Web interface

neuralinverse web starts the CLI's local server with a browser interface and opens it, already signed in. The interface is served by the same process, from files built into the CLI; it makes no requests to other hosts.

neuralinverse web                         # 127.0.0.1:7420, root = current folder
neuralinverse web --root ~/src --port 0   # any free port, sessions anywhere under ~/src
neuralinverse web --no-open               # only print the sign-in link
neuralinverse serve --web                 # the same server, without opening a browser

web accepts every serve option (--root, --port, --mode, --model and others).

What it offers

• Sessions: open sessions and saved sessions to resume, per root folder. New session picks a folder (limited to the server's roots), a model and a permission mode.
• Chat: streaming Markdown, collapsible thinking, and tool cards with live output, full input and output on expand, and inline diffs.
• Approvals: permission requests (with diff previews and "always allow" rules), questions and plan reviews open as dialogs. A countdown shows when an unanswered request will be denied.
• Composer: multi-line input, @ to mention workspace files, paste or drop images, send while the agent works to queue the prompt, Stop to interrupt.
• Header: a model picker grouped by provider with context window, price per million tokens and vision and reasoning badges; a permission mode switch.
• Panels: the agent's plan and background tasks; changed files with a diff viewer (unified or side by side).
• Status bar: connection state, context used, tokens in and out, estimated cost.
• Keyboard: Enter send, Shift+Enter new line, Esc stop, Ctrl+K or Cmd+K command palette, / focus the input, ↑ recall the previous prompt.

It reconnects automatically (reloading the transcript when events were missed), works down to tablet width, follows the system light or dark theme and prefers-reduced-motion, and is usable with a keyboard and a screen reader.

Sign in

Browsers cannot attach a bearer token to page loads, so the web interface uses a cookie session:

1. At start-up the server prints a one-time sign-in link …/login?code=… (and opens it with neuralinverse web). The code is 256 bits, valid for 5 minutes and usable once.
2. Opening it sets an HttpOnly, SameSite=Strict session cookie (plus Secure when the request arrived over HTTPS, for example behind a TLS proxy) and redirects to /, which removes the code from the address bar.
3. Without a valid link, /login offers a form for the server token, from the start-up output or ~/.neuralinverse/server.json. Ten failed attempts per minute lock the form for a minute.

Cookie names include the port (ni_session_<port>, ni_csrf_<port>). Sessions live in memory: restarting the server signs every browser out. Sign out in the sidebar ends the session.

Security

• The bearer token keeps working for every API call; the cookie is an extra credential used only by the web interface.
• Cookie-authenticated requests are refused when the browser reports (Sec-Fetch-Site) that they come from another site or another origin on the same site, such as a development server on another localhost port.
• State-changing requests with the cookie must also send X-NI-CSRF equal to the readable ni_csrf_<port> cookie bound to the session, and an Origin, when present, equal to the server's own.
• Pages are served with a strict Content-Security-Policy (default-src 'none', scripts, styles and connections only from the server itself, no inline code, frame-ancestors 'none', and Trusted Types), plus X-Frame-Options: DENY, Referrer-Policy: no-referrer and X-Content-Type-Options: nosniff.
• Model output is rendered by a built-in Markdown renderer that escapes everything, allows only http(s) and mailto links, and never loads images from other hosts.
• Loopback-only binding and Host header checks (DNS-rebinding protection) apply to the pages as they do to the API.

Anyone signed in can do everything the server token allows, which is everything the CLI can do as your user. Do not expose the server beyond your machine without a TLS proxy, --allow-remote and an explicit token.