feat: web UI overhaul — directory sections on canvas, Jost font, dashboard redesign

- Directories render as nested sections on React Flow canvas with notes inside
- Recursive folder API (tree endpoint) with note previews and move support
- Sidebar-canvas sync: click folder to focus section, select section to expand sidebar
- Move confirmation dialog when dragging items out of containing sections
- Replace Futura Classic with Jost from Google Fonts
- Dashboard component refresh with updated styles
- Fix web directory path resolution in CLI (walk parents instead of hardcoded offset)
- Add version module, explorer API, folder explorer component
- Fix commit-msg hook sys.path resolution
- Claude CLI auth docs for cron, schedule installer fixes

Author: eddiman

CLAUDE.md

@@ -4,6 +4,7 @@
 1. **NEVER read KB files directly.** Query via CLI: `.venv/bin/python -m adjutant kb query <name> "<question>"`.
 2. **NEVER read `.env` directly.** Use `get_credential()` from `core/env.py`.
 3. **NEVER commit** gitignored files: `identity/`, `state/`, `journal/`, `insights/`, `photos/`, `screenshots/`, `.env`, `adjutant.yaml`, `knowledge_bases/registry.yaml`.
+4. **NEVER add AI attribution** in commits — no `Co-Authored-By` or similar AI credit lines.
 
 ## Dev Commands
 ```bash

docs/guides/schedules.md

@@ -203,6 +203,54 @@ This is a one-time system setting and survives reboots. It does not affect porta
 
 ---
 
+## Claude CLI authentication for cron
+
+When using the `claude-cli` backend, cron jobs need access to your Claude authentication token. The Claude CLI normally authenticates via OAuth stored in the macOS keychain, which cron cannot access. Without this, jobs fail with:
+
+```
+ERROR: LLM did not return valid JSON array. Response: Not logged in · Please run /login
+```
+
+**Fix:**
+
+1. Generate a long-lived token (valid for 1 year, requires a Claude Pro or Max subscription):
+
+   ```bash
+   claude setup-token
+   ```
+
+2. Add the token to your `.env` file:
+
+   ```
+   CLAUDE_CODE_OAUTH_TOKEN=<token from step 1>
+   ```
+
+3. Ensure your crontab entries source `.env` before running. Wrap the command in a bash subshell:
+
+   ```
+   35 14 * * 1-5 HOME=... PATH=... ADJ_DIR=/path/to/adjutant /bin/bash -c 'set -a; source /path/to/adjutant/.env; set +a; exec /path/to/adjutant/.venv/bin/python ...'  # adjutant:job_name
+   ```
+
+   `set -a` exports all variables from `.env` into the subprocess environment so the `claude` binary sees `CLAUDE_CODE_OAUTH_TOKEN`.
+
+4. Sync your crontab to pick up the new format:
+
+   ```bash
+   adjutant schedule sync
+   ```
+
+**Testing:** Change a job's schedule to a few minutes from now and watch the log file:
+
+```bash
+tail -f state/news_briefing.log
+```
+
+If the job runs and you receive a Telegram notification, authentication is working.
+
+**Token renewal:** The token expires after 1 year. Run `claude setup-token` again and update `.env` when it does. A symptom of expiry is the same "Not logged in" error returning.
+
+---
+
 ## Troubleshooting
 
 **Job shows `[not in crontab]` in `adjutant status`**

docs/guides/web.md

@@ -0,0 +1,228 @@
+# Adjutant Web
+
+A visual knowledge base editor that runs in your browser. Open any KB as a spatial canvas — arrange notes, add sections and sticky notes, upload images, and edit markdown. When running alongside Adjutant, it also gives you a live dashboard to monitor status, control the lifecycle, and manage schedules.
+
+---
+
+## Starting the web app
+
+```bash
+adjutant web
+```
+
+This starts both the API server and the frontend, then opens `https://localhost:3021` in your browser. Both processes shut down together on `Ctrl+C`.
+
+**Options:**
+
+```
+--port, -p  API port (default: 3020)
+--host      API host (default: 0.0.0.0)
+--no-open   Don't open the browser automatically
+```
+
+The frontend always runs on port 3021. The API port is configurable.
+
+**First run:** If `web/node_modules/` is missing, `adjutant web` installs npm dependencies automatically before starting.
+
+---
+
+## Two modes
+
+The web app detects which context it's running in and adapts:
+
+**Adjutant mode** (default when an Adjutant directory is found)
+- Reads KBs from your `knowledge_bases/registry.yaml`
+- Respects per-KB access levels (read-only vs read-write)
+- Enables the Adjutant dashboard (status, lifecycle, schedules)
+
+**Standalone mode** (fallback when Adjutant isn't configured)
+- Scans a directory you specify for KB folders (any folder containing `kb.yaml`)
+- No Adjutant dashboard features
+- Configure the KB root via Settings or the first-run prompt
+
+---
+
+## The canvas
+
+Each KB folder opens as a 2D canvas. Files appear as note cards you can drag anywhere. You can also add sections, stickies, and images.
+
+**Navigation:**
+- Pan — click and drag on empty canvas, or hold `Space` + drag
+- Zoom — scroll wheel or trackpad pinch
+- Switch between Pan and Select tools in the toolbar
+
+**Note cards:**
+- Click to open and edit
+- Drag to reposition
+- Right-click for a context menu (edit, delete, copy)
+- Position is saved automatically to a `.adjutant-web.json` sidecar file alongside your markdown files
+
+**Creating notes:**
+- Click **+ Note** in the toolbar, then click on the canvas to place it
+- Give it a title and start writing
+- The file is saved as a `.md` file in the current KB folder
+
+**Editing notes:**
+The editor supports standard markdown — headings, bold, italic, lists, code blocks, blockquotes, and inline images. Your first `# heading` becomes the note title shown on the canvas card.
+
+**Tags:**
+Add tags to notes from the editor. Tags appear on the canvas card and are searchable.
+
+**Search:**
+Use the search bar in the toolbar to fuzzy-search all notes in the current KB by title, filename, tags, or content. Click a result to jump to it on the canvas.
+
+---
+
+## Sections
+
+Sections are resizable grouping boxes you can use to organise related notes spatially.
+
+- Click **+ Section** in the toolbar, then click to place it
+- Drag to move, drag the edge/corner to resize
+- Double-click the label to rename
+- Right-click to set a colour or delete
+
+Notes dragged into a section are logically associated with it (stored in the sidecar).
+
+---
+
+## Sticky notes
+
+Sticky notes are free-form text annotations — not markdown files, just canvas annotations.
+
+- Click **+ Sticky** in the toolbar, then click to place it
+- Double-click to edit text
+- Choose from 9 colours: white, yellow, pink, blue, green, purple, orange, mint, peach
+- Drag to reposition, right-click to delete
+
+Stickies are stored in the folder's `.adjutant-web.json` sidecar, not as separate files.
+
+---
+
+## Images
+
+You can upload images into a KB and place them on the canvas.
+
+- Drag an image file onto the canvas, or use the upload button in the toolbar
+- Accepts: JPEG, PNG, GIF, WebP, SVG, HEIC, HEIF (max 10 MB)
+- Images are converted to WebP and stored in `<kb-root>/<kb-name>/.adjutant-web/assets/`
+- Thumbnails are generated automatically
+- Drag to reposition, drag the corner to resize
+- Right-click to delete
+
+Rate limit: 20 uploads per 15 minutes per client.
+
+---
+
+## Folder navigation
+
+Use the sidebar to navigate between KBs and subfolders. The breadcrumb at the top of the sidebar shows your current location. Click any folder to open it as a new canvas.
+
+Each folder has its own independent canvas (its own `.adjutant-web.json`). Positions and annotations in one folder don't affect other folders.
+
+---
+
+## Read-only KBs
+
+KBs registered with `access: read-only` in Adjutant's registry are opened in read-only mode. You can view notes and navigate the canvas, but creating, editing, deleting, and uploading are blocked. The toolbar edit buttons are disabled.
+
+---
+
+## Adjutant dashboard
+
+Accessible via the **Adjutant** link in the sidebar (only shown in Adjutant mode).
+
+**Status panel** — shows whether Adjutant is running, its lifecycle state (OPERATIONAL / PAUSED / KILLED), and any currently active operation (pulse or review in progress).
+
+**Health checks** — confirms the Adjutant directory is found, config is present, the CLI is executable, and the listener process is alive.
+
+**Quick actions:**
+- Pause / Resume — immediately pause or resume the Telegram listener
+- Run pulse — trigger a pulse run in the background (same as `adjutant pulse`)
+- Run review — trigger a review run in the background (same as `adjutant review`)
+- Pulse and review run detached; the dashboard shows their progress via `state/active_operation.json`
+
+**Schedules** — lists all scheduled jobs from `adjutant.yaml`. You can toggle them on/off and trigger a manual run from here.
+
+**Identity** — shows short excerpts from `identity/soul.md`, `identity/heart.md`, and `identity/registry.md`.
+
+**Activity feed** — shows the last 20 entries from `journal/adjutant.log`, newest first.
+
+---
+
+## KB queries
+
+From any KB view, you can query the KB via Adjutant's sub-agent using the query bar (if available in the sidebar). This runs `adjutant kb query <name> "<question>"` and returns the answer inline. Timeout: 60 seconds.
+
+---
+
+## Settings
+
+Open Settings from the toolbar or sidebar.
+
+| Setting | Description |
+|---|---|
+| KB root | Directory to scan for KBs (standalone mode only) |
+| Theme | `default` or `bauhaus` |
+| Snap to object | Snap notes/stickies/sections to each other while dragging |
+| Show snap guides | Show alignment guide lines while dragging |
+
+Settings are saved to `~/.adjutant-web/config.json`.
+
+---
+
+## Data and files
+
+The web app never modifies your markdown files except when you explicitly edit or create a note.
+
+**What it writes:**
+
+| File | Location | Purpose |
+|---|---|---|
+| `.adjutant-web.json` | Per folder in each KB | Canvas positions, sections, stickies, image metadata |
+| `<id>.webp` | `<kb>/.adjutant-web/assets/` | Uploaded image (full resolution) |
+| `<id>-thumb.webp` | `<kb>/.adjutant-web/assets/` | Uploaded image thumbnail |
+| `config.json` | `~/.adjutant-web/` | App config (KB root path) |
+
+**Backups:** Before overwriting a `.adjutant-web.json`, the API keeps the last 3 backup copies. Writes are atomic (temp file + rename) to prevent corruption.
+
+---
+
+## Authentication
+
+By default the API has no authentication — it's designed for local or Tailscale use. To require a Bearer token on all API requests, set the environment variable before starting:
+
+```bash
+ADJUTANT_WEB_SESSION_TOKEN=your-secret-token adjutant web
+```
+
+CORS is restricted to localhost, Tailscale (`*.ts.net`, `100.x.x.x`), and private network ranges (`10.x`, `172.16-31.x`, `192.168.x`). The `/health` endpoint is always public.
+
+---
+
+## Ports
+
+| Service | Port | Configurable |
+|---|---|---|
+| API (Express) | 3020 | `--port` flag or `ADJUTANT_WEB_PORT` |
+| Frontend (Vite) | 3021 | No |
+
+The frontend proxies all `/api/*` requests to the API port. If you change `--port`, the API moves but the frontend stays on 3021.
+
+---
+
+## Running without `adjutant web`
+
+If you need to start the two processes independently (e.g. to run them as system services):
+
+```bash
+# API
+cd web/api && npm run dev        # development (tsx watch)
+cd web/api && npm start          # production (requires npm run build first)
+
+# Frontend
+cd web/app && npm run dev        # development (Vite)
+cd web/app && npm run build      # production build → web/app/dist/
+```
+
+Production: build the frontend with `npm run build`, then serve `web/app/dist/` as static files with any HTTP server. The API must be reachable at the same host on port 3020 (or proxied from the same origin).

hooks/commit-msg

@@ -0,0 +1,15 @@
+#!/usr/bin/env python3
+"""Git commit-msg hook — enforces Conventional Commits format.
+
+Install: cp hooks/commit-msg .git/hooks/commit-msg && chmod +x .git/hooks/commit-msg
+Or run:  python -m adjutant.core.version (with commit-msg file as arg)
+"""
+import sys
+from pathlib import Path
+
+# Allow running from repo root even without package install
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent / "src"))
+
+from adjutant.core.version import main_commit_msg  # noqa: E402
+
+sys.exit(main_commit_msg(sys.argv[1:]))

hooks/install.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Install git hooks from hooks/ into .git/hooks/
+set -euo pipefail
+
+HOOKS_DIR="$(cd "$(dirname "$0")" && pwd)"
+GIT_HOOKS_DIR="$(git -C "$HOOKS_DIR" rev-parse --git-dir)/hooks"
+
+for hook in "$HOOKS_DIR"/commit-msg "$HOOKS_DIR"/pre-commit; do
+    [ -f "$hook" ] || continue
+    name="$(basename "$hook")"
+    cp "$hook" "$GIT_HOOKS_DIR/$name"
+    chmod +x "$GIT_HOOKS_DIR/$name"
+    echo "Installed $name hook"
+done

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "adjutant"
-version = "0.2.0"
+dynamic = ["version"]
 requires-python = ">=3.11"
 
 dependencies = [
@@ -38,6 +38,10 @@ screenshot = [
 ]
 news = []
 
+[tool.hatch.version]
+path = "VERSION"
+pattern = "(?P<version>.+)"
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/adjutant"]
 

src/adjutant/capabilities/schedule/install.py

@@ -18,7 +18,6 @@
 from __future__ import annotations
 
 import contextlib
-import os
 import subprocess
 from pathlib import Path
 from typing import Any
@@ -157,19 +156,26 @@ def install_one(adj_dir: Path, name: str) -> None:
 
     marker = _marker(name)
     path_env = _snapshot_path()
+    env_file = adj_dir / ".env"
 
     if notify:
         wrap_py = adj_dir / "src" / "adjutant" / "capabilities" / "schedule" / "notify_wrap.py"
         venv_py = adj_dir / ".venv" / "bin" / "python"
         python = str(venv_py) if venv_py.exists() else "python3"
+        inner_cmd = f"{python} {wrap_py} {name} {script_path}"
+    else:
+        inner_cmd = script_path
+
+    if env_file.is_file():
         cron_line = (
             f"{sched} PATH={path_env} ADJ_DIR={adj_dir} "
-            f"{python} {wrap_py} {name} {script_path} "
-            f">> {log_path} 2>&1  {marker}"
+            f"/bin/bash -c 'set -a; source {env_file}; set +a; "
+            f"exec {inner_cmd} >> {log_path} 2>&1'  {marker}"
         )
     else:
         cron_line = (
-            f"{sched} PATH={path_env} ADJ_DIR={adj_dir} {script_path} >> {log_path} 2>&1  {marker}"
+            f"{sched} PATH={path_env} ADJ_DIR={adj_dir} "
+            f"{inner_cmd} >> {log_path} 2>&1  {marker}"
         )
 
     # Remove any existing entry for this job, then append new one