Web client

rove --web serves Rove in a browser. It runs the same bridge the iOS and Android apps pair with (IOS.md), and the page is one more client of it: same daemon, same tasks, same terminal sessions as the TUI.

rove --web                 # 127.0.0.1:7878 only
rove --web --port 7900     # another port

It prints two links and keeps running until you stop it:

open: http://127.0.0.1:7878/#token=…
pair: ws://127.0.0.1:7878/?token=…

Open the first in a browser. The second is the phone pairing URL. A phone already paired with rove-bridge keeps working: the two share one token.

What it does today

• The Tasks rail: projects, tasks and their tabs, with the TUI's status marks (? waiting on you, ! needs you, ● unseen turn, ○ quiet, a spinner while working) and the +N / −N / ↑N / PR marks.
• Click a task or tab to open its terminal session, and type into it. That includes answering an engine's prompts.
• Right-click a project, task or tab for the same menu the TUI has: new conversation, close tab, rename, rename branch, pin, set status, change engine, copy the task ID, branch or path, land, delete.
• + New task at the bottom of the rail, and + in the tab strip for a new conversation. The first message is optional, as in the TUI's picker: without one you get a plain engine (or shell) tab. A fork to new tasks needs one.
• The Inbox: click INBOX n at the top of the rail. ↑↓ moves, Enter opens the session and clears it, d clears it without opening.

The keyboard works as in the TUI: the rail's own keys (j/k, Enter, n, /, r, d and the rest of the sidebar chords), the ctrl+a prefix layer with its guide, F1 help and the command palette, and the direct chords such as Ctrl+E, Ctrl+1..9, F2–F5 and F7. Your ~/.rove/settings/keybindings.yaml applies here too. Chords the browser keeps for itself never reach the page: close a tab with ctrl+a w or the menu instead of Ctrl+W, open one with + or Ctrl+E instead of Ctrl+T, and there is no Ctrl+Q (a page cannot quit itself).

web/PARITY.md lists every TUI action and whether the web has it yet.

Security

• It listens on 127.0.0.1 only unless you pick a bridge preset (--preset tailscale or --preset cf, see IOS.md). There is no flag that opens it to the whole network by default.
• The token rides in the link's #fragment, which browsers never send to a server, so it reaches no access log. The page stores it in the browser's local storage and removes it from the address bar.
• The page sends the token as a Sec-WebSocket-Protocol value, because a browser cannot set the Authorization header phones use. A socket opened from another site is refused even with the token.
• --rotate-token revokes every browser and phone at once.

The page's files are served without the token (they carry none); every operation needs it. With --preset cf, Cloudflare Access gates the page too.

Limits

• The standalone rove binary does not include the page; rove --web says so. The npm package does.
• A browser tab resizes the shared session to its own width, as the phone apps do, so the TUI may redraw at the browser's size while it is open.