feat: add web-based UI for taskyou with Fly Sprites integration

.golangci.yml

@@ -1,15 +1,18 @@
 version: "2"
+
 linters:
   disable:
     - errcheck
+
   settings:
     staticcheck:
       checks:
         - all
-        - -QF1003
-        - -QF1008
-        - -S1017
-        - -SA9003
+        - -SA9003  # Empty branch - sometimes used for clarity
+        - -QF1003  # Tagged switch suggestion - keep explicit for readability
+        - -QF1008  # Remove embedded field from selector - keep explicit for clarity
+        - -S1017   # TrimPrefix suggestion - keep explicit for readability
+
   exclusions:
     generated: lax
     presets:
@@ -21,9 +24,11 @@ linters:
       - third_party$
       - builtin$
       - examples$
+
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
+
 formatters:
   exclusions:
     generated: lax

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build build-no-restart install clean test deploy
+.PHONY: build build-no-restart install clean test deploy web
 
 # Configuration
 SERVER ?= root@cloud-claude
@@ -21,6 +21,24 @@ build-ty:
 build-taskd:
 	$(GO) build -o bin/taskd ./cmd/taskd
 
+build-taskweb:
+	go build -o bin/taskweb ./cmd/taskweb
+
+# Build web frontend
+web:
+	cd web && npm install && npm run build
+
+# Build taskweb with embedded frontend
+build-taskweb-full: web build-taskweb
+
+# Run web UI in development mode (connects to local database)
+# Usage: make webdev (run API server), then in another terminal: make webui
+webdev:
+	go run ./cmd/taskweb-dev
+
+webui:
+	cd web && npm install && npm run dev
+
 # Restart daemon if it's running (silent if not). Never fail the build if we lack permissions.
 restart-daemon:
 	@if pgrep -f "ty daemon" > /dev/null; then \

cmd/taskweb-dev/main.go

@@ -0,0 +1,60 @@
+// taskweb-dev runs the web API server locally for development.
+// It connects to your local task database and serves the API on port 8081.
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/bborn/workflow/internal/db"
+	"github.com/bborn/workflow/internal/webapi"
+)
+
+func main() {
+	// Use the same database as the local task CLI
+	dbPath := db.DefaultPath()
+	fmt.Printf("Using database: %s\n", dbPath)
+
+	database, err := db.Open(dbPath)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to open database: %v\n", err)
+		os.Exit(1)
+	}
+	defer database.Close()
+
+	// Create the API server with dev mode enabled
+	server := webapi.New(webapi.Config{
+		Addr:      ":8081",
+		DB:        database,
+		DevMode:   true,
+		DevOrigin: "http://localhost:5173",
+	})
+
+	// Handle graceful shutdown
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, os.Interrupt, syscall.SIGTERM)
+
+	go func() {
+		<-sigCh
+		fmt.Println("\nShutting down...")
+		cancel()
+	}()
+
+	fmt.Println("Starting web API server on http://localhost:8081")
+	fmt.Println("Frontend should run on http://localhost:5173")
+	fmt.Println()
+	fmt.Println("To start the frontend:")
+	fmt.Println("  cd web && npm install && npm run dev")
+	fmt.Println()
+
+	if err := server.Start(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "Server error: %v\n", err)
+		os.Exit(1)
+	}
+}

cmd/taskweb/main.go

@@ -0,0 +1,124 @@
+// Package main provides the entry point for the taskweb server.
+// This server provides a web-based UI for taskyou with Fly Sprites integration.
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/bborn/workflow/internal/hostdb"
+	"github.com/bborn/workflow/internal/webserver"
+	"github.com/charmbracelet/log"
+	"github.com/spf13/cobra"
+)
+
+var (
+	addr    string
+	dbPath  string
+	baseURL string
+	secure  bool
+	domain  string
+)
+
+func main() {
+	rootCmd := &cobra.Command{
+		Use:   "taskweb",
+		Short: "Web server for taskyou with Fly Sprites integration",
+		Long: `taskweb provides a web-based UI for taskyou.
+
+Each user gets their own isolated Fly Sprite running the task executor.
+User data (tasks, projects) stays entirely within their sprite.
+This host service handles only authentication and sprite orchestration.
+
+Environment variables:
+  TASKWEB_DATABASE_PATH  - Path to host database (default: ~/.local/share/taskweb/taskweb.db)
+  GOOGLE_CLIENT_ID       - Google OAuth client ID
+  GOOGLE_CLIENT_SECRET   - Google OAuth client secret
+  GITHUB_CLIENT_ID       - GitHub OAuth client ID
+  GITHUB_CLIENT_SECRET   - GitHub OAuth client secret
+  SPRITES_TOKEN          - Fly Sprites API token`,
+		Run: runServer,
+	}
+
+	rootCmd.Flags().StringVarP(&addr, "addr", "a", getEnvOrDefault("TASKWEB_ADDR", ":8080"), "Server address")
+	rootCmd.Flags().StringVarP(&dbPath, "db", "d", hostdb.DefaultPath(), "Database path")
+	rootCmd.Flags().StringVar(&baseURL, "base-url", getEnvOrDefault("TASKWEB_BASE_URL", "http://localhost:8080"), "Base URL for OAuth callbacks")
+	rootCmd.Flags().BoolVar(&secure, "secure", getEnvOrDefault("TASKWEB_SECURE", "") == "true", "Use secure cookies (HTTPS)")
+	rootCmd.Flags().StringVar(&domain, "domain", getEnvOrDefault("TASKWEB_DOMAIN", ""), "Cookie domain")
+
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func runServer(cmd *cobra.Command, args []string) {
+	logger := log.NewWithOptions(os.Stderr, log.Options{
+		Prefix: "taskweb",
+	})
+
+	// Open host database
+	db, err := hostdb.Open(dbPath)
+	if err != nil {
+		logger.Fatal("failed to open database", "error", err)
+	}
+	defer db.Close()
+
+	logger.Info("database opened", "path", dbPath)
+
+	// Create server
+	server, err := webserver.New(webserver.Config{
+		Addr:    addr,
+		DB:      db,
+		BaseURL: baseURL,
+		Secure:  secure,
+		Domain:  domain,
+	})
+	if err != nil {
+		logger.Fatal("failed to create server", "error", err)
+	}
+
+	// Setup context with signal handling
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
+
+	go func() {
+		sig := <-sigCh
+		logger.Info("received signal, shutting down", "signal", sig)
+		cancel()
+	}()
+
+	// Log configuration
+	logger.Info("starting server",
+		"addr", addr,
+		"base_url", baseURL,
+		"secure", secure,
+	)
+
+	// Check OAuth configuration
+	if os.Getenv("GOOGLE_CLIENT_ID") == "" && os.Getenv("GITHUB_CLIENT_ID") == "" {
+		logger.Warn("no OAuth providers configured - authentication will not work")
+	}
+
+	if os.Getenv("SPRITES_TOKEN") == "" {
+		logger.Warn("SPRITES_TOKEN not set - sprite management will not work")
+	}
+
+	// Start server
+	if err := server.Start(ctx); err != nil {
+		logger.Fatal("server error", "error", err)
+	}
+}
+
+func getEnvOrDefault(key, defaultValue string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return defaultValue
+}

go.mod

@@ -11,13 +11,21 @@ require (
 	github.com/charmbracelet/log v0.4.1
 	github.com/charmbracelet/ssh v0.0.0-20250826160808-ebfa259c7309
 	github.com/charmbracelet/wish v1.4.7
+	github.com/fsnotify/fsnotify v1.9.0
+	github.com/google/uuid v1.6.0
+	github.com/gorilla/websocket v1.5.3
 	github.com/spf13/cobra v1.10.2
+	github.com/superfly/sprites-go v0.0.0-20260112234611-135551a277ef
 	golang.org/x/crypto v0.37.0
+	golang.org/x/oauth2 v0.34.0
 	golang.org/x/term v0.31.0
+	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.42.2
 )
 
 require (
+	cloud.google.com/go/compute/metadata v0.3.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
 	github.com/alecthomas/chroma/v2 v2.14.0 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
@@ -40,9 +48,7 @@ require (
 	github.com/dlclark/regexp2 v1.11.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
@@ -58,7 +64,6 @@ require (
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/sahilm/fuzzy v0.1.1 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yuin/goldmark v1.7.8 // indirect
@@ -67,8 +72,8 @@ require (
 	golang.org/x/net v0.36.0 // indirect
 	golang.org/x/sys v0.36.0 // indirect
 	golang.org/x/text v0.24.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.66.10 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
+	nhooyr.io/websocket v1.8.17 // indirect
 )

go.sum

@@ -1,5 +1,9 @@
+cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
+cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/alecthomas/assert/v2 v2.7.0 h1:QtqSACNS3tF7oasA8CU6A6sXZSBDqnm7RfpLl9bZqbE=
 github.com/alecthomas/assert/v2 v2.7.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.14.0 h1:R3+wzpnUArGcQz7fCETQBzO5n9IMNi13iIs46aU4V9E=
@@ -83,12 +87,12 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -121,14 +125,14 @@ github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJ
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=
-github.com/sahilm/fuzzy v0.1.1/go.mod h1:VFvziUEIMCrT6A6tw2RFIXPXXmzXbOsSHF0DOI8ZK9Y=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/superfly/sprites-go v0.0.0-20260112234611-135551a277ef h1:n5iTBxDcVWMq43jqeLUaG0i2xJsdOJIs8WTXOtz3NlY=
+github.com/superfly/sprites-go v0.0.0-20260112234611-135551a277ef/go.mod h1:4zltGIGJa3HV+XumRyNn4BmhlavbUZH3Uh5xJNaDwsY=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yuin/goldmark v1.7.1/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
@@ -145,6 +149,8 @@ golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
 golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.36.0 h1:vWF2fRbw4qslQsQzgFqZff+BItCvGFQqKzKIzx1rmoA=
 golang.org/x/net v0.36.0/go.mod h1:bFmbeoIPfrw4sMHNhb4J9f6+tPziuGjq7Jk/38fxi1I=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
 golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -157,6 +163,7 @@ golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
 golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
 golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
 golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -186,3 +193,5 @@ modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+nhooyr.io/websocket v1.8.17 h1:KEVeLJkUywCKVsnLIDlD/5gtayKp8VoCkksHCGGfT9Y=
+nhooyr.io/websocket v1.8.17/go.mod h1:rN9OFWIUwuxg4fR5tELlYC04bXYowCP9GX47ivo2l+c=