Web Interface

Web Interface

The web UI is the agent's workbench, served by the host at http://127.0.0.1:8765 by default
(start it with holaryn serve, or via the desktop app). Sixteen stable workspaces
are grouped into Work, Coordinate, Library, and Review & configure. Every destination remains a
real link with a stable URL.

On a wide window, the left navigation rail keeps group names and link text visible. Choose
Switch workspace or press Ctrl+Shift+K to search the same complete destination list. On a
constrained window, Workspaces opens a focus-contained navigation drawer. The context bar names
the current workspace and its Trust disclosure states connection, autonomy posture, current
activity, model when applicable, and data boundary without relying on color.

Use classic navigation is the local rollback control. It restores the prior flat navigation
without changing routes, chats, preferences, or application data; Use Harbor workbench returns
to the grouped rail.

The sixteen workspaces

On macOS use Cmd instead of Ctrl. All of these bindings are defaults — rebind them in Settings → Keyboard Shortcuts, and press Ctrl+. anywhere for the full list.

Chat (Ctrl+1)

The Chat tab is a multi-chat workspace:

• Tab strip — your open chats. Create more with New chat (saved) or New temporary chat (never persisted; dies with the session, or promote it with Save chat…). Tabs can be reordered, renamed, closed, and deleted; each tab has its own conversation, model, mode, and effort.
• Sidebar — a collapsible library with Recent Chats, Projects (group related chats), Artifacts (simple published files plus versioned professional DOCX, XLSX, PPTX, and PDF files; review versions, preview, compare, download, open, group, rename, or delete them here), and Canvases when the chat has any. Reopening a saved chat restores its full transcript. See Professional artifacts.
• Canvas panel — live visual surfaces the agent renders beside the conversation (dashboards, boards, tables) that update in place; a header button shows or hides the panel. See Canvas.
• Control tray — below the composer: the autonomy mode selector (ask, selective, allow-all, unrestricted — the dangerous two require a confirmation step), the connection and model pickers, and an effort selector for models that support a reasoning-effort knob. Voice and dictation is a disclosure above Message and starts closed; active microphone state and stop, finish, interrupt, approval-review, and end actions remain visible even while it is collapsed.
• Live approvals and questions — when the agent needs a permission decision or asks you something mid-run, the prompt appears inline in the conversation and waits for your answer.
• Theme toggle — light, dark, or follow the system, from the top header.
• Response metrics — after each model-backed response, a compact footer shows wall-clock run
  time and the total provider-reported tokens. Run details expands the available input, output,
  reasoning, cache, and model-call breakdown. The same accessible footer appears in Code because
  both workspaces use the shared conversation component; unavailable provider usage is never
  guessed.

The composer

• Multiline input: Enter sends, Shift+Enter inserts a newline.
• @-mentions — start a message with @ to open an accessible picker of addressable targets:
• @<profile> switches the chat to that configuration profile and sends the rest of the message.
• @<model-id-or-nickname> runs this turn only on that model, in the same conversation (see Providers & Models for nicknames).
• @claude-code <task> or @codex <task> delegates the task to that coding CLI backend — still behind the approval gate.
• @<peer>[:target] sends the message to a paired machine, optionally addressing a profile or model on that peer (see Peers & Networking).
• When one name means several things, resolution order is: profile, then model nickname, then model id, then coding backend, then peer. Escape a literal mention with \@name.
• Slash commands — type / at the start of the message for a popup of available commands (built-ins plus your own; see Slash Commands).
• Attachments — the paperclip menu stages files for the next message: Upload file… or Add a file/folder URL…. Staged items appear as removable chips and their contents are folded into the message on send. Cloud-storage sources (Drive, OneDrive, Dropbox) are shown but not yet available.

Code (Ctrl+2)

Coding sessions on a repository. Create a session by pointing at a repository directory, then converse as in Chat — the coding chrome lives around the conversation:

• Workspace isolation — new Git repositories default to a unique isolated branch/worktree.
  You can deliberately choose the current checkout, attach an existing branch/worktree, or force
  read-only exploration. The Workspace panel shows recorded base → candidate → target,
  deterministic commits/files, validation evidence, drift/conflicts, exact-plan integration,
  recoverable archive/recovery, and ownership-checked cleanup. See
  Isolated coding worktrees.
• Session rail — the session list, a text-only git status line for the active session ("main, 3 files changed", kept fresh by checkpoint and file-edit events), and the checkpoint list. Each checkpoint row shows its relative time and kind, and offers View diff (the checkpoint's changes in the accessible diff view; copy checkpoints record no diff and say so) and Revert behind a confirmation that states exactly what is discarded.
• Contextual inspector — Changes, Files, and Terminal are the primary views.
  Changes aggregates this session's file edits as diff cards. Files is an accessible tree of the
  workspace: arrow keys and typeahead navigate, directories load their children when expanded, and
  files the agent edited this session carry a visible Modified badge plus ", modified" in their
  accessible name. Selecting a file opens a read-only viewer — a focusable region named by the file
  path, line numbers hidden from screen readers, a truncation notice on large files, and a Close
  button that returns focus to the tree. More repository tools contains Index, Validation,
  Workspace, and Execution. The Repository instructions disclosure explains the exact
  target-scoped guidance used by the agent, including source, scope, precedence, hashes, required
  validation, conflicts, truncation, and diagnostics; with no file open it explains the workspace
  root.
• Syntax highlighting — file contents and diffs are highlighted for about a dozen common languages (inferred from the file extension). The highlighter loads lazily and the colors are purely decorative: the text a screen reader hears — including the diff view's "added:"/"removed:" line prefixes — is identical with or without it, and plain text is the automatic fallback.
• Plan/Build mode — Plan restricts the agent to read-only exploration and pins its proposed plan above the composer for approval; Build lets it edit files and run commands under the approval policy, with the exact diff shown before you approve a file edit.
• Editing files — the file viewer's Edit button opens the file in a code editor (JS/TS, Python, JSON, and Markdown get language support; anything else edits as plain text). Save with the rebindable Ctrl+S default or the Save button — writes are atomic and confined to the workspace, and "Saved" is announced. The dirty state rides the editor's accessible name ("app.py, modified, editor"). If the agent changes the file while your editor is clean it reloads automatically with a polite announcement; if you have unsaved changes, an alert pauses saving until you choose Reload file (drop your changes) or Keep editing (Save becomes a confirmed Overwrite). Esc returns to the read-only viewer, asking first when you have unsaved changes. Edit is unavailable for files shown truncated, so a partial view can never overwrite the full file.
• CLI jobs — the session rail also lists the host's background coding-CLI jobs (headless Claude Code / Codex delegation — see Subagents & Coding Agents). Each row shows the job's status, backend, and elapsed time as plain text plus the task excerpt; opening a row shows its details and output in an accessible log region, lets you steer a running claude-code job mid-run, and offers a confirm-gated Cancel. This panel monitors jobs — it cannot launch them: jobs are started by the agent (start_coding_task) or a scheduled dispatch. The list refreshes every few seconds while a job runs.
• Terminal — a toggle in the header opens a terminal drawer below the conversation: one true interactive PTY per session (Windows ConPTY or a Unix PTY), rooted at the repository, and started only by you — the agent cannot open it. Interactive prompts, no-echo input, ANSI/VT programs, Unicode, Ctrl+C, and window resize work through the same typed platform contract. Two views are remembered per browser: the log view is the default and accessible view — an append-only live log with terminal controls removed plus a labeled command input — while the terminal view renders the raw stream in a contained xterm.js component with screen-reader mode enabled and process-created links disabled. The server owns the process independently of the browser connection, keeps the last 512 KB as binary-safe sequenced output, reports when an old replay cursor was dropped, and reattaches without starting a second shell. Close terminal attempts graceful termination and then bounded process-tree cleanup; the same cleanup runs after 30 idle minutes and at host shutdown. Remote-terminal attachment and replay across a host restart are not yet supported.

Browser

The browser supervision page starts ephemeral or opt-in persistent Chromium sessions and provides a
live screenshot plus a list of accessible roles/names. Pause automation for a visible-window
takeover, resume it, stop the session, or download its redacted trace. The semantic list and all
controls remain usable without seeing the screenshot. See Browser agent.

Computer

The native computer-use page launches an exact operator-confirmed Windows application and binds
the session to its process and selected window. It exposes application identity, a one-shot
selected-window screenshot, keyboard-operable semantic roles and names, target highlighting,
pause, immediate takeover, resume, stop, and the complete redacted step history. The semantic list
and supervision controls work without seeing the screenshot. See
Native computer use.

Agents (Ctrl+5)

Delegated child runs — subagents the main agent has spawned. For each run you can approve or deny its parked actions, answer its questions, queue steering directives, cancel it, and inspect its recorded event stream. The page also hosts the Coding jobs cards and the Peers overview. See Subagents.

Teams (Ctrl+6)

Agent teams on their own page: create a team and add members (holaryn profiles, coding CLIs, or peers) directly in the UI, open a team into its full threaded feed with topic and member filters, post as the operator, review contracts with their per-party verdicts, watch escalated topics, and manage the roster. See Teams.

Scheduler (Ctrl+7)

Create unattended jobs with cron:…, interval:…, date:… triggers, or plain phrases like "every weekday at 8", and manage existing ones. Jobs run under the posture you pick; anything they cannot do silently lands in the Approvals inbox. Schedules survive host restarts. See Scheduler & Automation.

Annotations

The list-first review desk attaches versioned discussion threads to exact message text, plan steps,
diff ranges, and artifact regions. It exposes target/version evidence, assignment, replies,
resolution, conservative remapping, orphan state, audit export, and scoped agent actions without
requiring a visual inline marker. See Annotations.

Goals

Durable goals bind an objective to explicit proof, authority, budget, continuation,
and terminal conditions. The ledger shows every revision, attempt, decision, blocker,
and evidence item. A goal cannot mark itself achieved without verified evidence.

Batches

The batch ledger imports versioned CSV, TSV, or JSONL datasets, preflights prompt
templates and budgets, and shows durable state for every row and attempt. You can
pause, resume, cancel, retry failed or selected rows, filter item state, inspect
outputs and errors, and export linked CSV, JSONL, or Parquet-ready artifacts. See
Batch and dataset execution.

Improve

The self-improvement evidence ledger shows each hypothesis, isolated patch, required
gate, baseline/candidate metric, held-out result, independent review, rollout
threshold, observation, and provenance hash. Promotion records authorization only; it
does not apply a patch or deploy. See Evidence-gated self-improvement.

Packages

The chain-of-custody workspace separates immutable package provenance from local
resolution. It inventories and reviews every export finding, inspects untrusted
archives before import, shows the full clean-profile preflight, and lets you fork or
remap models, paths, accounts, and secret slots without changing the source digest.
Reference reruns require an explicit activation step and record equivalent-output
evidence. See Shareable task packages.

Training data

The three-step privacy ledger offers only successful terminal runs owned by the
local operator. Select exact runs and optional content, inspect redaction
categories and sanitized samples, then type the exact consent phrase before
Holaryn writes JSONL and its digest-bound provenance sidecar. It does not start
training or send the dataset anywhere. See
Privacy-reviewed training data.

Workflows

The workflow workspace builds typed runbooks, validates dependencies and
permissions without executing them, publishes immutable definitions, and
supervises durable step-by-step runs. See
Workflows & reusable runbooks.

Approvals (Ctrl+0)

The decision desk: every decision the host is waiting on — parked approvals from unattended runs,
operator questions, and recovery decisions for interrupted calls. Each card leads with the exact
action, affected resource, one-call or recovery scope, consequence, declared reversibility,
request time, provenance, and request identity before its actions. Current, refreshing,
last-known/offline, stale, and outcome-unknown states are explicit. Nothing auto-proceeds in an
unattended run; a gated action parks here and the run stays suspended until you decide. The
navigation shows the pending count from anywhere in the UI. See
Autonomy & Approvals.

Settings (Ctrl+,)

All 23 categories are grouped into Personalize, Intelligence & behavior, Tools & extensions,
Connect & collaborate, and Operations & support. All settings is a complete independently
filterable index of every category and registered control, while the sidebar and global Settings
search remain alternate finding paths. Direct URLs, Back/Forward, category-heading focus, and
search-result focus are preserved. The full reference is on the Settings page.

Accessibility

The web UI is accessibility-first and built on React Aria. It ships with a skip link, named landmarks, real labels and descriptions on every control, polite live regions for async work (streaming replies are announced), focus-managed dialogs and page changes, a semantic heading hierarchy down to individual messages, and reorder buttons instead of drag-only interactions. It is exercised with JAWS, and OS-level notifications from the desktop app are announced by JAWS and Orca. These behaviors are always on — they are not settings.