Host-side overview page: all projects, VM status, resource use

[repalash]

Deferred until after the current milestones. aibox status now carries per-container memory/disk and Docker disk totals in the terminal; this issue tracks the browser version.

A host-side HTML page (served by the aibox CLI on the Mac itself, NOT inside a container) that shows:

• All projects/containers: state, memory, disk, dev URLs, serve status.
• VM-level status (runtime, memory cap, disk usage).
• Possibly links into each project's per-container sessions UI.

Constraint that shapes this: the in-container sessions UI must never get docker-daemon access — mounting the docker socket into a sandboxed container would defeat the per-project isolation (daemon access ≈ host root). Cross-container/VM visibility therefore has to come from a host-side process only.

Explicitly out of scope: VM RAM controls from the UI (changing the VM memory cap requires a VM restart on Colima/Docker Desktop/OrbStack — a button that kills all sessions; per-container docker update --memory is the only live knob and aibox sets no per-container limits today).

[repalash]

Scope addition: when this host-side page is built, the per-project sessions UI (aibox serve, currently a Node server inside the container on port 45789) moves out of the container and into it.

Reason: the in-container UI is reachable from sibling containers over the shared aibox network (and would be even with per-project networks, since the shared proxy routes to every container by hostname). Its endpoints spawn/stop sessions for the project, so that's a control surface crossing the per-project isolation boundary. An interim access token (stored in the project's private home slice, unreadable by siblings) was considered and deliberately skipped — the decision is to fix it once by moving the UI host-side together with this overview page rather than patching it in place.

Until then this is a documented, accepted trade-off (see the note in REVAMP.md and the comment at the UI's listen() call): endpoints only affect the one project, and the exposure class is the same as dev servers on the shared network.

Design notes for the move: the host page needs a persistent host-side process (launchd or equivalent — new machinery for aibox, which is why it lives in this milestone); all actions still execute in containers via docker exec (spawning claude, reading transcripts from the volume), so the host server is a thin shim + static UI; the existing in-container UI's endpoints (/api/sessions, /api/new, /api/resume, /api/stop) map 1:1.

---

Generated by Claude Code

[repalash]

Partial delivery on the branch: aibox sessions now ships the sessions half of this page, host-side as planned — loopback-only Node server run in the foreground on demand (opens the browser; Ctrl-C or its Close button stops it; no daemon). All projects' sessions with per-session actions: open in Ghostty/Terminal, copy the resume command, or register for phone/claude.ai via the new aibox rc-resume <id> plumbing command.

Remaining for this issue: VM/runtime status + per-container resource stats on the page (terminal aibox status covers it meanwhile), and absorbing the in-container serve UI (per the earlier comment) — likely by teaching this page the serve UI's new/stop actions and then retiring the in-container one.

---

Generated by Claude Code