Add local web dashboard (same web)

Read-only localhost dashboard for browsing, searching, and inspecting
vaults. Single embedded HTML file, no build step, no dependencies.
Security hardened: localhost-only binding, CSP headers, path traversal
protection, private path filtering, safe markdown rendering.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sgx-labs

CHANGELOG.md

@@ -26,6 +26,8 @@ Comprehensive upgrade to session handoffs based on real-world user feedback. Ric
 
 ### Added
 
+- **Web dashboard** — `same web` launches a local read-only dashboard at `127.0.0.1:4078`. Browse notes, search semantically, view vault composition, read decisions and handoffs, see related notes. Single embedded HTML file, no external dependencies. Localhost-only with security headers (CSP, X-Frame-Options DENY, DNS rebinding protection). Works without Ollama (keyword fallback). `--port` and `--open` flags available
+- **Dashboard insights** — contextual tips based on vault state: index staleness warnings, search mode guidance, seed install suggestions, content type coaching, pinned notes tips
 - **Bug reporting** — "Report a Bug" link in README and npm package, GitHub issue templates (bug report + feature request), `same doctor` shows issues URL when checks fail, MCP `index_stats` description guides agents to `same doctor` and GitHub Issues
 - **Stop hook message control** — handoff creation message shows once per session; subsequent updates are silent
 

cmd/same/main.go

@@ -158,6 +158,7 @@ Need help? https://discord.gg/9KfTkcGs7g`,
 		searchCmd(),
 		askCmd(),
 		relatedCmd(),
+		webCmd(),
 	)
 
 	addGrouped("knowledge",

cmd/same/web_cmd.go

@@ -0,0 +1,70 @@
+package main
+
+import (
+	"fmt"
+	"os/exec"
+	"runtime"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"github.com/sgx-labs/statelessagent/internal/config"
+	"github.com/sgx-labs/statelessagent/internal/web"
+)
+
+func webCmd() *cobra.Command {
+	var (
+		port     int
+		openFlag bool
+	)
+	cmd := &cobra.Command{
+		Use:   "web",
+		Short: "Open the vault dashboard in your browser",
+		Long: `Start a local web server for the vault dashboard.
+
+The dashboard is read-only and only accessible from localhost.
+
+Examples:
+  same web                  # Start on port 4078
+  same web --port 8080      # Custom port
+  same web --open           # Auto-open browser`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			vp := config.VaultPath()
+			if vp == "" {
+				return config.ErrNoVault
+			}
+
+			// Create embed provider (nil is fine — keyword fallback)
+			embedClient, _ := newEmbedProvider()
+
+			addr := fmt.Sprintf("127.0.0.1:%d", port)
+
+			if openFlag {
+				go func() {
+					time.Sleep(300 * time.Millisecond)
+					openBrowser(fmt.Sprintf("http://%s", addr))
+				}()
+			}
+
+			return web.Serve(addr, embedClient, Version, vp)
+		},
+	}
+	cmd.Flags().IntVar(&port, "port", 4078, "Port to listen on")
+	cmd.Flags().BoolVar(&openFlag, "open", false, "Auto-open browser")
+	return cmd
+}
+
+func openBrowser(url string) {
+	var cmd *exec.Cmd
+	switch runtime.GOOS {
+	case "darwin":
+		cmd = exec.Command("open", url)
+	case "linux":
+		cmd = exec.Command("xdg-open", url)
+	case "windows":
+		cmd = exec.Command("rundll32", "url.dll,FileProtocolHandler", url)
+	default:
+		return
+	}
+	cmd.Run()
+}