fix(mobile-web): collapse carriage-return redraws in the console terminal

readline repaints its prompt in place with a lone \r (…└─# \r└─# cmd); the
browser turned that \r into a newline, stacking the pre-redraw prompt as a
phantom extra line (the mobile-only "extra --#"). Add a collapseCR() mini-vt
pass that resolves \r as a column-0 overwrite (ANSI escapes treated as
zero-width so colours survive; honours \x1b[K erase-to-EOL) before ansiToHtml,
so the real prompt stays and only the duplicate is dropped. TUI was already
correct via its real vt emulator.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -23,6 +23,10 @@ err.log
 
 # Sandbox save/load snapshots (large runtime tarballs, not source)
 /hh/hh-snapshots/
+# VM-library /loop artifacts — exported snapshot tars (repo-root, when `sbx`
+# is run from here) + per-run logs. Generated; the VMs live in the host registry.
+/hh-snapshots/
+/.loop-runs/
 
 # Out-of-tree experiments (not part of hack-house)
 /experiments/
@@ -31,6 +35,13 @@ err.log
 # Heavy / superseded demo-build kit (real demos live in video-toolkit)
 /docs/demo/
 
+# Native-harness benchmark harness + results — dev-internal test tooling, kept
+# on disk but never pushed to origin (coupled to the local tmux+podman test rig)
+/bench/
+
+# Local-only planning/design docs (kept on disk, never pushed to origin)
+/docs/plans/
+
 # Project scratch
 /i-try/
 test_rsa.py

CLAUDE.md

@@ -0,0 +1,102 @@
+# hack-house — Claude operating guide
+
+Encrypted collaborative terminal sessions with a summoned, shareable sandbox.
+**Rust TUI client** (`hh/`) + **Python server & operator bridge** (`cmd_chat/`).
+
+A Claude Code session can join a room as a **first-class member**: read/answer
+humans and other AIs, and — once granted — drive the shared sandbox with full
+shell + keystroke control. VMs carry a self-describing `.hh-agent` manifest so
+work + memory hand off between agents (and humans), and saved VM states are
+tradeable via a host-global registry.
+
+## Operating a room — use the `hh-operator` skill
+
+To enter/run/watch a room, bridge a Claude session into one, or autonomously
+monitor and respond, **use the `hh-operator` skill** (`~/.claude/skills/hh-operator/`).
+It documents the full doctrine: the daemon + `hh-bridge` CLI, the read→think→act
+loop, sandbox drive (exec/write/get), the keystroke relay + stop-vocabulary, the
+`watch` stop-condition engine, and the `.hh-agent` manifest for handoffs.
+
+```bash
+# Run from this repo root; pin the interpreter to the venv.
+HH=".venv/bin/python -m cmd_chat.operator"     # = the hh-bridge CLI
+$HH up <host> <port> <name> --password <pw> --no-tls   # join (spawns the daemon)
+$HH read --wait --timeout 30                            # long-poll for activity
+$HH say "…"                                             # chat into the room
+$HH keys "make build" enter ; $HH watch --for 'PASS|FAIL' --in screen   # drive
+$HH manifest push --root /root --name <vm> --purpose … --objective …    # handoff
+$HH spawn "<objective incl. the full join cmd>" --room-host … --go --skip-permissions
+```
+
+## Mobile operator on Android / Termux — the phone is REACHABLE, use it
+
+Spec: `docs/termux-operator.md`. The operator side is pure Python and runs on
+the **Fairphone-6** in Termux — it can both **join** and **host** rooms (the SRP
+shim now covers the server side too, so no Rust / no `srp` C-ext). You can drive
+the device directly over SSH — so **verify reachability before ever telling the
+user "this can only run on-device, paste it back."** That framing is wrong when
+the phone answers SSH.
+
+One canonical, hardened invocation (use this prefix everywhere — it sidesteps
+the wrong-alias trap and never hangs):
+```bash
+PHONE='ssh -i ~/.ssh/phone-deploy -p 8022 -o ConnectTimeout=8 -o BatchMode=yes -o StrictHostKeyChecking=accept-new u0_a203@100.95.202.68'
+$PHONE 'uname -m; python --version'    # aarch64 / Python 3.13.x
+```
+
+- **Reachability gate — probe the PORT, not `tailscale status`:**
+  `timeout 8 bash -c 'cat </dev/null >/dev/tcp/100.95.202.68/8022' && echo REACHABLE || echo OFFLINE`.
+  Tailscale reports `fairphone-6` **`active` even when sshd is dead** — Android
+  kills backgrounded Termux, taking `sshd` with it. The tailnet line is NOT
+  proof; the TCP probe is. If OFFLINE, the fix is **on-device** (wake the phone,
+  relaunch Termux, `termux-wake-lock` + start `sshd`) — say so, don't retry a
+  dead port.
+- **Trap:** the `~/.ssh/config` aliases `phone` / `phone-deploy` point at
+  `100.95.180.14` (`trilluminati`), a *different, usually-offline* phone —
+  `ssh phone` will time out. Use the Fairphone IP `100.95.202.68` (the `$PHONE`
+  prefix), not the alias.
+- Termux facts: Python 3.13 (≥3.11); **no `/tmp`** — `$TMPDIR` is
+  `$HOME/.claude-temp`; `$PREFIX=/data/data/com.termux/files/usr`; `rustc`/
+  `openssl` not installed by default.
+- Deps that work: `pkg install python-cryptography` (avoid a rust build),
+  `pip install requests rich websockets`; **skip `srp`** — both client and
+  server fall back to `cmd_chat/client/_srp_pure` (pure-Python SRP-6a shim).
+- Push-restricted work: copy this tree to the phone with tar-over-ssh rather
+  than a stale gitea clone —
+  `tar czf - cmd_chat scripts requirements-operator.txt | $PHONE 'tar xzf - -C ~/hh-mobile'`.
+- Phase-0 gate: `python scripts/termux-preflight.py` on the phone → expect
+  `RESULT: PASS`. Operator files staged at `~/hh-mobile` on-device.
+- **Proven live (2026-07-07):** phone JOINS a dev-box room; the phone HOSTS a
+  room the laptop joins (cross-impl SRP: laptop C-ext ↔ phone pure Verifier);
+  and the stdlib mobile web console (`python -m cmd_chat.operator web`) mirrors a
+  real room (terminal + keystroke drive + chat) in a mobile browser.
+
+## Key components
+
+| What | Where |
+|------|-------|
+| Operator bridge (daemon + CLI) | `cmd_chat/operator/__main__.py`, `bridge.py` |
+| Agent manifest (`hh-agent/v1`) | `cmd_chat/operator/manifest.py` — `.hh-agent/` bundle library + CLI |
+| Recursive spawn (Claude-spawns-Claude) | `cmd_chat/operator/bootstrap.py` (budgeted: `--depth`/`--fanout`) |
+| Saved-VM registry / discovery | `hh/src/registry.rs` → `~/.hh/registry.json`; reader: `$HH registry list\|show` |
+| Sandbox grammar (TUI) | `/sbx podman\|launch`, `/grant <name>`, `/sbx save`, `/sbx browse`, `/sbx publish`, `/sbx catalog @user`, `/sbx pull @user <label>` |
+| Server | `cmd_chat.py serve <host> <port> --password <pw> [--no-tls]` |
+| Rust client | `hh/target/debug/hack-house connect <host> <port> <name> --password <pw>` |
+
+## Demo videos — use the `video-toolkit`
+
+hack-house feature reels are produced with `~/coding/video-toolkit` (headless
+asciinema-in-tmux capture via `bin/tmux-demo.py`, then a `video-forge` cut).
+
+- **Flagship reel — three Claudes, one shared VM:** `scenarios/hh-vmhub.json`
+  (capture) + `scenarios/hh-vmhub-cut.json` (forge cut). A planner, builder, and
+  tester (each a real nested `claude -p`) collaborate to build **VMHub** — a
+  GitHub-for-VMs web app — live inside one shared sandbox, then save it to the VM
+  library. Role task-scripts: `scenarios/vmhub-{builder,tester}-task.sh`; staged
+  app under `scenarios/assets/vmhub/`.
+- A reel must **show the product**: the Rust TUI room (roster, encrypted chat, the
+  shared sandbox F2 view) with Claude visibly operating as a member and
+  Claude-spawning-Claude — not just a console of CLI calls.
+
+> Provisioning note: the demo summons a pre-baked `localhost/hh-dev:slim` (python
+> 3.11) podman sandbox so VMHub (stdlib, zero pip deps) runs with no installs.

README.MD

@@ -32,11 +32,12 @@ Encrypted chat that runs in your terminal. You host the server, you control the
 - **SRP authentication** — the password is never sent over the network (zero-knowledge proof)
 - **Zero-knowledge server** — relays only ciphertext; cannot read messages, files, or terminal output
 - **RAM only** — nothing persisted on the server; close it and history is gone
-- **Shared sandbox** — summon a disposable `local` / `docker` / `multipass` box the whole room can watch and drive
+- **Shared sandbox** — summon a disposable `local` / `docker` / `podman` / `multipass` box the whole room can watch and drive. Docker defaults to **Parrot OS Security** (`parrotsec/core`) and Podman to **Kali** (`kalilinux/kali-rolling`) — pentest distros out of the box; Podman is rootless & daemonless, so **no sudo** to launch
 - **Snapshot save/load** — freeze a sandbox to a named snapshot and restore it later (`/sbx save` · `/sbx load` · `/sbx snaps`)
 - **Local VirtualBox VMs** — `/sbx vms` detects VirtualBox and lists your VMs; `/sbx gui <vm>` opens a desktop VM locally for the room to gather around — per-user consent gate, with automatic resolution of VT-x conflicts (Docker Desktop / multipass)
 - **Real permissions** — the host grants/revokes *drive* (keyboard) and *sudo* (VM superuser) per user; **stacking roster badges** show exactly who holds what, both in the clergy panel and inline on every chat message
 - **Local-first AI agent** — `/ai start` summons an in-room AI that runs against *your own* [Ollama](https://ollama.com) (no API key, nothing leaves your machine); replies **stream token-by-token** with **in-RAM semantic recall** of the conversation for context; model-agnostic, addressed-only, end-to-end encrypted like every other client
+- **AI that acts in the sandbox** — grant an agent *drive* and address it with `/ai <name> !<task>`; it works the shared box through a bounded, host-side **tool-calling loop** (run shell, write/read files, inspecting each result before the next step) and you watch its commands land live in the shared terminal. Ungranted, it stays **advisory-only** (tells you the commands, runs nothing); destructive commands are gated behind an explicit `/ai <name> confirm`
 - **Encrypted file transfer** — `/send` → `/accept` with SHA-256 verification
 - **TLS** — self-signed by default, or bring your own cert; `--no-tls` for local/Tailscale use
 - **Themes** — seven switchable "vestments" (`crypt` default · `church` · `neon` · `blush` · `matrix` · `wraith` · `goldcrypt`), plus a live randomizer
@@ -153,16 +154,18 @@ Type to chat. Slash commands and keys:
 | `/sendroom <path>` | Offer a file (or directory) to the whole room |
 | `/accept` · `/reject` | Respond to a pending file offer |
 | `/clear` | Wipe your chat scrollback (local only) |
-| `/ai start [model\|profile]` | Summon a local AI agent (default `ollama/qwen2.5:3b`; a bare name is a `models.toml` profile) |
+| `/ai start [model\|profile] [allow]` | Summon a local AI agent (default `ollama/qwen2.5:3b`; a bare name is a `models.toml` profile). `allow` auto-grants it sandbox drive at spawn |
 | `/ai stop` | Dismiss the agent you summoned |
 | `/ai <question>` | Ask the agent (`/ai <name> <question>` if several present) |
+| `/ai <name> !<task>` | Have a *granted* agent act in the shared sandbox (advisory-only if it has no drive) |
+| `/ai <name> confirm` | Approve a gated (destructive) command the agent proposed |
 | `/ai list` | List the agents present (or hint to `/ai start` if none) |
 | `/ai models` | Models the active agent can serve — or, with no agent, your local Ollama tags |
-| `/sbx launch [local\|docker\|multipass] [image] [install]` | Summon the shared sandbox (`install` fetches a missing backend; `--start` boots a stopped Docker daemon) |
+| `/sbx <local\|docker\|podman\|multipass> [image] [install]` | Summon the shared sandbox — the backend leads (`/sbx launch …` still works). Docker → **Parrot OS** (`parrotsec/core`), Podman → **Kali** (`kalilinux/kali-rolling`, rootless, no sudo). `install` fetches a missing backend; `docker --start` boots a stopped daemon |
 | `/sbx stop` | Tear down the sandbox you host |
 | `/sbx save [label]` · `/sbx load <label>` · `/sbx snaps` | Snapshot the sandbox, restore one, or list snapshots |
 | `/sbx vms` | Detect VirtualBox and list local VMs |
-| `/sbx launch vbox [new [name]]` | Open the local VirtualBox VM picker, or build a fresh VM via cloud-init |
+| `/sbx vbox [new [name]]` | Open the local VirtualBox VM picker, or build a fresh VM via cloud-init |
 | `/sbx gui <vm> [--install]` | Open a local VirtualBox desktop VM for the room (consent-gated) |
 | `/drive` · `F2` | Take the shared shell (`Esc` releases) |
 | `/grant <user>` · `/revoke <user>` | Owner: delegate/withdraw drive |
@@ -176,7 +179,7 @@ Type to chat. Slash commands and keys:
 
 ### The shared sandbox
 
-Anyone in the room can summon a disposable Linux box with `/sbx launch`. The
+Anyone in the room can summon a disposable Linux box with `/sbx <backend>`. The
 person who summons it is the **owner/host**: their client runs the real PTY
 locally and relays its output to everyone else as encrypted frames, so the
 server only ever sees ciphertext (same trust model as chat).
@@ -184,10 +187,15 @@ server only ever sees ciphertext (same trust model as chat).
 | Backend | Isolation | Notes |
 |---|---|---|
 | `local` | none | a `bash` shell on the host — fast, for dev/testing only |
-| `docker` | container | `ubuntu:24.04` by default; `/sbx launch docker --start` boots the daemon (or run `hh/scripts/ensure-docker.sh`) |
+| `docker` | container | **Parrot OS Security** (`parrotsec/core`) by default — swap `parrotsec/security` per-launch for the full pentest set; `/sbx docker --start` boots the daemon (or run `hh/scripts/ensure-docker.sh`) |
+| `podman` | container | **Kali rolling** (`kalilinux/kali-rolling`) by default — **rootless & daemonless, no sudo to launch** (add `kali-linux-headless` for the toolset); `hh/scripts/ensure-podman.sh` installs it |
 | `multipass` | full VM | `24.04` by default; strongest isolation, ~30 s to boot, the choice for real use |
 
-Tear it down with `/sbx stop` (purges the VM/container).
+The backend leads the command — `/sbx podman`, `/sbx docker`, `/sbx multipass`,
+`/sbx local` (the older `/sbx launch <backend>` still works). Override the image
+positionally, e.g. `/sbx docker parrotsec/security` or `/sbx podman ubuntu:24.04`.
+Both container engines are Debian/apt-based, so the dev-toolchain bootstrap runs
+unchanged. Tear it down with `/sbx stop` (purges the VM/container).
 
 **Snapshots.** Freeze the current sandbox to a named checkpoint with `/sbx save
 [label]`, list what you've stored with `/sbx snaps`, and restore one later with
@@ -256,6 +264,15 @@ when you quit). Pick a model at summon time with `/ai start <model>`.
 - **Addressed-only.** The agent reads room traffic like any client but forwards
   to the model *only* the messages that trigger it (`/ai …`) — no passive
   surveillance, no cost or noise when idle.
+- **Can drive the sandbox.** Grant an agent *drive* (`/grant <name>`, or summon it
+  pre-granted with `/ai start <name> allow`) and ask it to act with
+  `/ai <name> !<task>`. It works the shared box through a bounded **host-side
+  tool-calling loop** — run shell commands, write and read files — inspecting each
+  result before the next step, and you watch its commands appear live in the
+  shared terminal. Every command runs *inside the sandbox* (the container/VM is the
+  blast radius), capped in count and time. Without drive it stays **advisory-only**
+  (it spells out the commands, runs nothing). Destructive commands are blocked
+  pending an explicit `/ai <name> confirm`.
 - **Model-agnostic.** Swap the backend without touching the client: bundled
   adapters for `ollama` (default), `anthropic`, and any OpenAI-compatible
   endpoint (OpenAI, Groq, Together, local vLLM…), plus a `module:Class` hook for
@@ -360,10 +377,11 @@ supports `-h` / `--help`** for full usage.
 
 | Script | What it does |
 |---|---|
-| `ensure-docker.sh` | Install Docker and/or start its daemon (idempotent; `--check`/`--plan`/`--yes`). Invoked by `/sbx launch docker`. |
+| `ensure-docker.sh` | Install Docker and/or start its daemon (idempotent; `--check`/`--plan`/`--yes`). Invoked by `/sbx docker`. |
-| `ensure-multipass.sh` | Install Multipass. Invoked by `/sbx launch multipass`. |
+| `ensure-podman.sh` | Install Podman (rootless; sets up subuid/subgid). Daemonless — nothing to start. Invoked by `/sbx podman`. |
-| `ensure-vbox.sh` | Install VirtualBox (warns on Secure Boot). Invoked by `/sbx launch virtualbox` and `/sbx gui`. |
+| `ensure-multipass.sh` | Install Multipass. Invoked by `/sbx multipass`. |
-| `vbox-new.sh` | Create + boot a fresh Ubuntu VirtualBox VM via cloud-init. Invoked by `/sbx launch virtualbox`. |
+| `ensure-vbox.sh` | Install VirtualBox (warns on Secure Boot). Invoked by `/sbx vbox` and `/sbx gui`. |
+| `vbox-new.sh` | Create + boot a fresh Ubuntu VirtualBox VM via cloud-init. Invoked by `/sbx vbox new`. |
 | `sandbox-bootstrap.sh` | Baseline dev-tool install piped into a Docker sandbox at provision time (package list from `sandbox-tools.json`). |
 | `sandbox-tools.json` | Editable package list consumed by `sandbox-bootstrap.sh`. |