New website: computers only, download + check list + report viewer, no AI in the browser (chat and phone check removed)

README.md

@@ -151,22 +151,22 @@ npm start                           # run the app
 
 Offline fine-tuning on CPU: `training/train_lora.py` (LoRA on Qwen2.5-0.5B-Instruct; see `--benchmark` and `--resume`).
 
-## Security assistant (chat)
-
-The Space's front page is a chat assistant in the style of Devseis Nox: ask about securing a computer or phone,
-ISO 27001, GDPR or the EU AI Act, and run an audit from the chat. The model runs on the device with WebLLM (1.5B,
-about 1 GB on first use); answers are grounded in the Devseis knowledge base (`library/knowledge.json`, 321 passages
-generated by `library/build_knowledge.py` from the catalog and library), cite their sources, and are checked
-(`chatProblems` in `app/renderer/knowledge.js`). Without WebGPU, or if the GPU fails, it answers directly from the
-knowledge base. **Run audit**: on phones it starts the phone check (`phone.html`), which hands the report back to the
-chat; on computers it leads to the desktop app, or the app's `…-evidence.json` report can be attached so the chat answers
-from the user's own results and writes the full report. Conversations stay in the browser.
-Until model v0.4 (Qwen2.5-1.5B fine-tuned for chat and reports) is published, the chat uses the base Qwen2.5-1.5B-Instruct
-(`chat.version` in `app/model-version.json`).
+## Website (this Space)
+
+The Space's front page (`index.html`, `site/`) is for computers only (Mac, Windows, Linux). It detects the visitor's
+system and offers the right download of the desktop app, lists all 68 computer checks from `catalog/checks.json` with
+their risk and ISO 27001 / GDPR references, and shows a report: the app's *Ask Arx about this report* button (or
+*Open a report* with the app's `…-evidence.json` file) opens the results page, written with the app's own templates
+(`findingTemplate` / `summaryTemplate` in `app/renderer/auditor-core.js`). The page runs **no AI** and uploads nothing:
+the AI model runs only inside the desktop app.
+
+The earlier chat assistant and the phone check were removed on 2026-10-14: small models in the browser froze weak
+computers and crashed phones, and the 0.5B chat model did not survive 4-bit rounding. They remain in the Space's git
+history. `mobile/` stays because the synthetic data generator uses its evidence code.
 
 ## Install on a Mac
 
-Download from **https://devseis-arx.static.hf.space/download.html** (universal app for Apple silicon and
+Download from **https://devseis-arx.static.hf.space/#download** (universal app for Apple silicon and
 Intel, macOS 13+; files and checksums in [Devseis/endpoint-auditor-releases](https://huggingface.co/datasets/Devseis/endpoint-auditor-releases)).
 Drag it to Applications; on first open, allow it once in *System Settings › Privacy & Security › Open Anyway* (the build
 is ad-hoc signed, not yet notarised). The app downloads the AI auditor model on first run and follows the model version
@@ -178,20 +178,6 @@ with `DEVSEIS_SMOKE=<folder> "<app>/Contents/MacOS/Devseis Endpoint Auditor"` (a
 
 Code collects the evidence and decides every verdict; the fine-tuned model explains, prioritises and writes the report, and every answer is checked against the evidence before it is used. See [docs/MODEL_LLM.md](docs/MODEL_LLM.md) for who does what and how the model's role can grow.
 
-## Phone check (iPhone, iPad, Android)
-
-The phone check (`phone.html`, also reachable from the chat's Run audit) runs entirely in the browser:
-
-1. **Detects** what a browser can see: OS and version (Safari 26+ hides the iOS version in its user agent, so Safari's own version is used; Android uses client hints), device model (Android), browser, whether a device unlock method is set up (WebAuthn), and WebGPU support.
-2. **Asks** the rest, one question at a time with *where to look* in Settings (`catalog/mobile_questions.json`). Every result is labelled `detected` or `self-reported` in the evidence and the report.
-3. **Matches** the iOS version against the signed phone subset of the vulnerability bundle (55 KB, signature checked with WebCrypto).
-4. **Writes** the findings with the same auditor model in WebLLM (about 350 MB download, roughly 1 GB of GPU memory, so newer phones) or with the built-in writer, and builds the same report as the desktop app.
-5. **Saves or shares** the report as a PDF (share sheet or download). Phones do not allow a silent auto-save.
-
-`mobile/mobile-core.js` turns detections and answers into evidence; the synthetic generator calls the same code through `mobile/build-evidence.mjs`, so training data has exactly the page's wording. Organisation answers can be passed in the link: `index.html#org=<base64 JSON {"ORG_ROPA": "yes", ...}>`.
-
-Test without a phone: serve the repo (`python3 -m http.server 8765`) and run `app/node_modules/.bin/electron mobile/test/e2e.cjs ios out.json` (or `android`); it answers every question in a phone-sized window with a phone user agent and builds the PDF; then check the evidence with `python3 tools/validate_evidence.py out.json`.
-
 ## Vulnerability matching (offline)
 
 `vuln.known_vulnerabilities` is decided by exact version comparison, never by the model:
@@ -209,8 +195,8 @@ Devseis builds the bundle with `python3 vulndb/build_bundle.py` (needs internet;
 | Catalog, library, synthetic data, training data | **0.3** | 74 checks: Windows 64, Linux 56, macOS 56, iPhone 29, Android 30. 0.3 adds phones, real CVEs in training data and wording identical to the collectors and the phone page; 39,500 grounded examples |
 | Collectors (Windows, Linux, macOS) | **0.2** (catalog 0.3) | macOS tested on a real Mac; Linux tested on Ubuntu 24.04 and Fedora 42 containers; Windows parse-checked only (needs a real Windows test). Known vulnerabilities: inventory only, matching comes with the offline vulnerability bundle |
 | Vulnerability matcher and bundle | 0.1 | Tested: this Mac (Chrome 154 → 58 critical/high, fixed in 155), Ubuntu 24.04 (OpenSSL), Rocky 9 (25 of 25 packages agree with dnf's own security list), Fedora reported as not covered |
-| Phone check (web) | **0.3** | Tested in a phone-sized window as iPhone (Safari 26) and Android (Chrome 141); needs testing on real phones |
-| Fine-tuned model | **v0.3 in use** | [Devseis/endpoint-auditor-0.5b](https://huggingface.co/Devseis/endpoint-auditor-0.5b) (+ q0f16 / q4f16_1 / q4f32_1 WebLLM builds), tag `v0.3`. v0.3 on 60 held-out examples (desktop and phones): 100% valid, 100% grounded, 100% exact fields; base model 0%. Used by the desktop apps and the phone check; in a real audit of a Mac it writes 36 of 36 report parts (v0.1: 22 of 36) |
+| Website | **2026-10-14** | Computers only: download, check list, report viewer; no AI in the browser |
+| Fine-tuned model | **v0.3 in use** | [Devseis/endpoint-auditor-0.5b](https://huggingface.co/Devseis/endpoint-auditor-0.5b) (+ q0f16 / q4f16_1 / q4f32_1 WebLLM builds), tag `v0.3`. v0.3 on 60 held-out examples (desktop and phones): 100% valid, 100% grounded, 100% exact fields; base model 0%. Used by the desktop apps; in a real audit of a Mac it writes 36 of 36 report parts (v0.1: 22 of 36) |
 
 ## Test status (collector version 0.1.0)
 

about.html

@@ -1,161 +1,5 @@
 <!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Arx · Devseis Endpoint Auditor</title>
-<meta name="description" content="Read-only endpoint audit for ISO 27001, GDPR and the EU AI Act. Stage 1, step 1: collectors, evidence format and synthetic data.">
-<style>
-  :root {
-    --bg: #f7f8fb; --card: #ffffff; --text: #16181d; --muted: #5b6270; --line: #e3e6ec;
-    --red: #ED2939; --blue: #00A1DE; --ok: #1a7f37; --bad: #c4242f; --na: #6e7781; --pending: #9a6700; --err: #8250df;
-    --code-bg: #0f1218; --code-text: #e6edf3;
-  }
-  @media (prefers-color-scheme: dark) {
-    :root:not([data-theme="light"]) {
-      --bg: #0d1117; --card: #161b22; --text: #e6edf3; --muted: #9da7b3; --line: #2b313a;
-      --ok: #3fb950; --bad: #ff6b6b; --na: #8b949e; --pending: #d29922; --err: #b392f0; --code-bg: #0a0d12;
-    }
-  }
-  * { box-sizing: border-box; }
-  body { margin: 0; background: var(--bg); color: var(--text); font: 16px/1.55 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
-  main { max-width: 1040px; margin: 0 auto; padding: 32px 16px 64px; }
-  .tag { display: inline-block; font-size: 12px; font-weight: 600; letter-spacing: .04em; text-transform: uppercase; color: var(--red); border: 1px solid var(--red); border-radius: 999px; padding: 2px 10px; }
-  h1 { font-size: clamp(28px, 5vw, 40px); line-height: 1.15; margin: 14px 0 8px; }
-  h2 { font-size: 20px; margin: 36px 0 12px; }
-  p.lead { color: var(--muted); font-size: 18px; max-width: 760px; margin: 0; }
-  .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 12px; margin-top: 20px; }
-  .card { background: var(--card); border: 1px solid var(--line); border-radius: 12px; padding: 16px; }
-  .card b { display: block; font-size: 15px; margin-bottom: 4px; }
-  .card span { color: var(--muted); font-size: 14px; }
-  .tabs { display: flex; gap: 8px; flex-wrap: wrap; margin: 12px 0; }
-  .tabs button { font: inherit; font-size: 14px; padding: 6px 14px; border-radius: 999px; border: 1px solid var(--line); background: var(--card); color: var(--text); cursor: pointer; }
-  .tabs button[aria-selected="true"] { background: var(--blue); border-color: var(--blue); color: #fff; }
-  .counts { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 12px; }
-  .pill { font-size: 13px; font-weight: 600; padding: 3px 10px; border-radius: 999px; background: var(--card); border: 1px solid var(--line); }
-  .s-Compliant { color: var(--ok); } .s-Non-Compliant { color: var(--bad); } .s-NotApplicable { color: var(--na); }
-  .s-Pending { color: var(--pending); } .s-Error { color: var(--err); }
-  .split { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 1.25fr); gap: 12px; }
-  @media (max-width: 760px) { .split { grid-template-columns: 1fr; } }
-  pre { margin: 0; background: var(--code-bg); color: var(--code-text); border-radius: 12px; padding: 14px; font: 12.5px/1.45 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; overflow: auto; max-height: 560px; }
-  table { width: 100%; border-collapse: collapse; font-size: 13.5px; }
-  .table-wrap { background: var(--card); border: 1px solid var(--line); border-radius: 12px; overflow: auto; max-height: 560px; }
-  th, td { text-align: left; padding: 7px 10px; border-bottom: 1px solid var(--line); vertical-align: top; }
-  th { position: sticky; top: 0; background: var(--card); font-size: 12px; text-transform: uppercase; letter-spacing: .03em; color: var(--muted); }
-  td.ref { color: var(--muted); font-size: 12.5px; }
-  code { font: 13px ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; background: var(--card); border: 1px solid var(--line); border-radius: 6px; padding: 1px 6px; }
-  .note { border-left: 4px solid var(--red); background: var(--card); padding: 12px 16px; border-radius: 0 12px 12px 0; color: var(--muted); }
-  ol li { margin: 4px 0; }
-  a { color: var(--blue); }
-  footer { margin-top: 48px; color: var(--muted); font-size: 14px; }
-</style>
-</head>
-<body>
-<main>
-  <span class="tag">Open source · stage 1</span>
-  <h1>Arx <span style="font-weight:400;color:var(--muted)">· Devseis Endpoint Auditor</span></h1>
-  <p class="lead">A read-only audit of Windows, Linux, macOS, iPhone and Android devices against a security baseline, GDPR technical controls, EU AI Act controls and organisational controls, written up by a small AI auditor model that runs on the device. <a href="index.html">ask the assistant</a>, <a href="phone.html">check your phone</a> or <a href="download.html">download the Mac app</a>.</p>
-
-  <div class="grid">
-    <div class="card"><b>Read-only collectors</b><span>PowerShell, Linux shell and macOS shell scripts. They read settings and never change the system.</span></div>
-    <div class="card"><b>One evidence format</b><span>Same JSON for every OS, joined to a catalog with ISO 27001, GDPR and AI Act references.</span></div>
-    <div class="card"><b>Synthetic data</b><span>Realistic evidence with the same rules, so the auditor model can be built before real data exists.</span></div>
-    <div class="card"><b>Runs locally</b><span>Evidence stays on the device. Nothing is sent anywhere.</span></div>
-    <div class="card"><b>Offline vulnerability matching</b><span>Installed software is matched against a signed OSV/NVD/CISA KEV bundle by exact version rules.</span></div>
-    <div class="card"><b>Phones too</b><span>A browser check for iPhone and Android: what the browser can detect plus guided questions, each result labelled detected or self-reported.</span></div>
-  </div>
-
-  <h2>Sample audit (synthetic)</h2>
-  <div class="tabs" role="tablist" id="tabs"></div>
-  <div class="counts" id="counts"></div>
-  <div class="split">
-    <pre id="report" aria-label="Text report">Loading…</pre>
-    <div class="table-wrap">
-      <table>
-        <thead><tr><th>Check</th><th>Status</th><th>Found</th><th>References</th></tr></thead>
-        <tbody id="rows"></tbody>
-      </table>
-    </div>
-  </div>
-
-  <h2>Roadmap</h2>
-  <ol>
-    <li><b>Collectors, evidence format, catalog (74 checks), synthetic data</b> — done</li>
-    <li><b>Control library and fix guidance</b> in Devseis's own wording — done; expert review welcome</li>
-    <li><b>Training data</b> v0.3: 39,500 grounded examples for Windows, Linux, macOS, iPhone and Android — done</li>
-    <li><b>Offline vulnerability matching</b> (OSV, NVD, CISA KEV, EPSS), signed bundle — done</li>
-    <li><b>Desktop app</b> (Electron + WebLLM) and <b>phone check</b> (this Space) — done, with the base model</li>
-    <li>Fine-tune Qwen2.5-0.5B-Instruct on this Mac (CPU, LoRA) — in progress</li>
-    <li>Evaluate on held-out data, publish the scores and the model</li>
-    <li>Installers per OS; tests on real Windows and Linux machines</li>
-  </ol>
-
-  <p class="note">Not a certification. ISO 27001 certification needs an accredited auditor, and much of GDPR and AI Act compliance is organisational. The tool collects evidence and flags gaps. See the <a href="README.md">README</a> for how to run the collectors.</p>
-
-  <footer>Open source by Devseis: code Apache-2.0, data CC BY 4.0 · <a href="https://huggingface.co/datasets/Devseis/endpoint-auditor-synthetic">training data</a> · <a href="https://huggingface.co/datasets/Devseis/endpoint-auditor-vulndb">vulnerability data</a> · <a href="CITATION.cff">cite</a></footer>
-</main>
-<script>
-const SAMPLES = Object.fromEntries(['windows', 'linux', 'macos', 'ios', 'android'].map(os => [os, `synthetic/samples/synthetic-${os}-42000126.json`]));
-const LABELS = { windows: 'Windows', linux: 'Linux', macos: 'macOS', ios: 'iPhone', android: 'Android' };
-const LAYOUT = {
-  windows: { title: 'WINDOWS ENDPOINT SECURITY BASELINE - AUDIT', results: 'COMPLIANCE RESULTS', end: 'END OF READ-ONLY AUDIT', blank: true, extra: ['Build', 'build'] },
-  linux: { title: 'LINUX ENDPOINT SECURITY BASELINE - AUDIT', results: 'LINUX ENDPOINT SECURITY BASELINE - RESULTS', end: 'END OF LINUX ENDPOINT SECURITY BASELINE AUDIT', blank: false, extra: ['Kernel', 'kernel'] },
-  macos: { title: 'macOS ENDPOINT SECURITY BASELINE - AUDIT', results: 'COMPLIANCE RESULTS', end: 'END OF AUDIT', blank: false, extra: ['Build', 'build'] },
-  ios: { title: 'iPHONE SECURITY CHECK (BROWSER)', results: 'COMPLIANCE RESULTS', end: 'END OF PHONE CHECK', blank: false, extra: ['Browser', 'browser'] },
-  android: { title: 'ANDROID SECURITY CHECK (BROWSER)', results: 'COMPLIANCE RESULTS', end: 'END OF PHONE CHECK', blank: false, extra: ['Browser', 'browser'] },
-};
-const SECTIONS = [['baseline', null], ['gdpr', 'GDPR TECHNICAL CONTROLS'], ['aiact', 'EU AI ACT CONTROLS'], ['org', 'ORGANISATIONAL CONTROLS']];
-let catalog = null;
-
-function render(rec) {
-  const L = LAYOUT[rec.host.os_family], line = '='.repeat(60), pad = s => (s + ' '.repeat(16)).slice(0, 16);
-  const out = [line, ' ' + L.title, line,
-    pad('Hostname') + ': ' + rec.host.hostname, pad('Operating System') + ': ' + rec.host.os_name,
-    pad('OS Version') + ': ' + rec.host.os_version, pad(L.extra[0]) + ': ' + (rec.host[L.extra[1]] || ''),
-    pad('Serial Number') + ': ' + (rec.host.serial_number || ''), pad('Execution User') + ': ' + rec.audit.execution_user,
-    pad('Audit Date') + ': ' + rec.audit.started_at.replace('T', ' ').slice(0, 19), pad('Audit Mode') + ': ' + rec.audit.mode, line];
-  for (const [id, title] of SECTIONS) {
-    if (L.blank) out.push('');
-    out.push(line, ' ' + (title || L.results), line);
-    for (const r of rec.results) if (r.section === id) out.push(r.name, r.status + (r.evidence ? ` (${r.evidence})` : ''));
-  }
-  out.push(line, ' ' + L.end, line);
-  return out.join('\n');
-}
-
-function refs(id) {
-  const c = catalog && catalog.checks.find(x => x.id === id);
-  if (!c) return '';
-  return [...c.controls.iso27001.map(x => 'ISO ' + x), ...c.controls.gdpr.map(x => 'GDPR ' + x), ...c.controls.ai_act.map(x => 'AI Act ' + x)].join(' · ');
-}
-
-function esc(s) { const d = document.createElement('div'); d.textContent = s; return d.innerHTML; }
-
-async function show(os) {
-  document.querySelectorAll('#tabs button').forEach(b => b.setAttribute('aria-selected', String(b.dataset.os === os)));
-  try {
-    const rec = await (await fetch(SAMPLES[os])).json();
-    document.getElementById('report').textContent = render(rec);
-    document.getElementById('counts').innerHTML = Object.entries(rec.summary)
-      .map(([k, v]) => `<span class="pill s-${k}">${v} ${k}</span>`).join('');
-    document.getElementById('rows').innerHTML = rec.results.map(r =>
-      `<tr><td>${esc(r.name)}</td><td class="s-${r.status}"><b>${r.status}</b></td><td>${esc(r.actual)}</td><td class="ref">${esc(refs(r.id))}</td></tr>`).join('');
-  } catch (e) {
-    document.getElementById('report').textContent = 'Could not load the sample: ' + e.message;
-  }
-}
-
-(async () => {
-  try { catalog = await (await fetch('catalog/checks.json')).json(); } catch (e) { catalog = null; }
-  const tabs = document.getElementById('tabs');
-  for (const os of Object.keys(SAMPLES)) {
-    const b = document.createElement('button');
-    b.textContent = LABELS[os]; b.dataset.os = os; b.setAttribute('role', 'tab');
-    b.addEventListener('click', () => show(os));
-    tabs.appendChild(b);
-  }
-  show('windows');
-})();
-</script>
-</body>
-</html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Arx</title><meta http-equiv="refresh" content="0; url=index.html#about"><link rel="canonical" href="index.html">
+<style>body{font-family:ui-monospace,Menlo,monospace;background:#f7f7f7;color:#0a0a0a;margin:0;padding:40px 16px;text-align:center}@media (prefers-color-scheme:dark){body{background:#0a0a0a;color:#fafafa}}a{color:inherit}</style></head>
+<body><p>Arx has moved to <a href="index.html#about">the Arx home page</a>.</p></body></html>

app/model-version.json

@@ -1,10 +1,4 @@
 {
   "version": "v0.3",
-  "note": "Model version the desktop app and phone check use (Devseis/endpoint-auditor-0.5b-*-MLC tags). Read at start-up, so installed apps follow updates.",
-  "chat": {
-    "version": "v0.5",
-    "size": "0.5B",
-    "note": "Chat model: Devseis/endpoint-auditor-<size>-<quant>-MLC tag. quant q0f16 = unrounded build (v0.5 breaks in 4-bit); omit to pick q4f16_1/q4f32_1 by GPU. null version = base Qwen2.5 Instruct.",
-    "quant": "q0f16"
-  }
+  "note": "Model version the desktop app and phone check use (Devseis/endpoint-auditor-0.5b-*-MLC tags). Read at start-up, so installed apps follow updates."
 }

app/renderer/knowledge.js

@@ -105,7 +105,7 @@ export function auditBrief(evidence, maxGaps = 8) {
 }
 
 // Messages for one chat turn. history: earlier [{role, content}] turns (already answered).
-// device: what the browser saw about the device the chat runs on (chat/device.js deviceBrief), or null.
+// device: what the browser saw about the device the chat runs on (deviceBrief in the former chat/device.js), or null.
 export function chatMessages(question, passages, audit = 'none', history = [], device = null) {
   const context = passages.length ? passages.map((p, n) => `[${n + 1}] ${p.title}: ${p.text}`).join('\n') : '(no matching passages)';
   const user = `CONTEXT:\n${context}\n\nMY AUDIT: ${audit}\n\n${device ? `MY DEVICE: ${device}\n\n` : ''}QUESTION: ${question}`;

chat/chat.css

@@ -1,155 +0,0 @@
-/* Devseis Security Assistant: layout follows Devseis Nox (header, empty state with chips, thread, pill composer, sidebar). */
-:root { --bg: #f4f6fb; --panel: #fff; --border: #e2e6ee; --text: #171a21; --muted: #666f80; --accent: #ED2939; --accent-dark: #C81E2B;
-  --accent-text: #fff; --accent-soft: rgba(237, 41, 57, .08); --accent-border: rgba(237, 41, 57, .35); --bubble-bot: #fff; --bubble-user: #ED2939;
-  --input-bg: #fff; --blue: #00A1DE; --ok: #1a7f37; --warn: #9a6700; }
-@media (prefers-color-scheme: dark) { :root:not([data-theme="light"]) { --bg: #0b0e14; --panel: #11151d; --border: #232a37; --text: #e8ecf4; --muted: #8b94a7;
-  --accent: #ff4d5a; --accent-dark: #ED2939; --accent-soft: rgba(255, 77, 90, .14); --accent-border: rgba(255, 77, 90, .4); --bubble-bot: #161c27; --bubble-user: #c81e2b; --input-bg: #1a202b; --ok: #3fb950; --warn: #d29922; } }
-:root[data-theme="dark"] { --bg: #0b0e14; --panel: #11151d; --border: #232a37; --text: #e8ecf4; --muted: #8b94a7;
-  --accent: #ff4d5a; --accent-dark: #ED2939; --accent-soft: rgba(255, 77, 90, .14); --accent-border: rgba(255, 77, 90, .4); --bubble-bot: #161c27; --bubble-user: #c81e2b; --input-bg: #1a202b; --ok: #3fb950; --warn: #d29922; }
-* { box-sizing: border-box; }
-html, body { height: 100%; }
-body { margin: 0; background: var(--bg); color: var(--text); font: 16px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Arial, sans-serif;
-  height: 100dvh; display: flex; flex-direction: column; overflow: hidden; }
-a { color: var(--blue); }
-.hidden { display: none !important; }
-.muted { color: var(--muted); } .tiny { font-size: 12px; }
-button { font: inherit; cursor: pointer; }
-button:focus-visible, a:focus-visible, .chip:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
-
-header { display: flex; align-items: center; justify-content: space-between; gap: 10px; padding: 10px 14px; padding-top: calc(10px + env(safe-area-inset-top));
-  border-bottom: 1px solid var(--border); background: var(--panel); border-top: 3px solid var(--accent); flex-shrink: 0; }
-.header-left, .header-actions { display: flex; align-items: center; gap: 6px; }
-.brand { display: flex; align-items: center; gap: 8px; color: var(--text); text-decoration: none; font-size: 15px; }
-.brand img { width: 28px; height: 28px; }
-.icon-btn { width: 38px; height: 38px; border-radius: 10px; border: 1px solid transparent; background: transparent; color: var(--text); display: grid; place-items: center; }
-.icon-btn:hover { background: var(--accent-soft); }
-.audit-btn { background: var(--accent); color: var(--accent-text); border: 0; border-radius: 999px; padding: 8px 14px; font-weight: 700; font-size: 14px; white-space: nowrap; }
-.audit-btn:hover { background: var(--accent-dark); }
-.status-bar { padding: 6px 16px; background: var(--accent-soft); border-bottom: 1px solid var(--border); font-size: 13px; }
-.status-progress { height: 4px; background: var(--border); border-radius: 99px; overflow: hidden; margin-top: 4px; }
-#statusFill { height: 100%; width: 0; background: var(--accent); transition: width .3s; }
-
-main { flex: 1; overflow-y: auto; padding: 18px 14px 8px; }
-.empty-state { max-width: 680px; margin: 6vh auto 0; text-align: center; }
-.hero-icon img { width: 64px; height: 64px; }
-.empty-state h1 { font-size: clamp(24px, 4.5vw, 32px); line-height: 1.2; margin: 10px 0; }
-.hero-sub { color: var(--muted); font-size: 17px; margin: 0 auto 20px; max-width: 560px; }
-.chips { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; max-width: 600px; margin: 0 auto; }
-@media (max-width: 520px) { .chips { grid-template-columns: 1fr; } }
-.chip { text-align: left; background: var(--panel); border: 1px solid var(--border); border-radius: 14px; padding: 12px 14px; color: var(--text); font-size: 15px; }
-.chip:hover:not(:disabled) { border-color: var(--accent-border); background: var(--accent-soft); }
-.chip:disabled { opacity: .45; cursor: default; }
-
-#thread { max-width: 780px; margin: 0 auto; display: flex; flex-direction: column; gap: 14px; }
-.msg { display: flex; gap: 10px; align-items: flex-start; }
-.msg.user { justify-content: flex-end; }
-.avatar { width: 30px; height: 30px; flex: none; border-radius: 8px; }
-.bubble { max-width: min(640px, 88%); padding: 11px 15px; border-radius: 18px; overflow-wrap: anywhere; }
-.msg.user .bubble { background: var(--bubble-user); color: #fff; border-bottom-right-radius: 6px; white-space: pre-wrap; }
-.msg.bot .bubble { background: var(--bubble-bot); border: 1px solid var(--border); border-bottom-left-radius: 6px; }
-.bubble p { margin: 0 0 8px; } .bubble p:last-child { margin-bottom: 0; }
-.bubble ol, .bubble ul { margin: 6px 0 8px 20px; padding: 0; } .bubble li { margin: 3px 0; }
-.bubble code { font: 13px ui-monospace, Menlo, monospace; background: var(--accent-soft); padding: 1px 5px; border-radius: 5px; }
-.cite { display: inline-block; font-size: 11px; font-weight: 700; color: var(--accent); background: var(--accent-soft); border-radius: 6px; padding: 0 5px; margin: 0 1px; cursor: pointer; vertical-align: 1px; border: 0; }
-.sources { margin-top: 10px; display: flex; flex-wrap: wrap; gap: 6px; }
-.source { font-size: 12px; color: var(--muted); border: 1px solid var(--border); border-radius: 999px; padding: 2px 9px; background: transparent; }
-.source.open { border-color: var(--accent-border); color: var(--text); }
-.source-text { font-size: 13px; color: var(--muted); border-left: 3px solid var(--accent-border); padding: 4px 10px; margin-top: 8px; }
-.note { font-size: 12px; color: var(--warn); margin-top: 8px; }
-.typing span { display: inline-block; width: 7px; height: 7px; border-radius: 50%; background: var(--muted); margin-right: 3px; animation: blink 1.2s infinite; }
-.typing span:nth-child(2) { animation-delay: .2s; } .typing span:nth-child(3) { animation-delay: .4s; }
-@keyframes blink { 0%, 80%, 100% { opacity: .25; } 40% { opacity: 1; } }
-.card { border: 1px solid var(--border); background: var(--panel); border-radius: 16px; padding: 14px; }
-.card .score { font-size: 30px; font-weight: 800; }
-.card .pill { display: inline-block; font-size: 12px; font-weight: 700; border: 1px solid; border-radius: 99px; padding: 0 8px; margin: 2px 4px 2px 0; }
-.btn-row { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 10px; }
-.small-btn { border: 1px solid var(--border); background: var(--panel); color: var(--text); border-radius: 10px; padding: 7px 12px; font-size: 14px; }
-.primary-btn { border: 0; background: var(--accent); color: #fff; border-radius: 10px; padding: 8px 14px; font-size: 14px; font-weight: 700; }
-
-#composer { display: flex; align-items: flex-end; gap: 8px; max-width: 812px; width: 100%; margin: 0 auto; padding: 8px 14px 4px; flex-shrink: 0; }
-.input-pill { position: relative; overflow: hidden; flex: 1; display: flex; background: var(--input-bg); border: 1px solid var(--border); border-radius: 22px; padding: 4px 6px 4px 16px; }
-.input-pill:focus-within { box-shadow: 0 0 0 2px var(--accent-border); }
-#input { flex: 1; border: 0; outline: 0; resize: none; background: transparent; color: var(--text); font: inherit; max-height: 180px; padding: 9px 0; }
-#input:disabled { cursor: not-allowed; }
-.send-btn { width: 44px; height: 44px; border-radius: 50%; border: 0; background: var(--accent); color: #fff; display: grid; place-items: center; flex: none; }
-.send-btn:disabled { opacity: .4; cursor: default; }
-.attach { width: 44px; height: 44px; flex: none; }
-.disclaimer { text-align: center; font-size: 11.5px; color: var(--muted); margin: 0 0 calc(8px + env(safe-area-inset-bottom)); padding: 0 12px; }
-
-.overlay { position: fixed; inset: 0; background: rgba(0,0,0,.35); z-index: 9; }
-.sidebar { position: fixed; top: 0; bottom: 0; left: 0; width: min(320px, 86vw); background: var(--panel); border-right: 1px solid var(--border); z-index: 10;
-  transform: translateX(-102%); transition: transform .2s; display: flex; flex-direction: column; padding-top: env(safe-area-inset-top); }
-.sidebar.open { transform: none; }
-.sidebar-head { display: flex; justify-content: space-between; align-items: center; padding: 12px 14px; border-bottom: 1px solid var(--border); }
-.sidebar-head h2 { font-size: 16px; margin: 0; }
-.sidebar-list { flex: 1; overflow-y: auto; padding: 8px; }
-.convo { display: flex; align-items: center; gap: 6px; padding: 9px 10px; border-radius: 10px; cursor: pointer; font-size: 14px; }
-.convo:hover, .convo.active { background: var(--accent-soft); }
-.convo span { flex: 1; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-.convo button { opacity: .5; border: 0; background: transparent; color: var(--text); }
-.sidebar-foot { border-top: 1px solid var(--border); padding: 12px 14px calc(12px + env(safe-area-inset-bottom)); font-size: 14px; }
-.sidebar-foot .row { display: flex; justify-content: space-between; align-items: center; gap: 8px; margin-bottom: 8px; }
-
-.modal { position: fixed; inset: 0; background: rgba(0,0,0,.45); display: grid; place-items: center; z-index: 20; padding: 16px; }
-.modal-card { background: var(--panel); border-radius: 18px; padding: 20px; max-width: 460px; width: 100%; border: 1px solid var(--border); }
-.modal-card h2 { margin: 0 0 6px; font-size: 20px; }
-.option { display: block; width: 100%; text-align: left; border: 1px solid var(--border); background: var(--bg); color: var(--text); border-radius: 14px; padding: 12px 14px; margin: 10px 0; text-decoration: none; }
-.option:hover { border-color: var(--accent-border); }
-.option b { display: block; } .option span { color: var(--muted); font-size: 14px; }
-.option.recommended { border: 2px solid var(--accent); }
-.link-btn { border: 0; background: transparent; color: var(--muted); text-decoration: underline; padding: 6px 0; }
-@media (max-width: 560px) { .brand span { display: none; } .audit-btn { padding: 8px 12px; } .hero-sub { font-size: 16px; } }
-
-.ai-chip { border: 1px solid var(--border); background: var(--panel); color: var(--text); border-radius: 999px; padding: 6px 11px; font-size: 13px; white-space: nowrap; }
-.ai-chip[data-state="ready"] { border-color: var(--ok); color: var(--ok); }
-.ai-chip[data-state="loading"] { border-color: var(--accent-border); color: var(--accent); }
-.ai-card { text-align: left; background: var(--panel); border: 2px solid var(--accent-border); border-radius: 16px; padding: 14px 16px; margin: 0 auto 16px; max-width: 600px; font-size: 15px; }
-.ai-card .btn-row { margin-top: 10px; }
-.quick-actions { margin-top: 10px; display: flex; gap: 8px; flex-wrap: wrap; }
-@media (max-width: 560px) { .ai-chip { padding: 6px 8px; font-size: 12px; } }
-
-/* While the AI assistant downloads, the locked message box is the progress bar. */
-.input-pill.loading { background: linear-gradient(90deg, var(--accent-soft) var(--progress, 0%), var(--input-bg) var(--progress, 0%)); border-color: var(--accent-border); }
-.input-pill.loading::after { content: ""; position: absolute; left: 0; bottom: 0; height: 3px; width: var(--progress, 0%); background: var(--accent); transition: width .3s; }
-.input-pill.loading #input::placeholder { color: var(--accent); opacity: 1; font-weight: 600; }
-
-/* This device: a pill above the message box; details open as a popover (computers) or a bottom sheet (phones). */
-.context-wrap { position: relative; max-width: 812px; width: 100%; margin: 0 auto; padding: 0 14px; flex-shrink: 0; }
-.context-bar { display: flex; align-items: center; gap: 10px; padding-top: 6px; min-width: 0; }
-.device-pill { display: inline-flex; align-items: center; gap: 7px; min-width: 0; max-width: 100%; border: 1px solid var(--border); background: var(--panel);
-  color: var(--text); border-radius: 999px; padding: 5px 12px 5px 9px; font-size: 13px; }
-.device-pill:hover { border-color: var(--accent-border); }
-.device-pill[data-kind="chosen"] { border-color: var(--blue); }
-.device-pill[data-kind="audit"] { border-color: var(--ok); }
-.device-text { white-space: nowrap; overflow: hidden; text-overflow: ellipsis; min-width: 0; }
-.device-ic { flex: none; } .chev { flex: none; color: var(--muted); font-size: 11px; }
-.context-note { color: var(--muted); font-size: 12px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-.device-panel { position: absolute; left: 14px; bottom: calc(100% + 8px); width: min(400px, calc(100% - 28px)); background: var(--panel); border: 1px solid var(--border);
-  border-radius: 16px; padding: 6px 16px 16px; box-shadow: 0 12px 32px rgba(0, 0, 0, .18); z-index: 15; max-height: 70dvh; overflow-y: auto; }
-.device-head { display: flex; justify-content: space-between; align-items: center; }
-.device-head h2 { font-size: 16px; margin: 0; }
-.device-panel dl { margin: 4px 0 10px; }
-.drow { display: grid; grid-template-columns: 112px 1fr; gap: 10px; padding: 7px 0; border-bottom: 1px solid var(--border); font-size: 14px; }
-.drow:last-child { border-bottom: 0; }
-.drow dt { color: var(--muted); } .drow dd { margin: 0; overflow-wrap: anywhere; }
-.drow small { display: block; color: var(--muted); font-size: 12px; }
-.device-note { background: var(--bg); border-radius: 10px; padding: 9px 11px; font-size: 13px; color: var(--muted); margin: 0 0 12px; }
-.device-audit { width: 100%; padding: 10px 14px; }
-.device-switch { margin-top: 14px; }
-.seg { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 6px; }
-.seg button { border: 1px solid var(--border); background: var(--bg); color: var(--text); border-radius: 999px; padding: 5px 10px; font-size: 13px; }
-.seg button[aria-pressed="true"] { border-color: var(--accent); background: var(--accent-soft); font-weight: 700; }
-.sheet-backdrop { position: fixed; inset: 0; z-index: 14; background: transparent; }
-@media (max-width: 560px) {
-  .context-note { display: none; }
-  .device-pill { width: 100%; justify-content: flex-start; }
-  .device-pill .chev { margin-left: auto; }
-  .sheet-backdrop { background: rgba(0, 0, 0, .4); }
-  .device-panel { position: fixed; left: 0; right: 0; bottom: 0; width: 100%; border-radius: 18px 18px 0 0; max-height: 85dvh;
-    padding-bottom: calc(16px + env(safe-area-inset-bottom)); animation: sheet-up .2s ease-out; }
-  .device-panel::before { content: ""; display: block; width: 40px; height: 4px; border-radius: 99px; background: var(--border); margin: 4px auto 6px; }
-  .drow { grid-template-columns: 104px 1fr; }
-}
-@keyframes sheet-up { from { transform: translateY(100%); } to { transform: none; } }
-@media (prefers-reduced-motion: reduce) { .device-panel { animation: none; } .input-pill.loading::after { transition: none; } }
-.device-retry { width: 100%; margin-bottom: 8px; }

chat/chat.js

@@ -1,601 +0,0 @@
-// Devseis Security Assistant: chat about endpoint security with the Devseis model running on the device (WebLLM),
-// grounded in the Devseis knowledge base (library/knowledge.json), plus audits: the phone check on phones, the desktop
-// app (or its report file) on computers. Conversations are stored only in this browser.
-import { Knowledge, chatMessages, auditBrief, chatProblems, searchWithAudit, repeatedText, tooShort } from '../app/renderer/knowledge.js';
-import { Library, findingPrompt, findingTemplate, summaryPrompt, summaryTemplate, aiPrompt, aiTemplate, writeAnswer, ANSWER_SCHEMAS } from '../app/renderer/auditor-core.js';
-import { buildReportHtml } from '../app/renderer/report.js';
-import { detectDevice } from '../mobile/detect.js';
-import { describeComputer, chosenDevice, deviceBrief, deviceIcon, osLabel, OS_CHOICES } from './device.js';
-
-const WEBLLM_URL = 'https://esm.run/@mlc-ai/web-llm@0.2.85';
-const STORE = 'devseis.chats.v1';
-const $ = id => document.getElementById(id);
-const esc = s => String(s ?? '').replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-
-const state = { kb: null, device: null, config: null, engine: null, enginePromise: null, modelLabel: '', busy: false, chats: [], current: null, libData: null };
-
-// ---------- storage ----------
-function loadChats() { try { return JSON.parse(localStorage.getItem(STORE)) || []; } catch { return []; } }
-function saveChats() { try { localStorage.setItem(STORE, JSON.stringify(state.chats.slice(0, 50))); } catch { /* private mode or full */ } }
-function newChat() {
-  const chat = { id: Date.now().toString(36), title: 'New conversation', messages: [], audit: null };
-  state.chats.unshift(chat); state.current = chat; saveChats(); render(); return chat;
-}
-
-// ---------- model ----------
-// The model never blocks a question: until it is ready, answers come straight from the knowledge base.
-// It downloads in the background after the user agrees once (chatModel().download), and starts by itself when already stored.
-const AI_CONSENT = 'devseis.aiConsent';
-// Set when the AI wrote unreadable text on this device (a faulty graphics chip or driver); holds the model version, so a new one is tried again.
-const AI_FAULT = 'devseis.aiFault';
-const AI_FAULT_REASON = 'devseis.aiFaultReason';
-// Set while the AI loads or writes. Still set when the page starts again = the browser killed the page (out of memory:
-// iOS reloads a tab that uses too much), so the AI is turned off on this device instead of crashing every question.
-const AI_RUNNING = 'devseis.aiRunning';
-function aiRunning(on) { try { if (on) localStorage.setItem(AI_RUNNING, faultKey()); else localStorage.removeItem(AI_RUNNING); } catch { /* ignore */ } }
-const FIRST_WORDS_LIMIT = 60000, ANSWER_LIMIT = 180000;
-let webllmPromise = null;
-const loadWebllm = () => (webllmPromise ||= import(WEBLLM_URL));
-
-// Chat model size from app/model-version.json (chat.size): 0.5B for phones and weak graphics chips, 1.5B before v0.5.
-const CHAT_MODELS = { '0.5B': { repo: '0.5b', download: 'about 300 MB', mb: 280 }, '1.5B': { repo: '1.5b', download: 'about 850 MB', mb: 840 } };
-// chat.quant "q0f16" = the unrounded build (v0.5 loses its training when rounded to 4 bits): about 3x the download,
-// and only on graphics chips with 16-bit support. Without it, the 4-bit build that suits this chip.
-function chatModel() {
-  const size = CHAT_MODELS[state.config?.chat?.size] ? state.config.chat.size : '1.5B', quant = state.config?.chat?.quant || null;
-  const m = { size, quant, ...CHAT_MODELS[size] };
-  return quant === 'q0f16' ? { ...m, download: `about ${Math.round(m.mb * 3.4 / 50) * 50} MB`, mb: Math.round(m.mb * 3.4) } : m;
-}
-// A broken-AI flag is kept per model build, so a new build gets a fresh try.
-function faultKey() { const c = state.config?.chat || {}; return [c.version || 'base', c.quant].filter(Boolean).join('-'); }
-// Why the AI cannot run here ('' = it can): the unrounded build is too big for a phone tab and needs 16-bit graphics.
-async function aiUnsuitable() {
-  if (chatModel().quant !== 'q0f16') return '';
-  if (state.device && state.device.desktop === false) return 'too large for phones until the smaller version is ready';
-  try { const a = await navigator.gpu.requestAdapter(); return !a || !a.features.has('shader-f16') ? 'this graphics chip has no 16-bit support' : ''; } catch { return 'no graphics adapter'; }
-}
-
-async function modelChoice() {
-  if (!('gpu' in navigator)) throw new Error('This browser has no WebGPU');
-  const adapter = await navigator.gpu.requestAdapter();
-  if (!adapter) throw new Error('No WebGPU graphics adapter');
-  const { size, repo, quant: fixed } = chatModel();
-  if (fixed === 'q0f16' && !adapter.features.has('shader-f16')) throw new Error('This graphics chip has no 16-bit support');
-  const quant = fixed || (adapter.features.has('shader-f16') ? 'q4f16_1' : 'q4f32_1');
-  const webllm = await loadWebllm();
-  const base = webllm.prebuiltAppConfig.model_list.find(m => m.model_id === `Qwen2.5-${size}-Instruct-${quant}-MLC`);
-  const v = state.config?.chat?.version;
-  const custom = v ? { ...base, model: `https://huggingface.co/Devseis/endpoint-auditor-${repo}-${quant}-MLC/resolve/${v}/`, model_id: `devseis-assistant-${repo}-${v}-${quant}` } : null;
-  const appConfig = { ...webllm.prebuiltAppConfig, model_list: custom ? [...webllm.prebuiltAppConfig.model_list, custom] : webllm.prebuiltAppConfig.model_list };
-  return { webllm, base, custom, appConfig, v };
-}
-
-// Is the model already stored on this device (no download needed)?
-async function modelCached() {
-  try {
-    const { webllm, base, custom, appConfig } = await modelChoice();
-    return await webllm.hasModelInCache((custom || base).model_id, appConfig);
-  } catch { return false; }
-}
-
-function getEngine() {
-  if (state.engine !== null || state.enginePromise) return state.enginePromise || Promise.resolve(state.engine);
-  state.loading = true; state.progress = 0; aiChip(); render();
-  state.enginePromise = (async () => {
-    const { webllm, base, custom, appConfig, v } = await modelChoice();
-    const initProgressCallback = r => {
-      state.progress = r.progress || 0;
-      const mb = /([\d.]+)MB fetched/.exec(r.text || '');
-      // Shown inside the (locked) message box, which fills up as the model arrives.
-      const pct = `${Math.round(state.progress * 100)}%`, narrow = matchMedia('(max-width: 560px)').matches;
-      state.progressText = state.cachedStart ? `Starting the AI… ${pct}` : narrow ? `Downloading AI… ${pct}${mb ? ` · ${Math.round(+mb[1])} MB` : ''}`
-        : `Downloading the AI assistant… ${pct}${mb ? ` · ${Math.round(+mb[1])} of ${chatModel().download}` : ''}`;
-      aiChip();
-    };
-    let engine, label;
-    if (custom) {
-      try { engine = await webllm.CreateMLCEngine(custom.model_id, { appConfig, initProgressCallback }); label = `Devseis assistant ${v} (${chatModel().size})`; } catch (e) { console.warn('Devseis model failed, using base', e); }
-    }
-    if (!engine) { engine = await webllm.CreateMLCEngine(base.model_id, { appConfig, initProgressCallback }); label = `Qwen2.5 ${chatModel().size} (base, until the Devseis model loads)`; }
-    state.modelLabel = label; $('modelName').textContent = label; status('');
-    return engine;
-  })().then(e => { state.engine = e; state.loading = false; aiChip(); render(); return e; },
-    err => { state.engine = false; state.loading = false; state.modelLabel = `Not available: ${err.message}`; $('modelName').textContent = 'Knowledge base only'; status(''); aiChip(); render(); return false; });
-  return state.enginePromise;
-}
-
-function enableAi() {
-  try { localStorage.setItem(AI_CONSENT, 'yes'); localStorage.removeItem(AI_FAULT); } catch { /* ignore */ }
-  state.consent = true; state.kbOnly = false; state.aiFault = false;
-  getEngine();
-}
-
-// Small status chip in the header: what the assistant is running on right now.
-function aiChip() {
-  const chip = $('aiChip');
-  if (!chip) return;
-  if (state.engine) { chip.textContent = '✨ AI ready'; chip.title = state.modelLabel; chip.dataset.state = 'ready'; }
-  else if (state.loading) { chip.textContent = `⬇ AI ${Math.round((state.progress || 0) * 100)}%`; chip.title = 'The AI assistant is getting ready'; chip.dataset.state = 'loading'; }
-  else if (state.engine === false || state.aiFault) { chip.textContent = '📚 Knowledge base'; chip.title = state.modelLabel; chip.dataset.state = 'off'; }
-  else { chip.textContent = '⚡ Enable AI'; chip.title = `Download the AI assistant (${chatModel().download}, one time)`; chip.dataset.state = 'off'; }
-  updateSend();
-  if (!$('devicePanel').classList.contains('hidden')) renderDevicePanel();
-}
-
-// With WebGPU the chat waits for the AI; the knowledge base answers alone only without WebGPU, if the AI fails to load,
-// or when the visitor chose "Not now".
-function aiPending() { return 'gpu' in navigator && !state.kbOnly && state.engine !== false && !state.engine; }
-
-// Instant answer straight from the knowledge base, formatted for reading.
-function quickAnswer(passages) {
-  if (!passages.length) return 'The Devseis knowledge base has nothing on that question. I cover device security, ISO 27001, GDPR and the EU AI Act.';
-  const top = passages[0];
-  const body = top.text.startsWith(top.title) ? top.text.slice(top.title.length).replace(/^[.:]\s*/, '') : top.text;
-  const text = body.replace(/\s\((\d+)\)\s/g, '\n$1. ')
-    .replace(/(^|\s)(How to fix on [A-Za-z]+|How to verify|Related controls|Why it matters|Risk if missing|Requirement|An auditor looks for|On endpoints|Where to look):/g, '\n\n**$2:**')
-    .replace(/^\s+/, '');
-  return `**${top.title}** [1]\n\n${text}`;
-}
-
-function status(text, fraction) {
-  $('statusBar').classList.toggle('hidden', !text);
-  $('statusText').textContent = text;
-  $('statusFill').style.width = `${Math.round((fraction || 0) * 100)}%`;
-}
-
-// ---------- rendering ----------
-function markdown(text, passages, msgIndex) {
-  const lines = esc(text).split('\n');
-  let html = '', list = null;
-  const close = () => { if (list) { html += `</${list}>`; list = null; } };
-  for (const line of lines) {
-    const ol = /^\s*\d+\.\s+(.*)$/.exec(line), ul = /^\s*[-•]\s+(.*)$/.exec(line);
-    if (ol || ul) {
-      const tag = ol ? 'ol' : 'ul';
-      if (list !== tag) { close(); html += `<${tag}>`; list = tag; }
-      html += `<li>${(ol || ul)[1]}</li>`;
-    } else { close(); if (line.trim()) html += `<p>${line}</p>`; }
-  }
-  close();
-  return html.replace(/\*\*(.+?)\*\*/g, '<b>$1</b>').replace(/`([^`]+)`/g, '<code>$1</code>')
-    .replace(/\[(\d+)\]/g, (m, n) => passages && passages[n - 1] ? `<button type="button" class="cite" data-msg="${msgIndex}" data-n="${n}" title="${esc(passages[n - 1].title)}">${n}</button>` : '');
-}
-
-function auditCard(audit) {
-  const s = audit.summary, assessed = s.Compliant + s['Non-Compliant'];
-  const pct = assessed ? Math.round(100 * s.Compliant / assessed) : 0;
-  const colours = { Compliant: 'var(--ok)', 'Non-Compliant': 'var(--accent)', Pending: 'var(--warn)', NotApplicable: 'var(--muted)', Error: '#8250df' };
-  const gaps = audit.results.filter(r => r.status === 'Non-Compliant').slice(0, 5);
-  return `<div class="card"><div class="muted tiny">AUDIT REPORT · ${esc(audit.host.os_name)} ${esc(audit.host.os_version)} · ${esc(String(audit.audit.started_at).slice(0, 10))}</div>
-    <div class="score">${pct}%</div><div class="muted">${s.Compliant} of ${assessed} assessed checks compliant</div>
-    <div>${Object.entries(s).filter(([, v]) => v).map(([k, v]) => `<span class="pill" style="color:${colours[k]}">${v} ${k}</span>`).join('')}</div>
-    ${gaps.length ? `<p style="margin:8px 0 0"><b>Top gaps:</b> ${gaps.map(g => esc(g.name)).join(', ')}</p>` : ''}
-    <div class="btn-row"><button type="button" class="primary-btn" data-ask="What should I fix first?">What should I fix first?</button>
-    <button type="button" class="small-btn" data-report="1">📄 Write my full report</button></div></div>`;
-}
-
-function render() {
-  const chat = state.current;
-  $('emptyState').classList.toggle('hidden', Boolean(chat && (chat.messages.length || chat.audit)));
-  $('aiCard').classList.toggle('hidden', !state.showAiCard || state.loading || Boolean(state.engine) || state.engine === false);
-  renderDevice();
-  const thread = $('thread');
-  thread.innerHTML = '';
-  if (!chat) return renderSidebar();
-  if (chat.audit) thread.insertAdjacentHTML('beforeend', `<div class="msg bot"><img class="avatar" src="app/build/icon.png" alt="">${auditCard(chat.audit)}</div>`);
-  chat.messages.forEach((m, i) => {
-    if (m.role === 'user') { thread.insertAdjacentHTML('beforeend', `<div class="msg user"><div class="bubble">${esc(m.content)}</div></div>`); return; }
-    const sources = (m.passages || []).map((p, n) => `<button type="button" class="source" data-msg="${i}" data-n="${n + 1}">[${n + 1}] ${esc(p.title)}</button>`).join('');
-    thread.insertAdjacentHTML('beforeend', `<div class="msg bot"><img class="avatar" src="app/build/icon.png" alt=""><div class="bubble" id="m${i}">
-      ${m.pending ? '<div class="typing"><span></span><span></span><span></span></div>' : markdown(m.content, m.passages, i)}
-      ${!m.pending && sources && !m.noSources ? `<div class="sources"><span class="muted tiny">Sources:</span>${sources}</div>` : ''}
-      ${m.note ? `<div class="note">${esc(m.note)}</div>` : ''}
-      ${m.quick && !m.pending && !m.writing ? (state.engine ? `<div class="quick-actions"><button type="button" class="primary-btn" data-rewrite="${i}">✨ Rewrite with AI</button></div>`
-        : (!state.loading && state.engine !== false ? `<div class="quick-actions"><button type="button" class="small-btn" data-enable="1">⚡ Enable the AI assistant (${chatModel().download}, one time)</button></div>` : '')) : ''}
-      <div class="source-slot"></div></div></div>`);
-  });
-  renderSidebar();
-  $('chatMain').scrollTop = $('chatMain').scrollHeight;
-}
-
-function renderSidebar() {
-  $('sidebarList').innerHTML = state.chats.map(c => `<div class="convo${c === state.current ? ' active' : ''}" data-id="${c.id}"><span>${esc(c.title)}</span><button type="button" data-del="${c.id}" aria-label="Delete">✕</button></div>`).join('')
-    || '<p class="muted tiny" style="padding:8px">No conversations yet.</p>';
-}
-
-function showSource(msgIndex, n, anchor) {
-  const m = state.current.messages[msgIndex];
-  const p = m && m.passages && m.passages[n - 1];
-  if (!p) return;
-  const slot = document.querySelector(`#m${msgIndex} .source-slot`);
-  slot.innerHTML = `<div class="source-text"><b>[${n}] ${esc(p.title)}</b><br>${esc(p.text)}</div>`;
-  document.querySelectorAll(`#m${msgIndex} .source`).forEach(b => b.classList.toggle('open', b.dataset.n === String(n)));
-  if (anchor) slot.scrollIntoView({ block: 'nearest' });
-}
-
-// ---------- asking ----------
-async function ask(question) {
-  if (state.busy || aiPending() || !question.trim()) return;
-  const chat = state.current || newChat();
-  if (chat.title === 'New conversation') chat.title = question.slice(0, 60);
-  // The model was trained on one question at a time: earlier answers in the prompt make it repeat them. A short
-  // follow-up ("and on Windows?") borrows the previous question to find its sources instead.
-  const history = [];
-  const prev = [...chat.messages].reverse().find(m => m.role === 'user');
-  const followUp = prev && /^(and|what about|how about|also|it|that|this|same)\b/i.test(question.trim()) && question.trim().split(/\s+/).length <= 6;
-  const searchFor = followUp ? `${prev.content} ${question}` : question;
-  chat.messages.push({ role: 'user', content: question });
-  const reply = { role: 'assistant', content: '', pending: true, passages: [] };
-  chat.messages.push(reply);
-  state.busy = true; updateSend(); render();
-  try {
-    const device = activeDevice();
-    const os = chat.audit ? chat.audit.host.os_family : (device.os_family === 'chromeos' ? null : device.os_family);
-    const passages = searchWithAudit(state.kb, searchFor, chat.audit, { k: 4, os });
-    reply.passages = passages;
-    const messages = chatMessages(followUp ? `${question} (follow-up to: ${prev.content})` : question, passages, auditBrief(chat.audit), history, chat.audit ? null : deviceBrief(device));
-    reply.question = question; reply.history = history;
-    if (state.engine) {
-      // Typing dots until the AI's first words arrive; the knowledge-base answer is only the fallback if the AI fails.
-      reply.writing = true; reply.note = '✨ Writing answer…';
-      render(); saveChats();
-      aiRunning(true);
-      try { await aiAnswer(chat, reply, messages, passages); } finally { aiRunning(false); }
-    } else {
-      reply.content = quickAnswer(passages);
-      reply.cited = true; reply.quick = true;
-      reply.note = state.loading ? `Quick answer from the knowledge base. The AI assistant is getting ready (${Math.round((state.progress || 0) * 100)}%); you can ask it to rewrite this when it is ready.`
-        : state.engine === false ? 'Quick answer from the knowledge base (the AI is not available in this browser).'
-          : 'Quick answer from the knowledge base. Enable the AI assistant for written answers.';
-    }
-  } catch (error) {
-    reply.content = `Something went wrong: ${error.message}`;
-  }
-  reply.pending = false; state.busy = false; saveChats(); updateSend(); render();
-}
-
-// Write (or rewrite) an answer with the model; the GPU can be lost (memory pressure, sleep): restart once, else keep the quick answer.
-async function aiAnswer(chat, reply, messages, passages) {
-  const index = chat.messages.indexOf(reply);
-  let engine = state.engine, lastError = '';
-  for (let attempt = 0; attempt < 2 && engine; attempt++) {
-    try {
-      const stream = await engine.chat.completions.create({ messages, temperature: 0, max_tokens: 700, stream: true });
-      let last = 0, started = false, fault = null;
-      // A weak graphics chip can take minutes; stop and use the knowledge base instead of leaving the visitor waiting.
-      const t0 = Date.now();
-      const watchdog = setInterval(() => {
-        if (Date.now() - t0 > (started ? ANSWER_LIMIT : FIRST_WORDS_LIMIT)) { fault = 'slow'; engine.interruptGenerate(); }
-      }, 1000);
-      try {
-        for await (const chunk of stream) {
-          const delta = chunk.choices[0]?.delta?.content || '';
-          if (!started && delta) { started = true; reply.pending = false; reply.content = ''; reply.quick = false; reply.writing = false; reply.note = ''; }
-          reply.content += delta;
-          // Looping text means the engine is broken on this device: stop at once, it only gets worse.
-          if (reply.content.length > 40 && repeatedText(reply.content)) { fault = 'junk'; engine.interruptGenerate(); break; }
-          if (Date.now() - last > 120) { last = Date.now(); const el = $(`m${index}`); if (el) el.innerHTML = markdown(clean(reply.content), passages, index); }
-        }
-      } finally { clearInterval(watchdog); }
-      if (fault === 'junk') { turnOffBrokenAi(); return fallback(reply, passages, 'The AI wrote unreadable text on this device, so Arx switched to answers from the knowledge base. Details: tap the device bar.'); }
-      if (fault === 'slow') return fallback(reply, passages, 'The AI was too slow on this device, so this answer comes from the knowledge base.');
-      if (!started) throw new Error('The AI returned no answer');
-      reply.content = clean(reply.content);
-      // A few stray words means the graphics chip garbled the answer; twice in a row, stop using the AI here.
-      if (tooShort(reply.content)) {
-        state.scraps = (state.scraps || 0) + 1;
-        if (state.scraps >= 2) { turnOffBrokenAi(); return fallback(reply, passages, 'The AI wrote unreadable text on this device, so Arx switched to answers from the knowledge base. Details: tap the device bar.'); }
-        return fallback(reply, passages, 'The AI\'s answer was unreadable, so this one comes from the knowledge base.');
-      }
-      state.scraps = 0;
-      reply.noSources = !/\[\d+\]/.test(reply.content) && /can only help|don't have|do not have|not able to|can't answer|cannot answer|sorry/i.test(reply.content);
-      reply.cited = /\[\d+\]/.test(reply.content);
-      if (chatProblems(messages[messages.length - 1].content, reply.content).length) reply.note = 'Some details in this answer could not be matched to the sources. Check them in the sources below before acting.';
-      return;
-    } catch (error) {
-      lastError = error.message;
-      if (!/lost|Instance reference|GPUDevice|disposed/i.test(error.message)) { console.warn('AI answer failed', error); break; }  // keep the quick answer
-      status('The graphics processor was reset; restarting the AI…', 0.5);
-      state.engine = null; state.enginePromise = null;
-      engine = attempt === 0 ? await getEngine() : null;
-    }
-  }
-  fallback(reply, passages, `Quick answer from the knowledge base (the AI could not run just now${lastError ? `: ${lastError.slice(0, 140)}` : ''}).`);
-}
-
-function fallback(reply, passages, note) {
-  reply.pending = false; reply.content = quickAnswer(passages); reply.cited = true; reply.quick = true; reply.writing = false; reply.noSources = false;
-  reply.note = note;
-}
-
-// The AI wrote junk: free the graphics chip (a broken driver can hang the whole computer) and stay on the knowledge base here.
-function turnOffBrokenAi(reason = 'it wrote unreadable text on this device') {
-  const engine = state.engine;
-  state.engine = null; state.enginePromise = null; state.loading = false; state.kbOnly = true; state.aiFault = true;
-  state.modelLabel = `Turned off: ${reason}`; $('modelName').textContent = 'Knowledge base only';
-  try { localStorage.setItem(AI_FAULT, faultKey()); localStorage.setItem(AI_FAULT_REASON, reason); } catch { /* ignore */ }
-  if (engine && engine.unload) engine.unload().catch(() => {});
-  aiChip();
-}
-
-async function rewriteWithAi(index) {
-  const chat = state.current; const reply = chat && chat.messages[index];
-  if (!reply || !state.engine || state.busy) return;
-  state.busy = true; updateSend();
-  const messages = chatMessages(reply.question, reply.passages, auditBrief(chat.audit), reply.history || [], chat.audit ? null : deviceBrief(activeDevice()));
-  saveChats(); aiRunning(true);
-  try { await aiAnswer(chat, reply, messages, reply.passages); } catch (error) { reply.note = `The AI could not answer: ${error.message}`; } finally { aiRunning(false); }
-  state.busy = false; saveChats(); updateSend(); render();
-}
-
-// Models sometimes emit HTML entities; show plain characters.
-function clean(text) { return text.replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'"); }
-
-function desktopOs() { const ua = navigator.userAgent; return /Windows/.test(ua) ? 'windows' : /Mac/.test(ua) ? 'macos' : 'linux'; }
-
-// ---------- audits ----------
-function openAuditModal() {
-  const d = state.device || {};
-  const phone = d.os_family === 'ios' || d.os_family === 'android';
-  const os = phone ? null : desktopOs();
-  const osName = { macos: 'Mac', windows: 'Windows', linux: 'Linux' }[os];
-  $('auditOptions').innerHTML = phone
-    ? `<p class="muted">The check runs in this browser: the phone answers what it can, you answer the rest. About 5 minutes.</p>
-       <a class="option recommended" href="phone.html?return=chat"><b>📱 Start the phone check</b><span>Your answers and report stay on this phone.</span></a>`
-    : `<p class="muted">A web page can't read a computer's settings, so computers are audited with the free Devseis app. It only reads, changes nothing, and takes about 15 minutes.</p>
-       <a class="option recommended" href="download.html#${os}"><b>💻 Get the desktop app for ${osName}${os === 'windows' ? ' (beta)' : ''}</b><span>Step-by-step install guide.</span></a>
-       <button type="button" class="option" id="optAttach"><b>📎 I already ran an audit</b><span>Add the report file (<code>…-evidence.json</code>, saved next to the PDF) and I'll answer from your results.</span></button>
-       <a class="option" href="phone.html"><b>📱 Check a phone instead</b><span>Open the phone check on the phone itself.</span></a>`;
-  $('auditModal').classList.remove('hidden');
-  const att = $('optAttach'); if (att) att.addEventListener('click', () => { $('auditModal').classList.add('hidden'); $('fileInput').click(); });
-}
-
-function attachAudit(evidence) {
-  if (!evidence || evidence.schema_version !== '1.0' || !Array.isArray(evidence.results) || !evidence.host) throw new Error('This is not a Devseis audit report file.');
-  const chat = state.current && !state.current.messages.length && !state.current.audit ? state.current : newChat();
-  chat.audit = evidence; chat.title = `Audit: ${evidence.host.os_name} ${String(evidence.audit.started_at).slice(0, 10)}`;
-  saveChats(); render();
-}
-
-// JSON from this site. A request can stall behind the browser's cache lock when the page was reloaded while it was
-// downloading (the desktop app does that when it opens the chat), so give up after a few seconds and retry past the cache.
-// The retry has no time limit, so a slow connection still gets there.
-async function getJson(p, { timeout = 5000, cache = 'default' } = {}) {
-  for (const mode of [cache, 'reload']) {
-    const ctl = new AbortController(); const timer = mode === 'reload' ? null : setTimeout(() => ctl.abort(), timeout);
-    try {
-      const r = await fetch(p, { cache: mode, signal: ctl.signal });
-      if (!r.ok) throw new Error(`${p}: ${r.status}`);
-      return await r.json();
-    } catch (error) { if (error.name !== 'AbortError' || mode === 'reload') throw error; } finally { clearTimeout(timer); }
-  }
-}
-
-async function loadLibrary() {
-  if (state.libData) return state.libData;
-  const [catalog, controls, guidance, aiTools] = await Promise.all(['catalog/checks.json', 'library/controls.json', 'library/check_guidance.json', 'library/ai_tools.json'].map(p => getJson(p)));
-  state.libData = new Library({ catalog, controls, guidance, aiTools });
-  return state.libData;
-}
-
-async function writeReport() {
-  const chat = state.current; if (!chat || !chat.audit || state.busy) return;
-  state.busy = true; updateSend();
-  const evidence = chat.audit;
-  try {
-    const lib = await loadLibrary();
-    const engine = state.engine || null;
-    const generate = engine ? async (system, prompt, task) => (await engine.chat.completions.create({
-      messages: [{ role: 'system', content: system }, { role: 'user', content: prompt }], temperature: 0, max_tokens: task === 'ai_classification' ? 1600 : 1200,
-      response_format: { type: 'json_object', schema: JSON.stringify(ANSWER_SCHEMAS[task]) } })).choices[0].message.content : null;
-    const targets = evidence.results.filter(r => ['Non-Compliant', 'Error', 'Pending'].includes(r.status));
-    const findings = {}, sources = { model: 0, template: 0 };
-    let i = 0;
-    for (const r of targets) {
-      status(`Writing your report: ${r.name} (${++i} of ${targets.length})`, i / (targets.length + 2));
-      const out = await writeAnswer('finding', findingPrompt(evidence, r, lib), findingTemplate(evidence, r, lib), r.section === 'org' ? null : generate);
-      findings[r.id] = out.answer; sources[out.source] += 1;
-    }
-    status('Writing your report: summary', 0.95);
-    const base = summaryTemplate(evidence, lib);
-    const so = await writeAnswer('summary', summaryPrompt(evidence, lib), base, generate);
-    sources[so.source] += 1;
-    const summary = so.source === 'model' ? { ...base, summary: so.answer.summary, next_steps: so.answer.next_steps } : base;
-    const ai = aiPrompt(evidence, lib);
-    let aiResult = null;
-    if (ai) { const o = await writeAnswer('ai_classification', ai, aiTemplate(evidence, lib), generate); aiResult = o.answer; sources[o.source] += 1; }
-    const html = buildReportHtml({ evidence, findings, summary, ai: aiResult, sha256: '(from attached file)', model: state.engine ? state.modelLabel : null, sources });
-    const url = URL.createObjectURL(new Blob([html], { type: 'text/html' }));
-    chat.messages.push({ role: 'assistant', content: `Your full report is ready: ${sources.model} parts written by the AI, ${sources.template} by the built-in writer. Open it and use your browser's Print › Save as PDF to keep it.`, passages: [] });
-    saveChats(); render();
-    const last = $(`m${chat.messages.length - 1}`);
-    last.insertAdjacentHTML('beforeend', `<div class="btn-row"><a class="primary-btn" href="${url}" target="_blank" rel="noopener" style="text-decoration:none">📄 Open the report</a></div>`);
-  } catch (error) {
-    chat.messages.push({ role: 'assistant', content: `The report could not be written: ${error.message}`, passages: [] }); render();
-  }
-  status(''); state.busy = false; updateSend();
-}
-
-// ---------- wiring ----------
-function updateSend() {
-  const wait = aiPending();
-  $('input').disabled = wait;
-  const loading = wait && state.loading;
-  $('inputPill').classList.toggle('loading', loading);
-  $('inputPill').style.setProperty('--progress', `${Math.round((state.progress || 0) * 100)}%`);
-  $('input').placeholder = !wait ? 'Ask Arx about security, or add your audit report…'
-    : loading ? state.progressText || 'Getting the AI assistant ready…'
-      : state.showAiCard ? 'Choose "Download now" or "Not now" above to start chatting…' : 'Tap ⚡ Enable AI at the top to start chatting…';
-  document.querySelectorAll('.chip[data-prompt]').forEach(c => { c.disabled = wait; });
-  $('sendBtn').disabled = wait || state.busy || !$('input').value.trim();
-}
-// ---------- this device ----------
-const DEVICE_CHOICE = 'devseis.deviceChoice';
-// The device answers are for: the one the browser detected, or one the visitor picked ("my Windows PC").
-function activeDevice() { return state.deviceChoice ? chosenDevice(state.deviceChoice) : (state.device || {}); }
-
-function renderDevice() {
-  const audit = state.current && state.current.audit;
-  const d = activeDevice();
-  const ready = Boolean(state.device);
-  let text, note;
-  if (audit) {
-    const s = audit.summary, assessed = s.Compliant + s['Non-Compliant'];
-    text = `Audit · ${audit.host.os_name} ${audit.host.os_version} · ${assessed ? Math.round(s.Compliant / assessed * 100) : 0}% compliant`;
-    note = 'Answers use your audit results';
-  } else if (!ready) { text = 'Detecting this device…'; note = ''; }
-  else if (!d.os_family) { text = 'Unknown device · choose yours'; note = 'Pick a system for tailored steps'; }
-  else {
-    text = [d.chosen ? `Asking about ${d.device_model}` : d.device_model !== d.os_name ? d.device_model : null, osLabel(d), d.chosen ? null : d.browser].filter(Boolean).join(' · ');
-    note = d.chosen ? 'Steps are for the system you chose' : 'Answers are tailored to this device';
-  }
-  $('deviceIcon').textContent = audit ? '📋' : deviceIcon(d);
-  $('deviceText').textContent = text;
-  $('contextNote').textContent = note;
-  $('deviceBtn').dataset.kind = audit ? 'audit' : d.chosen ? 'chosen' : 'detected';
-  if (!$('devicePanel').classList.contains('hidden')) renderDevicePanel();
-}
-
-function renderDevicePanel() {
-  const audit = state.current && state.current.audit;
-  const real = state.device || {};
-  const d = activeDevice();
-  const row = (label, value, hint = '') => value ? `<div class="drow"><dt>${label}</dt><dd>${esc(value)}${hint ? `<small>${esc(hint)}</small>` : ''}</dd></div>` : '';
-  const unlock = real.platform_authenticator === true ? 'Available (fingerprint, face or PIN)' : real.platform_authenticator === false ? 'None found by the browser' : '';
-  const ai = state.aiFault ? state.modelLabel : state.engine ? `Ready · ${state.modelLabel}` : state.loading ? `Downloading · ${Math.round((state.progress || 0) * 100)}%`
-    : 'gpu' in navigator && state.engine !== false ? 'Supported (WebGPU)' : 'Not supported here: answers come from the knowledge base';
-  let html;
-  if (audit) {
-    const h = audit.host, s = audit.summary, assessed = s.Compliant + s['Non-Compliant'];
-    $('deviceTitle').textContent = 'Audit in this chat';
-    html = `<dl>${row('Device', h.device_model || h.hostname)}${row('System', `${h.os_name} ${h.os_version}`)}${row('Audited', String(audit.audit.started_at).slice(0, 10))}
-      ${row('Result', `${s.Compliant} of ${assessed} checks compliant · ${s['Non-Compliant']} gaps`)}</dl>
-      <p class="device-note">Arx answers from these results. Start a new chat to ask about this device instead.</p>`;
-  } else {
-    $('deviceTitle').textContent = d.chosen ? 'Device you are asking about' : 'This device';
-    const version = d.os_version && !d.version_precise && !d.chosen && d.os_family !== 'windows' ? 'Approximate: browsers hide the exact version' : '';
-    html = `<dl>${row('Device', d.device_model ? `${d.device_model}${d.arch ? ` (${d.arch})` : ''}` : '')}${row('System', d.os_family ? osLabel(d) : 'Not recognised', version)}
-      ${d.chosen ? '' : row('Browser', real.browser) + row('Screen unlock', unlock) + row('Connection', real.cellular ? 'Mobile data' : '')}${row('On-device AI', ai)}</dl>
-      <p class="device-note">🔒 Read by your browser and never uploaded. Arx uses it to give steps for this system. A web page can't see settings such as encryption or the firewall: an audit checks those.</p>
-      ${state.aiFault && !d.chosen ? '<button type="button" class="small-btn device-retry" id="aiRetry">↻ Try the AI again (it may be slow or fail again)</button>' : ''}
-      <button type="button" class="primary-btn device-audit" id="deviceAudit">🛡 Audit ${d.chosen ? 'a device' : 'this device'}</button>
-      <div class="device-switch"><span class="muted tiny">Asking about another device?</span><div class="seg">
-        <button type="button" data-os="" aria-pressed="${!state.deviceChoice}">${deviceIcon(real)} This device</button>
-        ${OS_CHOICES.map(([os, label]) => `<button type="button" data-os="${os}" aria-pressed="${state.deviceChoice === os}">${label}</button>`).join('')}</div></div>`;
-  }
-  $('deviceBody').innerHTML = html;
-}
-
-function toggleDevicePanel(open) {
-  $('devicePanel').classList.toggle('hidden', !open);
-  $('deviceBackdrop').classList.toggle('hidden', !open);
-  $('deviceBtn').setAttribute('aria-expanded', String(open));
-  if (open) { renderDevicePanel(); $('deviceClose').focus(); } else $('deviceBtn').focus();
-}
-$('deviceBtn').addEventListener('click', () => toggleDevicePanel($('devicePanel').classList.contains('hidden')));
-$('deviceClose').addEventListener('click', () => toggleDevicePanel(false));
-$('deviceBackdrop').addEventListener('click', () => toggleDevicePanel(false));
-document.addEventListener('keydown', e => { if (e.key === 'Escape' && !$('devicePanel').classList.contains('hidden')) toggleDevicePanel(false); });
-$('deviceBody').addEventListener('click', e => {
-  const pick = e.target.closest('[data-os]');
-  if (pick) {
-    state.deviceChoice = pick.dataset.os || null;
-    try { if (state.deviceChoice) localStorage.setItem(DEVICE_CHOICE, state.deviceChoice); else localStorage.removeItem(DEVICE_CHOICE); } catch { /* ignore */ }
-    renderDevice(); renderDevicePanel(); return;
-  }
-  if (e.target.closest('#deviceAudit')) { toggleDevicePanel(false); openAuditModal(); }
-  if (e.target.closest('#aiRetry')) { toggleDevicePanel(false); enableAi(); }
-});
-
-function closeSidebar() { $('sidebar').classList.remove('open'); $('overlay').classList.add('hidden'); }
-
-$('composer').addEventListener('submit', e => { e.preventDefault(); const q = $('input').value.trim(); $('input').value = ''; $('input').style.height = ''; updateSend(); ask(q); });
-$('input').addEventListener('input', () => { const t = $('input'); t.style.height = 'auto'; t.style.height = `${Math.min(t.scrollHeight, 180)}px`; updateSend(); });
-$('input').addEventListener('keydown', e => { if (e.key === 'Enter' && !e.shiftKey && !e.isComposing) { e.preventDefault(); $('composer').requestSubmit(); } });
-document.querySelectorAll('.chip').forEach(c => c.addEventListener('click', () => (c.dataset.action === 'audit' ? openAuditModal() : ask(c.dataset.prompt))));
-$('auditBtn').addEventListener('click', openAuditModal);
-$('aiChip').addEventListener('click', () => { if (state.aiFault) toggleDevicePanel(true); else if (!state.engine && !state.loading && state.engine !== false) enableAi(); else if (state.engine) status(`AI assistant ready: ${state.modelLabel}`, 1) || setTimeout(() => status(''), 2500); });
-$('aiCardYes').addEventListener('click', () => { state.showAiCard = false; enableAi(); });
-$('aiCardNo').addEventListener('click', () => { state.showAiCard = false; state.kbOnly = true; aiChip(); try { localStorage.setItem(AI_CONSENT, 'later'); } catch { /* ignore */ } render(); });
-$('auditClose').addEventListener('click', () => $('auditModal').classList.add('hidden'));
-$('auditModal').addEventListener('click', e => { if (e.target === $('auditModal')) $('auditModal').classList.add('hidden'); });
-$('attachBtn').addEventListener('click', () => $('fileInput').click());
-$('fileInput').addEventListener('change', async () => {
-  const f = $('fileInput').files[0]; $('fileInput').value = '';
-  if (!f) return;
-  try { attachAudit(JSON.parse((await f.text()).replace(/^/, ''))); } catch (error) {
-    const chat = state.current || newChat(); chat.messages.push({ role: 'assistant', content: `I couldn't read that file: ${error.message} Use the …-evidence.json file the Devseis app saves next to the PDF report.`, passages: [] }); render();
-  }
-});
-$('thread').addEventListener('click', e => {
-  const t = e.target.closest('button'); if (!t) return;
-  if (t.dataset.rewrite) rewriteWithAi(+t.dataset.rewrite);
-  else if (t.dataset.enable) enableAi();
-  else if (t.dataset.ask) ask(t.dataset.ask);
-  else if (t.dataset.report) writeReport();
-  else if (t.dataset.msg) showSource(+t.dataset.msg, +t.dataset.n, true);
-});
-$('newChat').addEventListener('click', () => { newChat(); $('input').focus(); });
-$('sidebarToggle').addEventListener('click', () => { $('sidebar').classList.add('open'); $('overlay').classList.remove('hidden'); });
-$('sidebarClose').addEventListener('click', closeSidebar);
-$('overlay').addEventListener('click', closeSidebar);
-$('sidebarList').addEventListener('click', e => {
-  const del = e.target.closest('[data-del]');
-  if (del) { state.chats = state.chats.filter(c => c.id !== del.dataset.del); if (state.current && state.current.id === del.dataset.del) state.current = state.chats[0] || null; saveChats(); render(); return; }
-  const row = e.target.closest('.convo'); if (row) { state.current = state.chats.find(c => c.id === row.dataset.id); render(); closeSidebar(); }
-});
-$('clearAll').addEventListener('click', () => { state.chats = []; state.current = null; saveChats(); render(); });
-$('themeToggle').addEventListener('click', () => {
-  const dark = document.documentElement.dataset.theme ? document.documentElement.dataset.theme === 'dark' : matchMedia('(prefers-color-scheme: dark)').matches;
-  document.documentElement.dataset.theme = dark ? 'light' : 'dark';
-  try { localStorage.setItem('devseis.theme', document.documentElement.dataset.theme); } catch { /* ignore */ }
-});
-
-async function init() {
-  try { const t = localStorage.getItem('devseis.theme'); if (t) document.documentElement.dataset.theme = t; } catch { /* ignore */ }
-  state.chats = loadChats();
-  // An answer still being written when the page was saved: the page was killed mid-answer. Show the knowledge-base one.
-  for (const c of state.chats) for (const m of c.messages) if (m.role === 'assistant' && (m.pending || m.writing))
-    fallback(m, m.passages || [], 'The page reloaded while the AI was writing this (the device likely ran out of memory), so this answer comes from the knowledge base.');
-  state.current = state.chats[0] || null;
-  const [kb, device, config] = await Promise.all([
-    getJson('library/knowledge.json'),
-    detectDevice().catch(() => ({})),
-    getJson('app/model-version.json', { cache: 'no-cache' }).catch(() => ({})),
-  ]);
-  state.kb = new Knowledge(kb); state.device = await describeComputer(device); state.config = config;
-  $('aiCardText').textContent = $('aiCardText').textContent.replace('about 1 GB', chatModel().download);
-  try { state.deviceChoice = localStorage.getItem(DEVICE_CHOICE); } catch { /* ignore */ }
-  // Coming back from the phone check with a fresh report.
-  if (location.hash === '#audit') {
-    try { const ev = JSON.parse(localStorage.getItem('devseis.lastAudit')); if (ev) { attachAudit(ev); localStorage.removeItem('devseis.lastAudit'); } } catch { /* ignore */ }
-    history.replaceState(null, '', location.pathname);
-  } else if (location.hash.startsWith('#audit=')) {
-    // From the old address (apps 0.4.0/0.4.1 via the endpoint-auditor redirect Space). The fragment never reaches a server.
-    try { attachAudit(JSON.parse(decodeURIComponent(location.hash.slice(7)))); } catch { /* ignore */ }
-    history.replaceState(null, '', location.pathname);
-  }
-  render(); aiChip();
-  if ('gpu' in navigator) {
-    let consent = null; try { consent = localStorage.getItem(AI_CONSENT); } catch { /* ignore */ }
-    let fault = null; try { fault = localStorage.getItem(AI_FAULT); } catch { /* ignore */ }
-    let crashed = null; try { crashed = localStorage.getItem(AI_RUNNING); } catch { /* ignore */ }
-    if (crashed) {
-      aiRunning(false);
-      if (crashed === faultKey()) { turnOffBrokenAi('the page reloaded while the AI was running (this device ran out of memory)'); fault = faultKey(); }
-    }
-    let reason = 'it wrote unreadable text on this device'; try { reason = localStorage.getItem(AI_FAULT_REASON) || reason; } catch { /* ignore */ }
-    if (fault && fault === faultKey()) { state.kbOnly = true; state.aiFault = true; state.modelLabel = `Turned off: ${reason}`; $('modelName').textContent = 'Knowledge base only'; aiChip(); }
-    else aiUnsuitable().then(no => no ? (() => { state.engine = false; state.modelLabel = `Not available: ${no}`; $('modelName').textContent = 'Knowledge base only'; aiChip(); render(); updateSend(); })() : modelCached().then(cached => {
-      if (cached || consent === 'yes') { state.cachedStart = cached; getEngine(); }
-      else if (consent === 'later') { state.kbOnly = true; aiChip(); }
-      else {
-        state.showAiCard = true;
-        if (navigator.connection && navigator.connection.type === 'cellular') $('aiCardText').textContent += ' You seem to be on mobile data: Wi-Fi is recommended.';
-        render(); aiChip();
-      }
-    }));
-  } else { state.engine = false; state.modelLabel = 'Not available: this browser has no WebGPU'; $('modelName').textContent = 'Knowledge base only'; aiChip(); }
-  if (new URLSearchParams(location.search).has('test')) Object.assign(window, { __chat: state, __ask: ask, __enable: enableAi, __rewrite: rewriteWithAi });
-}
-init();

chat/device.js

@@ -1,48 +0,0 @@
-// What the chat knows about the device it runs on: the phone details from mobile/detect.js, plus the computer's OS,
-// version and chip, which a browser only partly reveals (Chromium client hints are precise; Safari and Firefox freeze
-// the macOS version, and Windows 10 and 11 look the same without hints). Nothing here is uploaded.
-
-const OS_NAMES = { macos: 'macOS', windows: 'Windows', linux: 'Linux', chromeos: 'ChromeOS', ios: 'iOS', android: 'Android' };
-const DEVICE_NAMES = { macos: 'Mac', windows: 'Windows PC', linux: 'Linux computer', chromeos: 'Chromebook', ios: 'iPhone', android: 'Android phone' };
-export const OS_CHOICES = [['windows', '🪟 Windows'], ['macos', '💻 macOS'], ['linux', '🐧 Linux'], ['ios', '📱 iPhone / iPad'], ['android', '🤖 Android']];
-
-// Fill in a computer's details (phones are already done by detectDevice).
-export async function describeComputer(device) {
-  const d = { ...device };
-  if (!d.desktop) return d;
-  const ua = navigator.userAgent;
-  d.os_family = /CrOS/.test(ua) ? 'chromeos' : /Windows/.test(ua) ? 'windows' : /Mac/.test(ua) ? 'macos' : 'linux';
-  d.os_name = OS_NAMES[d.os_family];
-  d.device_model = DEVICE_NAMES[d.os_family];
-  d.os_version = null; d.version_precise = false; d.arch = null;
-  const uaData = navigator.userAgentData;
-  if (uaData && uaData.getHighEntropyValues) {
-    try {
-      const hi = await Promise.race([uaData.getHighEntropyValues(['platformVersion', 'architecture', 'bitness']), new Promise(r => setTimeout(() => r({}), 1500))]);
-      const v = hi.platformVersion || '';
-      if (d.os_family === 'windows' && v) { d.os_version = parseInt(v, 10) >= 13 ? '11' : '10'; d.version_precise = true; }
-      if (d.os_family === 'macos' && v) { d.os_version = v.replace(/(\.0)+$/, ''); d.version_precise = true; }
-      if (hi.architecture) d.arch = hi.architecture === 'arm' ? (d.os_family === 'macos' ? 'Apple silicon' : 'ARM') : (d.os_family === 'macos' ? 'Intel' : `${hi.architecture === 'x86' ? 'x86' : hi.architecture}-${hi.bitness || '64'}`);
-    } catch { /* hints refused */ }
-  }
-  if (d.os_family === 'windows' && !d.os_version) d.os_version = '10 or 11';
-  return d;
-}
-
-// "macOS 15.6", "Windows 10 or 11", "iOS 18.6", "Linux".
-export function osLabel(d) { return [d.os_name || OS_NAMES[d.os_family] || 'Unknown system', d.os_version].filter(Boolean).join(' '); }
-
-export function deviceIcon(d) { return d.os_family === 'ios' || d.os_family === 'android' ? '📱' : '💻'; }
-
-// A device the visitor picked by hand ("I'm asking about my Windows PC").
-export function chosenDevice(family) {
-  return { os_family: family, os_name: OS_NAMES[family], os_version: null, device_model: DEVICE_NAMES[family], chosen: true };
-}
-
-// The MY DEVICE line in the chat prompt: what the browser saw, and that settings are not checked.
-export function deviceBrief(d) {
-  if (!d || !d.os_family) return null;
-  if (d.chosen) return `${osLabel(d)} (${d.os_family}), chosen by the user; its security settings have not been checked.`;
-  const model = d.device_model && d.device_model !== d.os_name ? ` on ${/^[AEIOU]/.test(d.device_model) ? 'an' : 'a'} ${d.device_model}${d.arch ? ` (${d.arch})` : ''}` : '';
-  return `${osLabel(d)} (${d.os_family})${model}, ${d.browser || 'unknown browser'}; detected by the browser, security settings not checked.`;
-}

download.html

@@ -1,214 +1,5 @@
 <!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
-  <meta name="description" content="Download the Devseis Endpoint Auditor for Mac, Windows and Linux: a free, read-only security and compliance check (ISO 27001, GDPR, EU AI Act) with an AI auditor that runs on your computer.">
-  <meta name="theme-color" content="#ED2939">
-  <title>Download Arx</title>
-  <style>
-    :root { --red: #ED2939; --red-dark: #C81E2B; --blue: #00A1DE; --bg: #f6f7fa; --card: #fff; --text: #16181d; --muted: #5b6270; --line: #e2e5eb; --soft: #fff4f4; --ok: #1a7f37; }
-    @media (prefers-color-scheme: dark) { :root:not([data-theme="light"]) { --bg: #101216; --card: #1a1d23; --text: #eef0f4; --muted: #a2a9b6; --line: #2c313a; --soft: #2a1a1c; --ok: #3fb950; } }
-    :root[data-theme="dark"] { --bg: #101216; --card: #1a1d23; --text: #eef0f4; --muted: #a2a9b6; --line: #2c313a; --soft: #2a1a1c; --ok: #3fb950; }
-    * { box-sizing: border-box; }
-    html, body { margin: 0; background: var(--bg); color: var(--text); }
-    body { font: 17px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Arial, sans-serif; }
-    a { color: var(--blue); }
-    .top { display: flex; justify-content: space-between; align-items: center; gap: 12px; padding: max(12px, env(safe-area-inset-top)) 16px 10px; border-top: 4px solid var(--red); background: var(--card); border-bottom: 1px solid var(--line); }
-    .brand { display: flex; align-items: center; gap: 10px; font-size: 16px; } .brand img { width: 30px; height: 30px; }
-    .top nav a { font-size: 15px; margin-left: 14px; text-decoration: none; }
-    main { max-width: 860px; margin: 0 auto; padding: 8px 16px 40px; }
-    h1 { font-size: clamp(28px, 5vw, 40px); line-height: 1.15; margin: 22px 0 8px; }
-    h2 { font-size: 22px; margin: 32px 0 12px; }
-    h3 { font-size: 18px; margin: 0 0 4px; }
-    .lead { font-size: 19px; color: var(--muted); margin: 0 0 18px; }
-    .muted { color: var(--muted); font-size: 15px; }
-    .facts { display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 10px; margin: 18px 0; }
-    .fact { background: var(--card); border: 1px solid var(--line); border-radius: 14px; padding: 12px 14px; }
-    .fact b { display: block; font-size: 15px; } .fact span { color: var(--muted); font-size: 14px; }
-    .tabs { display: flex; gap: 8px; margin: 26px 0 0; position: sticky; top: 0; background: var(--bg); padding: 8px 0; z-index: 2; }
-    .tab { flex: 1; font: inherit; font-weight: 700; font-size: 17px; padding: 14px 10px; border-radius: 14px; border: 2px solid var(--line); background: var(--card); color: var(--text); cursor: pointer; min-height: 56px; }
-    .tab[aria-selected="true"] { border-color: var(--red); background: var(--soft); color: var(--red-dark); }
-    .tab small { display: block; font-weight: 400; font-size: 13px; color: var(--muted); }
-    .panel { display: none; } .panel.active { display: block; }
-    .download { display: flex; flex-wrap: wrap; align-items: center; gap: 14px; background: var(--card); border: 2px solid var(--red); border-radius: 18px; padding: 18px; margin: 16px 0 6px; }
-    .download .big { display: inline-block; background: var(--red); color: #fff; text-decoration: none; font-weight: 800; font-size: 19px; padding: 16px 26px; border-radius: 14px; }
-    .download .big:hover { background: var(--red-dark); }
-    .download .alt { font-size: 15px; }
-    .download .meta { flex: 1 1 260px; color: var(--muted); font-size: 14px; }
-    .beta { display: inline-block; background: #fff3cd; color: #7a5a00; border-radius: 99px; padding: 1px 10px; font-size: 13px; font-weight: 700; margin-left: 6px; }
-    ol.steps { list-style: none; padding: 0; margin: 18px 0; counter-reset: s; }
-    ol.steps > li { counter-increment: s; position: relative; background: var(--card); border: 1px solid var(--line); border-radius: 16px; padding: 16px 16px 16px 64px; margin: 12px 0; }
-    ol.steps > li::before { content: counter(s); position: absolute; left: 16px; top: 16px; width: 34px; height: 34px; border-radius: 50%; background: var(--red); color: #fff; font-weight: 800; display: grid; place-items: center; }
-    ol.steps p { margin: 4px 0; }
-    .path { display: inline-block; background: var(--bg); border: 1px solid var(--line); border-radius: 8px; padding: 1px 8px; font-size: 15px; }
-    .key { display: inline-block; border: 1px solid var(--line); border-bottom-width: 3px; border-radius: 6px; padding: 0 7px; font-size: 14px; background: var(--card); }
-    code { font: 14px ui-monospace, SFMono-Regular, Menlo, monospace; background: var(--bg); border: 1px solid var(--line); border-radius: 6px; padding: 1px 6px; word-break: break-all; }
-    /* Pictures of the messages people will see (drawn, not screenshots) */
-    .shot { margin: 12px 0 4px; max-width: 420px; border-radius: 12px; border: 1px solid var(--line); box-shadow: 0 6px 20px rgba(0,0,0,.08); overflow: hidden; font-size: 14px; background: #fff; color: #1d1d1f; }
-    .shot .bar { background: #ececec; padding: 6px 10px; font-size: 12px; color: #555; display: flex; gap: 6px; align-items: center; }
-    .shot .bar i { width: 10px; height: 10px; border-radius: 50%; display: inline-block; background: #ff5f57; } .shot .bar i:nth-child(2) { background: #febc2e; } .shot .bar i:nth-child(3) { background: #28c840; }
-    .shot .body { padding: 14px 16px; } .shot .title { font-weight: 700; margin-bottom: 6px; }
-    .shot .btns { display: flex; gap: 8px; justify-content: flex-end; margin-top: 12px; flex-wrap: wrap; }
-    .shot .btn { border: 1px solid #c8c8cc; border-radius: 7px; padding: 4px 14px; background: #fff; font-size: 13px; }
-    .shot .btn.hit { outline: 3px solid var(--red); outline-offset: 2px; font-weight: 700; }
-    .shot.win { font-family: "Segoe UI", Arial, sans-serif; } .shot.win .body.blue { background: #0b5cad; color: #fff; }
-    .shot.win .body.blue a { color: #fff; text-decoration: underline; }
-    .shot.win .btn { border-radius: 3px; }
-    .shot .row { display: flex; justify-content: space-between; align-items: center; gap: 10px; padding: 10px 0; border-top: 1px solid #e5e5e5; }
-    .shot.linux .bar { background: #2c2c2c; color: #ddd; }
-    .tip { background: var(--soft); border-left: 4px solid var(--red); border-radius: 0 12px 12px 0; padding: 10px 14px; margin: 10px 0; font-size: 15px; }
-    details { background: var(--card); border: 1px solid var(--line); border-radius: 14px; padding: 12px 16px; margin: 10px 0; }
-    summary { font-weight: 700; cursor: pointer; } details p { margin: 8px 0 2px; }
-    .hash { font: 12px ui-monospace, Menlo, monospace; color: var(--muted); word-break: break-all; }
-    .foot { text-align: center; font-size: 13px; color: var(--muted); padding: 22px 16px max(22px, env(safe-area-inset-bottom)); }
-    .top nav a { white-space: nowrap; }
-    @media (max-width: 560px) { .brand span { font-size: 14px; } .brand b { display: block; } body { font-size: 16px; } ol.steps > li { padding-left: 56px; } .tab { font-size: 15px; padding: 10px 6px; } .top nav a { margin-left: 10px; } }
-  </style>
-</head>
-<body>
-  <header class="top">
-    <div class="brand"><img src="app/build/icon.png" alt=""><span><b>Arx</b> by Devseis</span></div>
-    <nav><a href="index.html">Arx</a><a href="phone.html">Phone check</a><a href="about.html">About</a></nav>
-  </header>
-
-  <main>
-    <h1>Check your computer with Arx in 15 minutes</h1>
-    <p class="lead">The desktop app (named <b>Devseis Endpoint Auditor</b> on your computer) runs a free, safe check of your computer's security settings against <b>ISO 27001</b>, <b>GDPR</b> and the <b>EU AI Act</b>. An AI auditor writes a clear report with what to fix — <b>on your computer</b>, without sending anything anywhere.</p>
-
-    <div class="facts">
-      <div class="fact"><b>✅ Only looks, never changes</b><span>It reads settings. Nothing on your computer is changed.</span></div>
-      <div class="fact"><b>🔒 Private</b><span>Your results stay on your computer. Nothing is uploaded.</span></div>
-      <div class="fact"><b>⏱ About 15 minutes</b><span>Install in 2 minutes; the first check takes 5–15 minutes.</span></div>
-      <div class="fact"><b>📄 A PDF report</b><span>A score, the main gaps and simple steps to fix them.</span></div>
-    </div>
-
-    <div class="tabs" role="tablist">
-      <button class="tab" role="tab" id="tab-mac" data-os="mac" aria-controls="panel-mac">🍎 Mac<small>macOS 13 or newer</small></button>
-      <button class="tab" role="tab" id="tab-windows" data-os="windows" aria-controls="panel-windows">🪟 Windows<small>Windows 10 or 11</small></button>
-      <button class="tab" role="tab" id="tab-linux" data-os="linux" aria-controls="panel-linux">🐧 Linux<small>Ubuntu, Debian and more</small></button>
-    </div>
-
-    <!-- ===================== MAC ===================== -->
-    <section class="panel" id="panel-mac" role="tabpanel" aria-labelledby="tab-mac">
-      <div class="download">
-        <a class="big" id="dl-dmg" href="#">⬇ Download for Mac</a>
-        <div class="meta"><span id="size-mac">Works on every Mac from 2017 on (Apple chip or Intel).</span><br><a class="alt" id="dl-zip" href="#">Prefer a .zip file?</a></div>
-      </div>
-      <ol class="steps">
-        <li><h3>Download</h3><p>Click <b>Download for Mac</b> above. The file goes to your <b>Downloads</b> folder.</p></li>
-        <li><h3>Install</h3><p>Open the downloaded file (it ends in <b>.dmg</b>). A small window opens: <b>drag the red app icon onto the Applications folder</b>. Then you can close that window.</p></li>
-        <li><h3>Open it — the first time, macOS asks you to confirm</h3>
-          <p>Open <b>Devseis Endpoint Auditor</b> from your Applications folder (or Launchpad). Because this free app is not yet registered with Apple, you will see this message. Click <b>Done</b>:</p>
-          <div class="shot"><div class="bar"><i></i><i></i><i></i></div><div class="body"><div class="title">"Devseis Endpoint Auditor" Not Opened</div>Apple could not verify "Devseis Endpoint Auditor" is free of malware that may harm your Mac or compromise your privacy.<div class="btns"><span class="btn hit">Done</span><span class="btn">Move to Bin</span></div></div></div>
-        </li>
-        <li><h3>Allow it once</h3>
-          <p>Click the <b> Apple menu</b> › <b>System Settings</b> › <b>Privacy &amp; Security</b>. Scroll down and click <b>Open Anyway</b>, then type your Mac password:</p>
-          <div class="shot"><div class="bar"><i></i><i></i><i></i> Privacy &amp; Security</div><div class="body"><div class="row"><span>"Devseis Endpoint Auditor" was blocked to protect your Mac.</span><span class="btn hit">Open Anyway</span></div></div></div>
-          <p class="muted">You only do this once. From now on the app opens normally.</p>
-        </li>
-        <li><h3>Run the check</h3>
-          <p>The first time, the app downloads its AI auditor (about 1 GB — a few minutes on Wi-Fi). Then click <b>Run audit</b>. Your Mac asks for your password: this only lets the app <i>read</i> the security settings.</p>
-          <p>After 5–15 minutes your report is ready. Click <b>Save report as PDF</b>. If you are away, it saves itself to <span class="path">Documents › Devseis Endpoint Audit</span>.</p>
-        </li>
-      </ol>
-      <div class="tip"><b>Comfortable with Terminal?</b> Instead of steps 3–4 you can run <code>xattr -dr com.apple.quarantine "/Applications/Devseis Endpoint Auditor.app"</code>.</div>
-      <p class="hash" id="hash-mac"></p>
-    </section>
-
-    <!-- ===================== WINDOWS ===================== -->
-    <section class="panel" id="panel-windows" role="tabpanel" aria-labelledby="tab-windows">
-      <div class="download">
-        <a class="big" id="dl-exe" href="#">⬇ Download for Windows</a>
-        <div class="meta"><span id="size-win">Windows 10 or 11, 64-bit.</span> <span class="beta">BETA</span><br>Built and packaged, not yet tested on many Windows PCs. Tell us if anything does not work.</div>
-      </div>
-      <ol class="steps">
-        <li><h3>Download</h3><p>Click <b>Download for Windows</b> above. If your browser asks, choose <b>Keep</b>. The file goes to your <b>Downloads</b> folder.</p></li>
-        <li><h3>Start the installer — Windows asks you to confirm</h3>
-          <p>Open the downloaded file (it ends in <b>.exe</b>). Because this free app is not yet signed, Windows shows a blue box. Click <b>More info</b>, then <b>Run anyway</b>:</p>
-          <div class="shot win"><div class="body blue"><div class="title" style="font-size:18px">Windows protected your PC</div>Microsoft Defender SmartScreen prevented an unrecognised app from starting.<br><a style="outline:3px solid var(--red);outline-offset:2px">① More info</a><div class="btns"><span class="btn hit" style="background:#fff;color:#000">② Run anyway</span><span class="btn" style="background:transparent;color:#fff;border-color:#fff">Don't run</span></div></div></div>
-        </li>
-        <li><h3>Install</h3><p>Click <b>Next</b>, keep the suggested folder, click <b>Install</b> and then <b>Finish</b>. A <b>Devseis Endpoint Auditor</b> shortcut appears on your desktop.</p></li>
-        <li><h3>Run the check</h3>
-          <p>Open the app. The first time, it downloads its AI auditor (about 1 GB). Click <b>Run audit</b>. Windows asks <i>"Do you want to allow this app to make changes to your device?"</i> — click <b>Yes</b>. The app only <i>reads</i> settings; it changes nothing.</p>
-          <div class="shot win"><div class="body"><div class="title">User Account Control</div>Do you want to allow this app to make changes to your device?<div class="btns"><span class="btn hit">Yes</span><span class="btn">No</span></div></div></div>
-        </li>
-        <li><h3>Save your report</h3><p>After 5–15 minutes, click <b>Save report as PDF</b>. If you are away, it saves itself to <span class="path">Documents › Devseis Endpoint Audit</span>.</p></li>
-      </ol>
-      <p class="hash" id="hash-win"></p>
-    </section>
-
-    <!-- ===================== LINUX ===================== -->
-    <section class="panel" id="panel-linux" role="tabpanel" aria-labelledby="tab-linux">
-      <div class="download">
-        <a class="big" id="dl-deb" href="#">⬇ Download for Ubuntu / Debian</a>
-        <div class="meta"><span id="size-linux">For Ubuntu, Debian, Linux Mint, Pop!_OS (64-bit).</span><br><a class="alt" id="dl-appimage" href="#">Other Linux (Fedora, openSUSE, Arch…): download the AppImage</a></div>
-      </div>
-      <h3 style="margin-top:18px">Ubuntu, Debian, Linux Mint, Pop!_OS</h3>
-      <ol class="steps">
-        <li><h3>Download</h3><p>Click <b>Download for Ubuntu / Debian</b> above. The file (ending in <b>.deb</b>) goes to your <b>Downloads</b> folder.</p></li>
-        <li><h3>Install</h3><p>Double-click the file. The <b>App Center</b> (or Software) opens: click <b>Install</b> and type your password.</p>
-          <p class="muted">Or in a terminal: <code>sudo apt install ~/Downloads/Devseis-Endpoint-Auditor-*.deb</code></p></li>
-        <li><h3>Run the check</h3><p>Open <b>Devseis Endpoint Auditor</b> from your applications menu. The first time, it downloads its AI auditor (about 1 GB). Click <b>Run audit</b> and type your password when asked — the app only <i>reads</i> settings.</p>
-          <div class="shot linux"><div class="bar">Authentication Required</div><div class="body">Authentication is needed to run "/bin/bash" as the super user<div class="btns"><span class="btn">Cancel</span><span class="btn hit">Authenticate</span></div></div></div>
-        </li>
-        <li><h3>Save your report</h3><p>After 5–15 minutes, click <b>Save report as PDF</b> (or find it in <span class="path">Documents › Devseis Endpoint Audit</span>).</p></li>
-      </ol>
-      <h3>Other Linux (AppImage)</h3>
-      <ol class="steps">
-        <li><h3>Download the AppImage</h3><p>Use the <b>AppImage</b> link above.</p></li>
-        <li><h3>Make it runnable</h3><p>Right-click the file › <b>Properties</b> › <b>Permissions</b> › tick <b>Allow executing file as program</b>. (Or: <code>chmod +x ~/Downloads/Devseis-Endpoint-Auditor-*.AppImage</code>.)</p></li>
-        <li><h3>Double-click it and run the check</h3><p>Same as above: click <b>Run audit</b> and save the PDF.</p></li>
-      </ol>
-      <p class="hash" id="hash-linux"></p>
-    </section>
-
-    <h2>Questions</h2>
-    <details><summary>Is it safe? Why does my computer warn me?</summary><p>The app is open source: anyone can read its code on Hugging Face. Mac and Windows warn about every app that has not paid for a developer certificate yet; the warning is not about anything the app does. You can check that your download is the real file with the SHA-256 code shown under each download.</p></details>
-    <details><summary>Does it change anything on my computer?</summary><p>No. It only reads settings (like password rules, firewall, disk encryption). It never changes them. The password prompt is needed because some settings can only be read by an administrator.</p></details>
-    <details><summary>Where do my results go?</summary><p>Nowhere — they stay on your computer. The app downloads two things (the AI auditor and a list of known security problems) but sends nothing about your computer.</p></details>
-    <details><summary>What is in the report?</summary><p>A score, the most important gaps, and for each problem: what was found, why it matters, how risky it is, and simple steps to fix it — mapped to ISO 27001, GDPR and the EU AI Act.</p></details>
-    <details><summary>Do I need internet?</summary><p>Only the first time (to download the AI auditor). After that, checks work offline.</p></details>
-    <details><summary>I'm setting this up for a company</summary><p>Before running, edit <code>baseline.conf</code> (approved admins, approved AI tools, rules) and <code>organisational.conf</code> (8 company questions). They are in <span class="path">~/Library/Application Support/Devseis Endpoint Auditor</span> on Mac, <span class="path">%APPDATA%\Devseis Endpoint Auditor</span> on Windows and <span class="path">~/.config/Devseis Endpoint Auditor</span> on Linux.</p></details>
-    <details><summary>What about my phone?</summary><p>Open <a href="phone.html">the phone check</a> on your iPhone or Android phone — the phone check runs in the browser, nothing to install.</p></details>
-    <p class="muted">Not legal advice or a certification. Open source by Devseis: code Apache-2.0, data CC BY 4.0. <a href="https://huggingface.co/spaces/Devseis/Arx/tree/main">Source</a> · <a href="https://huggingface.co/datasets/Devseis/endpoint-auditor-releases">All releases</a></p>
-  </main>
-  <footer class="foot">Devseis · <a href="index.html">Arx</a> · <a href="phone.html">Phone check</a> · <a href="about.html">About</a></footer>
-
-  <script>
-    // Pick the visitor's system, and fill in links, sizes and checksums from the releases repository.
-    const RELEASES = 'https://huggingface.co/datasets/Devseis/endpoint-auditor-releases/resolve/main/';
-    const ua = navigator.userAgent;
-    const detected = /Windows/.test(ua) ? 'windows' : (/Linux|X11|CrOS/.test(ua) && !/Android/.test(ua)) ? 'linux' : 'mac';
-    function select(os) {
-      document.querySelectorAll('.tab').forEach(t => t.setAttribute('aria-selected', String(t.dataset.os === os)));
-      document.querySelectorAll('.panel').forEach(p => p.classList.toggle('active', p.id === `panel-${os}`));
-    }
-    document.querySelectorAll('.tab').forEach(t => t.addEventListener('click', () => { select(t.dataset.os); history.replaceState(null, '', `#${t.dataset.os}`); }));
-    const fromHash = () => (['mac', 'windows', 'linux'].includes(location.hash.slice(1)) ? location.hash.slice(1) : detected);
-    select(fromHash());
-    window.addEventListener('hashchange', () => select(fromHash()));
-
-    const setLink = (id, file) => { const a = document.getElementById(id); a.href = RELEASES + file.file; };
-    const hash = (id, label, file) => { document.getElementById(id).textContent = `${label}: ${file.file} · SHA-256 ${file.sha256}`; };
-    fetch(RELEASES + 'latest.json', { cache: 'no-cache' }).then(r => r.json()).then(rel => {
-      const v = `Version ${rel.version}`;
-      setLink('dl-dmg', rel.mac.dmg); setLink('dl-zip', rel.mac.zip);
-      document.getElementById('size-mac').textContent = `${v} · ${rel.mac.dmg.size_mb} MB · works on every Mac with macOS ${rel.mac.min_macos} or newer (Apple chip or Intel).`;
-      hash('hash-mac', 'Check your download', rel.mac.dmg);
-      if (rel.windows) {
-        setLink('dl-exe', rel.windows.exe);
-        document.getElementById('size-win').textContent = `${v} · ${rel.windows.exe.size_mb} MB · Windows 10 or 11, 64-bit.`;
-        hash('hash-win', 'Check your download', rel.windows.exe);
-      }
-      if (rel.linux) {
-        setLink('dl-deb', rel.linux.deb); setLink('dl-appimage', rel.linux.appimage);
-        document.getElementById('size-linux').textContent = `${v} · ${rel.linux.deb.size_mb} MB · for Ubuntu, Debian, Linux Mint, Pop!_OS (64-bit).`;
-        hash('hash-linux', 'Check your download', rel.linux.deb);
-      }
-    }).catch(() => {
-      document.querySelectorAll('.download .meta').forEach(m => { m.insertAdjacentHTML('beforeend', '<br>Downloads could not be loaded right now: see <a href="https://huggingface.co/datasets/Devseis/endpoint-auditor-releases">all releases</a>.'); });
-    });
-  </script>
-</body>
-</html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Arx</title><meta http-equiv="refresh" content="0; url=index.html#download"><link rel="canonical" href="index.html">
+<style>body{font-family:ui-monospace,Menlo,monospace;background:#f7f7f7;color:#0a0a0a;margin:0;padding:40px 16px;text-align:center}@media (prefers-color-scheme:dark){body{background:#0a0a0a;color:#fafafa}}a{color:inherit}</style></head>
+<body><p>Arx has moved to <a href="index.html#download">the Arx home page</a>.</p></body></html>

index.html

@@ -2,99 +2,171 @@
 <html lang="en">
 <head>
   <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-content">
-  <meta name="description" content="Arx by Devseis, your security assistant: ask about securing your computer or phone, ISO 27001, GDPR and the EU AI Act, and run a free audit. The AI runs on your device; nothing is uploaded.">
-  <meta name="theme-color" content="#ED2939">
-  <title>Arx · Devseis security assistant</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="description" content="Arx by Devseis: a free, read-only security audit for your Mac, Windows or Linux computer. 68 checks in about a minute, offline, mapped to ISO 27001, GDPR and the EU AI Act. Nothing is uploaded.">
+  <meta name="theme-color" content="#f7f7f7">
+  <title>Arx · Security audit for your computer</title>
   <link rel="icon" href="app/build/icon.png">
   <link rel="apple-touch-icon" href="app/build/icon.png">
-  <link rel="stylesheet" href="chat/chat.css">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inconsolata:wght@400;500;600;700;800&display=swap">
+  <link rel="stylesheet" href="site/site.css">
+  <script>try { const t = localStorage.getItem('devseis.theme'); if (t) document.documentElement.dataset.theme = t; } catch { /* ignore */ }</script>
 </head>
 <body>
-  <header>
-    <div class="header-left">
-      <button type="button" id="sidebarToggle" class="icon-btn" aria-label="Conversations" title="Conversations">
-        <svg viewBox="0 0 24 24" width="20" height="20" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M4 6h16M4 12h16M4 18h16"/></svg>
-      </button>
-      <a class="brand" href="index.html"><img src="app/build/icon.png" alt=""><span><b>Arx</b> by Devseis</span></a>
-    </div>
-    <div class="header-actions">
-      <button type="button" id="aiChip" class="ai-chip" data-state="off">⚡ Enable AI</button>
-      <button type="button" id="newChat" class="icon-btn" aria-label="New chat" title="New chat">
-        <svg viewBox="0 0 24 24" width="19" height="19" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M12 5v14M5 12h14"/></svg>
-      </button>
-      <button type="button" id="themeToggle" class="icon-btn" aria-label="Light or dark" title="Light or dark">◐</button>
-      <button type="button" id="auditBtn" class="audit-btn">🛡 Run audit</button>
+  <header class="nav">
+    <div class="wrap nav-inner">
+      <a class="brand" href="index.html"><img src="app/build/icon.png" alt=""><b>Arx</b><span class="muted hide-xs">by Devseis</span></a>
+      <nav class="nav-links">
+        <a href="#checks">Checks</a><a href="#how">How it works</a><a href="#about">About</a>
+      </nav>
+      <div class="nav-actions">
+        <button type="button" class="icon-btn" id="themeToggle" aria-label="Light or dark" title="Light or dark">◐</button>
+        <a class="btn btn-primary btn-sm" href="#download">Download</a>
+      </div>
     </div>
   </header>
-  <div class="status-bar hidden" id="statusBar"><div class="status-text" id="statusText"></div><div class="status-progress"><div id="statusFill"></div></div></div>
 
-  <main id="chatMain">
-    <div class="empty-state" id="emptyState">
-      <div class="hero-icon"><img src="app/build/icon.png" alt=""></div>
-      <h1>Hi, I'm Arx, your Devseis security assistant.</h1>
-      <p class="hero-sub">Ask me how to secure your computer or phone, or about ISO 27001, GDPR and the EU AI Act. I can also <b>audit this device</b> for free. I run on your device: nothing you type is uploaded.</p>
-      <div class="ai-card hidden" id="aiCard">
-        <div><b>⚡ Turn on the AI assistant</b><br><span id="aiCardText">One-time download of about 1 GB; it then runs on this device, even offline. The chat opens when it is ready. Choose Not now to get answers from the Devseis knowledge base instead.</span></div>
-        <div class="btn-row"><button type="button" class="primary-btn" id="aiCardYes">Download now</button><button type="button" class="small-btn" id="aiCardNo">Not now</button></div>
+  <!-- ===== Landing ===== -->
+  <main id="landing">
+    <section class="wrap hero">
+      <p class="eyebrow"><img src="app/build/icon.png" alt="">Arx security audit</p>
+      <h1>Is your computer secure?<br><span class="soft">Find out in a minute.</span></h1>
+      <p class="lead">A free, read-only audit of your Mac, Windows or Linux computer: <b>68 checks</b> mapped to <b>ISO 27001</b>, <b>GDPR</b> and the <b>EU AI Act</b>. It runs offline, and a small AI on your computer writes the report. <u>Nothing is uploaded.</u></p>
+
+      <div class="device-card" id="deviceCard">
+        <span class="device-icon" id="deviceIcon">💻</span>
+        <div class="device-text"><span class="tiny muted" id="deviceLabel">Detected</span><b id="deviceName">Your computer</b></div>
+        <div class="seg" id="osSeg" aria-label="Choose your system">
+          <button type="button" data-os="mac">macOS</button>
+          <button type="button" data-os="windows">Windows</button>
+          <button type="button" data-os="linux">Linux</button>
+        </div>
       </div>
-      <div class="chips">
-        <button type="button" class="chip" data-prompt="How do I turn on disk encryption on my computer?">🔒 Turn on disk encryption</button>
-        <button type="button" class="chip" data-prompt="Is ChatGPT OK to use at work under GDPR?">🤖 Is ChatGPT OK at work?</button>
-        <button type="button" class="chip" data-prompt="What does ISO 27001 A.8.7 require?">📘 Explain ISO 27001 A.8.7</button>
-        <button type="button" class="chip" data-action="audit">🛡 Audit this device</button>
+
+      <div class="phone-note hidden" id="phoneNote">
+        <b>📱 Arx checks computers, not phones.</b>
+        <span class="muted">Open this page on your Mac, Windows or Linux computer to download it.</span>
+        <button type="button" class="btn btn-sm" id="copyLink">Copy link</button>
       </div>
-    </div>
-    <div id="thread" aria-live="polite"></div>
-  </main>
 
-  <div class="context-wrap" id="contextWrap">
-    <div class="context-bar">
-      <button type="button" id="deviceBtn" class="device-pill" aria-haspopup="dialog" aria-expanded="false" aria-controls="devicePanel">
-        <span class="device-ic" id="deviceIcon">💻</span><span class="device-text" id="deviceText">Detecting this device…</span><span class="chev" aria-hidden="true">▾</span>
-      </button>
-      <span class="context-note" id="contextNote">Answers are tailored to this device</span>
-    </div>
-    <div class="sheet-backdrop hidden" id="deviceBackdrop"></div>
-    <div class="device-panel hidden" id="devicePanel" role="dialog" aria-modal="false" aria-labelledby="deviceTitle">
-      <div class="device-head"><h2 id="deviceTitle">This device</h2><button type="button" class="icon-btn" id="deviceClose" aria-label="Close">✕</button></div>
-      <div id="deviceBody"></div>
-    </div>
-  </div>
-  <form id="composer" autocomplete="off">
-    <button type="button" id="attachBtn" class="icon-btn attach" title="Add an audit report (.json from the Devseis app)" aria-label="Add an audit report">
-      <svg viewBox="0 0 24 24" width="19" height="19" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21.44 11.05l-9.19 9.19a5.5 5.5 0 01-7.78-7.78l9.2-9.19a3.5 3.5 0 014.95 4.95l-9.2 9.19a1.5 1.5 0 01-2.12-2.12l8.49-8.48"/></svg>
-    </button>
-    <input type="file" id="fileInput" accept=".json,application/json" hidden>
-    <div class="input-pill" id="inputPill">
-      <textarea id="input" rows="1" placeholder="Ask Arx about security, or add your audit report…" aria-label="Message"></textarea>
-    </div>
-    <button type="submit" id="sendBtn" class="send-btn" aria-label="Send" disabled>
-      <svg viewBox="0 0 24 24" width="18" height="18" fill="currentColor"><path d="M3.4 20.4l17.45-7.48a1 1 0 000-1.84L3.4 3.6a.99.99 0 00-1.39.91L2 9.12c0 .5.37.93.87.99L17 12 2.87 13.88c-.5.07-.87.5-.87 1l.01 4.61c0 .71.73 1.2 1.39.91z"/></svg>
-    </button>
-  </form>
-  <p class="disclaimer">Runs on your device · Answers come from the Devseis knowledge base and can be wrong · Not legal advice</p>
+      <div class="cta">
+        <a class="btn btn-primary btn-lg" id="heroDownload" href="#download">Download for macOS</a>
+        <label class="btn btn-lg" for="reportFile" title="Open the …-evidence.json file Arx saves next to each report">Open a report</label>
+        <input type="file" id="reportFile" accept=".json,application/json" hidden>
+      </div>
+      <p class="tiny muted" id="heroMeta">Free · open source · version 0.4.2</p>
+    </section>
 
-  <div class="overlay hidden" id="overlay"></div>
-  <aside class="sidebar" id="sidebar" aria-label="Conversations">
-    <div class="sidebar-head"><h2>Conversations</h2><button type="button" class="icon-btn" id="sidebarClose" aria-label="Close">✕</button></div>
-    <div class="sidebar-list" id="sidebarList"></div>
-    <div class="sidebar-foot">
-      <div class="row"><span>AI model</span><span class="muted" id="modelName">loads on first question</span></div>
-      <div class="row"><a href="phone.html">📱 Phone check</a><a href="download.html">💻 Desktop app</a></div>
-      <div class="row"><a href="about.html">About</a><button type="button" class="small-btn" id="clearAll">Clear history</button></div>
-      <p class="muted tiny">Conversations are stored only in this browser. Open source by Devseis (Apache-2.0).</p>
-    </div>
-  </aside>
+    <section class="wrap">
+      <div class="stats">
+        <div class="stat"><span class="tiny muted">Checks</span><b>68</b><span class="tiny muted">settings &amp; controls</span></div>
+        <div class="stat"><span class="tiny muted">Time</span><b>~1 min</b><span class="tiny muted">for the whole audit</span></div>
+        <div class="stat"><span class="tiny muted">Uploaded</span><b>0 bytes</b><span class="tiny muted">runs offline</span></div>
+        <div class="stat"><span class="tiny muted">Frameworks</span><b>3</b><span class="tiny muted">ISO · GDPR · AI Act</span></div>
+      </div>
+    </section>
 
-  <div class="modal hidden" id="auditModal" role="dialog" aria-modal="true" aria-labelledby="auditTitle">
-    <div class="modal-card">
-      <h2 id="auditTitle">Audit this device</h2>
-      <div id="auditOptions"></div>
-      <button type="button" class="link-btn" id="auditClose">Not now</button>
-    </div>
-  </div>
+    <section class="wrap section" id="checks">
+      <div class="section-head"><h2>High-risk checks</h2><a class="tiny muted link" href="#all-checks">See all 68 →</a></div>
+      <div class="rail" id="riskRail"></div>
+    </section>
 
-  <script type="module" src="chat/chat.js"></script>
+    <section class="wrap section" id="how">
+      <div class="section-head"><h2>How it works</h2></div>
+      <ol class="steps">
+        <li><span class="step-n">1</span><div><b>Download and open Arx</b><p class="muted">One app for your system. Admin rights let it read every setting; without them, a few checks are skipped.</p></div></li>
+        <li><span class="step-n">2</span><div><b>Run the audit</b><p class="muted">Arx only reads settings: it never changes anything. The first run downloads the AI once; after that it works offline.</p></div></li>
+        <li><span class="step-n">3</span><div><b>Get your report</b><p class="muted">A score, your biggest gaps and simple steps to fix each one, mapped to ISO 27001, GDPR and the EU AI Act. Save it as a PDF.</p></div></li>
+      </ol>
+    </section>
+
+    <section class="wrap section" id="all-checks">
+      <div class="section-head"><h2>Everything Arx checks</h2><span class="tiny muted" id="checkCount"></span></div>
+      <div class="filters" id="filters"></div>
+      <div class="table-card">
+        <table class="table" id="checkTable">
+          <thead><tr><th class="num">#</th><th>Check</th><th>Risk</th><th class="hide-sm">ISO 27001</th><th class="hide-sm">GDPR</th><th class="hide-xs">Systems</th></tr></thead>
+          <tbody></tbody>
+        </table>
+        <button type="button" class="table-more" id="moreChecks">Show more</button>
+      </div>
+    </section>
+
+    <section class="wrap section" id="download">
+      <div class="section-head"><h2>Download Arx</h2><span class="tiny muted" id="dlVersion">Version 0.4.2</span></div>
+      <div class="dl-grid">
+        <article class="dl-card" data-os="mac">
+          <span class="ribbon ribbon-you hidden">YOUR SYSTEM</span>
+          <div class="dl-top"><span class="dl-icon"></span><div><b>macOS</b><span class="tiny muted">macOS 13+ · Apple chip or Intel</span></div></div>
+          <div class="kv"><span class="muted">Size</span><b data-size="mac">226 MB</b></div>
+          <a class="btn btn-primary" data-link="mac-dmg">Download .dmg</a>
+          <a class="tiny muted link" data-link="mac-zip">or .zip</a>
+          <details class="hash"><summary>SHA-256</summary><code data-hash="mac">loading…</code></details>
+        </article>
+        <article class="dl-card" data-os="windows">
+          <span class="ribbon ribbon-you hidden">YOUR SYSTEM</span><span class="ribbon ribbon-beta">BETA</span>
+          <div class="dl-top"><span class="dl-icon"></span><div><b>Windows</b><span class="tiny muted">Windows 10 or 11 · 64-bit</span></div></div>
+          <div class="kv"><span class="muted">Size</span><b data-size="windows">113 MB</b></div>
+          <a class="btn btn-primary" data-link="win-exe">Download .exe</a>
+          <span class="tiny muted">Not yet tested on real Windows PCs.</span>
+          <details class="hash"><summary>SHA-256</summary><code data-hash="windows">loading…</code></details>
+        </article>
+        <article class="dl-card" data-os="linux">
+          <span class="ribbon ribbon-you hidden">YOUR SYSTEM</span>
+          <div class="dl-top"><span class="dl-icon"></span><div><b>Linux</b><span class="tiny muted">Ubuntu, Debian, Mint, Pop!_OS · x86-64</span></div></div>
+          <div class="kv"><span class="muted">Size</span><b data-size="linux">103 MB</b></div>
+          <a class="btn btn-primary" data-link="linux-deb">Download .deb</a>
+          <a class="tiny muted link" data-link="linux-appimage">or AppImage (any distribution)</a>
+          <details class="hash"><summary>SHA-256</summary><code data-hash="linux">loading…</code></details>
+        </article>
+      </div>
+      <p class="tiny muted">If macOS says the app is from an unidentified developer: right-click it, choose Open, then Open again. All files: <a class="link" href="https://huggingface.co/datasets/Devseis/endpoint-auditor-releases">releases</a>.</p>
+    </section>
+
+    <section class="wrap section" id="about">
+      <div class="section-head"><h2>Why trust it</h2></div>
+      <div class="trust-grid">
+        <div class="card"><b>🔒 Read-only</b><p class="muted">Arx reads settings and never changes them. You decide what to fix.</p></div>
+        <div class="card"><b>📴 Offline and private</b><p class="muted">The audit and the AI run on your computer. The report stays there unless you share it.</p></div>
+        <div class="card"><b>🧾 Grounded report</b><p class="muted">The AI writes only from what the audit found and the Devseis library, and each answer is checked against both. If a check fails, Arx uses a fixed template instead.</p></div>
+        <div class="card"><b>📖 Open source</b><p class="muted">Code Apache-2.0, data CC BY 4.0. <a class="link" href="https://huggingface.co/spaces/Devseis/Arx/tree/main">Read the source</a>.</p></div>
+      </div>
+      <details class="faq"><summary>Is this a certification?</summary><p class="muted">No. ISO 27001 certification needs an accredited auditor, and much of GDPR and AI Act compliance is organisational. Arx collects evidence from the computer and flags the gaps.</p></details>
+      <details class="faq"><summary>I'm setting this up for a company</summary><p class="muted">Before running, edit <code>baseline.conf</code> (approved admins, approved AI tools, limits) and <code>organisational.conf</code> (8 company questions). They are in <code>~/Library/Application Support/Devseis Endpoint Auditor</code> on Mac, <code>%APPDATA%\Devseis Endpoint Auditor</code> on Windows and <code>~/.config/Devseis Endpoint Auditor</code> on Linux.</p></details>
+      <details class="faq"><summary>What does "Open a report" do?</summary><p class="muted">Arx saves an <code>…-evidence.json</code> file next to each PDF report. Open it here to see the results and fixes in your browser. The file is read on this page only; it is never uploaded.</p></details>
+    </section>
+  </main>
+
+  <!-- ===== Results: from the app's "Ask Arx about this report" (#audit), or an opened evidence file ===== -->
+  <main id="results" class="hidden">
+    <section class="wrap section">
+      <a class="tiny muted link" href="index.html">← Arx home</a>
+      <div class="result-head">
+        <div><p class="eyebrow" id="resDevice"></p><h1 id="resTitle">Your audit</h1><p class="tiny muted" id="resWhen"></p></div>
+        <div class="result-actions"><button type="button" class="btn btn-sm" id="printBtn">Save as PDF</button><label class="btn btn-sm" for="reportFile2">Open another</label><input type="file" id="reportFile2" accept=".json,application/json" hidden></div>
+      </div>
+      <div class="stats" id="resStats"></div>
+      <div class="card summary-card"><span class="tiny muted">Summary</span><p id="resSummary"></p><span class="tiny muted">Do next</span><ol id="resNext"></ol></div>
+    </section>
+    <section class="wrap section">
+      <div class="section-head"><h2>Gaps to fix</h2><span class="tiny muted" id="gapCount"></span></div>
+      <div id="gapList" class="findings"></div>
+    </section>
+    <section class="wrap section">
+      <details class="card other-results"><summary><b>Other results</b> <span class="tiny muted" id="otherCount"></span></summary><div id="otherList" class="findings"></div></details>
+      <p class="tiny muted">This page reads the report in your browser only; nothing is uploaded. Not legal advice or a certification.</p>
+    </section>
+  </main>
+
+  <footer class="foot">
+    <div class="wrap foot-inner">
+      <div><b>Arx</b> <span class="muted">by Devseis · a free security audit for your computer</span></div>
+      <div class="foot-links"><a href="#download">Download</a><a href="https://huggingface.co/spaces/Devseis/Arx/tree/main">Source</a><a href="https://huggingface.co/datasets/Devseis/endpoint-auditor-releases">Releases</a><a href="https://huggingface.co/Devseis/endpoint-auditor-0.5b">AI model</a><a href="CITATION.cff">Cite</a></div>
+    </div>
+  </footer>
+  <div class="toast hidden" id="toast" role="status"></div>
+  <script type="module" src="site/site.js"></script>
 </body>
 </html>

phone.html

@@ -1,92 +1,5 @@
 <!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
-  <meta name="description" content="Free, private security and compliance check for your phone (ISO 27001, GDPR, EU AI Act). Runs in your browser; nothing about your phone is uploaded.">
-  <meta name="theme-color" content="#ED2939">
-  <title>Arx phone check · Devseis</title>
-  <link rel="stylesheet" href="mobile/styles.css">
-</head>
-<body>
-  <header class="top">
-    <div class="brand"><span class="mark">D</span><span><b>Arx</b> phone check</span></div>
-    <div style="display:flex;gap:8px;align-items:center"><div id="model-chip" class="chip hidden"></div><a class="chip" href="index.html">← Arx</a></div>
-  </header>
-
-  <main>
-    <!-- 1. Start -->
-    <section id="s-start" class="screen">
-      <h1 id="hero-title">Is this phone ready for work?</h1>
-      <p class="lead" id="hero-lead">A free check against <b>ISO 27001</b>, <b>GDPR</b> and the <b>EU AI Act</b>, written by the Devseis AI auditor <b>inside your browser</b>.</p>
-      <div id="device-card" class="card device"><span class="muted">Detecting this device…</span></div>
-      <div id="desktop-note" class="card note hidden">
-        <p><a class="dl-mac" id="dl-desktop" href="download.html">Download the desktop app for Mac</a></p>
-        <p class="muted" id="desktop-other"></p>
-        <p class="muted">The phone check runs on phones: open this page on your iPhone or Android. To try it here as a demo, choose a phone type:</p>
-        <div class="row"><button class="secondary" data-demo="ios">iPhone</button><button class="secondary" data-demo="android">Android</button></div>
-      </div>
-      <ul class="facts" id="facts">
-        <li><b>Private:</b> your answers and the report stay on this phone. Only the AI model and vulnerability data are downloaded.</li>
-        <li><b>About 5 minutes:</b> the browser detects what it can; you answer the rest, with help on where to look.</li>
-        <li><b>Honest:</b> every result says whether it was <i>detected</i> or <i>self-reported</i>.</li>
-      </ul>
-      <button id="start" class="primary" disabled>Start the check</button>
-      <p class="muted center"><a href="about.html">About the project</a></p>
-    </section>
-
-    <!-- 2. Approval -->
-    <section id="s-consent" class="screen hidden">
-      <h1>Before we start</h1>
-      <div class="card">
-        <p><b>What will be checked</b> (<span id="check-count"></span> checks):</p>
-        <ul id="plan" class="plan"></ul>
-      </div>
-      <label class="card toggle">
-        <input type="checkbox" id="use-ai">
-        <span><b>Use the AI auditor</b><br><span id="ai-note" class="muted"></span></span>
-      </label>
-      <p class="muted">Nothing on the phone is changed. You can stop at any time.</p>
-      <div class="row"><button class="secondary" id="consent-back">Back</button><button class="primary" id="consent-ok">I agree, continue</button></div>
-    </section>
-
-    <!-- 3. Questions -->
-    <section id="s-question" class="screen hidden">
-      <div class="progress"><div id="q-bar" class="bar"></div></div>
-      <p class="muted" id="q-count"></p>
-      <h2 id="q-check" class="check-name"></h2>
-      <h1 id="q-text"></h1>
-      <div class="where"><span class="where-label">Where to look</span><span id="q-where"></span></div>
-      <div id="q-answers" class="answers"></div>
-      <div class="row"><button class="secondary" id="q-back">Back</button></div>
-    </section>
-
-    <!-- 4. Writing the report -->
-    <section id="s-work" class="screen hidden">
-      <h1 id="w-title">Writing your report</h1>
-      <p id="w-step" class="muted"></p>
-      <div class="progress big"><div id="w-bar" class="bar"></div></div>
-      <p id="w-current" class="muted"></p>
-    </section>
-
-    <!-- 5. Result -->
-    <section id="s-done" class="screen hidden">
-      <div id="result"></div>
-      <div class="actions">
-        <button class="primary" id="share-pdf">Save or share PDF</button>
-        <button class="secondary" id="view-report">View full report</button>
-        <button class="secondary" id="save-json">Download evidence (JSON)</button>
-      </div>
-      <p id="pdf-note" class="muted"></p>
-      <button class="link" id="again">Check again</button>
-    </section>
-  </main>
-
-  <footer class="foot">
-    Open source by Devseis · <a href="about.html">about</a> ·
-    <a href="https://huggingface.co/spaces/Devseis/Arx/tree/main">code (Apache-2.0)</a> ·
-    <a href="https://huggingface.co/datasets/Devseis/endpoint-auditor-synthetic">data (CC BY 4.0)</a> · Not legal advice or a certification.
-  </footer>
-  <script type="module" src="mobile/app.js"></script>
-</body>
-</html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Arx</title><meta http-equiv="refresh" content="0; url=index.html"><link rel="canonical" href="index.html">
+<style>body{font-family:ui-monospace,Menlo,monospace;background:#f7f7f7;color:#0a0a0a;margin:0;padding:40px 16px;text-align:center}@media (prefers-color-scheme:dark){body{background:#0a0a0a;color:#fafafa}}a{color:inherit}</style></head>
+<body><p>Arx has moved to <a href="index.html">the Arx home page</a>.</p></body></html>

site/site.css

@@ -0,0 +1,214 @@
+/* Arx website: neutral greys, thin-bordered cards and a monospace face (inspired by trustmrr.com). */
+:root {
+  --bg: #f7f7f7; --card: #ffffff; --fg: #0a0a0a; --muted: #737373; --soft: #a3a3a3; --border: #e5e5e5;
+  --primary: #171717; --primary-fg: #fafafa; --hover: #f2f2f2; --chip: #f2f2f2;
+  --high-bg: #fee2e2; --high-fg: #b91c1c; --med-bg: #fef3c7; --med-fg: #b45309; --low-bg: #e0f2fe; --low-fg: #0369a1;
+  --ok-bg: #dcfce7; --ok-fg: #15803d; --brand: #ed2939; --radius: 10px;
+  --font: 'Inconsolata', ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  color-scheme: light;
+}
+@media (prefers-color-scheme: dark) {
+  :root:not([data-theme="light"]) {
+    --bg: #0a0a0a; --card: #171717; --fg: #fafafa; --muted: #a3a3a3; --soft: #737373; --border: rgba(255,255,255,.1);
+    --primary: #e5e5e5; --primary-fg: #171717; --hover: #262626; --chip: #262626;
+    --high-bg: rgba(239,68,68,.15); --high-fg: #f87171; --med-bg: rgba(245,158,11,.15); --med-fg: #fbbf24; --low-bg: rgba(14,165,233,.15); --low-fg: #38bdf8;
+    --ok-bg: rgba(34,197,94,.15); --ok-fg: #4ade80; color-scheme: dark;
+  }
+}
+:root[data-theme="dark"] {
+  --bg: #0a0a0a; --card: #171717; --fg: #fafafa; --muted: #a3a3a3; --soft: #737373; --border: rgba(255,255,255,.1);
+  --primary: #e5e5e5; --primary-fg: #171717; --hover: #262626; --chip: #262626;
+  --high-bg: rgba(239,68,68,.15); --high-fg: #f87171; --med-bg: rgba(245,158,11,.15); --med-fg: #fbbf24; --low-bg: rgba(14,165,233,.15); --low-fg: #38bdf8;
+  --ok-bg: rgba(34,197,94,.15); --ok-fg: #4ade80; color-scheme: dark;
+}
+
+* { box-sizing: border-box; }
+html { scroll-behavior: smooth; scroll-padding-top: 72px; }
+body { margin: 0; background: var(--bg); color: var(--fg); font: 16px/1.55 var(--font); -webkit-font-smoothing: antialiased; }
+a { color: inherit; text-decoration: none; }
+code { font-family: var(--font); font-size: .92em; background: var(--chip); padding: 1px 5px; border-radius: 5px; word-break: break-all; }
+h1, h2 { margin: 0; letter-spacing: -0.02em; }
+p { margin: 0; }
+.hidden { display: none !important; }
+.wrap { max-width: 1024px; margin: 0 auto; padding: 0 16px; }
+.muted { color: var(--muted); }
+.soft { color: var(--soft); }
+.tiny { font-size: 13px; }
+.link:hover { color: var(--fg); text-decoration: underline; text-underline-offset: 4px; }
+
+/* nav */
+.nav { position: sticky; top: 0; z-index: 20; background: color-mix(in srgb, var(--bg) 85%, transparent); backdrop-filter: blur(10px); border-bottom: 1px solid var(--border); }
+.nav-inner { display: flex; align-items: center; gap: 16px; height: 56px; }
+.brand { display: flex; align-items: center; gap: 8px; font-size: 17px; }
+.brand img { width: 24px; height: 24px; border-radius: 6px; }
+.nav-links { display: flex; gap: 20px; margin-left: auto; font-size: 14px; color: var(--muted); }
+.nav-links a:hover { color: var(--fg); }
+.nav-actions { display: flex; gap: 8px; align-items: center; }
+.icon-btn { width: 34px; height: 34px; border: 1px solid var(--border); border-radius: 8px; background: var(--card); color: var(--fg); cursor: pointer; font: inherit; }
+.icon-btn:hover { background: var(--hover); }
+
+/* buttons */
+.btn { display: inline-flex; align-items: center; justify-content: center; gap: 8px; min-height: 40px; padding: 0 16px; border: 1px solid var(--border); border-radius: 8px; background: var(--card); color: var(--fg); font: 600 15px var(--font); cursor: pointer; white-space: nowrap; transition: background .15s, transform .05s; }
+.btn:hover { background: var(--hover); }
+.btn:active { transform: translateY(1px); }
+.btn-primary { background: var(--primary); color: var(--primary-fg); border-color: var(--primary); }
+.btn-primary:hover { background: color-mix(in srgb, var(--primary) 88%, var(--bg)); }
+.btn-sm { min-height: 34px; padding: 0 12px; font-size: 14px; }
+.btn-lg { min-height: 48px; padding: 0 22px; font-size: 16px; }
+
+/* hero */
+.hero { text-align: center; padding: 56px 16px 32px; }
+.eyebrow { display: inline-flex; align-items: center; gap: 8px; font-weight: 700; color: var(--muted); margin-bottom: 18px; }
+.eyebrow img { width: 22px; height: 22px; border-radius: 5px; }
+.hero h1 { font-size: clamp(32px, 6vw, 54px); line-height: 1.08; font-weight: 800; margin-bottom: 18px; }
+.lead { max-width: 640px; margin: 0 auto 28px; color: var(--muted); font-size: 16px; }
+.lead b { color: var(--fg); font-weight: 600; }
+.lead u { text-underline-offset: 4px; color: var(--fg); }
+.device-card { display: flex; align-items: center; gap: 12px; max-width: 560px; margin: 0 auto 18px; padding: 10px 10px 10px 14px; background: var(--card); border: 1px solid var(--border); border-radius: var(--radius); text-align: left; }
+.device-icon { font-size: 22px; }
+.device-text { display: flex; flex-direction: column; min-width: 0; flex: 1; }
+.device-text b { white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.seg { display: inline-flex; background: var(--chip); border-radius: 8px; padding: 3px; gap: 2px; flex-shrink: 0; }
+.seg button { border: 0; background: transparent; color: var(--muted); font: 600 13px var(--font); padding: 6px 10px; border-radius: 6px; cursor: pointer; }
+.seg button[aria-pressed="true"] { background: var(--card); color: var(--fg); box-shadow: 0 1px 2px rgba(0,0,0,.08); }
+.phone-note { display: flex; flex-wrap: wrap; align-items: center; justify-content: center; gap: 8px 12px; max-width: 560px; margin: 0 auto 18px; padding: 12px 14px; background: var(--med-bg); color: var(--fg); border-radius: var(--radius); font-size: 14px; }
+.cta { display: flex; gap: 10px; justify-content: center; flex-wrap: wrap; margin-bottom: 12px; }
+
+/* stats (metric grid) */
+.stats { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px; }
+.stat { background: var(--card); border: 1px solid var(--border); border-radius: var(--radius); padding: 14px; display: flex; flex-direction: column; gap: 2px; }
+.stat b { font-size: 26px; font-weight: 800; letter-spacing: -0.02em; line-height: 1.2; }
+
+/* sections */
+.section { padding-top: 56px; }
+.section-head { display: flex; align-items: baseline; justify-content: space-between; gap: 12px; margin-bottom: 14px; padding: 0 2px; }
+.section-head h2 { font-size: 20px; font-weight: 700; }
+.card { background: var(--card); border: 1px solid var(--border); border-radius: var(--radius); padding: 16px; }
+.card p { margin-top: 6px; font-size: 14px; }
+
+/* rail of check cards */
+.rail { display: flex; gap: 10px; overflow-x: auto; padding-bottom: 8px; scroll-snap-type: x mandatory; scrollbar-width: none; margin: 0 -16px; padding-left: 16px; padding-right: 16px; }
+.rail::-webkit-scrollbar { display: none; }
+.check-card { position: relative; flex: 0 0 236px; scroll-snap-align: start; display: flex; flex-direction: column; gap: 10px; padding: 14px; background: var(--card); border: 1px solid var(--border); border-radius: var(--radius); overflow: hidden; cursor: pointer; transition: border-color .15s; text-align: left; font: inherit; color: inherit; }
+.check-card:hover { border-color: color-mix(in srgb, var(--fg) 30%, transparent); }
+.check-card .name { font-weight: 700; font-size: 15px; line-height: 1.25; padding-right: 40px; }
+.check-card .why { font-size: 13px; color: var(--muted); display: -webkit-box; -webkit-line-clamp: 3; -webkit-box-orient: vertical; overflow: hidden; min-height: 3.9em; }
+.mini { display: grid; grid-template-columns: repeat(3, 1fr); gap: 6px; margin-top: auto; }
+.mini > span { display: flex; flex-direction: column; font-size: 12px; min-width: 0; }
+.mini > span > span { color: var(--muted); font-size: 11px; }
+.mini b { white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.check-card .name, .check-card .why { display: block; }
+.ribbon { position: absolute; top: 0; right: 0; font-size: 10px; font-weight: 800; padding: 3px 8px; border-bottom-left-radius: 8px; letter-spacing: .04em; }
+.ribbon-high { background: var(--high-bg); color: var(--high-fg); }
+.ribbon-beta { background: var(--med-bg); color: var(--med-fg); }
+.ribbon-you { background: var(--ok-bg); color: var(--ok-fg); right: auto; left: 0; border-bottom-left-radius: 0; border-bottom-right-radius: 8px; }
+
+/* steps */
+.steps { list-style: none; margin: 0; padding: 0; display: grid; grid-template-columns: repeat(3, 1fr); gap: 10px; }
+.steps li { display: flex; gap: 12px; background: var(--card); border: 1px solid var(--border); border-radius: var(--radius); padding: 16px; }
+.steps p { font-size: 14px; margin-top: 4px; }
+.step-n { flex: 0 0 28px; height: 28px; border-radius: 50%; background: var(--primary); color: var(--primary-fg); display: grid; place-items: center; font-weight: 800; font-size: 14px; }
+
+/* table */
+.filters { display: flex; gap: 6px; flex-wrap: wrap; margin-bottom: 10px; }
+.pill { border: 1px solid var(--border); background: var(--card); color: var(--muted); border-radius: 999px; padding: 4px 12px; font: 600 13px var(--font); cursor: pointer; }
+.pill[aria-pressed="true"] { background: var(--primary); color: var(--primary-fg); border-color: var(--primary); }
+.table-card { background: var(--card); border: 1px solid var(--border); border-radius: var(--radius); overflow: hidden; }
+.table { width: 100%; border-collapse: collapse; font-size: 14px; }
+.table th { text-align: left; font-size: 12px; font-weight: 600; color: var(--muted); padding: 10px 12px; border-bottom: 1px solid var(--border); }
+.table td { padding: 10px 12px; border-bottom: 1px solid var(--border); vertical-align: top; }
+.table tr:last-child td { border-bottom: 0; }
+.table tbody tr { cursor: pointer; }
+.table tbody tr:hover td { background: var(--hover); }
+.table .num { width: 44px; color: var(--muted); }
+.table .check-name { font-weight: 600; }
+.table .sub { display: block; color: var(--muted); font-size: 12px; }
+.table tr.detail td { background: var(--bg); cursor: default; font-size: 13px; color: var(--muted); }
+.table tr.detail:hover td { background: var(--bg); }
+.table-more { width: 100%; border: 0; border-top: 1px solid var(--border); background: var(--card); color: var(--muted); padding: 12px; font: 600 14px var(--font); cursor: pointer; }
+.table-more:hover { color: var(--fg); background: var(--hover); }
+.badge { display: inline-block; font-size: 11px; font-weight: 800; padding: 2px 8px; border-radius: 999px; letter-spacing: .02em; white-space: nowrap; }
+.badge-High { background: var(--high-bg); color: var(--high-fg); }
+.badge-Medium { background: var(--med-bg); color: var(--med-fg); }
+.badge-Low { background: var(--low-bg); color: var(--low-fg); }
+.badge-ok { background: var(--ok-bg); color: var(--ok-fg); }
+.badge-grey { background: var(--chip); color: var(--muted); }
+.medal { font-size: 15px; }
+
+/* downloads */
+.dl-grid { display: grid; grid-template-columns: repeat(3, 1fr); gap: 10px; margin-bottom: 12px; }
+.dl-card { position: relative; display: flex; flex-direction: column; gap: 10px; padding: 18px 16px 16px; background: var(--card); border: 1px solid var(--border); border-radius: var(--radius); overflow: hidden; }
+.dl-card.you { border-color: color-mix(in srgb, var(--fg) 35%, transparent); }
+.dl-top { display: flex; gap: 10px; align-items: center; }
+.dl-top div { display: flex; flex-direction: column; }
+.dl-icon { font-size: 26px; }
+.dl-card[data-os="mac"] .dl-icon::before { content: '💻'; }
+.dl-card[data-os="windows"] .dl-icon::before { content: '🪟'; }
+.dl-card[data-os="linux"] .dl-icon::before { content: '🐧'; }
+.kv { display: flex; justify-content: space-between; font-size: 14px; border-top: 1px dashed var(--border); padding-top: 8px; }
+.hash summary { font-size: 12px; color: var(--muted); cursor: pointer; }
+.hash code { display: block; margin-top: 6px; font-size: 11px; }
+
+/* trust + faq */
+.trust-grid { display: grid; grid-template-columns: repeat(2, 1fr); gap: 10px; margin-bottom: 14px; }
+.faq { border-bottom: 1px solid var(--border); padding: 12px 2px; }
+.faq summary { cursor: pointer; font-weight: 600; }
+.faq p { margin-top: 8px; font-size: 14px; }
+
+/* results */
+.result-head { display: flex; justify-content: space-between; align-items: flex-end; gap: 12px; flex-wrap: wrap; margin: 16px 0 18px; }
+.result-head h1 { font-size: clamp(26px, 5vw, 38px); font-weight: 800; }
+.result-head .eyebrow { margin-bottom: 6px; }
+.result-actions { display: flex; gap: 8px; }
+.stat.score b { font-size: 34px; }
+.bar { height: 6px; background: var(--chip); border-radius: 99px; overflow: hidden; margin-top: 6px; }
+.bar i { display: block; height: 100%; background: var(--fg); border-radius: 99px; }
+.summary-card { margin-top: 10px; }
+.summary-card p { font-size: 15px; color: var(--fg); margin: 6px 0 12px; }
+.summary-card ol { margin: 6px 0 0; padding-left: 20px; font-size: 14px; }
+.summary-card li { margin-bottom: 4px; }
+.findings { display: flex; flex-direction: column; gap: 8px; }
+.finding { background: var(--card); border: 1px solid var(--border); border-radius: var(--radius); }
+.finding > summary { list-style: none; display: flex; align-items: center; gap: 10px; padding: 12px 14px; cursor: pointer; }
+.finding > summary::-webkit-details-marker { display: none; }
+.finding > summary::after { content: '+'; margin-left: auto; color: var(--muted); font-weight: 700; }
+.finding[open] > summary::after { content: '−'; }
+.finding .f-name { font-weight: 700; }
+.finding > summary > .badge { min-width: 62px; text-align: center; flex-shrink: 0; }
+.finding .f-found { font-size: 13px; color: var(--muted); }
+.f-body { padding: 0 14px 14px; font-size: 14px; display: flex; flex-direction: column; gap: 10px; border-top: 1px dashed var(--border); padding-top: 12px; }
+.f-body h4 { margin: 0 0 4px; font-size: 12px; color: var(--muted); font-weight: 600; text-transform: uppercase; letter-spacing: .04em; }
+.f-body ol { margin: 0; padding-left: 20px; }
+.f-refs { display: flex; flex-wrap: wrap; gap: 6px; }
+.other-results summary { cursor: pointer; }
+.other-results .findings { margin-top: 12px; }
+
+/* footer + toast */
+.foot { margin-top: 72px; border-top: 1px solid var(--border); padding: 24px 0 40px; font-size: 14px; }
+.foot-inner { display: flex; justify-content: space-between; gap: 12px; flex-wrap: wrap; }
+.foot-links { display: flex; gap: 16px; flex-wrap: wrap; color: var(--muted); }
+.foot-links a:hover { color: var(--fg); }
+.toast { position: fixed; left: 50%; bottom: 24px; transform: translateX(-50%); background: var(--primary); color: var(--primary-fg); padding: 10px 16px; border-radius: 8px; font-size: 14px; z-index: 50; max-width: calc(100% - 32px); }
+
+@media (max-width: 760px) {
+  .nav-links { display: none; }
+  .nav-actions { margin-left: auto; }
+  .stats { grid-template-columns: repeat(2, 1fr); }
+  .steps, .dl-grid, .trust-grid { grid-template-columns: 1fr; }
+  .hide-sm { display: none; }
+  .hero { padding-top: 36px; }
+}
+@media (max-width: 520px) {
+  .device-card { flex-wrap: wrap; }
+  .seg { width: 100%; }
+  .seg button { flex: 1; }
+  .cta .btn { width: 100%; }
+  .hide-xs { display: none; }
+  .table th, .table td { padding: 9px 8px; }
+}
+@media print {
+  .nav, .foot, .result-actions, #landing, .toast { display: none !important; }
+  body { background: #fff; color: #000; }
+  .finding { break-inside: avoid; }
+  details.finding:not([open]) > .f-body, .other-results:not([open]) > .findings { display: flex !important; }
+}

site/site.js

@@ -0,0 +1,252 @@
+// Arx website: detect the visitor's computer and offer the right download, list every check from the catalog, and
+// show a report from the desktop app (its "Ask Arx about this report" button, or an opened …-evidence.json file).
+// No AI here: the AI runs only inside the desktop app. Reports are written with the app's own templates
+// (app/renderer/auditor-core.js), so they read the same as the app's fallback report. Nothing is uploaded.
+import { Library, findingTemplate, summaryTemplate } from '../app/renderer/auditor-core.js';
+
+const $ = id => document.getElementById(id);
+const esc = s => String(s ?? '').replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+const RELEASES = 'https://huggingface.co/datasets/Devseis/endpoint-auditor-releases/resolve/main/';
+const DESKTOP = ['windows', 'macos', 'linux'];
+const OS_LABEL = { mac: 'macOS', windows: 'Windows', linux: 'Linux' };
+const FAMILY = { mac: 'macos', windows: 'windows', linux: 'linux' };
+const SHORT = { windows: 'Win', macos: 'Mac', linux: 'Linux' };
+const RISK_ORDER = { High: 0, Medium: 1, Low: 2 };
+const state = { os: 'mac', lib: null, checks: [], filter: 'all', shown: 15, open: null };
+
+function toast(text) {
+  const t = $('toast'); t.textContent = text; t.classList.remove('hidden');
+  clearTimeout(toast.timer); toast.timer = setTimeout(() => t.classList.add('hidden'), 2600);
+}
+
+// ---------- theme ----------
+$('themeToggle').addEventListener('click', () => {
+  const root = document.documentElement;
+  const dark = root.dataset.theme ? root.dataset.theme === 'dark' : matchMedia('(prefers-color-scheme: dark)').matches;
+  root.dataset.theme = dark ? 'light' : 'dark';
+  try { localStorage.setItem('devseis.theme', root.dataset.theme); } catch { /* ignore */ }
+});
+
+// ---------- device ----------
+// Computers only. iPadOS reports itself as a Mac, so a touch screen on "Mac" counts as a tablet.
+async function detect() {
+  const ua = navigator.userAgent;
+  const phone = /iPhone|iPod|Android|Mobile/.test(ua) || (/Macintosh/.test(ua) && navigator.maxTouchPoints > 1) || /iPad/.test(ua);
+  const os = /Windows/.test(ua) ? 'windows' : (/Linux|X11|CrOS/.test(ua) && !/Android/.test(ua)) ? 'linux' : 'mac';
+  const browser = (/Edg\/(\d+)/.exec(ua) && `Edge ${/Edg\/(\d+)/.exec(ua)[1]}`) || (/Firefox\/(\d+)/.exec(ua) && `Firefox ${/Firefox\/(\d+)/.exec(ua)[1]}`)
+    || (/Chrome\/(\d+)/.exec(ua) && `Chrome ${/Chrome\/(\d+)/.exec(ua)[1]}`) || (/Version\/(\d+[.\d]*).*Safari/.exec(ua) && `Safari ${/Version\/(\d+[.\d]*)/.exec(ua)[1]}`) || 'your browser';
+  let version = '', arch = '';
+  try {
+    const hi = await Promise.race([navigator.userAgentData?.getHighEntropyValues(['platformVersion', 'architecture']), new Promise(r => setTimeout(() => r(null), 1200))]);
+    if (hi) {
+      if (os === 'windows' && hi.platformVersion) version = parseInt(hi.platformVersion, 10) >= 13 ? '11' : '10';
+      if (os === 'mac' && hi.platformVersion) version = hi.platformVersion.replace(/(\.0)+$/, '');
+      if (hi.architecture) arch = hi.architecture === 'arm' ? (os === 'mac' ? 'Apple chip' : 'ARM') : (os === 'mac' ? 'Intel' : 'x86-64');
+    }
+  } catch { /* hints refused */ }
+  return { phone, os, browser, version, arch };
+}
+
+function chooseOs(os) {
+  state.os = os;
+  document.querySelectorAll('#osSeg button').forEach(b => b.setAttribute('aria-pressed', String(b.dataset.os === os)));
+  document.querySelectorAll('.dl-card').forEach(c => {
+    c.classList.toggle('you', c.dataset.os === os);
+    c.querySelector('.ribbon-you').classList.toggle('hidden', c.dataset.os !== os);
+  });
+  $('heroDownload').textContent = `Download for ${OS_LABEL[os]}`;
+  const main = document.querySelector(`.dl-card[data-os="${os}"] .btn-primary`);
+  $('heroDownload').href = main && main.href ? main.href : '#download';
+  renderTable();
+}
+
+async function initDevice() {
+  const d = await detect();
+  if (d.phone) {
+    $('phoneNote').classList.remove('hidden');
+    $('deviceIcon').textContent = '📱'; $('deviceLabel').textContent = 'You are on a phone or tablet'; $('deviceName').textContent = 'Choose the computer to check';
+    $('heroDownload').classList.add('hidden');
+    document.querySelector('label[for="reportFile"]').classList.add('hidden');
+  } else {
+    $('deviceName').textContent = [OS_LABEL[d.os] + (d.version ? ` ${d.version}` : ''), d.arch, d.browser].filter(Boolean).join(' · ');
+  }
+  chooseOs(d.os);
+}
+document.querySelectorAll('#osSeg button').forEach(b => b.addEventListener('click', () => {
+  chooseOs(b.dataset.os);
+  if (!$('phoneNote').classList.contains('hidden')) $('deviceName').textContent = `${OS_LABEL[b.dataset.os]} (chosen)`;
+}));
+$('copyLink').addEventListener('click', async () => {
+  try { await navigator.clipboard.writeText(location.origin + location.pathname); toast('Link copied: open it on your computer'); }
+  catch { toast(location.origin + location.pathname); }
+});
+
+// ---------- downloads ----------
+async function initDownloads() {
+  try {
+    const rel = await (await fetch(RELEASES + 'latest.json', { cache: 'no-cache' })).json();
+    const set = (key, file) => document.querySelectorAll(`[data-link="${key}"]`).forEach(a => { a.href = RELEASES + file.file; a.setAttribute('download', ''); });
+    set('mac-dmg', rel.mac.dmg); set('mac-zip', rel.mac.zip);
+    if (rel.windows) set('win-exe', rel.windows.exe);
+    if (rel.linux) { set('linux-deb', rel.linux.deb); set('linux-appimage', rel.linux.appimage); }
+    const sizes = { mac: rel.mac.dmg, windows: rel.windows?.exe, linux: rel.linux?.deb };
+    for (const [os, f] of Object.entries(sizes)) if (f) {
+      document.querySelector(`[data-size="${os}"]`).textContent = `${f.size_mb} MB`;
+      document.querySelector(`[data-hash="${os}"]`).textContent = `${f.file}\n${f.sha256}`;
+    }
+    $('dlVersion').textContent = `Version ${rel.version} · ${rel.date}`;
+    $('heroMeta').textContent = `Free · open source · version ${rel.version}`;
+    chooseOs(state.os);
+  } catch {
+    document.querySelectorAll('[data-hash]').forEach(c => { c.textContent = 'Could not load: see the releases page.'; });
+    document.querySelectorAll('.dl-card .btn-primary').forEach(a => { a.href = 'https://huggingface.co/datasets/Devseis/endpoint-auditor-releases'; });
+  }
+}
+
+// ---------- checks ----------
+async function loadLibrary() {
+  const get = async path => { const r = await fetch(path); if (!r.ok) throw new Error(`${path}: HTTP ${r.status}`); return r.json(); };
+  const [catalog, controls, guidance, aiTools] = await Promise.all([get('catalog/checks.json'), get('library/controls.json'), get('library/check_guidance.json'), get('library/ai_tools.json')]);
+  state.lib = new Library({ catalog, controls, guidance, aiTools });
+  state.checks = catalog.checks.filter(c => !c.os || c.os.some(o => DESKTOP.includes(o))).map(c => {
+    const g = state.lib.guide(c.id) || {};
+    return { ...c, guide: g, risk: g.risk?.level || 'Low', systems: (c.os || DESKTOP).filter(o => DESKTOP.includes(o)) };
+  }).sort((a, b) => RISK_ORDER[a.risk] - RISK_ORDER[b.risk]);
+}
+
+const refs = (c, key) => (c.controls?.[key] || []).join(', ') || '—';
+const systems = c => c.systems.length === 3 ? 'All' : c.systems.map(o => SHORT[o]).join(' · ');
+
+function renderRail() {
+  const high = state.checks.filter(c => c.risk === 'High' && c.section === 'baseline').slice(0, 12);
+  $('riskRail').innerHTML = high.map(c => `
+    <button type="button" class="check-card" data-id="${esc(c.id)}">
+      <span class="ribbon ribbon-high">HIGH RISK</span>
+      <span class="name">${esc(c.name)}</span>
+      <span class="why">${esc(c.guide.why || '')}</span>
+      <span class="mini"><span><span>ISO 27001</span><b>${esc(refs(c, 'iso27001').split(', ')[0])}</b></span><span><span>GDPR</span><b>${esc(refs(c, 'gdpr').split(', ')[0])}</b></span><span><span>Systems</span><b>${esc(systems(c))}</b></span></span>
+    </button>`).join('');
+  $('riskRail').querySelectorAll('.check-card').forEach(b => b.addEventListener('click', () => {
+    state.filter = 'all'; state.open = b.dataset.id;
+    const i = state.checks.findIndex(c => c.id === b.dataset.id); state.shown = Math.max(state.shown, i + 1);
+    renderFilters(); renderTable();
+    document.querySelector(`tr[data-id="${CSS.escape(b.dataset.id)}"]`)?.scrollIntoView({ behavior: 'smooth', block: 'center' });
+  }));
+}
+
+const FILTERS = [['all', 'All'], ['High', 'High risk'], ['windows', 'Windows'], ['macos', 'macOS'], ['linux', 'Linux'], ['gdpr', 'GDPR'], ['aiact', 'AI Act'], ['org', 'Company']];
+function matches(c, f) {
+  if (f === 'all') return true;
+  if (f === 'High') return c.risk === 'High';
+  if (DESKTOP.includes(f)) return c.systems.includes(f);
+  return c.section === f;
+}
+function renderFilters() {
+  $('filters').innerHTML = FILTERS.map(([k, label]) => `<button type="button" class="pill" data-f="${k}" aria-pressed="${state.filter === k}">${label} <span class="soft">${state.checks.filter(c => matches(c, k)).length}</span></button>`).join('');
+  $('filters').querySelectorAll('.pill').forEach(p => p.addEventListener('click', () => { state.filter = p.dataset.f; state.shown = 15; state.open = null; renderFilters(); renderTable(); }));
+}
+
+function fixFor(c) {
+  const fam = c.systems.includes(FAMILY[state.os]) ? FAMILY[state.os] : c.systems[0];
+  const steps = c.guide.fix?.[fam] || c.guide.fix?.all || [];
+  return { fam, steps: steps.map(s => s.replace(/\{[A-Z_]+\}/g, '…')) };
+}
+
+function renderTable() {
+  if (!state.checks.length) return;
+  const rows = state.checks.filter(c => matches(c, state.filter));
+  $('checkCount').textContent = `${rows.length} of ${state.checks.length}`;
+  $('checkTable').querySelector('tbody').innerHTML = rows.slice(0, state.shown).map((c, i) => {
+    const row = `<tr data-id="${esc(c.id)}"><td class="num">${i + 1}</td><td><span class="check-name">${esc(c.name)}</span><span class="sub">${esc(c.id)}</span></td>
+      <td><span class="badge badge-${c.risk}">${c.risk}</span></td><td class="hide-sm">${esc(refs(c, 'iso27001'))}</td><td class="hide-sm">${esc(refs(c, 'gdpr'))}</td><td class="hide-xs">${esc(systems(c))}</td></tr>`;
+    if (state.open !== c.id) return row;
+    const fix = fixFor(c);
+    return row + `<tr class="detail"><td></td><td colspan="5"><b>Why it matters:</b> ${esc(c.guide.why || '')}<br><b>Risk:</b> ${esc(c.guide.risk?.reason || '')}
+      ${fix.steps.length ? `<br><b>How to fix on ${esc({ windows: 'Windows', macos: 'macOS', linux: 'Linux' }[fix.fam] || fix.fam)}:</b> ${esc(fix.steps[0])}` : ''}</td></tr>`;
+  }).join('');
+  $('moreChecks').classList.toggle('hidden', rows.length <= state.shown);
+  $('moreChecks').textContent = `Show more (${rows.length - state.shown} more checks)`;
+  $('checkTable').querySelectorAll('tbody tr[data-id]').forEach(tr => tr.addEventListener('click', () => { state.open = state.open === tr.dataset.id ? null : tr.dataset.id; renderTable(); }));
+}
+$('moreChecks').addEventListener('click', () => { state.shown += 25; renderTable(); });
+
+// ---------- results ----------
+function validEvidence(ev) { return ev && ev.host && Array.isArray(ev.results) && ev.summary && ev.audit; }
+
+function findingHtml(record, result, open) {
+  let f;
+  try { f = findingTemplate(record, result, state.lib); } catch { f = { title: result.name, finding: `${result.actual || ''} (expected ${result.expected || '—'})`, risk: { level: 'Unknown', reason: '' }, recommendation: [], references: [] }; }
+  const level = f.risk?.level;
+  const badge = result.status === 'Compliant' ? '<span class="badge badge-ok">PASS</span>'
+    : result.status === 'Non-Compliant' ? `<span class="badge badge-${esc(level)}">${esc(level)}</span>` : `<span class="badge badge-grey">${esc(result.status.toUpperCase())}</span>`;
+  return `<details class="finding"${open ? ' open' : ''}><summary>${badge}<span><span class="f-name">${esc(result.name)}</span><br><span class="f-found">Found: ${esc(result.actual || '—')}${result.expected ? ` · required: ${esc(result.expected)}` : ''}</span></span></summary>
+    <div class="f-body"><div><h4>Finding</h4>${esc(f.finding)}</div>
+    ${f.risk?.reason && level !== 'None' ? `<div><h4>Risk</h4>${esc(f.risk.reason)}</div>` : ''}
+    ${f.recommendation?.length ? `<div><h4>How to fix</h4><ol>${f.recommendation.map(s => `<li>${esc(s)}</li>`).join('')}</ol></div>` : ''}
+    ${f.verification ? `<div><h4>Check it worked</h4>${esc(f.verification)}</div>` : ''}
+    ${f.references?.length ? `<div class="f-refs">${f.references.map(r => `<span class="badge badge-grey">${esc(r)}</span>`).join('')}</div>` : ''}</div></details>`;
+}
+
+function showResults(ev) {
+  if (!validEvidence(ev)) { toast('That file is not an Arx report (…-evidence.json).'); return; }
+  if (!DESKTOP.includes(ev.host.os_family)) { toast('Arx now shows computer reports only.'); return; }
+  const s = summaryTemplate(ev, state.lib);
+  $('landing').classList.add('hidden'); $('results').classList.remove('hidden');
+  const h = ev.host;
+  $('resDevice').textContent = `💻 ${h.hostname || 'Computer'} · ${h.os_name || ''} ${h.os_version || ''}`;
+  $('resTitle').textContent = `${s.score.percent}% of checks met`;
+  const when = ev.audit.started_at ? new Date(ev.audit.started_at) : null;
+  $('resWhen').textContent = `${when && !isNaN(when) ? `Audited ${when.toLocaleString()}` : 'Audit'}${ev.audit.is_admin ? ' · as administrator' : ' · without admin rights (some checks skipped)'}`;
+  const c = ev.summary;
+  $('resStats').innerHTML = `<div class="stat score"><span class="tiny muted">Score</span><b>${s.score.percent}%</b><div class="bar"><i style="width:${s.score.percent}%"></i></div></div>
+    <div class="stat"><span class="tiny muted">Passed</span><b>${c.Compliant}</b><span class="tiny muted">of ${s.score.assessed} assessed</span></div>
+    <div class="stat"><span class="tiny muted">Gaps</span><b>${c['Non-Compliant']}</b><span class="tiny muted">${ev.results.filter(r => r.status === 'Non-Compliant' && state.lib.guide(r.id)?.risk?.level === 'High').length} high risk</span></div>
+    <div class="stat"><span class="tiny muted">Not checked</span><b>${(c.Error || 0) + (c.Pending || 0)}</b><span class="tiny muted">${c.Error || 0} errors · ${c.Pending || 0} pending</span></div>`;
+  $('resSummary').textContent = s.summary;
+  $('resNext').innerHTML = s.next_steps.map(x => `<li>${esc(x)}</li>`).join('') || '<li>Nothing urgent: keep the current settings and re-run the audit regularly.</li>';
+  const gaps = ev.results.filter(r => r.status === 'Non-Compliant')
+    .sort((a, b) => (RISK_ORDER[state.lib.guide(a.id)?.risk?.level] ?? 3) - (RISK_ORDER[state.lib.guide(b.id)?.risk?.level] ?? 3));
+  $('gapCount').textContent = `${gaps.length} found`;
+  $('gapList').innerHTML = gaps.map((r, i) => findingHtml(ev, r, i === 0)).join('') || '<div class="card">No gaps found. 🎉</div>';
+  const other = ev.results.filter(r => r.status !== 'Non-Compliant');
+  $('otherCount').textContent = `(${other.length}: passed, pending, errors, not applicable)`;
+  $('otherList').innerHTML = other.map(r => findingHtml(ev, r, false)).join('');
+  document.title = `Arx · ${s.score.percent}% · ${h.hostname || 'audit'}`;
+  scrollTo(0, 0);
+}
+
+function openFile(input) {
+  const file = input.files && input.files[0];
+  if (!file) return;
+  file.text().then(t => showResults(JSON.parse(t))).catch(() => toast('Could not read that file.'));
+  input.value = '';
+}
+$('reportFile').addEventListener('change', e => openFile(e.target));
+$('reportFile2').addEventListener('change', e => openFile(e.target));
+$('printBtn').addEventListener('click', () => print());
+addEventListener('beforeprint', () => document.querySelectorAll('#results details').forEach(d => { d.dataset.wasOpen = d.open; d.open = true; }));
+addEventListener('afterprint', () => document.querySelectorAll('#results details').forEach(d => { d.open = d.dataset.wasOpen === 'true'; }));
+
+// A report handed over by the desktop app (0.4.x: "Ask Arx about this report" stores it, then opens #audit),
+// or by apps 0.4.0/0.4.1 in the address fragment (#audit=…; fragments never reach a server).
+function handedOverReport() {
+  try {
+    if (location.hash === '#audit') {
+      const ev = JSON.parse(localStorage.getItem('devseis.lastAudit'));
+      localStorage.removeItem('devseis.lastAudit');
+      return ev;
+    }
+    if (location.hash.startsWith('#audit=')) return JSON.parse(decodeURIComponent(location.hash.slice(7)));
+  } catch { /* ignore */ }
+  return null;
+}
+
+async function init() {
+  initDevice(); initDownloads();
+  try { await loadLibrary(); } catch (e) { $('checkCount').textContent = 'Could not load the check list.'; console.warn(e); return; }
+  renderRail(); renderFilters(); renderTable();
+  const showHandedOver = () => { const ev = handedOverReport(); if (ev) { history.replaceState(null, '', location.pathname); showResults(ev); } };
+  showHandedOver();
+  addEventListener('hashchange', showHandedOver);
+}
+init();

training/build_chat.py

@@ -1,12 +1,14 @@
 #!/usr/bin/env python3
-"""Chat training examples for model v0.4 (questions about endpoint security, ISO 27001, GDPR, EU AI Act, the auditor,
+"""Chat training examples for models v0.4/v0.5 (questions about endpoint security, ISO 27001, GDPR, EU AI Act, the auditor,
 and the user's own audit), grounded in library/knowledge.json and cited as [n].
 
 Answers are composed from the same library facts the passages are built from, so they are grounded by construction;
 check_chat() verifies it (citations exist, numbers appear in the prompt, refusals cite nothing). Prompts are built by
 training/chat-contexts.mjs with the app's own search, so training matches runtime.
 
-Usage: python3 training/build_chat.py --evidence synthetic/out-v0.3/evidence.jsonl --base training/out-v0.3 --out training/out-v0.4
+v0.5 adds MY DEVICE (what the browser detected, as deviceBrief() in the former chat/device.js wrote it) to most prompts without an audit.
+
+Usage: python3 training/build_chat.py --evidence synthetic/out-v0.3/evidence.jsonl --base training/out-v0.3 --out training/out-v0.5
 """
 import argparse
 import json
@@ -20,7 +22,7 @@ ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 sys.path.insert(0, os.path.join(ROOT, "library"))
 import build_knowledge as kb_build  # noqa: E402
 
-DATASET_VERSION = "0.4.0"
+DATASET_VERSION = "0.5.0"
 OS_LABEL = kb_build.OS_LABEL
 NUMBER = re.compile(r"(?<![\w.])\d+(?:\.\d+)?(?!\w)")
 
@@ -210,6 +212,66 @@ def make_jobs(rng, catalog, guidance, controls, tools, phone, evidences):
     return jobs
 
 
+# What browsers report (the former chat/device.js). arch only for computers with Chromium client hints.
+DEVICES = {
+    "macos": {"model": "Mac", "versions": ["13.6", "14.5", "14.7.1", "15.1", "15.6", "26.0.1", "26.5.2", None], "arch": ["Intel", "Apple silicon", None],
+              "browsers": ["Chrome 141", "Chrome 152", "Edge 140", "Safari 18.6", "Firefox 143"]},
+    "windows": {"model": "Windows PC", "versions": ["10", "11", "10 or 11"], "arch": ["x86-64", "ARM", None],
+                "browsers": ["Chrome 141", "Chrome 152", "Edge 141", "Firefox 143"]},
+    "linux": {"model": "Linux computer", "versions": [None], "arch": ["x86-64", None], "browsers": ["Chrome 141", "Firefox 143", "Chrome 152"]},
+    "ios": {"model": "iPhone", "versions": ["17.6", "18.5", "18.6", "26.0", "26.1"], "arch": [None], "browsers": ["Safari 18.6", "Safari 26.0", "Chrome 141 (iOS)"]},
+    "android": {"model": "Android phone", "versions": ["13", "14", "15", "16"], "arch": [None], "browsers": ["Chrome 141", "Samsung Internet 28.0", "Firefox 143"]},
+}
+OS_NAMES = {"macos": "macOS", "windows": "Windows", "linux": "Linux", "ios": "iOS", "android": "Android"}
+
+
+def make_device(rng, family):
+    """A detected device: (MY DEVICE line, short label for answers, browser). Python twin of deviceBrief() in the former chat/device.js."""
+    d = DEVICES[family]
+    version, arch, browser = rng.choice(d["versions"]), rng.choice(d["arch"]), rng.choice(d["browsers"])
+    model = d["model"]
+    if family == "android" and rng.random() < 0.5:
+        model = rng.choice(["Pixel 8", "SM-S921B", "Pixel 9a", "moto g84"])
+    os_label = " ".join(x for x in (OS_NAMES[family], version) if x)
+    article = "an" if model[0].lower() in "aeiou" else "a"
+    on = f" on {article} {model}{f' ({arch})' if arch else ''}"
+    return f"{os_label} ({family}){on}, {browser}; detected by the browser, security settings not checked.", f"{os_label}{on}", browser
+
+
+def add_devices(rng, jobs, share):
+    """MY DEVICE on most prompts without an audit, as at runtime; the search then filters by that system, as the chat does."""
+    for job, answer, (kind, os_family) in jobs:
+        if job.get("audit") or rng.random() >= share:
+            continue
+        family = job["os"] or (None if kind == "noaudit" else rng.choice(list(DEVICES)))
+        if not family:
+            continue
+        job["os"] = family
+        job["device"], job["device_label"], _ = make_device(rng, family)
+
+
+DEVICE_QUESTIONS = ["Which system am I using?", "What device am I on?", "Which operating system do I have?",
+                    "What version of my operating system do I have?", "Can you see my device?", "What do you know about my computer?"]
+
+
+def device_jobs(rng):
+    """Questions about the device itself: say what the browser saw, and that settings need an audit."""
+    jobs = []
+    for q in DEVICE_QUESTIONS:
+        for family in ("macos", "windows", "linux", "ios", "android"):
+            line, label, browser = make_device(rng, family)
+            phone = family in ("ios", "android")
+            gold = "faq:7" if phone else "faq:3"
+            jobs.append(({"question": q, "os": family, "gold": [gold], "device": line, "device_label": label},
+                         lambda o, label=label, browser=browser, phone=phone, gold=gold: (
+                             f"This browser reports {label}, using {browser}. That is all a web page can see: it can't read security settings "
+                             "such as encryption, the firewall or the screen lock. "
+                             + ("To check those, run the phone check: open this page on the phone and tap Start the check " if phone
+                                else "To check those, run an audit with the free Devseis desktop app ") + f"{cite(o, gold)}."),
+                         ("device", family)))
+    return jobs
+
+
 def audit_brief(ev):
     """Python twin of auditBrief() in app/renderer/knowledge.js (tested for identical output)."""
     h, s = ev["host"], ev["summary"]
@@ -254,7 +316,8 @@ def main():
     parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
     parser.add_argument("--evidence", default=os.path.join(ROOT, "synthetic", "out-v0.3", "evidence.jsonl"))
     parser.add_argument("--base", default=os.path.join(ROOT, "training", "out-v0.3"), help="report-task data to include")
-    parser.add_argument("--out", default=os.path.join(ROOT, "training", "out-v0.4"))
+    parser.add_argument("--out", default=os.path.join(ROOT, "training", "out-v0.5"))
+    parser.add_argument("--device-share", type=float, default=0.6, help="share of prompts without an audit that carry MY DEVICE")
     parser.add_argument("--seed", type=int, default=11)
     args = parser.parse_args()
     rng = random.Random(args.seed)
@@ -262,6 +325,8 @@ def main():
     tools, phone = load("library", "ai_tools.json"), load("catalog", "mobile_questions.json")
     evidences = [json.loads(l) for l in open(args.evidence)][:600]
     jobs = make_jobs(rng, catalog, guidance, controls, tools, phone, evidences)
+    add_devices(rng, jobs, args.device_share)
+    jobs += device_jobs(rng)
     # A few examples carry an earlier, unrelated turn so the model learns to answer the latest question.
     for job, _, _ in jobs:
         job["shuffle"] = rng.random() < 0.5
@@ -270,7 +335,11 @@ def main():
     built = [json.loads(l) for l in proc.stdout.splitlines() if l.strip()]
     examples, bad = [], 0
     for (job, answer, (kind, os_family)), b in zip(jobs, built):
-        msgs = b["messages"] + [{"role": "assistant", "content": answer(b["order"])}]
+        text = answer(b["order"])
+        if kind == "noaudit" and job.get("device"):
+            text = text.replace("I can't see your device from here, so I can't tell you yet.",
+                                f"I can see this is {job['device_label']}, but a web page can't read its security settings, so I can't tell you yet.")
+        msgs = b["messages"] + [{"role": "assistant", "content": text}]
         ex = {"messages": msgs, "meta": {"task": "chat", "os": os_family, "status": kind, "dataset_version": DATASET_VERSION}}
         if check_chat(ex):
             bad += 1