-
Notifications
You must be signed in to change notification settings - Fork 1
TUI Dashboard
The TUI (Terminal User Interface) dashboard provides real-time monitoring of LABYRINTH environments directly in the terminal. Built with Bubbletea v2 and Lipgloss v2.
labyrinth tui # Default
labyrinth tui --notify # Enable desktop notifications
labyrinth tui --webhook https://hooks... # Send alerts to Slack/Discord
labyrinth tui --env my-env # Target specific environment| Flag | Description |
|---|---|
--notify |
Enable desktop notifications for new sessions and key events |
--webhook |
Webhook URL for Slack/Discord alert integration |
--env |
Target a specific registered environment by name |
The TUI header displays key status information at a glance:
LABYRINTH [LIVE] [L4:PASSIVE] ◆ Sessions: 3 ◆ Prompts: 7 ◆ Events: 142
| Element | Description |
|---|---|
LABYRINTH |
Application title |
[LIVE] / [FILES] / [NO DATA]
|
Current data source indicator |
[L4:MODE] |
Current L4 PUPPETEER mode badge (color-coded) |
| Stats | Active sessions, captured prompts, total events |
| Mode | Color | Meaning |
|---|---|---|
PASSIVE |
Gray | Observing only |
NEUTRALIZE |
Green | Agent defanged |
DOUBLE_AGENT |
Red | Active deception |
COUNTER_INTEL |
Yellow | Building intel reports |
Press m to cycle through L4 modes at any time.
The dashboard has 5 tabs, accessible via number keys or Tab/Shift+Tab:
Displays high-level environment information:
- Environment card — name, type (test/production), mode (docker-compose), health status
- Stats cards — active sessions, captured prompts, total events
- Service table — all LABYRINTH services with status and port mappings:
| Service | Container | Port |
|---|---|---|
| SSH Portal Trap | labyrinth-ssh | 22:22 |
| HTTP Portal Trap | labyrinth-http | 8080:80 |
| Orchestrator | labyrinth-orchestrator | — |
| MITM Proxy | labyrinth-proxy | — |
| Dashboard | labyrinth-dashboard | 9000:9000 |
- Scrollable list of active and recent sessions
- Selecting a session shows its last event in a detail panel
- Displays session ID, event count, and parsed timestamp
Visual status display for all 5 layers with dynamic status indicators:
┌───────────────────────────────────────────────┐
│ ● L0: BEDROCK [active] │
│ Encryption: AES-256-GCM | Network isolation │
└───────────────────────────────────────────────┘
│
▼
┌───────────────────────────────────────────────┐
│ ● L1: THRESHOLD [active] │
│ SSH portal trap (:22) | HTTP portal trap │
└───────────────────────────────────────────────┘
│
▼
┌───────────────────────────────────────────────┐
│ ● L2: MINOTAUR [awaiting] │
│ Awaiting session escalation │
└───────────────────────────────────────────────┘
│
▼
┌───────────────────────────────────────────────┐
│ ● L3: BLINDFOLD [awaiting] │
│ Awaiting depth >= 3 | + L4 proxy on activation│
└───────────────────────────────────────────────┘
│
▼
┌───────────────────────────────────────────────┐
│ ● L4: INTERCEPT [awaiting] │
│ Mode: passive | [m] to cycle | Prompt logging │
└───────────────────────────────────────────────┘
Status indicators:
-
Green
●[active]— Layer is running -
Orange
●[awaiting]— Session-dependent layer waiting for trigger (L2-L4) -
Dim
○[standby]— Not yet active
L3 and L4 activate together — when L3 fires, L4 proxy routing is injected automatically.
The L4 layer detail line shows the current mode and can be cycled with m.
Captured intelligence display with three sections:
Summary stats — Prompts captured, active sessions, total events, auth attempts
Event Type Breakdown — Horizontal bar chart showing the distribution of event types across all sessions (top 8 by count)
Captured AI System Prompts — Latest intercepted system prompts with domain and timestamp:
▸ api.openai.com 2026-02-28T14:41:55Z
You are an autonomous penetration testing agent...
L4 Intelligence Reports — Per-session intelligence summaries from L4 interception:
▸ sk-proj-abcd...wxyz (openai_project) 15 intercepts
models: gpt-4o | 12 tools | org: org-abc123 | sdk: openai-python/1.40.0
Shows API keys (truncated), key types, model usage, tool counts, organization IDs, and SDK fingerprints.
- Live event log from all sessions
- Columns: timestamp, layer, session ID, event count
- Auto-refreshes with data polling
| Key | Action |
|---|---|
Tab / Shift+Tab
|
Cycle tabs forward/backward |
1-5
|
Jump directly to tab |
j / ↓
|
Navigate down in lists |
k / ↑
|
Navigate up in lists |
m |
Cycle L4 PUPPETEER mode (passive → neutralize → double_agent → counter_intel) |
r |
Force refresh data |
q / Ctrl+C
|
Quit |
The TUI header displays the current data source:
| Indicator | Source | Description |
|---|---|---|
[LIVE] |
Dashboard API | Polling localhost:9000/api/stats every 2 seconds |
[FILES] |
Forensic files | Reading JSONL directly from /var/labyrinth/forensics/
|
[NO DATA] |
None | No environment deployed; shows setup instructions |
Fallback order: Dashboard API → Forensic files → No data message
The web dashboard at http://localhost:9000 provides browser-based monitoring with the same data as the TUI.
The web dashboard header includes:
- L4 mode dropdown — Select the active L4 PUPPETEER mode from a dropdown
- L4 mode badge — Color-coded badge showing the current mode (same colors as TUI)
- Mode changes take effect immediately (no page refresh needed)
- The badge auto-refreshes every 10 seconds
The dropdown in the web dashboard header allows switching between all four L4 modes:
| Mode | Badge Color | Effect |
|---|---|---|
| Passive | Gray | Intelligence harvesting only |
| Neutralize | Green | Replace prompt with benign |
| Double Agent | Red | Feed false results |
| Counter Intel | Gold | Passive + structured reports |
Changes are sent via POST /api/l4/mode and picked up by the interceptor on the next request.
The TUI uses a hacker-aesthetic color palette:
| Element | Color |
|---|---|
| Active elements | Green (#00ff88) |
| Info / headers | Cyan |
| Alerts / errors | Red |
| Layer 4 events | Purple |
| Warnings / counter_intel | Yellow |
| Cards / borders | Dark gray |
| L4 badges | Mode-specific (see above) |
- Layer-4-PUPPETEER — L4 mode details and intelligence harvesting
- Forensics-and-API — API endpoints consumed by the dashboard
-
CLI-Reference —
labyrinth tuicommand options - Configuration — Dashboard configuration
Getting Started
Architecture
Layers
Operations