Release 0.5.0 web app and Docker support

.dockerignore

@@ -0,0 +1,10 @@
+.git
+release
+dist
+node_modules
+.opencode/node_modules
+.ruff_cache
+*.log
+.env
+.env.*
+.DS_Store

.github/workflows/build.yml

@@ -27,6 +27,12 @@ jobs:
       - name: Build frontend
         run: bun run build
 
+      - name: Run unit tests
+        run: bun test
+
+      - name: Build Docker image
+        run: docker build -t opengui:web .
+
       - name: Package .deb
         run: bunx electron-builder --linux deb --publish never
 

.github/workflows/crocodile.yml

@@ -1,7 +1,7 @@
 name: crocodile
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
 
 jobs:
@@ -14,8 +14,19 @@ jobs:
       pull-requests: write
       issues: write
     steps:
-      # Safe with pull_request_target because no PR code gets checked out or executed.
-      # Restrict to trusted authors only because action may fetch repo content internally.
+      # Runs only for same-repo or trusted contributors. Fork PRs from outsiders may not
+      # have enough token permissions for automatic review comments.
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Configure git identity
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
       - uses: anomalyco/opencode/github@latest
         env:
           GITHUB_TOKEN: ${{ github.token }}

CONTRIBUTING.md

@@ -18,29 +18,31 @@ bun install
 
 ## Development
 
-Run the web frontend + Electron in development mode (with HMR):
+Run Electron app in development mode (renderer HMR + Electron shell):
 
 ```bash
-bun run dev
+bun dev
 ```
 
-Or run just the web frontend (no Electron):
+Or run browser version with Bun backend API:
 
 ```bash
-bun run dev:web
+bun dev:web
 ```
 
 ## Code Style
 
-This project uses [Biome](https://biomejs.dev/) for linting and formatting. Always use the bun scripts:
+This project currently uses `oxlint` via Bun scripts:
 
 ```bash
-bun run lint          # check and auto-fix lint + format issues
-bun run lint:check    # check only, no auto-fix
-bun run format        # auto-fix formatting only
+bun run lint          # lint check
+bun run lint:check    # lint check
+bun run lint:fix      # auto-fix where possible
+bun run typecheck     # TypeScript-aware checks
+bun test              # unit tests
 ```
 
-Run `bun run lint` before submitting a PR to make sure your code passes.
+Run `bun run lint:check`, `bun run typecheck`, and `bun test` before submitting a PR.
 
 ## Commit Messages
 
@@ -55,7 +57,7 @@ Write clear, concise commit messages. Focus on the "why" rather than the "what."
 1. Fork the repository
 2. Create a feature branch from `master`: `git checkout -b my-feature`
 3. Make your changes
-4. Run `bun run lint` to verify code style
+4. Run `bun run lint:check`, `bun run typecheck`, and `bun test`
 5. Commit your changes with a clear message
 6. Push to your fork and open a pull request against `master`
 
@@ -73,18 +75,19 @@ Check existing issues before opening a new one to avoid duplicates.
 If you're new to the codebase, here's where things live:
 
 ```
-main.cjs            Electron main process (window management, IPC)
-preload.cjs         Preload script (contextBridge API for renderer)
-opencode-bridge.mjs IPC bridge to the OpenCode SDK (SSE, sessions, prompts)
+main.cjs              Electron main process (window management, IPC)
+preload.cjs           Preload script (contextBridge API for renderer)
+opencode-bridge.mjs   IPC bridge to OpenCode SDK (SSE, sessions, prompts)
+server/web-server.ts  Bun backend for browser mode (RPC, events, server FS browser)
 src/
-  index.ts          Bun web server (development + production)
-  index.html        HTML entry point
-  frontend.tsx      React entry point
-  App.tsx           Main app layout
-  hooks/            Custom React hooks (state management, STT)
-  components/       UI components (sidebar, messages, prompt box, etc.)
-  lib/              Utility modules
-  types/            TypeScript type definitions
+  index.ts            Renderer-only Bun dev server entry
+  index.html          HTML entry point
+  frontend.tsx        React entry point
+  App.tsx             Main app layout
+  hooks/              Custom React hooks (state management, backends, STT)
+  components/         UI components (sidebar, messages, prompt box, etc.)
+  lib/                Utility modules, including browser Electron shim
+  types/              TypeScript type definitions
 ```
 
 ## Areas Where Help Is Needed

Dockerfile

@@ -0,0 +1,36 @@
+FROM oven/bun:1.3-debian
+
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends \
+		bash \
+		ca-certificates \
+		git \
+		iproute2 \
+		openssh-client \
+		procps \
+		ripgrep \
+		util-linux \
+	&& rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+
+COPY . .
+RUN bun run build
+COPY docker/host-exec /usr/local/bin/opengui-host-exec
+COPY docker/entrypoint.sh /usr/local/bin/opengui-entrypoint
+RUN chmod +x /usr/local/bin/opengui-host-exec /usr/local/bin/opengui-entrypoint \
+	&& mkdir -p /usr/local/host-bin \
+	&& for cmd in git opencode claude codex pi bun node npm python python3 bash sh rg fd make gcc g++; do ln -sf /usr/local/bin/opengui-host-exec /usr/local/host-bin/$cmd; done
+
+ENV HOST=0.0.0.0
+ENV PORT=3000
+ENV NODE_ENV=production
+ENV OPENGUI_ALLOWED_ROOTS=/workspace
+
+EXPOSE 3000
+
+ENTRYPOINT ["/usr/local/bin/opengui-entrypoint"]
+CMD ["/usr/local/bin/bun", "server/web-server.ts"]

README.md

@@ -87,18 +87,26 @@ No manual config file needed. Connection settings live in UI.
 
 ### Development
 
-Run web frontend + Electron with HMR:
+Run Electron app with HMR:
 
 ```bash
-bun run dev
+bun dev
 ```
 
-Run only web frontend:
+Run web app with local backend API (projects, git, agents):
 
 ```bash
-bun run dev:web
+bun dev:web
 ```
 
+Open `http://127.0.0.1:3000`. Browser folder picker uses server paths. Set `OPENGUI_ALLOWED_ROOTS=/path/to/projects` to restrict browsable folders.
+
+### Docker
+
+Docker install supports contained mode and host-control mode. Host-control mode uses host CLIs through `nsenter` while Docker manages web server.
+
+See [docs/docker.md](docs/docker.md) for Docker modes and [docs/apache.md](docs/apache.md) for Apache reverse proxy + Basic Auth.
+
 ### Production
 
 Build frontend bundle:
@@ -110,9 +118,17 @@ bun run build
 Run Electron app in production mode:
 
 ```bash
-bun run start:electron
+bun start
 ```
 
+Build and run web app in production mode:
+
+```bash
+bun start:web
+```
+
+For internet-facing deploys, keep OpenGUI bound to localhost and put Apache or another HTTPS reverse proxy in front.
+
 ### Distribution
 
 Build Linux `.deb`:
@@ -136,20 +152,21 @@ bun run dist:win
 ## Architecture
 
 ```
-main.cjs            Electron main process (window management, IPC)
-preload.cjs         Preload script (contextBridge API for renderer)
-opencode-bridge.mjs IPC bridge to the OpenCode SDK (SSE, sessions, prompts)
+main.cjs              Electron main process (window management, IPC)
+preload.cjs           Preload script (contextBridge API for renderer)
+opencode-bridge.mjs   IPC bridge to OpenCode SDK (SSE, sessions, prompts)
+server/web-server.ts  Bun backend for browser mode (RPC, events, server FS browser)
 src/
-  index.ts          Bun web server (development + production)
-  index.html        HTML entry point
-  frontend.tsx      React entry point
-  App.tsx           Main app layout
+  index.ts            Renderer-only Bun dev server entry
+  index.html          HTML entry point
+  frontend.tsx        React entry point + web Electron shim install
+  App.tsx             Main app layout
   hooks/
-    use-opencode.tsx  Central state management (context + reducer)
-    useSTT.ts         Speech-to-text hook
-  components/       UI components (sidebar, messages, prompt box, etc.)
-  lib/              Utility modules
-  types/            TypeScript type definitions
+    use-agent-impl-core.tsx  Central agent/workspace state
+  components/         UI components (sidebar, messages, prompt box, etc.)
+  lib/
+    web-electron-api.ts      Browser shim for Electron preload API
+  types/              TypeScript type definitions
 ```
 
 ## Configuration