tid=$(jq -r '.id' "$task_file")
+            [ -z "$id" ] || [ "$tid" = "$id" ] || continue
+
+            local name state
+            name=$(jq -r '.name' "$task_file")
+            if state=$(run_state "$tid"); then
+                any=true
+                local pid started log
+                pid=$(printf '%s' "$state" | cut -f1)
+                started=$(printf '%s' "$state" | cut -f2)
+                log=$(printf '%s' "$state" | cut -f3)
+                echo "● RUNNING  $name ($tid)"
+                echo "    elapsed: $(elapsed_since "$started")   pid: $pid"
+                echo "    log:     $log"
+                # `claude -p` writes its answer in one go at the end, so a log
+                # with only its header is the normal state of a healthy run —
+                # print the tail only when there is something to show, rather
+                # than an empty "last output:" that reads like a stall.
+                # `|| true` throughout: under `set -e` a grep matching nothing
+                # would otherwise abort the whole command.
+                local tail_out=""
+                if [ -f "$log" ]; then
+                    tail_out=$({ grep -v '^===' "$log" || true; } \
+                        | { grep -v '^$' || true; } | tail -n 3)
+                fi
+                if [ -n "$tail_out" ]; then
+                    echo "    last output:"
+                    printf '%s\n' "$tail_out" | sed 's/^/      /'
+                fi
+            elif [ -n "$id" ]; then
+                echo "○ idle     $name ($tid)"
+                local latest
+                latest=$(ls -t "$LOGS_DIR/$tid"/*.log 2>/dev/null | head -1) || true
+                if [ -n "$latest" ]; then
+                    echo "    last run: $(basename "$latest" .log)  $(grep -o 'Exit code: [0-9]*' "$latest" | tail -1)"
+                fi
+            fi
+        done
+
+        if [ "$any" = "false" ] && [ -z "$id" ]; then
+            echo "Nothing running."
+        fi
+
+        [ "$watch" = "true" ] || break
+        # Stop watching once the thing being watched has finished.
+        [ "$any" = "true" ] || break
+        sleep 5
+        echo ""
+    done
+}
+
 cmd_logs() {
     local id="" tail_n=50
 
@@ -413,8 +541,53 @@ cmd_run() {
 
     local name
     name=$(jq -r '.name' "$task_file")
+
+    if run_state "$id" >/dev/null; then
+        echo "Task '$name' ($id) is already running — see: triple-c-scheduler status --id $id"
+        return 0
+    fi
+
     echo "Manually triggering task '$name' ($id)..."
-    /usr/local/bin/triple-c-task-runner "$id"
+
+    # Run in the background and stream its log. A task can easily think for
+    # minutes, and the previous behaviour — block with no output until it is
+    # over — is indistinguishable from a hang.
+    /usr/local/bin/triple-c-task-runner "$id" &
+    local runner_pid=$!
+
+    local state="" waited=0
+    while [ "$waited" -lt 20 ]; do
+        if state=$(run_state "$id"); then
+            break
+        fi
+        kill -0 "$runner_pid" 2>/dev/null || break
+        sleep 0.5
+        waited=$(( waited + 1 ))
+    done
+
+    local log=""
+    [ -n "$state" ] && log=$(printf '%s' "$state" | cut -f3)
+
+    if [ -n "$log" ]; then
+        echo "  log:     $log"
+        echo "  elsewhere: triple-c-scheduler status --id $id --watch"
+        echo ""
+        # --pid stops the follow when the runner exits, so this returns on its own.
+        tail -n +1 -f --pid="$runner_pid" "$log" 2>/dev/null
+    fi
+
+    local rc=0
+    wait "$runner_pid" || rc=$?
+
+    # A run short enough that its state file was never observed still deserves
+    # its output shown rather than swallowed.
+    if [ -z "$log" ]; then
+        local latest
+        latest=$(ls -t "$LOGS_DIR/$id"/*.log 2>/dev/null | head -1) || true
+        [ -n "$latest" ] && tail -n 20 "$latest"
+    fi
+
+    return $rc
 }
 
 cmd_notifications() {
@@ -464,6 +637,7 @@ case "$command" in
     enable)        cmd_enable "$@" ;;
     disable)       cmd_disable "$@" ;;
     list)          cmd_list ;;
+    status)        cmd_status "$@" ;;
     logs)          cmd_logs "$@" ;;
     run)           cmd_run "$@" ;;
     notifications) cmd_notifications "$@" ;;

container/triple-c-task-runner

@@ -9,6 +9,7 @@ SCHEDULER_DIR="${HOME}/.claude/scheduler"
 TASKS_DIR="${SCHEDULER_DIR}/tasks"
 LOGS_DIR="${SCHEDULER_DIR}/logs"
 NOTIFICATIONS_DIR="${SCHEDULER_DIR}/notifications"
+RUNNING_DIR="${SCHEDULER_DIR}/running"
 ENV_FILE="${SCHEDULER_DIR}/.env"
 
 TASK_ID="${1:-}"
@@ -34,11 +35,19 @@ if ! flock -n 200; then
 fi
 
 # ── Source saved environment ─────────────────────────────────────────────────
+# The env file is a snapshot taken by the entrypoint, which runs as root. A
+# snapshot written before the entrypoint stopped capturing HOME still carries
+# HOME=/root, and `set -a` would apply it to `claude` below — which then finds no
+# credential under /root/.claude and exits with "Not logged in". The env file
+# lives on the home volume, so those stale copies outlive an image update until
+# the container is restarted; keep our own HOME regardless of what it says.
 if [ -f "$ENV_FILE" ]; then
+    REAL_HOME="${HOME:-/home/claude}"
     set -a
     # shellcheck disable=SC1090
     source "$ENV_FILE"
     set +a
+    HOME="$REAL_HOME"
 fi
 
 # ── Read task definition ────────────────────────────────────────────────────
@@ -69,6 +78,27 @@ mkdir -p "$TASK_LOG_DIR"
 TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
 LOG_FILE="${TASK_LOG_DIR}/${TIMESTAMP}.log"
 
+# ── Publish run state ───────────────────────────────────────────────────────
+# A scheduled run is detached — cron has no terminal, and the app fires it as a
+# detached exec — so without this there is no way to tell a task that is still
+# thinking from one that died, and a long run reads as a stall. `list`, `status`
+# and the app's Automation tab all read this file.
+#
+# flock above is what actually prevents overlapping runs; this is purely an
+# observability record, which is why readers verify the pid rather than trust
+# the file. The EXIT trap covers the crash paths (OOM, container stop, SIGTERM)
+# that would otherwise leave a task looking like it had been running for days.
+mkdir -p "$RUNNING_DIR"
+RUN_STATE="${RUNNING_DIR}/${TASK_ID}.json"
+trap 'rm -f "$RUN_STATE"' EXIT
+jq -n \
+    --arg pid "$$" \
+    --arg started "$(date +%s)" \
+    --arg log "$LOG_FILE" \
+    --arg name "$TASK_NAME" \
+    '{pid: ($pid | tonumber), started_epoch: ($started | tonumber), log: $log, name: $name}' \
+    > "$RUN_STATE"
+
 # ── Execute Claude agent ────────────────────────────────────────────────────
 {
     echo "=== Task: $TASK_NAME ($TASK_ID) ==="