Skip to content

Feature Web UI

Jump to bottom
Luigi Colluto edited this page Jul 14, 2026 · 1 revision

Feature: Web UI

A no-build web interface: paste the program, point at a repo, click start, watch the audit run live, read the results — without touching the CLI. Served by the HTTP API on top of the same pipeline every CLI command drives.

Run it

python -m argo.cli serve --open    # starts the API + UI, opens http://127.0.0.1:8000

Or double-click start.cmd (Windows) / run ./start.sh. Localhost only — it runs an agent over arbitrary repos; do not expose it unauthenticated.

Stack — deliberately no build step

Vanilla ES modules + modern CSS, served as static files; a hash router; marked vendored locally so there's no runtime CDN dependency — no npm/Node/bundler. For a local single-user tool, reliability beats toolchain fashion. Light + dark theme, persisted, respecting prefers-color-scheme, no flash on load.

The views

  • New run — a mode toggle picks 🔍 General audit (default — no brief, just point at code) or 🎯 Bug bounty (reveals program description + reference links). Both feed the same engine — see Two Modes. Includes an ⬆ Upload .zip button (path-traversal + zip-bomb guarded server-side extraction), a runner selector (Mock/Claude/Codex), model pickers populated live from the backend, and a "Let the pipeline choose" card (Quick/Standard/Thorough) that fills in a recommended config for you. Cost-aware: defaults to Mock (free); switching to a real backend reveals an explicit cost warning.
  • Settings — persisted defaults for the New Run form (runner, budget, parallelism, audit model, calibration, per-stage models).
  • Vuln index — the curated vulnerability-class index by archetype, browsable/educational.
  • Costs — see Benchmarks & Costs.
  • Benchmarks — findings quality (precision/recall/F1) against labeled suites, plus a Real-world quality card pairing triager accept-rate with benchmark recall.
  • Run (the live view) — a stage timeline filling in via server-sent events with a pulsing active stage and a live cost chip; artifact cards that update as files land; a Cancel button that kills the running session immediately, not at the next stage boundary. When finished: Report, Findings (sortable/filterable, detail drawer), Fixes (Remediation & Fixes), Chat (Interrogation Chat), Drafts, Artifacts.
  • History — every past run, click to reopen.

How live progress works

The run view opens an EventSource to a server-sent-events endpoint. Each event is the run's current status (stage states + live cost + which artifacts exist), so the timeline and artifact cards update in real time and partial results appear as soon as each stage produces them — no blind spinner, even on a 30-minute real run.

Safety in the UI

Default runner is Mock — a click costs nothing until you explicitly choose Real. The UI only calls whitelisted artifact endpoints; it never receives the repo copy or arbitrary paths. Every engine guardrail (read-only repo, no live host, no patching, no auto-submit) is unchanged — the UI is a viewer/launcher, not a new execution path. See Guardrails & Safety.

Related

  • Getting Started — the CLI-first quickstart, if you'd rather skip the browser.
  • Two Modes — what the mode toggle on the New Run screen actually changes.

Argo

Features

Reference

Clone this wiki locally