TraceForge Interactive Web Console

TraceForge includes a built-in, local-first web interface designed for operators who prefer an interactive visual console alongside the command line.

The web interface binds strictly to the local loopback interface (127.0.0.1) by default, ensuring zero network exposure and preserving local privacy.

1. Quick Start

To launch the web console from the project root:

# Via main.sh
./main.sh web

# Or with a custom port
./main.sh web --port 8080

# Or via the Python CLI
traceforge web --port 8000

# Or via run.sh
./run.sh web

Once running, navigate to:

http://127.0.0.1:8000

To stop the web console, press Ctrl+C in the terminal.

2. Desktop-Grade Architecture & Capabilities

The web interface is a zero-dependency single-page application (SPA) backed by Python’s standard library http.server API routes. It directly invokes the existing Python, Go, and Bash modules without running external database daemons or node servers.

3. Security & Safety Standards

  • Strict Localhost Binding: Binds strictly to 127.0.0.1 by default (Zero LAN exposure).

  • Path Traversal Protection: Upload and download endpoints validate canonical paths strictly within the project root and workspace boundaries.

  • Defensive Subprocess Execution: Subprocess calls use structured arrays with allowlisted parameters without shell string concatenation.

  • Immutable Read-Only Storage: Ingested evidence files are given read-only permissions (0o444) with cryptographic hash verification.