FEAT: opt-in browser session approvals and prompts

[merefield]

Why

The local browser dashboard can already identify sessions needing attention, but users must return to Codex or the TUI to respond. This adds a deliberately opt-in session command centre while keeping ordinary --web read-only and preserving the terminal launch path.

What changes

• Add --web-control (requires --web), with explicit launch/header/footer indicators. The flag is never persisted and cannot be enabled through the browser.
• Full-page Sessions detail can offer the existing client's supported command-approval choices, structured input questions and idle-thread follow-up messages. Unsupported/local-only observations continue to direct users to Codex.
• Show exact target thread, command, directory and permission scope. Linked-child questions do not mislabel the parent's directory as the child's. Mask secret answers; do not save drafts.
• Require separate review and confirmation for every action, including declines; Enter in a textarea never submits. Invalidate browser confirmation on changed offers, stale state and navigation.
• Fix an old approval justification obscuring a newer reply in the web projection.
• Update README, SECURITY.md and intro-post.md with setup, limitations and safety guidance: dedicated updated browser profile without extensions, private pairing links, loopback only, no tunnels/proxies, scoped approvals, preserve sandbox protections and stop the server to revoke access.

Security boundaries

• Control routes do not exist unless explicitly enabled. Existing pairing, bearer auth, Host/Origin/Fetch Metadata checks, CSP and resource bounds remain in place; every control call requires same-origin JSON.
• The paired capability has control permission only for this opted-in server launch; there is no simultaneous read-only pairing on the same server.
• Raw Codex capabilities stay in Go, outside snapshots/SSE. Opaque keyed offer IDs bind the exact source request and advertised choices; preparation retains the exact payload in Go for a one-use confirmation.
• At most one pending preparation per server, expiring after 30 seconds; 64 KiB request bodies and 4,096-character answers. Session observations older than ten seconds, failed observations, removed sessions and changed capabilities fail closed.
• Reuse the existing shared-daemon approval/prompt clients and their connection-local/one-use checks. Consume before dispatch; never automatically retry failed or ambiguous sends. Sent is not a claim that the task succeeded.
• Browser write mode adds attack surface. Same-origin compromise/extensions or local malware are not defeated by UI confirmations. These limitations are explicitly documented.
• Benchmarks, resets, pricing/learning and terminal UI behavior are out of scope and unchanged.

Try it locally

./codexometer --web --web-control --demo

The simulated approval exercises the real browser endpoints without running any command. For real actions omit --demo and connect CLI sessions through the documented shared app-server setup.

Verification

• go test -race -cover ./... — all packages pass; web coverage 94.9%, terminal UI coverage 91.2%.
• go vet ./... and git diff --check pass.
• make web-test — Svelte/type/format checks, production asset build, local binary build and 25 Playwright tests pass.
• Go tests cover read-only route absence, origin/auth/body validation, exact session/request/payload binding, expired/replaced preparations, reconnect/stale/removed sessions, invalid choices/answers, concurrent/replayed commits and ambiguous outcomes.
• Browser tests cover confirmation, request replacement, stale state, session/draft isolation, keyboard handling, secret fields, narrow layout and a real-server demo approval.
• Production assets committed; local binary rebuilt. No live user session approval or prompt was used in testing.

[Copilot]

🟡 Changes recommended

Secret questions with fixed options currently expose their selected answer in an unmasked control.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds opt-in browser session approvals and prompts while preserving read-only default web mode and existing security boundaries.

Changes:

• Adds --web-control and secured prepare/commit endpoints.
• Adds session action UI with confirmation, expiry, and draft isolation.
• Expands automated tests, documentation, and production assets.

File summaries

File	Description
main.go	Wires the control-mode flag and demo approval.
main_web_test.go	Tests explicit control opt-in.
internal/web/control.go	Implements secured action offers and commits.
internal/web/control_test.go	Covers validation, freshness, replay, and security.
internal/web/server.go	Conditionally registers control routes.
internal/web/server_test.go	Updates server invocation tests.
internal/web/state.go	Projects control state and retains private capabilities.
web/src/SessionActions.svelte	Adds browser action controls.
web/src/Sessions.svelte	Integrates controls into session detail.
web/src/state.svelte.ts	Adds authenticated control requests.
web/src/App.svelte	Displays active control mode.
web/src/style.css	Refines session-detail layout.
web/tests/browser.spec.ts	Adds browser control-flow tests.
README.md	Documents setup, operation, and risks.
SECURITY.md	Defines control-mode security invariants.
intro-post.md	Announces the optional functionality.
internal/web/dist/index.html	References rebuilt assets.
internal/web/dist/assets/index-CUbf51Nc.js	Adds rebuilt application bundle.
internal/web/dist/assets/index-DDwYKqoi.js	Removes superseded bundle.
internal/web/dist/assets/index-DCwkqPue.css	Adds rebuilt stylesheet.
internal/web/dist/assets/index-CYAA_qS7.css	Removes superseded stylesheet.

Review details

• Files reviewed: 16/21 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.