FE-737: Web shell over the same host (M3) by lunelson · Pull Request #147 · hashintel/brunch

lunelson · 2026-05-21T15:37:49Z

FE-737: Start web shell frontier

FE-737 reject non-linear transcript JSONL

FE-737 fail fast on non-linear session RPC

FE-737 block TUI branch flows

lunelson · 2026-05-21T15:38:02Z

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

This stack of pull requests is managed by Graphite. Learn more about stacking.

semgrep-code-hashintel · 2026-05-21T16:05:06Z

+}
+
+function websocketHandshakeResponse(key: string): string {
+  const accept = createHash("sha1")


The use of a weak cryptographic algorithm (e.g., SHA-1 or MD5) has been identified. These algorithms are considered insecure due to vulnerabilities that make them susceptible to collision attacks, allowing attackers to compromise data integrity or security. Replace SHA-1 or MD5 with secure hashing algorithms, such as: SHA-256 or higher (e.g., SHA-3).

⭐ Fixed in commit ec2f985 ⭐

cursor · 2026-05-27T16:31:04Z

PR Summary

Medium Risk
Introduces a new browser transport and session-projection contract that many clients will depend on; mistakes in binding/linearity or RPC params could mis-route reads, though scope stays read-only POC with broad automated coverage.

Overview
Delivers M3 (web-shell): brunch --mode web runs a local HTTP host that serves the Vite-built React shell and exposes the same JSON-RPC handlers over WebSocket /rpc (no REST product reads). The browser stack adds React 19, TanStack Router/Query, dist-web in the build, and a minimal index.html entry.

Transcript and session reads are centralized on a canonical Brunch session envelope (readBrunchSessionEnvelope): one Pi header, one brunch.session_binding, strict entry shape, and fail-fast linearity (no branch-derived sessions, branch summaries, or multi-child graphs). Active-branch JSONL projection is removed; elicitation and display paths go through linear loaders with an allowlisted set of prompt-side custom entry types and new session.transcriptDisplay RPC alongside session.elicitationExchanges, including optional explicit { sessionId, specId } targets and a -32002 error for non-linear transcripts. The TUI extension cancels Pi session_before_tree / session_before_fork with a stable warning.

Shared json-rpc-protocol helpers factor parse/dispatch out of transports; fixture capture and tests are updated for the linear model. SPEC/PLAN mark web-shell complete, document D33-L (connections are client attachments, one-writer/many-observer POC), and advance the active frontier to graph-data-plane. Also adds the ln-judo-review agent skill and minor workflow doc tweaks (Graphite frontier setup, dist-web gitignore).

^{Reviewed by Cursor Bugbot for commit eab91df. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit eab91df. Configure here.}

cursor · 2026-05-27T16:34:38Z

+
+function hasRequiredSessionEntryShape(value: unknown): value is SessionEntry {
+  return isTranscriptEntry(value) && hasStringOrNullParentId(value)
+}


Identical function duplicated within same file

Low Severity

hasRequiredSessionEntryShape and isSessionEntry in brunch-session-envelope.ts have identical implementations — both return isTranscriptEntry(value) && hasStringOrNullParentId(value). One of them is unnecessary and risks diverging silently if only one is updated in the future.

Additional Locations (1)

src/brunch-session-envelope.ts#L159-L162

^{Reviewed by Cursor Bugbot for commit eab91df. Configure here.}

cursor · 2026-05-27T16:34:38Z

+    (value as { parentId?: unknown }).parentId === null ||
+    typeof (value as { parentId?: unknown }).parentId === "string"
+  )
+}


Transcript entry helpers duplicated across two files

Low Severity

isTranscriptEntry, isSessionEntry, and hasStringOrNullParentId are identically copy-pasted as private functions in both brunch-session-envelope.ts and elicitation-exchange.ts. Since elicitation-exchange.ts already imports from brunch-session-envelope.ts, these helpers could be shared rather than duplicated, reducing the risk of future divergence.

Additional Locations (1)

src/brunch-session-envelope.ts#L159-L183

^{Reviewed by Cursor Bugbot for commit eab91df. Configure here.}

augmentcode · 2026-05-27T16:35:14Z

🤖 Augment PR Summary

Summary: This PR introduces the M3 “web shell” as a native React UI served by the Brunch host, using a single WebSocket-backed JSON-RPC transport (no REST read model).

Changes:

Adds --mode web CLI support and a Node HTTP host that serves built web assets plus /rpc WebSocket JSON-RPC.
Introduces a typed JSON-RPC protocol helper module to centralize parsing/dispatch and standard error frames.
Adds a browser WebSocket RPC client with request multiplexing and protocol-failure hardening.
Builds the initial React dashboard using TanStack Router + Query to render workspace chrome and a read-only transcript display.
Adds a canonical “Brunch session envelope” reader that validates session self-description (brunch.session_binding) and enforces linear transcript constraints.
Hardens projection/RPC paths to reject non-linear transcripts and to require explicit session/spec targets for durable reads.
Blocks Pi branch flows (/tree, /fork) in the TUI with a stable user-facing warning.
Wires Vite build output to dist-web and updates packaging/tsconfig accordingly.

Technical Notes: Session-consuming reads now treat transport connections as ephemeral attachments; explicit { sessionId, specId } targeting is used for web projections, and non-linear Pi JSONL shapes fail fast.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-05-27T16:35:19Z


  const response = JSON.parse(chunks.join("")) as JsonRpcResponse<T>
-  if (response.error) {
+  if ("error" in response) {


src/fixture-capture.ts:164 — Since response comes from JSON.parse without runtime validation, a malformed frame that lacks both error and result will now fall through and return undefined, which can mask protocol failures during fixture capture.

Severity: medium

⏳ Generating Fix in Augment link...

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

lunelson added 4 commits May 21, 2026 17:21

FE-737: Start web shell frontier

a9171f2

FE-737 reject non-linear transcript JSONL

6ecc356

FE-737 fail fast on non-linear session RPC

3acf9df

FE-737 block TUI branch flows

514c01e

This was referenced May 21, 2026

FE-736: JSONL session viability proof (M2) #146

Open

FE-735: Mode shell and fixture driver (M1) #144

Open

FE-702: Walking skeleton — brunch binary + TUI over pi (M0) #142

Open

lunelson added 6 commits May 21, 2026 17:42

FE-737 clarify web-shell slice status

dbf2bb3

FE-737 enforce strict transcript reader shape

c0ae135

FE-737 centralize linear exchange projection

fec7073

FE-737 add minimal web HTTP shell

0a849d3

FE-737 add web websocket RPC bridge

5ef039b

FE-737 render workspace snapshot in React shell

0781833

semgrep-code-hashintel Bot reviewed May 21, 2026

View reviewed changes

lunelson added 15 commits May 22, 2026 09:38

FE-737: Share JSON-RPC protocol helpers

6bdfc28

FE-737: Add WebSocket RPC transport adapter

4a47c3c

FE-737: Persist browser RPC client connection

18d82e6

FE-737: Serve canonical built web shell

bffad46

FE-737: Stabilize React web runtime

0d8ccda

FE-737: Target session projections explicitly

22afcdb

Harden explicit session projection reads

b7bfe88

Share JSON-RPC dispatch failures

9b2f65b

Harden browser RPC protocol failures

11ab8ca

Constrain web asset paths

c30c6cb

Reuse shared JSON-RPC response type

ecd668a

Render read-only web transcript projection

ec2f985

Share session binding codec

1123508

Require cwd for RPC handlers

a0fd9dd

Treat browser RPC socket errors as terminal

93253d2

lunelson added 11 commits May 22, 2026 10:31

Render transcript display projection

4d90bbb

Record M3 smoke postconditions

c8d986d

Validate explicit session self-description

65523f2

Render elicitation prompt display rows

fc264ca

Tie off web shell M3

1cfb88b

add ln-judo-review skill

72a9734

Share Brunch session envelope reader

f5a26ea

Use explicit transcript custom entry classifiers

ab28054

Use typed web session projection target

1cbd57b

Sync web shell closeout

64406a9

Restore ln-judo-review skill

eab91df

lunelson mentioned this pull request May 22, 2026

FE-744: Document Pi command containment evidence #150

Draft

lunelson changed the title ~~FE-737: Start web shell frontier~~ FE-737: Web shell over the same host (M3) May 27, 2026

lunelson marked this pull request as ready for review May 27, 2026 16:30

cursor Bot reviewed May 27, 2026

View reviewed changes

augmentcode Bot reviewed May 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FE-737: Web shell over the same host (M3)#147

FE-737: Web shell over the same host (M3)#147
lunelson wants to merge 36 commits into
ln/fe-736-jsonl-session-viabilityfrom
ln/fe-737-web-shell

lunelson commented May 21, 2026

Uh oh!

lunelson commented May 21, 2026 •

edited

Loading

Uh oh!

semgrep-code-hashintel Bot May 21, 2026 •

edited

Loading

Uh oh!

cursor Bot commented May 27, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot May 27, 2026

Uh oh!

cursor Bot May 27, 2026

Uh oh!

augmentcode Bot commented May 27, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lunelson commented May 21, 2026

Uh oh!

lunelson commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

semgrep-code-hashintel Bot May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot May 27, 2026

Choose a reason for hiding this comment

Identical function duplicated within same file

Uh oh!

cursor Bot May 27, 2026

Choose a reason for hiding this comment

Transcript entry helpers duplicated across two files

Uh oh!

augmentcode Bot commented May 27, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lunelson commented May 21, 2026 •

edited

Loading

semgrep-code-hashintel Bot May 21, 2026 •

edited

Loading

cursor Bot commented May 27, 2026 •

edited

Loading