h5i-dev/h5i

Part of #496. Build a small CLI that converts the output of h5i browser audit --json into a self-contained HTML report. h5i already provides the structured audit data. This tool should make that record easy to archive, attach to a CI run, or send to someone who does not have h5i installed. It is not intended to replace the live h5i ui. Estimated effort: 2 to 4 hours. What to build The basic workflow should be: h5i browser audit --json > audit.json h5i-audit-report audit.json --out report.html Piping the audit directly should also be supported if convenient: h5i browser audit --json | h5i-audit-report > report.html The report should include: Session identity, starting URL, placement, and ending reason. The policy digest and available evidence information. One ordered timeline containing browser actions, requests, handovers, and lifecycle events. Clear visual distinction between allowed and denied requests. The reason recorded for each denied request. Filters for event type and request

Part of #496. An fzf front end for h5i box ls: fuzzy-find a box, read its state in the preview pane, and press one key to shell into it, diff it, watch its browser, or export it. You stop typing box names, and you stop opening a shell in the wrong one. Almost all of it already exists, and the data source is already structured: h5i box ls --json gives you, per box, the id, status, profile, isolation claim, pinned base, capture count, base drift, and the live sessions holding it right now. So the tool is a picker over that array plus a keymap. What makes it worth writing well is the part the obvious version throws away. The obvious version pipes the human h5i box ls through awk '{print $1}', and that first column is a display string, not a handle: the trailing markers (⚠drift, ●shell pid 4127, ⚠stale) are exactly what tells you that the box you are about to enter already has an agent writing in it. h5i does not refuse a second writer session, so a picker that drops those marks is a

Part of #496. A small set of git hooks that runs your tests inside a box, so the run that gates your history is the confined one: pre-commit for a fast subset, pre-push for the whole suite. Most of this already exists. h5i box run <name> -- cargo test passes the exit code straight through, which is exactly the contract a git hook wants. What is missing is the twenty lines around it that decide which commit to test, name the box, tear it down afterwards, and get out of the way when someone is committing from inside a box already. Everybody writes those twenty lines wrong the first time, and the interesting part is that the obvious version is wrong in a way nobody notices: it tests the previous commit and reports it as if it had tested yours. Estimated effort: 30 minutes to an hour. What to build An installer, an uninstaller, and the runner the hook itself calls: h5i-git-hooks install --pre-push # the whole suite, before a push h5i-git-hooks install --pre-commit # a fast subs

Part of #496. A small tool that reads a box's receipts, finds the destinations the egress allowlist refused, and turns each one into a question for a human: "this run tried to reach registry.npmjs.org:443 eleven times and was refused. Do you want to allow it?" Right now a refusal shows up as a count in h5i box inspect and a red row in h5i ui. Deciding what to do about it means reading the receipt, working out which host it was, and writing the h5i box allow line yourself. That last step is mechanical, and it is the one people skip. Estimated effort: 2 to 4 hours. What to build A CLI that reads receipts and reports refused egress, grouped by destination: h5i box export mybox --out ./review h5i-egress-advisor ./review/receipt.json # an export bundle h5i-egress-advisor --box mybox # or the live box's receipt.jsonl h5i-egress-advisor ./review/receipt.json --json For each refused host:port: how many times, in which runs, and the exact command that would allow it, pri

Part of #496. A small tool that turns the invite from h5i box share into a QR code, so the person you are sharing with can point a phone at the screen instead of copying a long string out of a chat window. Estimated effort: 1 to 2 hours. What to build A CLI that reads an invite and renders it as a QR code: h5i box share demo --tunnel | h5i-share-qr # read from a pipe h5i-share-qr - # read from stdin h5i-share-qr h5i1_eyJ2IjoxLCJib3hf… # or take it as an argument h5i-share-qr --png invite.png h5i1_… # write a PNG instead Terminal output by default, drawn with half-block characters or ANSI background colors so it scans off the screen. A --png flag for when the invite has to go into a slide or a doc. Handle both kinds of invite: the peer-to-peer ticket (h5i1_<base64url>, a few hundred bytes) and the plain link a --tunnel share hands back. Scanning a tunnel link opens the page directly; scanning a P2P ticket giv