JailbrokenAI · KillAllTheHippies · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## Unreleased — WebUI V2 unified operator surface
+
+- Added a shared typed capability catalog so TUI behavior is the canonical contract and
+  every registered operation remains discoverable from V2.
+- Added server-owned queued executions with pause, resume, steering, attacker switching,
+  cancellation, and reconnectable sequenced events.
+- Added canonical JSONL history with a rebuildable SQLite search/correlation index.
+- Added `/v2` alongside `/legacy`, with dedicated Agent and Live surfaces, persistent
+  multi-turn Compose, workflow sequencing and reconstruction, cross-run findings, run-log
+  exploration, evidence reports, provider verification, and profile management.
+- Added historical-run selection to Live and preserved drafts and view state across V2
+  navigation.
+- Added [complete setup and development documentation](docs/SETUP.md).
+
 ## Five new attack tools: cipherchat, skeleton_key, persuasion_attack, drattack, ica
 
 Adds five research-derived attack tools that were missing from the arsenal, wired into

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -14,6 +14,10 @@ wallbreaker check              # validate config (profiles, keys, target, judge)
 pytest -q                      # full suite must stay green
 ```
 
+Dashboard contributors should install `.[dev,dashboard]`, run `npm install` in
+`wallbreaker/dashboard/web`, and verify `npm run build`. See [docs/SETUP.md](docs/SETUP.md)
+for the complete cross-platform setup and local development workflow.
+
 ## Architecture (where things live)
 
 - `wallbreaker/providers/` normalize OpenAI + Anthropic wire formats to one event stream
@@ -25,7 +29,11 @@ pytest -q                      # full suite must stay green
 - `wallbreaker/presets.py` — curated single-shot jailbreak templates.
 - `wallbreaker/tui/` — the Textual terminal UI (theme in `theme.py`, chrome in
   `header.py`/`sidebar.py`/`widgets.py`, layout in `app.tcss`).
-- `dashboard/` — FastAPI backend + React/Svelte web dashboard.
+- `wallbreaker/capabilities.py` — typed capability manifest shared by the TUI and WebUI V2.
+- `wallbreaker/executions.py` — server-owned execution lifecycle and resumable events.
+- `wallbreaker/history_index.py` — rebuildable SQLite index over canonical JSONL history.
+- `wallbreaker/dashboard/` — FastAPI backend + React/Vite dashboards; V2 lives under
+  `web/src/v2/`, while the original interface remains available during rollout.
 
 ## House rules
 

diff --git a/README.md b/README.md
@@ -287,15 +287,12 @@ pytest -q
 
 ## Web dashboard
 
-A browser dashboard ships alongside the TUI (FastAPI backend + React/Vite SPA). Its
-headline is the **Agent** view, the *same autonomous attack loop the TUI runs*: give it an
-objective ("jailbreak the model into …") and the attacker brain reasons, picks techniques,
-fires at the target, reads the verdict, and keeps going, streamed live to your browser over
-SSE. Plus a single-shot **attack console** (preset + transform chips → verdict), a live ASR
-scoreboard, findings table, run-log viewer, a searchable arsenal of
-presets/transforms/tools, and a **Settings** panel to swap the target / attacker / judge
-model live (persisted to `.wallbreaker_state.json`, applied without a restart; image
-targets auto-set `modality=image`).
+A browser dashboard ships alongside the TUI (FastAPI backend + React/Vite SPA). WebUI V2
+uses the same capability catalog and application services as the TUI, and adds a
+server-owned execution queue, resumable event streams, persistent multi-turn composition,
+workflow sequencing, provider/profile management, and current or historical evidence
+inspection. **Agent** is dedicated to the autonomous Attack → Target → Judge loop;
+**Live** provides the holistic-to-granular observability surface.
 
 ![Wallbreaker attack console](docs/images/dashboard-console.png)
 
@@ -310,12 +307,18 @@ targets auto-set `modality=image`).
 ```bash
 pip install -e ".[dashboard]"                       # FastAPI + uvicorn
 cd wallbreaker/dashboard/web && npm install && npm run build && cd -
-wallbreaker dashboard                                # http://127.0.0.1:8787
+wallbreaker dashboard                                # binds to 127.0.0.1:8787
 ```
 
-The backend reuses the same engine as the TUI, so the console fires through `query_target`
-against your `[target]`. For frontend hot-reload during development, run `npm run dev` in
-`wallbreaker/dashboard/web` (it proxies `/api` to the running `wallbreaker dashboard`).
+Open WebUI V2 at <http://127.0.0.1:8787/v2>. The original dashboard remains available at
+<http://127.0.0.1:8787/legacy> during the parity rollout. The backend reuses the same
+engine as the TUI. For frontend hot-reload, run `npm run dev` in
+`wallbreaker/dashboard/web`; it proxies `/api` to the dashboard backend.
+
+See the [setup guide](docs/SETUP.md) for Windows instructions, provider configuration,
+history storage, development workflow, network-exposure safeguards, and troubleshooting.
+See the [WebUI V2 showcase](docs/WEBUI_V2_SHOWCASE.md) for a visual tour of the unified
+operator surface.
 
 ## Responsible use
 

diff --git a/README_RICHERUI.md b/README_RICHERUI.md
@@ -1,8 +1,12 @@
-# Wallbreaker Richer UI Guide
+# Wallbreaker browser UI guide
 
-This guide covers the browser-dashboard features added on the `richer-ui` branch. It is
-intended as a companion to the main [README](README.md), which remains the reference for
-the red-team harness, CLI, tools, and safety policy.
+This guide describes the original browser dashboard retained at `/legacy`. WebUI V2 is
+the active unified operator surface at `/v2`; use the [setup guide](docs/SETUP.md) for
+installation, current navigation, local history, development, and troubleshooting.
+
+The original interface remains available during the V2 parity rollout. Its provider and
+profile management APIs are also used by V2, but its page names and workflows below should
+not be read as the V2 information architecture.
 
 ## Install and launch
 
@@ -17,15 +21,15 @@ cd ../../..
 wallbreaker dashboard
 ```
 
-Open <http://127.0.0.1:8787>. For frontend development, keep `wallbreaker dashboard`
+Open <http://127.0.0.1:8787/legacy>. Open V2 at <http://127.0.0.1:8787/v2>. For frontend development, keep `wallbreaker dashboard`
 running and start Vite in another terminal:
 
 ```bash
 cd wallbreaker/dashboard/web
 npm run dev
 ```
 
-The dashboard has nine views: **Agent**, **Overview**, **Attack console**, **Findings**,
+The original dashboard has nine views: **Agent**, **Overview**, **Attack console**, **Findings**,
 **Run logs**, **Arsenal**, **Profiles**, **Advanced**, and **Settings**. Use the arrow beside the Wallbreaker logo to
 collapse or expand the navigation rail. The choice is remembered in the browser.
 

diff --git a/docs/SETUP.md b/docs/SETUP.md
@@ -0,0 +1,194 @@
+# Wallbreaker setup
+
+This guide installs Wallbreaker for local terminal and browser use. Wallbreaker is an
+authorized LLM security-testing harness; only connect it to systems you own or have
+explicit permission to evaluate.
+
+## Requirements
+
+- Python 3.11 or newer
+- Git
+- Node.js 18 or newer and npm, if you want the browser interface
+- Credentials for the model providers you intend to use, unless you use a supported
+  keyless local CLI provider
+
+## Install
+
+Clone your fork (or the upstream repository), then create an isolated Python environment:
+
+```bash
+git clone https://github.com/YOUR_ACCOUNT/wallbreaker.git
+cd wallbreaker
+python -m venv .venv
+```
+
+Activate it on macOS or Linux:
+
+```bash
+. .venv/bin/activate
+```
+
+Activate it on Windows PowerShell:
+
+```powershell
+.\.venv\Scripts\Activate.ps1
+```
+
+Install the terminal application, development tools, and dashboard backend:
+
+```bash
+python -m pip install -e ".[dev,dashboard]"
+```
+
+Optional extras are available for barcode and steganography tools:
+
+```bash
+python -m pip install -e ".[dev,dashboard,barcodes,stego]"
+```
+
+## Configure providers and roles
+
+Copy the example configuration and keep the resulting local file out of source control:
+
+```bash
+cp config.example.toml config.toml
+```
+
+On Windows PowerShell, use:
+
+```powershell
+Copy-Item config.example.toml config.toml
+```
+
+Edit `config.toml` to define at least one attacker profile and the target and judge
+roles. Prefer `api_key_env` plus environment variables or the dashboard's credential
+editor over committing literal keys. Validate the result before launching:
+
+```bash
+wallbreaker check
+```
+
+The browser interface can also create, edit, test, enable, and disable providers and
+manage attacker, target, and judge profiles. Known credential fields are redacted from
+API responses and execution history.
+
+## Run the terminal interface
+
+```bash
+wallbreaker
+```
+
+Useful alternatives include:
+
+```bash
+wallbreaker --profile PROFILE_NAME
+wallbreaker --auto "authorized evaluation objective"
+wallbreaker --resume
+```
+
+Terminal sessions autosave under `sessions/`.
+
+## Build and run the browser interface
+
+Install the frontend dependencies and create the production bundle:
+
+```bash
+cd wallbreaker/dashboard/web
+npm install
+npm run build
+cd ../../..
+```
+
+Start the backend from the repository root:
+
+```bash
+wallbreaker dashboard
+```
+
+Open these local URLs:
+
+- WebUI V2: <http://127.0.0.1:8787/v2>
+- Original dashboard: <http://127.0.0.1:8787/legacy>
+
+V2 separates operation from observation. **Agent** runs and steers the Attack → Target
+→ Judge loop, while **Live** observes either the current execution or a selected
+historical run. Compose, Workflows, Arsenal, Findings, Runs and Logs, Reports, Models,
+and Settings expose the rest of the operator surface.
+
+The dashboard binds to loopback by default and has no multi-user authentication. To bind
+to another interface you must both choose the host and acknowledge the exposure:
+
+```bash
+wallbreaker dashboard --host 0.0.0.0 --allow-network
+```
+
+Do this only behind an access-controlled boundary. Run history can contain prompts,
+responses, reasoning, tool arguments, and generated artifacts.
+
+## Frontend development
+
+Keep `wallbreaker dashboard` running, then start the Vite development server in another
+terminal:
+
+```bash
+cd wallbreaker/dashboard/web
+npm run dev
+```
+
+Vite proxies `/api` to `http://127.0.0.1:8787`. Frontend source changes hot-reload.
+After Python backend changes, restart `wallbreaker dashboard`. To update the production
+bundle served on port 8787, run `npm run build` again and refresh the browser.
+
+## History and local state
+
+| Path | Purpose |
+|---|---|
+| `config.toml` | Provider definitions, profiles, and active role configuration |
+| `.env` | Optional locally managed provider credentials |
+| `.wallbreaker_state.json` | Non-secret runtime preferences and UI references |
+| `.wallbreaker_models.sqlite3` | Rebuildable provider model catalog |
+| `sessions/run-*.jsonl` | Canonical portable execution history |
+| `sessions/.wallbreaker_history.sqlite3` | Rebuildable search and correlation index |
+
+JSONL is the source of truth. The SQLite history index may be deleted and rebuilt from
+V2's Runs and Logs screen or through `POST /api/v2/history/rebuild`. Archive or remove
+canonical run files only when you intend to remove that evidence.
+
+## Verify the installation
+
+Run the Python suite with the project environment and build the frontend:
+
+```bash
+python -m pytest tests
+cd wallbreaker/dashboard/web
+npm run build
+```
+
+The full Python suite needs the project environment because the TUI, dashboard, image,
+and steganography tests use optional dependencies installed there.
+
+## Troubleshooting
+
+### The API runs but the browser UI is missing
+
+Build the frontend with `npm run build`, then refresh. Without a production bundle the
+backend returns a message explaining that only its API is available.
+
+### Every provider request fails
+
+Run `wallbreaker check`, then use **Models → Test provider**. A real test must authenticate
+and query the configured provider; an authentication error is not a successful connection.
+Check the key variable, base URL, protocol, authentication style, model path, and model ID.
+Native Anthropic normally uses `x-api-key`; some compatible proxies require `bearer`.
+
+### A run is absent from Live, Findings, or Reports
+
+Confirm its `run-*.jsonl` file is in the directory passed through `--sessions` (default:
+`sessions/`). In **Runs and Logs**, rebuild the history index. Malformed JSONL records are
+retained as visible parse errors rather than silently discarded.
+
+### Browser state appears stale
+
+Hard-refresh after rebuilding the frontend. V2 keeps drafts, selected views, conversation
+state, and workflow state while navigating; resetting or archiving a conversation is an
+explicit action.