diff --git a/.claude/settings.json b/.claude/settings.json
index dec0ed4c..e11a8b41 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -1,5 +1,6 @@
 {
   "enabledPlugins": {
-    "test-automation": true
+    "test-automation": true,
+    "doc-enforcement": true
   }
 }
diff --git a/.launcher-config.template.yaml b/.launcher-config.template.yaml
new file mode 100644
index 00000000..53865fed
--- /dev/null
+++ b/.launcher-config.template.yaml
@@ -0,0 +1,43 @@
+# Launcher Configuration Template
+# Copy this to your project root as .launcher-config.yaml
+
+project:
+  name: myproject              # Internal project name (lowercase, no spaces)
+  display_name: My Project     # Human-readable name shown in UI
+
+prerequisites:
+  required:
+    - docker
+    - git
+  optional:
+    - python
+    - uv
+
+setup:
+  command: ./setup.sh          # Command to run when setting up the project
+  env_vars:
+    - PROJECT_ROOT
+    - WORKTREE_PATH
+
+infrastructure:
+  compose_file: docker-compose.yml  # Path to compose file for shared infrastructure
+  project_name: myproject-infra     # Docker compose project name
+  profile: default                  # Optional: compose profile to use
+
+containers:
+  naming_pattern: "{env_name}-{service}"  # How containers are named
+  primary_service: backend              # Main service to health-check
+  health_endpoint: /health              # Health check endpoint
+  tailscale_project_prefix: myproject   # Optional: Tailscale prefix
+
+ports:
+  allocation_strategy: offset     # or: fixed
+  base_port: 8000                # Starting port for services
+  offset:
+    min: 0
+    max: 100
+    step: 10
+
+worktrees:
+  default_parent: ../worktrees/{project_name}  # Where worktrees are created
+  branch_prefix: env/                          # Optional prefix for environment branches
diff --git a/.launcher-config.yaml b/.launcher-config.yaml
new file mode 100644
index 00000000..a2c50000
--- /dev/null
+++ b/.launcher-config.yaml
@@ -0,0 +1,80 @@
+# Ushadow Launcher Configuration
+# This file defines how the launcher manages environments for this project
+
+project:
+  name: "ushadow"
+  display_name: "Ushadow"
+
+# Prerequisites required for this project
+prerequisites:
+  required:
+    - docker
+    - git
+    - python3
+  optional:
+    - tailscale
+    - uv
+
+# Environment setup configuration
+setup:
+  # Command to run when creating a new environment
+  # Available variables: {ENV_NAME}, {PORT_OFFSET}, {WORKING_DIR}
+  command: "uv run --with pyyaml setup/run.py --dev --quick --skip-admin"
+
+  # Environment variables passed during setup
+  env_vars:
+    - ENV_NAME
+    - PORT_OFFSET
+    - USHADOW_NO_BROWSER=1
+
+# Docker infrastructure configuration (shared services)
+infrastructure:
+  # Path to infrastructure compose file (relative to project root)
+  compose_file: "compose/docker-compose.infra.yml"
+
+  # Docker Compose project name for infrastructure
+  project_name: "infra"
+
+  # Profile to use when starting infrastructure (optional)
+  profile: "infra"
+
+# Container naming and discovery
+containers:
+  # Naming pattern for environment containers
+  # Variables: {project_name}, {env_name}, {service_name}
+  # Note: {env_name} will be empty for "default" environment
+  naming_pattern: "{project_name}{env_name}-{service_name}"
+
+  # Primary service that exposes the main application port
+  # This service's port is used to calculate other service ports
+  primary_service: "backend"
+
+  # Health check endpoint (relative to primary service)
+  health_endpoint: "/api/unodes/leader/info"
+
+  # Optional: Project prefix for Tailscale hostnames (for multi-project setups)
+  # If not set, Tailscale URLs will be: https://{env}.{tailnet}
+  # If set to "ushadow", URLs will be: https://ushadow-{env}.{tailnet}
+  # tailscale_project_prefix: "ushadow"
+
+# Port management
+ports:
+  # Strategy: "hash" (deterministic from env name) | "sequential" | "random"
+  allocation_strategy: "hash"
+
+  # Base port for primary service (default environment)
+  base_port: 8000
+
+  # Port offset configuration (for hash-based allocation)
+  offset:
+    min: 0
+    max: 500
+    step: 10  # Offsets are multiples of 10: 0, 10, 20, 30...
+
+# Worktree configuration
+worktrees:
+  # Default parent directory for worktrees (expandable via ~)
+  default_parent: "~/repos/worktrees/{project_name}"
+
+  # Optional prefix for branch names (e.g., "env/" creates "env/staging")
+  branch_prefix: ""
diff --git a/.workmux.yaml b/.workmux.yaml
index 17d84c34..223f0483 100644
--- a/.workmux.yaml
+++ b/.workmux.yaml
@@ -53,8 +53,6 @@ panes:
   # Main pane - ready for commands or agent interaction
   - command: "echo '🚀 Ushadow Environment: $(basename $(pwd))' && echo '' && echo 'Quick commands:' && echo '  ./dev.sh    - Start in dev mode' && echo '  ./go.sh     - Start in prod mode' && echo '  make test   - Run tests' && echo '  code .      - Open in VSCode' && echo '' && $SHELL"
     focus: true
-    split: horizontal
-    size: 75%
 
 # Agent status icons (shown in tmux status bar)
 status_icons:
diff --git a/ENV_CONFIG_GUIDE.md b/ENV_CONFIG_GUIDE.md
new file mode 100644
index 00000000..628f00fb
--- /dev/null
+++ b/ENV_CONFIG_GUIDE.md
@@ -0,0 +1,135 @@
+# Environment Configuration System
+
+## Overview
+
+The launcher now supports comprehensive environment configuration including:
+- Custom startup commands per project
+- Automatic port detection and allocation
+- Multi-environment support with port offsetting
+- Database and service port management
+
+## How It Works
+
+### 1. Project Configuration (`.launcher-config.yaml`)
+
+Each project can have a configuration file that defines:
+
+```yaml
+project:
+  name: myproject
+  display_name: My Project
+
+setup:
+  command: ./go.sh            # Command to start an environment
+  env_vars:                   # Vars to inject
+    - PROJECT_ROOT
+    - WORKTREE_PATH
+    - PORT_OFFSET             # Auto-calculated offset
+
+ports:
+  allocation_strategy: offset  # or: fixed
+  base_port: 8000
+  offset:
+    min: 0
+    max: 100
+    step: 10                   # Each env gets ports +10 from previous
+```
+
+### 2. Port Detection
+
+The launcher scans `.env.template` or `.env.example` to detect:
+- Port variables (e.g., `BACKEND_PORT`, `WEBUI_PORT`)
+- Database ports (e.g., `POSTGRES_PORT`, `REDIS_PORT`)
+- Default values
+
+**Example `.env.template`:**
+```bash
+BACKEND_PORT=8000
+WEBUI_PORT=3000
+POSTGRES_PORT=5432
+REDIS_PORT=6379
+```
+
+### 3. Port Allocation
+
+When creating environments, ports are automatically offset:
+
+**Environment 1 (offset=0):**
+- BACKEND_PORT=8000
+- WEBUI_PORT=3000
+- POSTGRES_PORT=5432
+
+**Environment 2 (offset=10):**
+- BACKEND_PORT=8010
+- WEBUI_PORT=3010
+- POSTGRES_PORT=5442
+
+**Environment 3 (offset=20):**
+- BACKEND_PORT=8020
+- WEBUI_PORT=3020
+- POSTGRES_PORT=5452
+
+### 4. Environment Startup
+
+When you create or start an environment:
+1. Launcher calculates the port offset
+2. Injects environment variables:
+   ```bash
+   PROJECT_ROOT=/Users/you/repos/myproject
+   WORKTREE_PATH=/Users/you/repos/worktrees/myproject/dev
+   PORT_OFFSET=10
+   ```
+3. Runs the startup command (e.g., `./go.sh`)
+4. Your startup script reads PORT_OFFSET and adjusts ports accordingly
+
+## Startup Script Pattern
+
+Your `go.sh` or startup script should use the PORT_OFFSET:
+
+```bash
+#!/bin/bash
+
+# Get port offset from environment (default to 0)
+OFFSET=${PORT_OFFSET:-0}
+
+# Calculate actual ports
+export BACKEND_PORT=$((8000 + OFFSET))
+export WEBUI_PORT=$((3000 + OFFSET))
+export POSTGRES_PORT=$((5432 + OFFSET))
+export REDIS_PORT=$((6379 + OFFSET))
+
+# Load base .env if it exists
+if [ -f .env.template ]; then
+  source .env.template
+fi
+
+# Override with offset ports
+cat > .env.local <<EOF
+BACKEND_PORT=${BACKEND_PORT}
+WEBUI_PORT=${WEBUI_PORT}
+POSTGRES_PORT=${POSTGRES_PORT}
+REDIS_PORT=${REDIS_PORT}
+EOF
+
+# Start services
+docker compose --env-file .env.local up -d
+```
+
+## Configuration UI
+
+Access the configuration editor:
+1. Enable Multi-Project Mode in settings
+2. Go to Install tab
+3. Add or select a project
+4. Click "Configure" or "Edit Config"
+5. Set startup command and port strategy
+6. Click "Scan .env files" to auto-detect ports
+
+## Next Steps
+
+- [ ] Add TypeScript interface for DetectedPort
+- [ ] Wire up ProjectConfigEditor in ProjectsPanel
+- [ ] Implement config save/load commands
+- [ ] Auto-calculate PORT_OFFSET when creating environments
+- [ ] Inject env vars when running startup commands
+- [ ] Add UI to show port allocations for each environment
diff --git a/KANBAN_INTEGRATION.md b/KANBAN_INTEGRATION.md
new file mode 100644
index 00000000..19c7c8da
--- /dev/null
+++ b/KANBAN_INTEGRATION.md
@@ -0,0 +1,377 @@
+# Kanban + Tmux Integration
+
+This document describes the integrated kanban ticket system that links with the launcher's tmux and worktree management.
+
+## Overview
+
+The kanban system provides:
+- **Ticket Management**: Create, track, and organize development tasks
+- **Epic Grouping**: Group related tickets with shared branches and color teams
+- **Tmux Integration**: Each ticket automatically gets its own tmux window
+- **Context Sharing**: Tickets with matching tags or in the same epic share context
+- **Shared Branches**: Multiple tickets can collaborate on a single branch
+
+## Architecture
+
+### Backend (Python/FastAPI)
+
+**Models** (`ushadow/backend/src/models/kanban.py`):
+- `Epic`: Groups related tickets with shared branch and color
+- `Ticket`: Individual work items with 1:1 tmux window mapping
+- `TicketStatus`: Enum for workflow states (backlog, todo, in_progress, in_review, done, archived)
+- `TicketPriority`: Enum for urgency levels (low, medium, high, urgent)
+
+**API Router** (`ushadow/backend/src/routers/kanban.py`):
+- `POST /api/kanban/epics` - Create epic
+- `GET /api/kanban/epics` - List epics (with optional project filter)
+- `GET /api/kanban/epics/{id}` - Get epic details
+- `PATCH /api/kanban/epics/{id}` - Update epic
+- `DELETE /api/kanban/epics/{id}` - Delete epic (unlinks tickets)
+- `POST /api/kanban/tickets` - Create ticket
+- `GET /api/kanban/tickets` - List tickets (filters: project, epic, status, tags, assigned_to)
+- `GET /api/kanban/tickets/{id}` - Get ticket details
+- `PATCH /api/kanban/tickets/{id}` - Update ticket
+- `DELETE /api/kanban/tickets/{id}` - Delete ticket
+- `GET /api/kanban/tickets/{id}/related` - Find related tickets (epic + tags)
+- `GET /api/kanban/stats` - Board statistics
+
+### Launcher Backend (Rust/Tauri)
+
+**Tmux Integration** (`ushadow/launcher/src-tauri/src/commands/kanban.rs`):
+- `create_ticket_worktree()` - Create worktree and tmux window for ticket
+- `attach_ticket_to_worktree()` - Attach ticket to existing worktree (for shared branches)
+- `get_tickets_for_tmux_window()` - Query tickets using a tmux window
+- `get_ticket_tmux_info()` - Get tmux details for a ticket
+
+**How It Works**:
+1. When creating a ticket with epic → checks if epic has shared branch
+2. If shared branch exists → attach to existing worktree
+3. If no shared branch → create new worktree with `create_worktree_with_workmux`
+4. Tmux window naming: `ushadow-{branch_name}` or `ushadow-ticket-{id}`
+5. Session name: `workmux` (default)
+
+### Frontend (React/TypeScript)
+
+**Components** (`ushadow/launcher/src/components/`):
+- `KanbanBoard.tsx` - Main board with column layout
+- `TicketCard.tsx` - Individual ticket card with color team visualization
+- `CreateTicketDialog.tsx` - Modal for creating new tickets
+- `CreateEpicDialog.tsx` - Modal for creating new epics
+
+**Navigation**:
+- Added "Kanban" tab to launcher navigation (Install | Infra | Environments | **Kanban**)
+- Full-screen kanban view when activated
+- Automatically uses first running environment's backend URL
+
+**Color Teams**:
+Tickets inherit colors through three-level fallback:
+1. Ticket's own color (if set)
+2. Epic's color (if ticket belongs to epic)
+3. Generated color (hash-based from ticket ID)
+
+## Workflow Examples
+
+### Creating an Epic with Shared Branch
+
+```bash
+# 1. Create epic via API or UI
+POST /api/kanban/epics
+{
+  "title": "Authentication Overhaul",
+  "color": "#8B5CF6",
+  "base_branch": "main",
+  "project_id": "/path/to/project"
+}
+
+# Epic gets created with no branch yet (branch_name: null)
+# When first ticket is created, shared branch gets created
+```
+
+### Creating Tickets in an Epic
+
+```bash
+# 2. Create first ticket
+POST /api/kanban/tickets
+{
+  "title": "Add JWT token validation",
+  "epic_id": "epic-id-here",
+  "priority": "high"
+}
+
+# Launcher creates worktree for this ticket:
+# - Branch: "epic-auth-overhaul" (derived from epic title)
+# - Tmux window: "ushadow-epic-auth-overhaul"
+
+# 3. Create second ticket in same epic
+POST /api/kanban/tickets
+{
+  "title": "Add refresh token rotation",
+  "epic_id": "epic-id-here",
+  "priority": "medium"
+}
+
+# Launcher attaches to existing worktree:
+# - Same branch: "epic-auth-overhaul"
+# - Same tmux window: "ushadow-epic-auth-overhaul"
+# Both tickets share context!
+```
+
+### Tag-Based Context Sharing
+
+```bash
+# Tickets with matching tags can find each other even across epics
+POST /api/kanban/tickets
+{
+  "title": "Update login API",
+  "tags": ["api", "auth"],
+  "epic_id": "epic-1"
+}
+
+POST /api/kanban/tickets
+{
+  "title": "Add API rate limiting",
+  "tags": ["api", "security"],
+  "epic_id": "epic-2"  # Different epic!
+}
+
+# Find related tickets
+GET /api/kanban/tickets/ticket-1-id/related
+# Returns both epic tickets AND tickets with shared tags
+```
+
+## Configuration
+
+### Backend Setup
+
+1. **Database**: MongoDB (Beanie ODM)
+   - Collections: `tickets`, `epics`
+   - Indexes: status, epic_id, project_id, tags, assigned_to
+
+2. **Registration**: Already added to `main.py`
+   ```python
+   from src.models.kanban import Ticket, Epic
+   from src.routers import kanban
+
+   await init_beanie(database=db, document_models=[User, Ticket, Epic])
+   app.include_router(kanban.router, tags=["kanban"])
+   ```
+
+### Frontend Setup
+
+1. **App Store**: Added `'kanban'` to `AppMode` type in `store/appStore.ts`
+
+2. **Navigation**: Added kanban tab to `App.tsx`
+   ```tsx
+   <button onClick={() => setAppMode('kanban')}>
+     <Trello className="w-3 h-3 inline mr-1" />
+     Kanban
+   </button>
+   ```
+
+3. **Rendering**: Kanban board renders when `appMode === 'kanban'`
+
+## Key Design Decisions
+
+### 1. Simple 1:1 Ticket-Tmux Mapping
+Each ticket = exactly one tmux window. This keeps the mental model simple.
+
+**Alternative considered**: One ticket = multiple windows (frontend, backend, tests)
+**Why rejected**: Added complexity without clear benefit for most workflows
+
+### 2. Epic + Tag Based Context Sharing
+Enables both structured (epic) and ad-hoc (tag) relationships.
+
+**Structured (Epic)**: "All auth tickets share same branch"
+**Ad-hoc (Tags)**: "All tickets tagged 'api' can see each other"
+
+### 3. Shared Branches for Epic Tickets
+Tickets in the same epic use one shared branch.
+
+**Alternative considered**: One branch per ticket with merging
+**Why rejected**: Sharing context across tickets is the explicit goal
+
+### 4. Standalone Kanban (No External Dependency)
+Built directly into launcher, no vibe-kanban required.
+
+**Alternative considered**: Two-way sync with vibe-kanban
+**Why rejected**: Simpler architecture, fewer moving parts
+
+## Color Team System
+
+Color inheritance creates visual organization:
+
+```
+Epic: "Authentication" (Purple #8B5CF6)
+  ├─ Ticket 1: "JWT validation" (inherits purple)
+  ├─ Ticket 2: "Refresh tokens" (inherits purple)
+  └─ Ticket 3: "OAuth flow" (overrides with orange)
+
+Epic: "Database" (Green #10B981)
+  ├─ Ticket 4: "Add indexes" (inherits green)
+  └─ Ticket 5: "Migration" (inherits green)
+```
+
+Visual indicators:
+- **Ticket card border**: 4px left border in team color
+- **Epic badge**: Badge with epic color at 20% opacity
+- **Generated colors**: Hash-based HSL when no color set
+
+## Next Steps / TODOs
+
+### Immediate
+- [ ] Add "Create Ticket from Environment" button to EnvironmentsPanel
+  - **Decision needed**: Where to place button? (card action, context menu, or details panel)
+  - See `KANBAN_INTEGRATION.md` for options
+
+### Enhancements
+- [ ] Drag-and-drop to change ticket status
+- [ ] Ticket detail modal with full description + comments
+- [ ] Assign tickets to users (already has `assigned_to` field)
+- [ ] Epic progress visualization (% tickets complete)
+- [ ] Timeline view (Gantt chart style)
+- [ ] Sprint planning mode
+- [ ] Ticket time tracking integration with tmux activity
+
+### Integration Opportunities
+- [ ] Auto-create ticket when running `/commit` in tmux
+- [ ] Show active ticket in launcher status bar
+- [ ] Link tickets to PRs via GitHub integration
+- [ ] Chronicle integration (link tickets to memories)
+- [ ] Notification when ticket's tmux window becomes inactive
+
+## Testing
+
+### Backend API Testing
+```bash
+# Start backend
+cd ushadow/backend
+uv run main.py
+
+# Create epic
+curl -X POST http://localhost:8000/api/kanban/epics \
+  -H "Content-Type: application/json" \
+  -d '{"title": "Test Epic", "color": "#3B82F6", "base_branch": "main"}'
+
+# Create ticket
+curl -X POST http://localhost:8000/api/kanban/tickets \
+  -H "Content-Type: application/json" \
+  -d '{"title": "Test Ticket", "priority": "medium", "tags": ["test"]}'
+
+# List tickets
+curl http://localhost:8000/api/kanban/tickets
+```
+
+### Frontend Testing
+```bash
+# Start launcher
+cd ushadow/launcher
+npm run dev
+
+# Navigate to Kanban tab
+# Should see empty kanban board
+# Click "New Epic" or "New Ticket" to create items
+```
+
+### Tmux Integration Testing
+```bash
+# From launcher, create ticket via UI
+# Check tmux window created
+tmux list-windows -t workmux
+
+# Should see: ushadow-{branch-name}
+```
+
+## Architecture Diagram
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                    Vibe Launcher (Tauri)                 │
+├─────────────────────────────────────────────────────────┤
+│  Navigation: [Install] [Infra] [Environments] [Kanban]  │
+├─────────────────────────────────────────────────────────┤
+│                                                          │
+│  ┌────────────────────────────────────────────────┐    │
+│  │          KanbanBoard Component                  │    │
+│  │  ┌──────┬──────┬──────┬──────┬──────┐         │    │
+│  │  │Back- │ To   │ In   │ In   │ Done │         │    │
+│  │  │log   │ Do   │Prog  │Review│      │         │    │
+│  │  ├──────┼──────┼──────┼──────┼──────┤         │    │
+│  │  │[Card]│[Card]│[Card]│[Card]│[Card]│         │    │
+│  │  │[Card]│[Card]│      │      │[Card]│         │    │
+│  │  │      │[Card]│      │      │      │         │    │
+│  │  └──────┴──────┴──────┴──────┴──────┘         │    │
+│  │                                                 │    │
+│  │  Epic Filter: [All Tickets ▼]                 │    │
+│  │  Actions: [New Epic] [New Ticket]             │    │
+│  └────────────────────────────────────────────────┘    │
+│                         │                               │
+│                         │ API Calls                     │
+│                         ▼                               │
+└─────────────────────────┬───────────────────────────────┘
+                          │
+                          │
+┌─────────────────────────▼───────────────────────────────┐
+│              Backend (FastAPI + MongoDB)                 │
+├─────────────────────────────────────────────────────────┤
+│  Routers:                                                │
+│    /api/kanban/tickets                                   │
+│    /api/kanban/epics                                     │
+│    /api/kanban/stats                                     │
+│                                                          │
+│  Models:                                                 │
+│    ┌──────────┐         ┌──────────┐                   │
+│    │  Epic    │         │  Ticket  │                   │
+│    │─────────│         │──────────│                   │
+│    │ title    │1      ∞│ title    │                   │
+│    │ color    │◀───────│ epic_id  │                   │
+│    │ branch   │         │ tags[]   │                   │
+│    │ base_br  │         │ status   │                   │
+│    └──────────┘         │ tmux_win │                   │
+│                         │ branch   │                   │
+│                         └──────────┘                   │
+│                              │                           │
+│                              │ Worktree Creation         │
+│                              ▼                           │
+└─────────────────────────────┬───────────────────────────┘
+                              │
+                              │
+┌─────────────────────────────▼───────────────────────────┐
+│         Tauri Commands (Rust) + Tmux                     │
+├─────────────────────────────────────────────────────────┤
+│  create_ticket_worktree()                                │
+│    ├─ git worktree add                                   │
+│    ├─ tmux new-window -n ushadow-{branch}               │
+│    └─ cd {worktree_path}                                 │
+│                                                          │
+│  attach_ticket_to_worktree()                             │
+│    └─ verify tmux window exists                         │
+│                                                          │
+│  Tmux Session: "workmux"                                 │
+│    ├─ Window: ushadow-epic-auth (3 tickets)            │
+│    ├─ Window: ushadow-ticket-123 (1 ticket)            │
+│    └─ Window: ushadow-database (2 tickets)             │
+└─────────────────────────────────────────────────────────┘
+```
+
+## Files Modified/Created
+
+### Backend
+- ✅ `ushadow/backend/src/models/kanban.py` - Data models
+- ✅ `ushadow/backend/src/routers/kanban.py` - API routes
+- ✅ `ushadow/backend/main.py` - Router registration + Beanie init
+
+### Launcher Backend
+- ✅ `ushadow/launcher/src-tauri/src/commands/kanban.rs` - Tmux integration commands
+- ✅ `ushadow/launcher/src-tauri/src/commands/mod.rs` - Module exports
+- ✅ `ushadow/launcher/src-tauri/src/main.rs` - Command registration
+
+### Frontend
+- ✅ `ushadow/launcher/src/components/KanbanBoard.tsx` - Main board
+- ✅ `ushadow/launcher/src/components/TicketCard.tsx` - Ticket cards
+- ✅ `ushadow/launcher/src/components/CreateTicketDialog.tsx` - Ticket creation modal
+- ✅ `ushadow/launcher/src/components/CreateEpicDialog.tsx` - Epic creation modal
+- ✅ `ushadow/launcher/src/store/appStore.ts` - Added 'kanban' mode
+- ✅ `ushadow/launcher/src/App.tsx` - Navigation + routing
+
+### Documentation
+- ✅ `KANBAN_INTEGRATION.md` - This file!
diff --git a/MULTI_PROJECT_GUIDE.md b/MULTI_PROJECT_GUIDE.md
new file mode 100644
index 00000000..65b97ff2
--- /dev/null
+++ b/MULTI_PROJECT_GUIDE.md
@@ -0,0 +1,93 @@
+# Multi-Project Launcher Guide
+
+## Overview
+
+The launcher now supports managing multiple projects beyond ushadow. Each project can have its own configuration, prerequisites, and infrastructure.
+
+## Quick Start
+
+### 1. Enable Multi-Project Mode
+
+1. Open launcher settings (⚙️ icon)
+2. Toggle "Multi-Project Mode" to ON
+3. Navigate to "Setup & Installation" tab
+4. You'll see the ProjectManager UI
+
+### 2. Add a Project
+
+1. Click "+ Add Project" in the ProjectManager
+2. Select your project folder (e.g., `/Users/stu/repos/chronicle`)
+3. The launcher will:
+   - Use the folder as the project root
+   - Create worktrees in `../worktrees/projectname`
+   - Look for `.launcher-config.yaml` in the project root
+
+### 3. Create Project Configuration
+
+Each project needs a `.launcher-config.yaml` in its root directory:
+
+```yaml
+project:
+  name: chronicle
+  display_name: Chronicle
+
+prerequisites:
+  required:
+    - docker
+    - git
+  optional:
+    - python
+
+setup:
+  command: ./setup.sh
+  env_vars:
+    - PROJECT_ROOT
+
+infrastructure:
+  compose_file: docker-compose.yml
+  project_name: chronicle-infra
+
+containers:
+  naming_pattern: "{env_name}-{service}"
+  primary_service: backend
+  health_endpoint: /health
+
+ports:
+  allocation_strategy: offset
+  base_port: 8000
+  offset:
+    min: 0
+    max: 100
+    step: 10
+
+worktrees:
+  default_parent: ../worktrees/chronicle
+```
+
+See `.launcher-config.template.yaml` for full documentation.
+
+## Current Limitations (To Be Fixed)
+
+1. **Prerequisites per project**: Currently uses global prerequisites. Need to load from project config.
+2. **Infrastructure per project**: Infrastructure panel doesn't yet read from project config.
+3. **Environment commands**: setup.command not yet integrated into environment creation flow.
+
+## Workaround for Now
+
+For projects like Chronicle:
+
+1. **Add the project** to get it in the list
+2. **Manually create worktrees** using git:
+   ```bash
+   cd /Users/stu/repos/chronicle
+   git worktree add ../worktrees/chronicle/dev
+   ```
+3. **Use discovery** - The launcher will discover and manage existing worktrees
+
+## Next Steps to Complete Integration
+
+- [ ] Load prerequisites from active project's config
+- [ ] Load infrastructure services from project config
+- [ ] Run setup.command when creating new environments
+- [ ] Show project-specific status in UI
+- [ ] Add config editor UI for projects without `.launcher-config.yaml`
diff --git a/REFACTORING_PLAN.md b/REFACTORING_PLAN.md
deleted file mode 100644
index a325ef70..00000000
--- a/REFACTORING_PLAN.md
+++ /dev/null
@@ -1,220 +0,0 @@
-# Refactoring Plan: Instance → ServiceConfiguration
-
-## Goal
-Rename "Instance" to "ServiceConfiguration" to better reflect that this represents a configured service (either cloud credentials or deployable service with config).
-
-## New Naming Convention
-
-| Current | New | Purpose |
-|---------|-----|---------|
-| `Template` | `Template` | Abstract service or provider definition (keep) |
-| `Instance` | `ServiceConfiguration` | Template + Config + DeploymentTarget |
-| `InstanceManager` | `ConfigurationManager` | Manages service configurations |
-| `InstanceStatus` | `ConfigurationStatus` | Status enum |
-| `InstanceConfig` | `ServiceConfig` | Configuration values |
-| `InstanceOutputs` | `ConfigurationOutputs` | Runtime outputs |
-| `InstanceCreate` | `ConfigurationCreate` | API request model |
-| `InstanceUpdate` | `ConfigurationUpdate` | API request model |
-| `InstanceSummary` | `ConfigurationSummary` | API response model |
-| `instances.yaml` | `configurations.yaml` | YAML storage file |
-
-## Status Values Semantic
-
-### Cloud Providers
-- `configured` - Has valid credentials, ready to use
-- `unconfigured` - Missing required credentials
-
-### Deployable Services (ComposeService, local providers)
-- `pending` - Created but not yet started
-- `deploying` - Currently starting
-- `running` - Running and accessible
-- `stopped` - Stopped gracefully
-- `error` - Failed to deploy or crashed
-
-## Files to Update
-
-### Backend Models (Priority 1)
-
-1. **`ushadow/backend/src/models/instance.py`** → Rename to `configuration.py`
-   - `Instance` → `ServiceConfiguration`
-   - `InstanceStatus` → `ConfigurationStatus`
-   - `InstanceConfig` → `ServiceConfig`
-   - `InstanceOutputs` → `ConfigurationOutputs`
-   - `InstanceCreate` → `ConfigurationCreate`
-   - `InstanceUpdate` → `ConfigurationUpdate`
-   - `InstanceSummary` → `ConfigurationSummary`
-   - `Wiring` stays the same
-   - Update all docstrings
-
-2. **`ushadow/backend/src/services/instance_manager.py`** → Rename to `configuration_manager.py`
-   - `InstanceManager` → `ConfigurationManager`
-   - `_instances` → `_configurations`
-   - `instances.yaml` → `configurations.yaml`
-   - All method names: `create_instance` → `create_configuration`, etc.
-   - Update all docstrings
-
-### Backend Services (Priority 1)
-
-3. **`ushadow/backend/src/services/capability_resolver.py`**
-   - Update all references to `Instance` → `ServiceConfiguration`
-   - `consumer_instance_id` → `consumer_config_id`
-   - `provider_instance` → `provider_config`
-
-4. **`ushadow/backend/src/services/deployment_manager.py`**
-   - `instance_id` parameter → `config_id`
-   - Update docstrings
-
-5. **`ushadow/backend/src/services/service_orchestrator.py`**
-   - `instance_id` parameter → `config_id`
-
-### API Routes (Priority 1)
-
-6. **`ushadow/backend/src/routers/instances.py`** → Rename to `configurations.py`
-   - Update all endpoint paths:
-     - `/api/instances` → `/api/configurations`
-     - `/api/instances/{id}` → `/api/configurations/{id}`
-   - Add backwards-compatibility aliases (optional)
-   - Update all request/response models
-   - Update docstrings
-
-7. **`ushadow/backend/src/main.py`**
-   - Update router import and include
-
-### Frontend Types (Priority 2)
-
-8. **`ushadow/frontend/src/services/api.ts`**
-   - `Instance` → `ServiceConfiguration`
-   - `InstanceSummary` → `ConfigurationSummary`
-   - `InstanceCreateRequest` → `ConfigurationCreateRequest`
-   - `instancesApi` → `configurationsApi` (or keep as `configurationsApi` but map endpoints)
-   - Update endpoint URLs
-
-### Frontend Pages (Priority 2)
-
-9. **`ushadow/frontend/src/pages/InstancesPage.tsx`** → Rename to `ConfigurationsPage.tsx`
-   - Update component name
-   - Update all variable names
-   - Update all API calls
-   - Update test IDs
-
-10. **`ushadow/frontend/src/App.tsx`**
-    - Update route import and component
-
-11. **`ushadow/frontend/src/components/wiring/WiringBoard.tsx`**
-    - Update all references to instances
-
-### Configuration Files (Priority 3)
-
-12. **`config/instances.yaml`** → Rename to `configurations.yaml`
-    - Update key: `instances:` → `configurations:`
-    - Migrate existing data
-
-13. **`config/wiring.yaml`**
-    - Update references if needed
-
-### Documentation (Priority 3)
-
-14. **Update all markdown files**
-    - `ARCHITECTURE_OVERVIEW.md`
-    - `README.md`
-    - Any other docs
-
-## Migration Strategy
-
-### Phase 1: Backend Models (Break nothing)
-1. Create new `configuration.py` alongside `instance.py`
-2. Copy all classes with new names
-3. Add type aliases in `instance.py` for backwards compatibility:
-   ```python
-   # Backwards compatibility
-   Instance = ServiceConfiguration
-   InstanceManager = ConfigurationManager
-   ```
-
-### Phase 2: Backend Services & Routes (Gradual migration)
-1. Update internal services to use new names
-2. Keep old API endpoints working with aliases
-3. Add deprecation warnings to old endpoints
-
-### Phase 3: Frontend (Coordinated update)
-1. Update API client first
-2. Update pages and components
-3. Test thoroughly
-
-### Phase 4: Cleanup (After testing)
-1. Remove backwards compatibility aliases
-2. Remove old files
-3. Rename YAML files (with data migration)
-
-## Backwards Compatibility Considerations
-
-### Option 1: Hard Break (Fast, risky)
-- Rename everything at once
-- Update all references in one PR
-- Requires coordination with frontend
-
-### Option 2: Soft Transition (Safer, slower)
-- Keep old API endpoints working
-- Add deprecation warnings
-- Gradually migrate frontend
-- Remove old code after 1-2 releases
-
-**Recommendation**: Option 2 for production, Option 1 for development branches
-
-## Testing Checklist
-
-- [ ] All backend tests pass
-- [ ] All frontend tests pass
-- [ ] API endpoints work with new names
-- [ ] YAML config loads correctly
-- [ ] Create new configuration works
-- [ ] Deploy configuration works
-- [ ] Stop configuration works
-- [ ] Delete configuration works
-- [ ] Wiring still works
-- [ ] Frontend UI displays correctly
-- [ ] No broken imports
-- [ ] Documentation updated
-
-## Rollback Plan
-
-If issues arise:
-1. Keep old model files as `instance.py`
-2. Git revert specific commits
-3. Use type aliases to minimize changes
-
-## Estimated Effort
-
-- Backend models: 1-2 hours
-- Backend services: 2-3 hours
-- API routes: 1-2 hours
-- Frontend types: 1 hour
-- Frontend pages: 2-3 hours
-- Testing: 2-3 hours
-- Documentation: 1 hour
-
-**Total: ~12-15 hours**
-
-## Next Steps
-
-1. Get approval on naming convention
-2. Choose migration strategy (hard break vs soft transition)
-3. Start with backend models (Phase 1)
-4. Test each phase before proceeding
-5. Update documentation as you go
-
----
-
-## Questions to Resolve
-
-1. **API endpoint naming**: Keep `/api/instances` with alias or change to `/api/configurations`?
-2. **YAML filename**: Migrate `instances.yaml` → `configurations.yaml` now or later?
-3. **Variable names**: `config_id` or `configuration_id`?
-4. **Backwards compatibility**: How long to keep old names?
-
-## Decision Log
-
-- [x] Use `ServiceConfiguration` instead of `Instance`
-- [x] Keep unified model (not splitting cloud/local)
-- [ ] API endpoint strategy: TBD
-- [ ] Migration timeline: TBD
diff --git a/claude.md b/claude.md
index be67204b..edfbf7c1 100644
--- a/claude.md
+++ b/claude.md
@@ -2,6 +2,15 @@
 - There may be multiple environments running simultaneously using different worktrees. To determine the corren environment, you can get port numbers and env name from the root .env file.
 - When refactoring module names, run `grep -r "old_module_name" .` before committing to catch all remaining references (especially entry points like `main.py`). Use `__init__.py` re-exports for backward compatibility.
 
+## Doc Enforcement Plugin
+
+The `doc-enforcement` plugin (enabled in `.claude/settings.json`) enforces that AI agents read the quick reference documentation before modifying code:
+
+- **Backend files**: Must read `ushadow/backend/BACKEND_QUICK_REF.md` before editing Python code
+- **Frontend files**: Must read `ushadow/frontend/AGENT_QUICK_REF.md` before editing React/TypeScript code
+
+The plugin uses PreToolUse hooks to validate documentation has been read. If not, it blocks the edit with a clear message directing to read the docs first. This prevents code duplication and ensures architectural patterns are followed.
+
 ## Backend Development Workflow
 
 **BEFORE writing ANY backend code, follow this workflow:**
diff --git a/compose/backend.yml b/compose/backend.yml
index ad34cf25..c5a86c98 100644
--- a/compose/backend.yml
+++ b/compose/backend.yml
@@ -31,7 +31,7 @@ services:
       # Config directory location
       - CONFIG_DIR=/config
       - MONGODB_DATABASE=${MONGODB_DATABASE:-ushadow}
-      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173,http://localhost:3000,http://localhost:${WEBUI_PORT}}
+      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173,http://localhost:3000,http://localhost:1421,http://localhost:${WEBUI_PORT:-3000}}
       # Rich console width for logging (prevents log wrapping)
       - COLUMNS=200
       # Database configuration
@@ -48,7 +48,7 @@ services:
       - KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID:-ushadow-frontend}
       - KEYCLOAK_CLIENT_SECRET=${KEYCLOAK_CLIENT_SECRET:-}
       - KEYCLOAK_ADMIN=${KEYCLOAK_ADMIN:-admin}
-      - KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD:-changeme}
+      - KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD:-admin}
     volumes:
       - ../ushadow/backend:/app
       - ../config:/config  # Mount config directory (read-write for feature flags)
diff --git a/compose/docker-compose.infra.yml b/compose/docker-compose.infra.yml
index 481cc43b..33698189 100644
--- a/compose/docker-compose.infra.yml
+++ b/compose/docker-compose.infra.yml
@@ -159,7 +159,6 @@ services:
       - KC_DB_USERNAME=${POSTGRES_USER:-ushadow}
       - KC_DB_PASSWORD=${POSTGRES_PASSWORD:-ushadow}
       - KC_HOSTNAME_STRICT=false
-      - KC_HOSTNAME_STRICT_HTTPS=false
       - KC_HTTP_ENABLED=true
       - KC_HEALTH_ENABLED=true
     volumes:
diff --git a/compose/openmemory-compose.yaml b/compose/openmemory-compose.yaml
index 0a4e5634..70beb997 100644
--- a/compose/openmemory-compose.yaml
+++ b/compose/openmemory-compose.yaml
@@ -52,7 +52,9 @@ services:
     volumes:
       - mem0_data:/app/data
     networks:
-      - ushadow-network
+      ushadow-network:
+        aliases:
+          - mem0  # Allow other containers to reach via http://mem0:8765
     healthcheck:
       test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8765/api/v1/config/'); exit(0)"]
       interval: 10s
diff --git a/compose/ushadow-compose.yaml b/compose/ushadow-compose.yaml
index 922fbbb9..8909d98d 100644
--- a/compose/ushadow-compose.yaml
+++ b/compose/ushadow-compose.yaml
@@ -72,7 +72,7 @@ services:
     # Service management is handled via kubectl to the K8s API
 
     networks:
-      - infra-network
+      - ushadow-network
 
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
@@ -94,12 +94,12 @@ services:
     ports:
       - "3000:80"
     environment:
-      - VITE_BACKEND_URL=${VITE_BACKEND_URL:-http://ushadow-backend.ushadow.svc.cluster.local:8000}
+      # - VITE_BACKEND_URL=${VITE_BACKEND_URL:-http://ushadow-backend.ushadow.svc.cluster.local:8000}
       - VITE_ENV_NAME=${VITE_ENV_NAME:-k8s}
       # BACKEND_HOST for nginx proxy (K8s service name)
       - BACKEND_HOST=${BACKEND_HOST:-ushadow-backend}
     networks:
-      - infra-network
+      - ushadow-network
     depends_on:
       - ushadow-backend
     restart: unless-stopped
@@ -116,5 +116,8 @@ volumes:
 
 networks:
   infra-network:
-    name: infra-network
+    name: ushadow-network
+    external: true
+  ushadow-network:
+    name: ushadow-network
     external: true
diff --git a/config/config.defaults.yaml b/config/config.defaults.yaml
index 5655b596..f6c95818 100644
--- a/config/config.defaults.yaml
+++ b/config/config.defaults.yaml
@@ -87,7 +87,7 @@ network:
 # Security Configuration
 security:
   # Merges CORS_ORIGINS env var with defaults (deduplicates)
-  cors_origins: ${merge_csv:${oc.env:CORS_ORIGINS},http://localhost:5173,http://localhost:3000,http://127.0.0.1:5173,http://127.0.0.1:3000}
+  cors_origins: ${merge_csv:${oc.env:CORS_ORIGINS},http://localhost:5173,http://localhost:3000,http://localhost:1421,http://127.0.0.1:5173,http://127.0.0.1:3000}
 
 # Infrastructure Services
 infrastructure:
@@ -104,6 +104,9 @@ infrastructure:
 
   ollama_base_url: http://ollama:11434
   openai_base_url: https://api.openai.com/v1
+  # DEPRECATED: This default is for local dev only. The backend should dynamically
+  # set this to the internal proxy URL when starting Chronicle.
+  # TODO: Remove this once backend sets MEMORY_SERVER_URL dynamically
   memory_server_url: http://mem0:8765
 
 # Miscellaneous Settings
diff --git a/config/defaults.yml b/config/defaults.yml
index 46ce632b..4fa1a3df 100644
--- a/config/defaults.yml
+++ b/config/defaults.yml
@@ -174,9 +174,9 @@ models:
         interim_type: Results
         final_type: Results
         extract:
-            text: results.channels[0].alternatives[0].transcript
-            words: results.channels[0].alternatives[0].words
-            segments: results.utterances
+          text: channel.alternatives[0].transcript
+          words: channel.alternatives[0].words
+          segments: channel.alternatives[0].paragraphs.paragraphs
 
   - name: stt-parakeet-stream
     description: Parakeet streaming transcription over WebSocket
@@ -229,7 +229,7 @@ models:
 # Memory Configuration
 # ===========================
 memory:
-  provider: chronicle
+  provider: openmemory_mcp
   timeout_seconds: 1200
   extraction:
     enabled: true
@@ -240,7 +240,7 @@ memory:
 
   # OpenMemory MCP provider settings (used when provider: openmemory_mcp)
   openmemory_mcp:
-    server_url: http://localhost:8765
+    server_url:  ${oc.env:MEMORY_SERVER_URL,'http://localhost:8765'}
     client_name: chronicle
     user_id: default
     timeout: 30
diff --git a/config/keycloak/realm-export.json b/config/keycloak/realm-export.json
index 0e158ee5..71fe59df 100644
--- a/config/keycloak/realm-export.json
+++ b/config/keycloak/realm-export.json
@@ -36,6 +36,14 @@
   "actionTokenGeneratedByUserLifespan": 300,
   "oauth2DeviceCodeLifespan": 600,
   "oauth2DevicePollingInterval": 5,
+  "browserSecurityHeaders": {
+    "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self' http: https: tauri:; object-src 'none';",
+    "xContentTypeOptions": "nosniff",
+    "xRobotsTag": "none",
+    "xFrameOptions": "",
+    "xXSSProtection": "1; mode=block",
+    "strictTransportSecurity": "max-age=31536000; includeSubDomains"
+  },
   "clientScopes": [
     {
       "name": "openid",
@@ -165,11 +173,13 @@
       "fullScopeAllowed": true,
       "redirectUris": [
         "http://localhost:3000/oauth/callback",
-        "http://localhost:*/oauth/callback"
+        "http://localhost:*/oauth/callback",
+        "tauri://oauth-callback"
       ],
       "webOrigins": [
         "http://localhost:3000",
-        "http://localhost:*"
+        "http://localhost:*",
+        "tauri://localhost"
       ],
       "attributes": {
         "pkce.code.challenge.method": "S256",
diff --git a/config/tailscale copy.yaml b/config/tailscale copy.yaml
deleted file mode 100644
index ac0e6d60..00000000
--- a/config/tailscale copy.yaml	
+++ /dev/null
@@ -1,12 +0,0 @@
-backend_port: 8000
-deployment_mode:
-  environment: dev
-  mode: single
-environments:
-- dev
-- test
-- prod
-frontend_port: 3000
-hostname: gold.spangled-kettle.ts.net
-https_enabled: true
-use_caddy_proxy: false
diff --git a/config/tailscale-serve.json b/config/tailscale-serve.json
new file mode 100644
index 00000000..7463ba25
--- /dev/null
+++ b/config/tailscale-serve.json
@@ -0,0 +1,23 @@
+{
+  "version": "alpha0",
+  "TCP": {
+    "443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "gold.spangled-kettle.ts.net:443": {
+      "Handlers": {
+        "/auth": {
+          "Proxy": "http://ushadow-gold-backend:8000/auth"
+        },
+        "/api": {
+          "Proxy": "http://ushadow-gold-backend:8000/api"
+        },
+        "/": {
+          "Proxy": "http://ushadow-gold-webui:5173"
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/ushadow/backend/src/config/keycloak_settings.py b/ushadow/backend/src/config/keycloak_settings.py
index 26a98963..33966f3f 100644
--- a/ushadow/backend/src/config/keycloak_settings.py
+++ b/ushadow/backend/src/config/keycloak_settings.py
@@ -1,25 +1,19 @@
 """Keycloak configuration settings.
 
-This module provides configuration for Keycloak integration using python-keycloak library.
+This module provides configuration for Keycloak integration using OmegaConf.
 All sensitive values (passwords, client secrets) are stored in secrets.yaml.
-
-Architecture:
-- Uses KeycloakOpenIDConnection for centralized configuration
-- Public URL is dynamically constructed from Tailscale hostname or config
-- Provides singleton instances for KeycloakAdmin and KeycloakOpenID
 """
 
-from typing import Optional
 import logging
+from typing import Optional
 
-from keycloak import KeycloakOpenIDConnection, KeycloakAdmin, KeycloakOpenID
-from keycloak.exceptions import KeycloakError
+from keycloak import KeycloakAdmin, KeycloakOpenID, KeycloakOpenIDConnection
 
 from src.config import get_settings_store as get_settings
 
 logger = logging.getLogger(__name__)
 
-# Singleton instances
+# Global instances (initialized on first use)
 _keycloak_connection: Optional[KeycloakOpenIDConnection] = None
 _keycloak_admin: Optional[KeycloakAdmin] = None
 _keycloak_openid: Optional[KeycloakOpenID] = None
@@ -28,58 +22,18 @@
 def get_keycloak_public_url() -> str:
     """Get the Keycloak public URL.
 
-    Priority:
-    1. KEYCLOAK_PUBLIC_URL environment variable (for explicit override)
-    2. Query Tailscale to find the host's IP address (for development)
-    3. Config setting (keycloak.public_url from config.defaults.yaml)
-    4. Fallback to localhost
+    Returns the URL that browsers/frontends use to access Keycloak.
+
+    Resolution handled by OmegaConf in config.defaults.yaml:
+    - keycloak.public_url: ${oc.env:KEYCLOAK_PUBLIC_URL,http://localhost:8081}
+
+    This automatically checks KEYCLOAK_PUBLIC_URL env var and falls back to localhost:8081.
 
     Returns:
-        Public URL like "http://keycloak.root.svc.cluster.local:8080" or "http://localhost:8080"
+        Public URL like "http://localhost:8081"
     """
-    import os
-
-    # Check environment variable first (highest priority)
-    env_url = os.environ.get("KEYCLOAK_PUBLIC_URL")
-    if env_url:
-        logger.info(f"[KC-SETTINGS] Using KEYCLOAK_PUBLIC_URL from env: {env_url}")
-        return env_url
-
-    # Try Tailscale discovery (for development environments)
-    host_hostname = os.environ.get("HOST_HOSTNAME")
-    if host_hostname:
-        try:
-            from src.services.tailscale_manager import get_tailscale_manager
-
-            manager = get_tailscale_manager()
-
-            # Check if Tailscale is running and authenticated
-            status = manager.get_container_status()
-            if status.running and status.authenticated:
-                # Query Tailscale peers for host's IP
-                host_ip = manager.get_peer_ip_by_hostname(host_hostname)
-
-                if host_ip:
-                    url = f"http://{host_ip}:8081"
-                    logger.info(f"[KC-SETTINGS] Using Tailscale IP for Keycloak: {url}")
-                    return url
-                else:
-                    logger.warning(f"[KC-SETTINGS] Could not find host '{host_hostname}' in Tailscale peers")
-            else:
-                logger.debug("[KC-SETTINGS] Tailscale not running or not authenticated")
-        except Exception as e:
-            logger.warning(f"[KC-SETTINGS] Failed to query Tailscale: {e}")
-
-    # Check config setting
     settings = get_settings()
-    config_url = settings.get_sync("keycloak.public_url")
-    if config_url:
-        logger.info(f"[KC-SETTINGS] Using keycloak.public_url from config: {config_url}")
-        return config_url
-
-    # Fallback to localhost
-    logger.info("[KC-SETTINGS] Using localhost for Keycloak (fallback)")
-    return "http://localhost:8080"
+    return settings.get_sync("keycloak.public_url", "http://localhost:8081")
 
 
 def get_keycloak_connection() -> KeycloakOpenIDConnection:
@@ -104,12 +58,8 @@ def get_keycloak_connection() -> KeycloakOpenIDConnection:
         settings = get_settings()
 
         # Backend uses internal URL for direct connection to Keycloak
-        # Priority: KEYCLOAK_URL env var > config setting > default
-        internal_url = (
-            os.environ.get("KEYCLOAK_URL") or
-            settings.get_sync("keycloak.url") or
-            "http://keycloak:8080"
-        )
+        # Resolved by OmegaConf: ${oc.env:KEYCLOAK_URL,http://keycloak:8080}
+        internal_url = settings.get_sync("keycloak.url", "http://keycloak:8080")
 
         # Admin user authenticates against master realm, not application realm
         # This allows cross-realm admin operations (managing ushadow realm)
@@ -153,14 +103,11 @@ def get_keycloak_admin() -> KeycloakAdmin:
         settings = get_settings()
 
         # Get application realm to manage
-        app_realm = settings.get_sync("keycloak.realm", "ushadow")
+        app_realm = settings.get_sync("keycloak.realm", "master")
 
         # Internal URL for backend-to-Keycloak communication
-        internal_url = (
-            os.environ.get("KEYCLOAK_URL") or
-            settings.get_sync("keycloak.url") or
-            "http://keycloak:8080"
-        )
+        # Resolved by OmegaConf: ${oc.env:KEYCLOAK_URL,http://keycloak:8080}
+        internal_url = settings.get_sync("keycloak.url", "http://keycloak:8080")
 
         # Admin credentials from master realm
         admin_user = settings.get_sync("keycloak.admin_user", "admin")
@@ -200,7 +147,10 @@ def get_keycloak_openid(client_id: Optional[str] = None) -> KeycloakOpenID:
 
     if _keycloak_openid is None:
         settings = get_settings()
-        connection = get_keycloak_connection()
+
+        # Internal URL for backend-to-Keycloak communication
+        # Resolved by OmegaConf: ${oc.env:KEYCLOAK_URL,http://keycloak:8080}
+        internal_url = settings.get_sync("keycloak.url", "http://keycloak:8080")
 
         # Use provided client_id or default to frontend
         if client_id is None:
@@ -214,7 +164,7 @@ def get_keycloak_openid(client_id: Optional[str] = None) -> KeycloakOpenID:
         logger.info(f"[KC-SETTINGS] Initializing KeycloakOpenID for client: {client_id}")
 
         _keycloak_openid = KeycloakOpenID(
-            server_url=connection.server_url,
+            server_url=internal_url,
             realm_name=app_realm,  # Use application realm for token operations
             client_id=client_id,
             client_secret_key=client_secret,
@@ -226,39 +176,46 @@ def get_keycloak_openid(client_id: Optional[str] = None) -> KeycloakOpenID:
 def get_keycloak_config() -> dict:
     """Get Keycloak configuration from OmegaConf settings.
 
-    Legacy compatibility function - provides dict interface for code
-    that hasn't been migrated to use connection objects directly.
+    Dynamically determines public_url based on Tailscale configuration:
+    - If tailscale.hostname exists: Use http://{hostname}:8081
+    - Otherwise: Use localhost fallback
 
     Returns:
         dict with keys:
             - enabled: bool
             - url: str (internal Docker URL)
-            - public_url: str (external browser URL, dynamically constructed)
+            - public_url: str (external browser URL - dynamically determined)
             - realm: str
             - backend_client_id: str
             - backend_client_secret: str (from secrets.yaml)
             - frontend_client_id: str
-            - admin_keycloak_user: str
-            - admin_keycloak_password: str
+            - admin_keycloak_user: str (from secrets.yaml keycloak.admin_user)
+            - admin_keycloak_password: str (from secrets.yaml keycloak.admin_password)
     """
     settings = get_settings()
-    connection = get_keycloak_connection()
 
     # Application realm (not master realm used for admin connection)
     app_realm = settings.get_sync("keycloak.realm", "ushadow")
 
-    return {
+    # Build config dict
+    config = {
         "enabled": settings.get_sync("keycloak.enabled", False),
         "url": settings.get_sync("keycloak.url", "http://keycloak:8080"),
-        "public_url": connection.server_url,  # From connection (dynamic)
+        "public_url": get_keycloak_public_url(),  # Dynamic public URL
         "realm": app_realm,  # Application realm (ushadow), not master
         "backend_client_id": settings.get_sync("keycloak.backend_client_id", "ushadow-backend"),
         "frontend_client_id": settings.get_sync("keycloak.frontend_client_id", "ushadow-frontend"),
-        "backend_client_secret": settings.get_sync("keycloak.backend_client_secret"),
-        "admin_keycloak_user": connection.username,
-        "admin_keycloak_password": connection.password,
     }
 
+    # Secrets (from config/SECRETS/secrets.yaml)
+    config["backend_client_secret"] = settings.get_sync("keycloak.backend_client_secret")
+
+    # Keycloak admin credentials (separate from Ushadow admin)
+    config["admin_keycloak_user"] = settings.get_sync("keycloak.admin_user", "admin")
+    config["admin_keycloak_password"] = settings.get_sync("keycloak.admin_password", "admin")
+
+    return config
+
 
 def is_keycloak_enabled() -> bool:
     """Check if Keycloak authentication is enabled.
diff --git a/ushadow/backend/src/config/store.py b/ushadow/backend/src/config/store.py
index 403041a8..dc914c67 100644
--- a/ushadow/backend/src/config/store.py
+++ b/ushadow/backend/src/config/store.py
@@ -104,8 +104,9 @@ def __init__(self, config_dir: Optional[Path] = None):
 
         self.config_dir = Path(config_dir)
 
-        # File paths (merge order: defaults → secrets → overrides → instance_overrides)
+        # File paths (merge order: defaults → tailscale → secrets → overrides → instance_overrides)
         self.defaults_path = self.config_dir / "config.defaults.yaml"
+        self.tailscale_path = self.config_dir / "tailscale.yaml"
         self.secrets_path = self.config_dir / "SECRETS" / "secrets.yaml"
         self.overrides_path = self.config_dir / "config.overrides.yaml"
         self.instance_overrides_path = self.config_dir / "instance-overrides.yaml"
@@ -137,9 +138,10 @@ async def load_config(self, use_cache: bool = True) -> DictConfig:
 
         Merge order (later overrides earlier):
         1. config.defaults.yaml - All default values
-        2. secrets.yaml - API keys, passwords (gitignored)
-        3. config.overrides.yaml - Template-level overrides (gitignored)
-        4. instance-overrides.yaml - Instance-level overrides (gitignored)
+        2. tailscale.yaml - Tailscale configuration (hostname, etc.)
+        3. secrets.yaml - API keys, passwords (gitignored)
+        4. config.overrides.yaml - Template-level overrides (gitignored)
+        5. instance-overrides.yaml - Instance-level overrides (gitignored)
 
         Returns:
             OmegaConf DictConfig with all values merged
@@ -158,6 +160,10 @@ async def load_config(self, use_cache: bool = True) -> DictConfig:
             configs.append(cfg)
             logger.debug(f"Loaded defaults from {self.defaults_path}")
 
+        if cfg := self._load_yaml_if_exists(self.tailscale_path):
+            configs.append(cfg)
+            logger.debug(f"Loaded tailscale config from {self.tailscale_path}")
+
         if cfg := self._load_yaml_if_exists(self.secrets_path):
             configs.append(cfg)
             logger.debug(f"Loaded secrets from {self.secrets_path}")
@@ -191,6 +197,18 @@ async def get(self, key_path: str, default: Any = None) -> Any:
             Resolved value (interpolations are automatically resolved)
             Converts OmegaConf containers to regular Python dicts/lists
         """
+        # Special handling for dynamic service_urls.{service_name} pattern
+        if key_path.startswith("service_urls."):
+            service_name = key_path[len("service_urls."):]
+            try:
+                from src.utils.service_urls import get_internal_proxy_url
+                internal_url = get_internal_proxy_url(service_name)
+                logger.debug(f"Dynamically resolved {key_path} -> {internal_url}")
+                return internal_url
+            except Exception as e:
+                logger.warning(f"Failed to resolve dynamic service URL for {service_name}: {e}")
+                # Fall through to normal config lookup
+
         config = await self.load_config()
         value = OmegaConf.select(config, key_path, default=default)
 
@@ -207,6 +225,18 @@ def get_sync(self, key_path: str, default: Any = None) -> Any:
         Use this when you need config values at import time (e.g., SECRET_KEY).
         For async contexts, prefer the async get() method.
         """
+        # Special handling for dynamic service_urls.{service_name} pattern
+        if key_path.startswith("service_urls."):
+            service_name = key_path[len("service_urls."):]
+            try:
+                from src.utils.service_urls import get_internal_proxy_url
+                internal_url = get_internal_proxy_url(service_name)
+                logger.debug(f"Dynamically resolved {key_path} -> {internal_url}")
+                return internal_url
+            except Exception as e:
+                logger.warning(f"Failed to resolve dynamic service URL for {service_name}: {e}")
+                # Fall through to normal config lookup
+
         if self._cache is None:
             # Force sync load - _load_yaml_if_exists is already sync
             configs = []
diff --git a/ushadow/backend/src/middleware/app_middleware.py b/ushadow/backend/src/middleware/app_middleware.py
index 8eba3f61..13deb273 100644
--- a/ushadow/backend/src/middleware/app_middleware.py
+++ b/ushadow/backend/src/middleware/app_middleware.py
@@ -84,17 +84,32 @@ def setup_cors_middleware(app: FastAPI) -> None:
             allowed_origins.append(tailscale_origin)
             logger.info(f"Added Tailscale origin to CORS: {tailscale_origin}")
 
-    # Build Tailscale origin regex for any tailnet
+    # Build regex patterns for CORS
+    regex_patterns = []
+
+    # Tailscale origin regex for any tailnet
     tailscale_regex = _get_tailscale_origin_regex()
     if tailscale_regex:
+        regex_patterns.append(tailscale_regex)
         logger.info(f"Tailscale CORS regex: {tailscale_regex}")
 
+    # In development mode, allow any localhost port for launcher/dev tools
+    dev_mode = os.getenv("DEV_MODE", "false").lower() in ("true", "1", "yes")
+    env_mode = os.getenv("ENVIRONMENT_MODE", "")
+    if dev_mode or env_mode == "development":
+        localhost_regex = r"http://(localhost|127\.0\.0\.1):\d+"
+        regex_patterns.append(localhost_regex)
+        logger.info(f"Development mode: allowing all localhost ports via regex")
+
+    # Combine regex patterns
+    combined_regex = "|".join(f"({pattern})" for pattern in regex_patterns) if regex_patterns else None
+
     logger.info(f"CORS configured with origins: {allowed_origins}")
 
     app.add_middleware(
         CORSMiddleware,
         allow_origins=allowed_origins,
-        allow_origin_regex=tailscale_regex,
+        allow_origin_regex=combined_regex,
         allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],
diff --git a/ushadow/backend/src/models/kanban.py b/ushadow/backend/src/models/kanban.py
new file mode 100644
index 00000000..bfa45255
--- /dev/null
+++ b/ushadow/backend/src/models/kanban.py
@@ -0,0 +1,267 @@
+"""Kanban ticket models for integrated task management with tmux.
+
+This module provides models for kanban boards, tickets, and epics that integrate
+directly with the launcher's tmux and worktree management.
+
+Key Features:
+- Tickets linked to tmux windows for context preservation
+- Epic-based grouping for related tickets
+- Tag-based context sharing for ad-hoc relationships
+- Color teams for visual organization
+- Shared branches for collaborative tickets
+"""
+
+import logging
+from datetime import datetime
+from enum import Enum
+from typing import Optional, List
+
+from beanie import Document, PydanticObjectId, Link
+from pydantic import ConfigDict, Field, BaseModel
+
+logger = logging.getLogger(__name__)
+
+
+class TicketStatus(str, Enum):
+    """Ticket workflow status."""
+    BACKLOG = "backlog"
+    TODO = "todo"
+    IN_PROGRESS = "in_progress"
+    IN_REVIEW = "in_review"
+    DONE = "done"
+    ARCHIVED = "archived"
+
+
+class TicketPriority(str, Enum):
+    """Ticket priority levels."""
+    LOW = "low"
+    MEDIUM = "medium"
+    HIGH = "high"
+    URGENT = "urgent"
+
+
+class Epic(Document):
+    """Epic for grouping related tickets with shared context.
+
+    Epics enable:
+    - Logical grouping of related tickets
+    - Shared branch across all tickets in the epic
+    - Unified color team for visual organization
+    - Context sharing (all tickets access same worktree)
+    """
+
+    model_config = ConfigDict(
+        from_attributes=True,
+        populate_by_name=True,
+    )
+
+    # Core fields
+    title: str = Field(..., min_length=1, max_length=200)
+    description: Optional[str] = None
+
+    # Color team (hex color for UI)
+    color: str = Field(default="#3B82F6")  # Default blue
+
+    # Branch management
+    branch_name: Optional[str] = None  # Shared branch for all tickets
+    base_branch: str = Field(default="main")  # Branch to fork from
+
+    # Project association
+    project_id: Optional[str] = None  # Links to launcher project
+
+    # Metadata
+    created_at: datetime = Field(default_factory=datetime.utcnow)
+    updated_at: datetime = Field(default_factory=datetime.utcnow)
+    created_by: Optional[PydanticObjectId] = None  # User who created epic
+
+    class Settings:
+        name = "epics"
+
+    async def save(self, *args, **kwargs):
+        """Override save to update timestamp."""
+        self.updated_at = datetime.utcnow()
+        return await super().save(*args, **kwargs)
+
+
+class Ticket(Document):
+    """Kanban ticket with tmux and worktree integration.
+
+    Each ticket represents a unit of work that:
+    - Has exactly one tmux window (1:1 mapping)
+    - May belong to an epic (shared branch)
+    - Has tags for ad-hoc context sharing
+    - Uses color from epic or generates own color
+    """
+
+    model_config = ConfigDict(
+        from_attributes=True,
+        populate_by_name=True,
+    )
+
+    # Core fields
+    title: str = Field(..., min_length=1, max_length=200)
+    description: Optional[str] = None
+    status: TicketStatus = Field(default=TicketStatus.TODO)
+    priority: TicketPriority = Field(default=TicketPriority.MEDIUM)
+
+    # Epic relationship (optional)
+    epic_id: Optional[PydanticObjectId] = None
+    epic: Optional[Link[Epic]] = None
+
+    # Tags for context sharing
+    tags: List[str] = Field(default_factory=list)
+
+    # Color team (inherited from epic or unique)
+    color: Optional[str] = None  # If None, inherit from epic or generate
+
+    # Tmux integration
+    tmux_window_name: Optional[str] = None  # e.g., "ushadow-ticket-123"
+    tmux_session_name: Optional[str] = None  # Usually project name
+
+    # Worktree/branch integration
+    branch_name: Optional[str] = None  # Own branch or epic's shared branch
+    worktree_path: Optional[str] = None  # Path to worktree on filesystem
+
+    # Environment association
+    environment_name: Optional[str] = None  # Links to launcher environment
+    project_id: Optional[str] = None  # Links to launcher project
+
+    # Assignment
+    assigned_to: Optional[PydanticObjectId] = None  # User assigned to ticket
+
+    # Ordering
+    order: int = Field(default=0)  # For custom ordering within status column
+
+    # Metadata
+    created_at: datetime = Field(default_factory=datetime.utcnow)
+    updated_at: datetime = Field(default_factory=datetime.utcnow)
+    created_by: Optional[PydanticObjectId] = None
+
+    class Settings:
+        name = "tickets"
+        indexes = [
+            "status",
+            "epic_id",
+            "project_id",
+            "tags",
+            "assigned_to",
+        ]
+
+    async def save(self, *args, **kwargs):
+        """Override save to update timestamp."""
+        self.updated_at = datetime.utcnow()
+        return await super().save(*args, **kwargs)
+
+    @property
+    def ticket_id_str(self) -> str:
+        """Return short ticket ID for display (last 6 chars)."""
+        return str(self.id)[-6:]
+
+    async def get_effective_color(self) -> str:
+        """Get the color to use for this ticket (own or epic's)."""
+        if self.color:
+            return self.color
+
+        if self.epic_id and self.epic:
+            epic = await self.epic.fetch()
+            return epic.color if epic else self._generate_color()
+
+        return self._generate_color()
+
+    def _generate_color(self) -> str:
+        """Generate a color based on ticket ID hash."""
+        # Simple hash-based color generation
+        id_hash = hash(str(self.id))
+        hue = id_hash % 360
+        return f"hsl({hue}, 70%, 60%)"
+
+    async def get_effective_branch(self) -> Optional[str]:
+        """Get the branch to use (own or epic's shared branch)."""
+        if self.branch_name:
+            return self.branch_name
+
+        if self.epic_id and self.epic:
+            epic = await self.epic.fetch()
+            return epic.branch_name if epic else None
+
+        return None
+
+
+# Pydantic schemas for API requests/responses
+
+class EpicCreate(BaseModel):
+    """Schema for creating a new epic."""
+    title: str
+    description: Optional[str] = None
+    color: Optional[str] = None
+    base_branch: str = "main"
+    project_id: Optional[str] = None
+
+
+class EpicRead(BaseModel):
+    """Schema for reading epic data."""
+    id: PydanticObjectId
+    title: str
+    description: Optional[str]
+    color: str
+    branch_name: Optional[str]
+    base_branch: str
+    project_id: Optional[str]
+    created_at: datetime
+    updated_at: datetime
+
+
+class EpicUpdate(BaseModel):
+    """Schema for updating epic data."""
+    title: Optional[str] = None
+    description: Optional[str] = None
+    color: Optional[str] = None
+    branch_name: Optional[str] = None
+
+
+class TicketCreate(BaseModel):
+    """Schema for creating a new ticket."""
+    title: str
+    description: Optional[str] = None
+    status: TicketStatus = TicketStatus.TODO
+    priority: TicketPriority = TicketPriority.MEDIUM
+    epic_id: Optional[str] = None
+    tags: List[str] = []
+    color: Optional[str] = None
+    project_id: Optional[str] = None
+    assigned_to: Optional[str] = None
+
+
+class TicketRead(BaseModel):
+    """Schema for reading ticket data."""
+    id: PydanticObjectId
+    title: str
+    description: Optional[str]
+    status: TicketStatus
+    priority: TicketPriority
+    epic_id: Optional[PydanticObjectId]
+    tags: List[str]
+    color: Optional[str]
+    tmux_window_name: Optional[str]
+    tmux_session_name: Optional[str]
+    branch_name: Optional[str]
+    worktree_path: Optional[str]
+    environment_name: Optional[str]
+    project_id: Optional[str]
+    assigned_to: Optional[PydanticObjectId]
+    order: int
+    created_at: datetime
+    updated_at: datetime
+
+
+class TicketUpdate(BaseModel):
+    """Schema for updating ticket data."""
+    title: Optional[str] = None
+    description: Optional[str] = None
+    status: Optional[TicketStatus] = None
+    priority: Optional[TicketPriority] = None
+    epic_id: Optional[str] = None
+    tags: Optional[List[str]] = None
+    color: Optional[str] = None
+    assigned_to: Optional[str] = None
+    order: Optional[int] = None
diff --git a/ushadow/backend/src/models/kubernetes.py b/ushadow/backend/src/models/kubernetes.py
index a6fee80e..3b377501 100644
--- a/ushadow/backend/src/models/kubernetes.py
+++ b/ushadow/backend/src/models/kubernetes.py
@@ -26,6 +26,7 @@ class KubernetesCluster(BaseModel):
     version: Optional[str] = Field(None, description="Kubernetes version")
     node_count: Optional[int] = Field(None, description="Number of nodes in cluster")
     namespace: str = Field("default", description="Default namespace for deployments")
+    infra_namespace: Optional[str] = Field(None, description="Namespace where infrastructure services (mongo, redis, etc.) are located")
 
     # Infrastructure scan results (cached per namespace)
     infra_scans: Dict[str, Dict[str, Any]] = Field(
@@ -153,6 +154,7 @@ class KubernetesClusterUpdate(BaseModel):
 
     name: Optional[str] = None
     namespace: Optional[str] = None
+    infra_namespace: Optional[str] = None
     labels: Optional[Dict[str, str]] = None
     ingress_domain: Optional[str] = None
     ingress_class: Optional[str] = None
diff --git a/ushadow/backend/src/routers/audio_relay.py b/ushadow/backend/src/routers/audio_relay.py
index 770af6f8..52bdf12f 100644
--- a/ushadow/backend/src/routers/audio_relay.py
+++ b/ushadow/backend/src/routers/audio_relay.py
@@ -39,7 +39,7 @@ async def connect(self):
             import websockets
 
             # Add token to URL (use & if URL already has query params)
-            separator = '&' if '?' in self.url else '?'
+            separator = "&" if "?" in self.url else "?"
             url_with_token = f"{self.url}{separator}token={self.token}"
 
             # Detect endpoint type for logging
@@ -205,33 +205,26 @@ async def audio_relay_websocket(
     try:
         destinations_param = websocket.query_params.get("destinations")
         token = websocket.query_params.get("token")
+        codec = websocket.query_params.get("codec", "pcm")  # Default to PCM if not specified
 
         if not destinations_param or not token:
             await websocket.close(code=1008, reason="Missing destinations or token parameter")
             return
 
-        # Bridge Keycloak token to service token for destinations
-        from src.services.token_bridge import bridge_to_service_token
-        service_token = await bridge_to_service_token(
-            token,
-            audiences=["ushadow", "chronicle", "mycelia"]
-        )
-
-        if not service_token:
-            logger.error("[AudioRelay] Token bridging failed")
-            await websocket.close(code=1008, reason="Authentication failed")
-            return
-
-        logger.info("[AudioRelay] ✓ Token bridged successfully")
-        # Use service token for downstream connections
-        token = service_token
-
         destinations = json.loads(destinations_param)
         if not isinstance(destinations, list) or len(destinations) == 0:
             await websocket.close(code=1008, reason="destinations must be a non-empty array")
             return
 
+        # Add codec parameter to destination URLs if not already present
+        for dest in destinations:
+            if "codec=" not in dest['url']:
+                separator = "&" if "?" in dest['url'] else "?"
+                dest['url'] = f"{dest['url']}{separator}codec={codec}"
+
         logger.info(f"[AudioRelay] Destinations: {[d['name'] for d in destinations]}")
+        logger.info(f"[AudioRelay] Using codec: {codec}")
+
         # Log exact URLs received from client for debugging
         for dest in destinations:
             # Detect endpoint type (check for old formats first, then new)
@@ -285,6 +278,17 @@ async def audio_relay_websocket(
             except WebSocketDisconnect:
                 logger.info("[AudioRelay] Client disconnected")
                 break
+            except RuntimeError as e:
+                # Handle "Cannot call receive once a disconnect message has been received"
+                if "disconnect" in str(e).lower():
+                    logger.info("[AudioRelay] Client disconnected (disconnect message received)")
+                    break
+                raise
+
+            # Check for disconnect message type
+            if message.get("type") == "websocket.disconnect":
+                logger.info("[AudioRelay] Client disconnected (disconnect message)")
+                break
 
             # Relay text messages (Wyoming protocol headers)
             if "text" in message:
diff --git a/ushadow/backend/src/routers/auth.py b/ushadow/backend/src/routers/auth.py
index 3eaa25c3..26e96fc3 100644
--- a/ushadow/backend/src/routers/auth.py
+++ b/ushadow/backend/src/routers/auth.py
@@ -526,3 +526,89 @@ async def refresh_access_token(request: TokenRefreshRequest):
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail=str(e)
         )
+
+
+# Dynamic Redirect URI Registration
+class RedirectUriRequest(BaseModel):
+    """Request for registering a redirect URI with Keycloak."""
+    redirect_uri: str = Field(..., description="OAuth redirect URI to register (e.g., http://localhost:3500/oauth/callback)")
+    post_logout_redirect_uri: Optional[str] = Field(None, description="Optional post-logout redirect URI")
+
+
+class RedirectUriResponse(BaseModel):
+    """Response after registering redirect URI."""
+    success: bool
+    redirect_uri: str
+    message: str
+
+
+@router.post("/register-redirect-uri", response_model=RedirectUriResponse)
+async def register_redirect_uri_endpoint(request: RedirectUriRequest):
+    """Register this environment's redirect URI with Keycloak.
+
+    Called by frontend on startup to dynamically register its OAuth callback URL.
+    This allows multiple environments to run on different ports without pre-configuring
+    all possible redirect URIs in Keycloak.
+
+    Uses the existing KeycloakAdminClient.register_redirect_uri() service method.
+
+    Args:
+        request: Contains redirect URI to register
+
+    Returns:
+        Success status and registered URI
+
+    Raises:
+        400: If redirect URI is invalid
+        500: If Keycloak registration fails
+    """
+    from src.services.keycloak_admin import get_keycloak_admin
+
+    # Validate redirect URI format
+    # Allow http://, https://, tauri:// (desktop app), ushadow:// (mobile), exp:// (Expo)
+    allowed_schemes = ('http://', 'https://', 'tauri://', 'ushadow://', 'exp://')
+    if not request.redirect_uri.startswith(allowed_schemes):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"redirect_uri must start with one of: {', '.join(allowed_schemes)}"
+        )
+
+    try:
+        kc_admin = get_keycloak_admin()
+
+        # Use existing service method to register redirect URI
+        success = await kc_admin.register_redirect_uri(
+            client_id="ushadow-frontend",
+            redirect_uri=request.redirect_uri
+        )
+
+        if not success:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Failed to register redirect URI with Keycloak"
+            )
+
+        # Optionally register post-logout redirect URI
+        if request.post_logout_redirect_uri:
+            await kc_admin.update_post_logout_redirect_uris(
+                client_id="ushadow-frontend",
+                post_logout_redirect_uris=[request.post_logout_redirect_uri],
+                merge=True
+            )
+
+        logger.info(f"[REDIRECT-URI] ✓ Registered redirect URI: {request.redirect_uri}")
+
+        return RedirectUriResponse(
+            success=True,
+            redirect_uri=request.redirect_uri,
+            message=f"Redirect URI registered successfully"
+        )
+
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"[REDIRECT-URI] Failed to register: {e}", exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to register redirect URI: {str(e)}"
+        )
diff --git a/ushadow/backend/src/routers/deployments.py b/ushadow/backend/src/routers/deployments.py
index 8990cf94..b844d9a6 100644
--- a/ushadow/backend/src/routers/deployments.py
+++ b/ushadow/backend/src/routers/deployments.py
@@ -78,20 +78,22 @@ async def list_deployment_targets(
         logger.info(f"  → Adding K8s cluster: {cluster.name} (status: {cluster.status})")
         parsed = parse_deployment_target_id(cluster.deployment_target_id)
 
-        # Get infrastructure - try cluster's namespace first, then any available namespace
+        # Get infrastructure - skip target namespace as it contains deployed services, not infra
         infra = {}
         if cluster.infra_scans:
-            # Try cluster's configured namespace first
-            if cluster.namespace in cluster.infra_scans:
-                infra = cluster.infra_scans[cluster.namespace]
-                logger.info(f"    ✓ Using infrastructure from namespace '{cluster.namespace}'")
+            # Filter out scans of the target namespace
+            infra_scans_filtered = {
+                ns: scan for ns, scan in cluster.infra_scans.items()
+                if ns != cluster.namespace
+            }
+
+            if not infra_scans_filtered:
+                logger.info(f"    ⚠️ No infrastructure scans available (target namespace '{cluster.namespace}' excluded)")
             else:
-                # Use first available namespace with infrastructure
-                for ns, ns_infra in cluster.infra_scans.items():
-                    if ns_infra:  # Non-empty infrastructure
-                        infra = ns_infra
-                        logger.info(f"    ✓ Using infrastructure from namespace '{ns}' (cluster namespace '{cluster.namespace}' not found)")
-                        break
+                # Use the first available infrastructure scan
+                infra_ns = next(iter(infra_scans_filtered.keys()))
+                infra = infra_scans_filtered[infra_ns]
+                logger.info(f"    ✓ Using infrastructure from namespace '{infra_ns}'")
 
             if infra:
                 logger.info(f"    Infrastructure services: {list(infra.keys())}")
diff --git a/ushadow/backend/src/routers/kanban.py b/ushadow/backend/src/routers/kanban.py
new file mode 100644
index 00000000..5d3c09b4
--- /dev/null
+++ b/ushadow/backend/src/routers/kanban.py
@@ -0,0 +1,404 @@
+"""API routes for kanban ticket management.
+
+This router provides CRUD operations for tickets and epics, integrating with
+the launcher's tmux and worktree systems for context-aware task management.
+"""
+
+import logging
+from typing import List, Optional, Dict, Any
+
+from fastapi import APIRouter, HTTPException, Depends, Query
+from beanie import PydanticObjectId
+from pydantic import BaseModel
+
+from src.models.kanban import (
+    Ticket,
+    Epic,
+    TicketStatus,
+    TicketPriority,
+    TicketCreate,
+    TicketRead,
+    TicketUpdate,
+    EpicCreate,
+    EpicRead,
+    EpicUpdate,
+)
+from src.services.auth import get_current_user
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/api/kanban", tags=["kanban"])
+
+
+# =============================================================================
+# Epic Endpoints
+# =============================================================================
+
+@router.post("/epics", response_model=Dict[str, Any])
+async def create_epic(
+    epic_data: EpicCreate,
+    current_user: dict = Depends(get_current_user)
+):
+    """Create a new epic for grouping related tickets."""
+    try:
+        epic = Epic(
+            title=epic_data.title,
+            description=epic_data.description,
+            color=epic_data.color or "#3B82F6",
+            base_branch=epic_data.base_branch,
+            project_id=epic_data.project_id,
+            created_by=PydanticObjectId(current_user["id"])
+        )
+        await epic.save()
+
+        logger.info(f"Created epic: {epic.title} (ID: {epic.id})")
+        return epic.model_dump()
+    except Exception as e:
+        logger.error(f"Failed to create epic: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/epics", response_model=List[Dict[str, Any]])
+async def list_epics(
+    project_id: Optional[str] = Query(None),
+    current_user: dict = Depends(get_current_user)
+):
+    """List all epics, optionally filtered by project."""
+    try:
+        query = {}
+        if project_id:
+            query["project_id"] = project_id
+
+        epics = await Epic.find(query).to_list()
+        return [epic.model_dump() for epic in epics]
+    except Exception as e:
+        logger.error(f"Failed to list epics: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/epics/{epic_id}", response_model=Dict[str, Any])
+async def get_epic(
+    epic_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """Get a specific epic by ID."""
+    try:
+        epic = await Epic.get(PydanticObjectId(epic_id))
+        if not epic:
+            raise HTTPException(status_code=404, detail="Epic not found")
+        return epic.model_dump()
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to get epic {epic_id}: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.patch("/epics/{epic_id}", response_model=Dict[str, Any])
+async def update_epic(
+    epic_id: str,
+    update_data: EpicUpdate,
+    current_user: dict = Depends(get_current_user)
+):
+    """Update an epic."""
+    try:
+        epic = await Epic.get(PydanticObjectId(epic_id))
+        if not epic:
+            raise HTTPException(status_code=404, detail="Epic not found")
+
+        # Update fields
+        if update_data.title is not None:
+            epic.title = update_data.title
+        if update_data.description is not None:
+            epic.description = update_data.description
+        if update_data.color is not None:
+            epic.color = update_data.color
+        if update_data.branch_name is not None:
+            epic.branch_name = update_data.branch_name
+
+        await epic.save()
+        logger.info(f"Updated epic: {epic.title} (ID: {epic.id})")
+        return epic.model_dump()
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to update epic {epic_id}: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.delete("/epics/{epic_id}")
+async def delete_epic(
+    epic_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """Delete an epic. Tickets in the epic will have epic_id set to None."""
+    try:
+        epic = await Epic.get(PydanticObjectId(epic_id))
+        if not epic:
+            raise HTTPException(status_code=404, detail="Epic not found")
+
+        # Unlink tickets from epic
+        tickets = await Ticket.find(Ticket.epic_id == epic.id).to_list()
+        for ticket in tickets:
+            ticket.epic_id = None
+            ticket.epic = None
+            await ticket.save()
+
+        await epic.delete()
+        logger.info(f"Deleted epic: {epic.title} (ID: {epic.id})")
+        return {"status": "success", "deleted": str(epic.id)}
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to delete epic {epic_id}: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+# =============================================================================
+# Ticket Endpoints
+# =============================================================================
+
+@router.post("/tickets", response_model=Dict[str, Any])
+async def create_ticket(
+    ticket_data: TicketCreate,
+    current_user: dict = Depends(get_current_user)
+):
+    """Create a new ticket."""
+    try:
+        # Validate epic exists if provided
+        epic_obj_id = None
+        if ticket_data.epic_id:
+            epic = await Epic.get(PydanticObjectId(ticket_data.epic_id))
+            if not epic:
+                raise HTTPException(status_code=400, detail="Epic not found")
+            epic_obj_id = epic.id
+
+        ticket = Ticket(
+            title=ticket_data.title,
+            description=ticket_data.description,
+            status=ticket_data.status,
+            priority=ticket_data.priority,
+            epic_id=epic_obj_id,
+            tags=ticket_data.tags,
+            color=ticket_data.color,
+            project_id=ticket_data.project_id,
+            assigned_to=PydanticObjectId(ticket_data.assigned_to) if ticket_data.assigned_to else None,
+            created_by=PydanticObjectId(current_user["id"])
+        )
+        await ticket.save()
+
+        logger.info(f"Created ticket: {ticket.title} (ID: {ticket.id})")
+        return ticket.model_dump()
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to create ticket: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/tickets", response_model=List[Dict[str, Any]])
+async def list_tickets(
+    project_id: Optional[str] = Query(None),
+    epic_id: Optional[str] = Query(None),
+    status: Optional[TicketStatus] = Query(None),
+    tags: Optional[str] = Query(None),  # Comma-separated tags
+    assigned_to: Optional[str] = Query(None),
+    current_user: dict = Depends(get_current_user)
+):
+    """List tickets with optional filters."""
+    try:
+        query = {}
+        if project_id:
+            query["project_id"] = project_id
+        if epic_id:
+            query["epic_id"] = PydanticObjectId(epic_id)
+        if status:
+            query["status"] = status
+        if assigned_to:
+            query["assigned_to"] = PydanticObjectId(assigned_to)
+
+        # Tag filtering (find tickets with ANY of the specified tags)
+        if tags:
+            tag_list = [t.strip() for t in tags.split(",")]
+            query["tags"] = {"$in": tag_list}
+
+        tickets = await Ticket.find(query).sort("+order").to_list()
+        return [ticket.model_dump() for ticket in tickets]
+    except Exception as e:
+        logger.error(f"Failed to list tickets: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/tickets/{ticket_id}", response_model=Dict[str, Any])
+async def get_ticket(
+    ticket_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """Get a specific ticket by ID."""
+    try:
+        ticket = await Ticket.get(PydanticObjectId(ticket_id))
+        if not ticket:
+            raise HTTPException(status_code=404, detail="Ticket not found")
+        return ticket.model_dump()
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to get ticket {ticket_id}: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.patch("/tickets/{ticket_id}", response_model=Dict[str, Any])
+async def update_ticket(
+    ticket_id: str,
+    update_data: TicketUpdate,
+    current_user: dict = Depends(get_current_user)
+):
+    """Update a ticket."""
+    try:
+        ticket = await Ticket.get(PydanticObjectId(ticket_id))
+        if not ticket:
+            raise HTTPException(status_code=404, detail="Ticket not found")
+
+        # Update fields
+        if update_data.title is not None:
+            ticket.title = update_data.title
+        if update_data.description is not None:
+            ticket.description = update_data.description
+        if update_data.status is not None:
+            ticket.status = update_data.status
+        if update_data.priority is not None:
+            ticket.priority = update_data.priority
+        if update_data.epic_id is not None:
+            # Validate epic exists
+            epic = await Epic.get(PydanticObjectId(update_data.epic_id))
+            if not epic:
+                raise HTTPException(status_code=400, detail="Epic not found")
+            ticket.epic_id = epic.id
+        if update_data.tags is not None:
+            ticket.tags = update_data.tags
+        if update_data.color is not None:
+            ticket.color = update_data.color
+        if update_data.assigned_to is not None:
+            ticket.assigned_to = PydanticObjectId(update_data.assigned_to) if update_data.assigned_to else None
+        if update_data.order is not None:
+            ticket.order = update_data.order
+
+        await ticket.save()
+        logger.info(f"Updated ticket: {ticket.title} (ID: {ticket.id})")
+        return ticket.model_dump()
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to update ticket {ticket_id}: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.delete("/tickets/{ticket_id}")
+async def delete_ticket(
+    ticket_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """Delete a ticket."""
+    try:
+        ticket = await Ticket.get(PydanticObjectId(ticket_id))
+        if not ticket:
+            raise HTTPException(status_code=404, detail="Ticket not found")
+
+        await ticket.delete()
+        logger.info(f"Deleted ticket: {ticket.title} (ID: {ticket.id})")
+        return {"status": "success", "deleted": str(ticket.id)}
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to delete ticket {ticket_id}: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+# =============================================================================
+# Context Sharing Endpoints
+# =============================================================================
+
+@router.get("/tickets/{ticket_id}/related", response_model=List[Dict[str, Any]])
+async def get_related_tickets(
+    ticket_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """Find tickets related to this one via epic or shared tags."""
+    try:
+        ticket = await Ticket.get(PydanticObjectId(ticket_id))
+        if not ticket:
+            raise HTTPException(status_code=404, detail="Ticket not found")
+
+        related = []
+
+        # Find tickets in same epic
+        if ticket.epic_id:
+            epic_tickets = await Ticket.find(
+                Ticket.epic_id == ticket.epic_id,
+                Ticket.id != ticket.id
+            ).to_list()
+            related.extend(epic_tickets)
+
+        # Find tickets with shared tags
+        if ticket.tags:
+            tag_tickets = await Ticket.find(
+                Ticket.tags == {"$in": ticket.tags},
+                Ticket.id != ticket.id
+            ).to_list()
+            # Deduplicate
+            existing_ids = {t.id for t in related}
+            for t in tag_tickets:
+                if t.id not in existing_ids:
+                    related.append(t)
+
+        return [t.model_dump() for t in related]
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to get related tickets for {ticket_id}: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+# =============================================================================
+# Statistics Endpoints
+# =============================================================================
+
+@router.get("/stats", response_model=Dict[str, Any])
+async def get_kanban_stats(
+    project_id: Optional[str] = Query(None),
+    current_user: dict = Depends(get_current_user)
+):
+    """Get kanban board statistics."""
+    try:
+        query = {}
+        if project_id:
+            query["project_id"] = project_id
+
+        tickets = await Ticket.find(query).to_list()
+
+        stats = {
+            "total": len(tickets),
+            "by_status": {},
+            "by_priority": {},
+            "by_epic": {},
+            "with_tmux": sum(1 for t in tickets if t.tmux_window_name),
+        }
+
+        for status in TicketStatus:
+            stats["by_status"][status.value] = sum(1 for t in tickets if t.status == status)
+
+        for priority in TicketPriority:
+            stats["by_priority"][priority.value] = sum(1 for t in tickets if t.priority == priority)
+
+        # Count tickets per epic
+        epic_counts = {}
+        for ticket in tickets:
+            if ticket.epic_id:
+                epic_id_str = str(ticket.epic_id)
+                epic_counts[epic_id_str] = epic_counts.get(epic_id_str, 0) + 1
+        stats["by_epic"] = epic_counts
+
+        return stats
+    except Exception as e:
+        logger.error(f"Failed to get kanban stats: {e}")
+        raise HTTPException(status_code=500, detail=str(e))
diff --git a/ushadow/backend/src/routers/kubernetes.py b/ushadow/backend/src/routers/kubernetes.py
index 6214bab7..f2e0e56b 100644
--- a/ushadow/backend/src/routers/kubernetes.py
+++ b/ushadow/backend/src/routers/kubernetes.py
@@ -238,6 +238,14 @@ async def scan_cluster_for_infra(
     if not cluster:
         raise HTTPException(status_code=404, detail="Cluster not found")
 
+    # Don't allow scanning the target namespace - it contains deployed services, not infrastructure
+    if request.namespace == cluster.namespace:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Cannot scan target namespace '{cluster.namespace}' for infrastructure. "
+                   f"This namespace contains deployed services. Scan a different namespace where infrastructure services are located."
+        )
+
     results = await k8s_manager.scan_cluster_for_infra_services(
         cluster_id,
         request.namespace
@@ -257,6 +265,41 @@ async def scan_cluster_for_infra(
     }
 
 
+@router.delete("/{cluster_id}/scan-infra/{namespace}")
+async def delete_infra_scan(
+    cluster_id: str,
+    namespace: str,
+    current_user: User = Depends(get_current_user)
+):
+    """
+    Delete an infrastructure scan for a specific namespace.
+
+    Useful for removing stale or incorrect scan data.
+    """
+    k8s_manager = await get_kubernetes_manager()
+
+    # Verify cluster exists
+    cluster = await k8s_manager.get_cluster(cluster_id)
+    if not cluster:
+        raise HTTPException(status_code=404, detail="Cluster not found")
+
+    # Check if scan exists
+    if not cluster.infra_scans or namespace not in cluster.infra_scans:
+        raise HTTPException(
+            status_code=404,
+            detail=f"No infrastructure scan found for namespace '{namespace}'"
+        )
+
+    # Remove the scan
+    await k8s_manager.delete_cluster_infra_scan(cluster_id, namespace)
+
+    return {
+        "cluster_id": cluster_id,
+        "namespace": namespace,
+        "message": f"Infrastructure scan for namespace '{namespace}' deleted successfully"
+    }
+
+
 @router.post("/{cluster_id}/envmap")
 async def create_or_update_envmap(
     cluster_id: str,
diff --git a/ushadow/backend/src/routers/settings.py b/ushadow/backend/src/routers/settings.py
index 9dcfb236..e95d3a8b 100644
--- a/ushadow/backend/src/routers/settings.py
+++ b/ushadow/backend/src/routers/settings.py
@@ -43,11 +43,24 @@ async def get_settings_info():
 
 @router.get("/config")
 async def get_config():
-    """Get merged configuration with secrets masked."""
+    """Get merged configuration with secrets masked.
+
+    Dynamically injects keycloak.public_url based on Tailscale configuration.
+    """
     try:
+        from src.config.keycloak_settings import get_keycloak_config
+
         settings = get_settings()
         all_config = await settings.get_all()
 
+        # Inject dynamic Keycloak config (public_url determined from tailscale.hostname)
+        keycloak_config = get_keycloak_config()
+        if "keycloak" not in all_config:
+            all_config["keycloak"] = {}
+        all_config["keycloak"]["public_url"] = keycloak_config["public_url"]
+        all_config["keycloak"]["realm"] = keycloak_config["realm"]
+        all_config["keycloak"]["frontend_client_id"] = keycloak_config["frontend_client_id"]
+
         # Recursively mask all sensitive values
         masked_config = mask_dict_secrets(all_config)
 
diff --git a/ushadow/backend/src/routers/tailscale.py b/ushadow/backend/src/routers/tailscale.py
index 69de0e6f..87f2d361 100644
--- a/ushadow/backend/src/routers/tailscale.py
+++ b/ushadow/backend/src/routers/tailscale.py
@@ -90,6 +90,7 @@ class DeploymentMode(BaseModel):
 class TailscaleConfig(BaseModel):
     """Complete Tailscale configuration"""
     hostname: str = Field(..., description="Tailscale hostname (e.g., machine-name.tail12345.ts.net)")
+    ip_address: Optional[str] = Field(None, description="Tailscale IP address (e.g., 100.105.225.45)")
     deployment_mode: DeploymentMode
     https_enabled: bool = True
     use_caddy_proxy: bool = Field(..., description="True for multi-env, False for single-env")
@@ -415,6 +416,7 @@ async def generate_serve_config(config: TailscaleConfig) -> Dict[str, str]:
         f"tailscale serve https / http://localhost:{frontend_port}",
         f"tailscale serve https /api http://localhost:{backend_port}",
         f"tailscale serve https /auth http://localhost:{backend_port}",
+        f"tailscale serve https /keycloak http://localhost:8081",
         "",
         "# To view current configuration:",
         "tailscale serve status",
@@ -1388,6 +1390,14 @@ async def configure_tailscale_serve(
     try:
         manager = get_tailscale_manager()
 
+        # Get container status to capture IP address
+        container_status = manager.get_container_status()
+        if container_status.ip_address:
+            config.ip_address = container_status.ip_address
+            logger.info(f"Captured Tailscale IP: {container_status.ip_address}")
+        else:
+            logger.warning("Could not capture Tailscale IP address")
+
         # Save configuration to disk first
         config_data = config.model_dump()
         with open(TAILSCALE_CONFIG_FILE, 'w') as f:
diff --git a/ushadow/backend/src/services/keycloak_admin.py b/ushadow/backend/src/services/keycloak_admin.py
index f5988b8e..ccb4297b 100644
--- a/ushadow/backend/src/services/keycloak_admin.py
+++ b/ushadow/backend/src/services/keycloak_admin.py
@@ -135,13 +135,13 @@ async def update_client_redirect_uris(
                 logger.info(f"[KC-ADMIN] Extracted {len(final_origins)} webOrigins from redirect URIs")
 
             # Update client using official library method
-            self.admin.update_client(
-                client_uuid,
-                {
-                    "redirectUris": final_uris,
-                    "webOrigins": final_origins,
-                }
-            )
+            # IMPORTANT: Must update the full client object, not partial update
+            # Partial updates cause Hibernate to try INSERT instead of REPLACE,
+            # leading to duplicate key violations on redirectUris
+            client["redirectUris"] = final_uris
+            client["webOrigins"] = final_origins
+
+            self.admin.update_client(client_uuid, client)
 
             logger.info(f"[KC-ADMIN] ✓ Updated redirect URIs for client '{client_id}'")
             for uri in final_uris:
@@ -208,14 +208,13 @@ async def update_post_logout_redirect_uris(
                 logger.info(f"[KC-ADMIN] Replacing post-logout redirect URIs with {len(final_uris)} URIs")
 
             # Post-logout redirect URIs are stored as a ## delimited string in attributes
-            attributes = client.get("attributes", {})
-            attributes["post.logout.redirect.uris"] = "##".join(final_uris)
+            # Update full client object to avoid Hibernate collection merge issues
+            if "attributes" not in client:
+                client["attributes"] = {}
+            client["attributes"]["post.logout.redirect.uris"] = "##".join(final_uris)
 
-            # Update using official library
-            self.admin.update_client(
-                client_uuid,
-                {"attributes": attributes}
-            )
+            # Update using official library with full client object
+            self.admin.update_client(client_uuid, client)
 
             logger.info(f"[KC-ADMIN] ✓ Updated post-logout redirect URIs for client '{client_id}'")
             for uri in final_uris:
@@ -226,6 +225,37 @@ async def update_post_logout_redirect_uris(
             logger.error(f"[KC-ADMIN] Failed to update post-logout redirect URIs: {e}")
             return False
 
+    def update_realm_browser_security_headers(self, headers: dict) -> None:
+        """
+        Update realm's browser security headers (CSP, X-Frame-Options, etc.).
+
+        Args:
+            headers: Dictionary of browser security headers to update
+        """
+        from ..config.keycloak_settings import get_keycloak_config
+
+        try:
+            # Get realm from config
+            config = get_keycloak_config()
+            realm = config["realm"]
+
+            # Get current realm configuration
+            realm_config = self.admin.get_realm(realm)
+
+            # Update browserSecurityHeaders
+            realm_config["browserSecurityHeaders"] = headers
+
+            # Update realm
+            self.admin.update_realm(realm, realm_config)
+
+            logger.info(f"[KC-ADMIN] ✓ Updated realm browser security headers for realm: {realm}")
+            for key, value in headers.items():
+                logger.info(f"[KC-ADMIN]   {key}: {value[:50]}...")  # Truncate long values
+
+        except KeycloakError as e:
+            logger.error(f"[KC-ADMIN] Failed to update realm: {e}")
+            raise
+
 
 async def register_current_environment_redirect_uri() -> bool:
     """
diff --git a/ushadow/backend/src/services/keycloak_auth.py b/ushadow/backend/src/services/keycloak_auth.py
index 69df7498..b8363ae2 100644
--- a/ushadow/backend/src/services/keycloak_auth.py
+++ b/ushadow/backend/src/services/keycloak_auth.py
@@ -33,21 +33,21 @@ def get_jwks_client() -> PyJWKClient:
         from src.config import get_settings_store
 
         settings = get_settings_store()
+        app_realm = settings.get_sync("keycloak.realm", "ushadow")
 
-        # Get Keycloak internal URL
+        # IMPORTANT: Backend must use internal URL for JWKS, never external/proxy URLs
+        # Priority: KEYCLOAK_URL env var > config setting > Docker default
         internal_url = (
             os.environ.get("KEYCLOAK_URL") or
             settings.get_sync("keycloak.url") or
             "http://keycloak:8080"
         )
 
-        # Get application realm (where tokens are issued)
-        app_realm = settings.get_sync("keycloak.realm", "ushadow")
-
-        # Construct JWKS URL from application realm (not master)
+        # Construct JWKS URL from internal Keycloak URL
+        # IMPORTANT: Use application realm (ushadow), not admin realm (master)
         jwks_url = f"{internal_url}/realms/{app_realm}/protocol/openid-connect/certs"
         _jwks_client = PyJWKClient(jwks_url)
-        logger.info(f"[KC-AUTH] Initialized JWKS client: {jwks_url}")
+        logger.info(f"[KC-AUTH] Initialized JWKS client for realm '{app_realm}': {jwks_url}")
     return _jwks_client
 
 
diff --git a/ushadow/backend/src/services/keycloak_startup.py b/ushadow/backend/src/services/keycloak_startup.py
index a95a2778..544e0589 100644
--- a/ushadow/backend/src/services/keycloak_startup.py
+++ b/ushadow/backend/src/services/keycloak_startup.py
@@ -152,6 +152,7 @@ def get_web_origins() -> List[str]:
         if cors_origins and cors_origins.strip():
             # Split comma-separated origins and strip whitespace
             origins = [origin.strip() for origin in cors_origins.split(",") if origin.strip()]
+            logger.info(f"[KC_STARTUP] CORS: {cors_origins}")
             logger.info(f"[KC-STARTUP] Using {len(origins)} web origins from settings")
             return origins
     except Exception as e:
@@ -222,6 +223,23 @@ async def register_current_environment():
         else:
             logger.warning("[KC-STARTUP] ⚠️  Failed to register post-logout redirect URIs")
 
+        # Update realm CSP to allow embedding from any origin (Tauri, Tailscale, etc.)
+        try:
+            logger.info("[KC-STARTUP] 🔒 Updating realm CSP to allow embedding...")
+            headers = {
+                "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self' http: https: tauri:; object-src 'none';",
+                "xContentTypeOptions": "nosniff",
+                "xRobotsTag": "none",
+                "xFrameOptions": "",  # Remove X-Frame-Options (conflicts with CSP frame-ancestors)
+                "xXSSProtection": "1; mode=block",
+                "strictTransportSecurity": "max-age=31536000; includeSubDomains"
+            }
+            admin_client.update_realm_browser_security_headers(headers)
+            logger.info("[KC-STARTUP] ✅ Realm CSP updated successfully")
+        except Exception as csp_error:
+            logger.warning(f"[KC-STARTUP] ⚠️  Failed to update realm CSP: {csp_error}")
+            logger.warning("[KC-STARTUP] You may need to manually configure CSP in Keycloak admin console")
+
     except Exception as e:
         logger.warning(f"[KC-STARTUP] ⚠️  Failed to auto-register Keycloak URIs: {e}")
         logger.warning("[KC-STARTUP] This is non-critical - you can manually configure URIs in Keycloak admin console")
diff --git a/ushadow/backend/src/services/kubernetes_manager.py b/ushadow/backend/src/services/kubernetes_manager.py
index 148c69b4..e97dca94 100644
--- a/ushadow/backend/src/services/kubernetes_manager.py
+++ b/ushadow/backend/src/services/kubernetes_manager.py
@@ -339,6 +339,31 @@ async def update_cluster_infra_scan(
             logger.error(f"Error updating cluster infra scan: {e}")
             return False
 
+    async def delete_cluster_infra_scan(
+        self,
+        cluster_id: str,
+        namespace: str
+    ) -> bool:
+        """
+        Delete cached infrastructure scan for a specific namespace.
+
+        Args:
+            cluster_id: The cluster ID
+            namespace: The namespace scan to delete
+
+        Returns:
+            True if deletion was successful
+        """
+        try:
+            result = await self.clusters_collection.update_one(
+                {"cluster_id": cluster_id},
+                {"$unset": {f"infra_scans.{namespace}": ""}}
+            )
+            return result.modified_count > 0
+        except Exception as e:
+            logger.error(f"Error deleting cluster infra scan: {e}")
+            return False
+
     async def update_cluster(
         self,
         cluster_id: str,
diff --git a/ushadow/backend/src/services/tailscale_manager.py b/ushadow/backend/src/services/tailscale_manager.py
index bc201de5..c85bce48 100644
--- a/ushadow/backend/src/services/tailscale_manager.py
+++ b/ushadow/backend/src/services/tailscale_manager.py
@@ -707,6 +707,7 @@ def configure_base_routes(self,
         Sets up:
         - /api/* → backend (REST APIs through generic proxy)
         - /auth/* → backend (authentication)
+        - /keycloak/* → keycloak (OIDC authentication)
         - /* → frontend (SPA catch-all)
 
         Note: Chronicle and other deployed services are accessed via their own ports,
@@ -745,6 +746,11 @@ def configure_base_routes(self,
             if not self.add_serve_route(route, target):
                 success = False
 
+        # Keycloak authentication service
+        keycloak_target = "http://keycloak:8080"
+        if not self.add_serve_route("/keycloak", keycloak_target):
+            success = False
+
         # Chronicle WebSocket routes removed - Chronicle is now a deployed service
         # accessed via its own port (e.g., http://localhost:8090)
 
diff --git a/ushadow/frontend/src/App.tsx b/ushadow/frontend/src/App.tsx
index c9b83d95..8342ac2f 100644
--- a/ushadow/frontend/src/App.tsx
+++ b/ushadow/frontend/src/App.tsx
@@ -1,4 +1,5 @@
 import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom'
+import { useEffect } from 'react'
 import { ErrorBoundary } from './components/ErrorBoundary'
 import { ThemeProvider } from './contexts/ThemeContext'
 import { AuthProvider, useAuth } from './contexts/AuthContext'
@@ -72,6 +73,9 @@ function AppContent() {
 
   const { backendError, checkSetupStatus, isLoading, token } = useAuth()
 
+  // Note: Redirect URI registration moved to login flow (KeycloakAuthContext)
+  // to avoid unnecessary calls on every app mount
+
   // Show error page if backend has configuration errors
   if (backendError) {
     return <ErrorPage error={backendError} onRetry={checkSetupStatus} />
@@ -126,7 +130,7 @@ function AppContent() {
                 <Route path="wizard/mobile-app" element={<MobileAppWizard />} />
                 <Route path="wizard/speaker-recognition" element={<SpeakerRecognitionWizard />} />
                 <Route path="wizard/mycelia" element={<MyceliaWizard />} />
-                <Route path="chronicle" element={<ChroniclePage />} />
+                <Route path="chronicle" element={<FeatureRoute featureFlag="chronicle_page"><ChroniclePage /></FeatureRoute>} />
                 <Route path="conversations" element={<ConversationsPage />} />
                 <Route path="conversations/:id" element={<ConversationDetailPage />} />
                 <Route path="recording" element={<RecordingPage />} />
diff --git a/ushadow/frontend/src/auth/ServiceTokenManager.ts b/ushadow/frontend/src/auth/ServiceTokenManager.ts
index 11bc00c8..c789b8b2 100644
--- a/ushadow/frontend/src/auth/ServiceTokenManager.ts
+++ b/ushadow/frontend/src/auth/ServiceTokenManager.ts
@@ -44,13 +44,13 @@ export async function getServiceToken(
 
 /**
  * Get a Chronicle-compatible token for the current user.
- * Automatically retrieves the Keycloak token from session storage.
- * 
+ * Automatically retrieves the Keycloak token from local storage.
+ *
  * @returns Service token ready to use with Chronicle WebSocket
  */
 export async function getChronicleToken(): Promise<string> {
-  const keycloakToken = sessionStorage.getItem('kc_access_token')
-  
+  const keycloakToken = localStorage.getItem('kc_access_token')
+
   if (!keycloakToken) {
     throw new Error('No Keycloak token found. Please log in first.')
   }
diff --git a/ushadow/frontend/src/auth/TokenManager.ts b/ushadow/frontend/src/auth/TokenManager.ts
index 9dd36083..462cfa14 100644
--- a/ushadow/frontend/src/auth/TokenManager.ts
+++ b/ushadow/frontend/src/auth/TokenManager.ts
@@ -2,7 +2,7 @@
  * Token Manager
  *
  * Handles OIDC token storage, retrieval, and validation.
- * Uses sessionStorage for security (tokens cleared when tab closes).
+ * Uses localStorage for persistence across browser sessions.
  */
 
 import { jwtDecode } from 'jwt-decode'
@@ -50,73 +50,146 @@ interface DecodedToken {
 
 export class TokenManager {
   /**
-   * Store tokens in sessionStorage with expiry times
+   * Check if running inside launcher iframe
+   *
+   * Simple check: if we're in an iframe, assume it's the launcher.
+   * Will attempt to request tokens via postMessage (worst case: 5s timeout if wrong).
+   */
+  private static isInLauncher(): boolean {
+    return window.parent !== window
+  }
+
+  /**
+   * Store tokens in localStorage with expiry times
    */
   static storeTokens(tokens: TokenResponse): void {
     const now = Math.floor(Date.now() / 1000)
 
     if (tokens.access_token) {
-      sessionStorage.setItem(TOKEN_KEY, tokens.access_token)
+      localStorage.setItem(TOKEN_KEY, tokens.access_token)
     }
     if (tokens.refresh_token) {
-      sessionStorage.setItem(REFRESH_TOKEN_KEY, tokens.refresh_token)
+      localStorage.setItem(REFRESH_TOKEN_KEY, tokens.refresh_token)
     }
     if (tokens.id_token) {
-      sessionStorage.setItem(ID_TOKEN_KEY, tokens.id_token)
+      localStorage.setItem(ID_TOKEN_KEY, tokens.id_token)
     }
 
     // Store expiry times (OAuth2 standard: use expires_in from token response)
     if (tokens.expires_in) {
       const expiresAt = now + tokens.expires_in
-      sessionStorage.setItem(EXPIRES_AT_KEY, expiresAt.toString())
+      localStorage.setItem(EXPIRES_AT_KEY, expiresAt.toString())
       console.log('[TokenManager] Access token expires in:', tokens.expires_in, 'seconds')
     }
 
     // Store refresh token expiry if provided
     if (tokens.refresh_expires_in) {
       const refreshExpiresAt = now + tokens.refresh_expires_in
-      sessionStorage.setItem(REFRESH_EXPIRES_AT_KEY, refreshExpiresAt.toString())
+      localStorage.setItem(REFRESH_EXPIRES_AT_KEY, refreshExpiresAt.toString())
       console.log('[TokenManager] Refresh token expires in:', tokens.refresh_expires_in, 'seconds')
     }
   }
 
   /**
-   * Get access token from storage
+   * Get access token from storage (or from launcher if in iframe)
+   */
+  static async getAccessToken(): Promise<string | null> {
+    // If in launcher iframe, request token from parent
+    if (this.isInLauncher()) {
+      return this.getTokenFromLauncher()
+    }
+
+    // Otherwise use localStorage
+    return localStorage.getItem(TOKEN_KEY)
+  }
+
+  /**
+   * Get access token synchronously (for backwards compatibility)
+   */
+  static getAccessTokenSync(): string | null {
+    return localStorage.getItem(TOKEN_KEY)
+  }
+
+  /**
+   * Request token from launcher via postMessage
+   * Caches tokens in localStorage for synchronous access
    */
-  static getAccessToken(): string | null {
-    return sessionStorage.getItem(TOKEN_KEY)
+  private static async getTokenFromLauncher(): Promise<string | null> {
+    return new Promise((resolve) => {
+      console.log('[TokenManager] Requesting token from launcher...')
+
+      // Send request to launcher
+      window.parent.postMessage({ type: 'GET_KC_TOKEN' }, '*')
+
+      // Listen for response
+      const handler = (event: MessageEvent) => {
+        if (event.data.type === 'KC_TOKEN_RESPONSE') {
+          window.removeEventListener('message', handler)
+
+          const tokens = event.data.tokens
+          console.log('[TokenManager] Received tokens from launcher:', {
+            hasToken: !!tokens.token,
+            hasRefresh: !!tokens.refreshToken,
+            hasId: !!tokens.idToken
+          })
+
+          // Cache tokens in iframe localStorage for synchronous access
+          if (tokens.token) {
+            localStorage.setItem(TOKEN_KEY, tokens.token)
+          }
+          if (tokens.refreshToken) {
+            localStorage.setItem(REFRESH_TOKEN_KEY, tokens.refreshToken)
+          }
+          if (tokens.idToken) {
+            localStorage.setItem(ID_TOKEN_KEY, tokens.idToken)
+          }
+
+          console.log('[TokenManager] ✓ Tokens cached in iframe localStorage')
+          resolve(tokens.token)
+        }
+      }
+
+      window.addEventListener('message', handler)
+
+      // Timeout after 5 seconds
+      setTimeout(() => {
+        window.removeEventListener('message', handler)
+        console.warn('[TokenManager] ⚠️ Timeout requesting token from launcher')
+        resolve(null)
+      }, 5000)
+    })
   }
 
   /**
    * Get refresh token from storage
    */
   static getRefreshToken(): string | null {
-    return sessionStorage.getItem(REFRESH_TOKEN_KEY)
+    return localStorage.getItem(REFRESH_TOKEN_KEY)
   }
 
   /**
    * Get ID token from storage
    */
   static getIdToken(): string | null {
-    return sessionStorage.getItem(ID_TOKEN_KEY)
+    return localStorage.getItem(ID_TOKEN_KEY)
   }
 
   /**
    * Clear all tokens from storage
    */
   static clearTokens(): void {
-    sessionStorage.removeItem(TOKEN_KEY)
-    sessionStorage.removeItem(REFRESH_TOKEN_KEY)
-    sessionStorage.removeItem(ID_TOKEN_KEY)
-    sessionStorage.removeItem(EXPIRES_AT_KEY)
-    sessionStorage.removeItem(REFRESH_EXPIRES_AT_KEY)
+    localStorage.removeItem(TOKEN_KEY)
+    localStorage.removeItem(REFRESH_TOKEN_KEY)
+    localStorage.removeItem(ID_TOKEN_KEY)
+    localStorage.removeItem(EXPIRES_AT_KEY)
+    localStorage.removeItem(REFRESH_EXPIRES_AT_KEY)
   }
 
   /**
    * Get access token expiry info from storage (OAuth2 standard)
    */
   static getTokenExpiry(): { expiresAt: number; expiresIn: number } | null {
-    const expiresAtStr = sessionStorage.getItem(EXPIRES_AT_KEY)
+    const expiresAtStr = localStorage.getItem(EXPIRES_AT_KEY)
     if (!expiresAtStr) return null
 
     const expiresAt = parseInt(expiresAtStr, 10)
@@ -130,7 +203,7 @@ export class TokenManager {
    * Get refresh token expiry info from storage (OAuth2 standard)
    */
   static getRefreshTokenExpiry(): { expiresAt: number; expiresIn: number } | null {
-    const expiresAtStr = sessionStorage.getItem(REFRESH_EXPIRES_AT_KEY)
+    const expiresAtStr = localStorage.getItem(REFRESH_EXPIRES_AT_KEY)
     if (!expiresAtStr) return null
 
     const expiresAt = parseInt(expiresAtStr, 10)
@@ -142,11 +215,77 @@ export class TokenManager {
 
   /**
    * Check if user is authenticated (has valid token)
+   *
+   * If running in launcher, attempts to get token from parent first.
+   * This is an async operation that will resolve quickly (cached or from launcher).
+   */
+  static async isAuthenticatedAsync(): Promise<boolean> {
+    // If in launcher, request token from parent first
+    if (this.isInLauncher()) {
+      const token = await this.getTokenFromLauncher()
+      if (!token) {
+        console.log('[TokenManager] No token from launcher')
+        return false
+      }
+      // Token is now cached in localStorage, continue with validation below
+    }
+
+    // Check for Keycloak token (localStorage)
+    let token = localStorage.getItem(TOKEN_KEY)
+
+    // Check for native token (localStorage - persists)
+    if (!token) {
+      token = localStorage.getItem('ushadow_access_token')
+    }
+
+    if (!token) {
+      console.log('[TokenManager] No access token found in localStorage')
+      return false
+    }
+
+    try {
+      const decoded = jwtDecode<DecodedToken>(token)
+      const now = Math.floor(Date.now() / 1000)
+      const isValid = decoded.exp > now
+      const expiresIn = decoded.exp - now
+
+      console.log('[TokenManager] Token check:', {
+        isValid,
+        expiresIn: `${Math.floor(expiresIn / 60)}m ${expiresIn % 60}s`,
+        expiresAt: new Date(decoded.exp * 1000).toISOString(),
+        now: new Date(now * 1000).toISOString()
+      })
+
+      if (!isValid) {
+        console.warn('[TokenManager] ⚠️ Token EXPIRED!', {
+          expiredAgo: `${Math.floor(Math.abs(expiresIn) / 60)}m ${Math.abs(expiresIn) % 60}s ago`
+        })
+      }
+
+      return isValid
+    } catch (error) {
+      console.error('[TokenManager] Invalid token:', error)
+      return false
+    }
+  }
+
+  /**
+   * Check if user is authenticated (synchronous version)
+   *
+   * Note: This only checks localStorage and won't request from launcher.
+   * Use isAuthenticatedAsync() for launcher-aware check.
    */
   static isAuthenticated(): boolean {
-    const token = this.getAccessToken()
+    // Check for Keycloak token first (localStorage)
+    let token = localStorage.getItem(TOKEN_KEY)
+
+    // Check for native token (localStorage - persists)
+    if (!token) {
+      token = localStorage.getItem('ushadow_access_token')
+    }
+
     if (!token) {
-      console.log('[TokenManager] No access token found')
+      console.log('[TokenManager] No access token found in localStorage')
       return false
     }
 
@@ -177,10 +316,10 @@ export class TokenManager {
   }
 
   /**
-   * Get user info from decoded token
+   * Get user info from decoded token (synchronous - uses localStorage)
    */
   static getUserInfo(): any | null {
-    const token = this.getAccessToken()
+    const token = localStorage.getItem(TOKEN_KEY)
     if (!token) return null
 
     try {
diff --git a/ushadow/frontend/src/auth/config.ts b/ushadow/frontend/src/auth/config.ts
index 53e815f5..a2ba3dad 100644
--- a/ushadow/frontend/src/auth/config.ts
+++ b/ushadow/frontend/src/auth/config.ts
@@ -25,67 +25,22 @@ function getBackendUrl(): string {
   return import.meta.env.VITE_BACKEND_URL || 'http://localhost:8000'
 }
 
-/**
- * Get Keycloak URL for frontend browser access.
- *
- * Frontend always uses localhost:8081 because:
- * - When accessing locally, Keycloak is on localhost:8081
- * - When accessing via Tailscale, Tailscale routes to the same machine where localhost:8081 works
- * - Backend uses a different URL (internal Docker network) for server-to-server communication
- */
-function getKeycloakUrl(): string {
-  return 'http://localhost:8081'
-}
-
 // Backend config is static (based on origin)
 export const backendConfig = {
   url: getBackendUrl(),
 }
 
-// Internal state for Keycloak config (can be updated from backend settings)
-let _keycloakRealm = 'ushadow'
-let _keycloakClientId = 'ushadow-frontend'
-
-// Keycloak config - URL is always dynamic based on current origin
-// Use Object.defineProperty to create getters that recalculate on each access
-export const keycloakConfig: {
-  readonly url: string
-  realm: string
-  clientId: string
-} = Object.defineProperties({}, {
-  url: {
-    get() {
-      return getKeycloakUrl() // Recalculates every time it's accessed
-    },
-    enumerable: true
-  },
-  realm: {
-    get() {
-      return _keycloakRealm
-    },
-    set(value: string) {
-      _keycloakRealm = value
-    },
-    enumerable: true
-  },
-  clientId: {
-    get() {
-      return _keycloakClientId
-    },
-    set(value: string) {
-      _keycloakClientId = value
-    },
-    enumerable: true
-  }
-}) as any
+// Keycloak config will be populated from backend settings
+// Default to localhost for initial load, then update from backend
+export let keycloakConfig = {
+  url: 'http://localhost:8081',
+  realm: 'ushadow',
+  clientId: 'ushadow-frontend',
+}
 
 /**
  * Update Keycloak config from backend settings.
  * Should be called on app initialization and after settings changes.
- *
- * Note: The URL is always determined dynamically based on the current origin,
- * not from settings. This allows seamless switching between localhost and Tailscale.
- * Settings are only used for realm and clientId configuration.
  */
 export function updateKeycloakConfig(settings: {
   keycloak?: {
@@ -95,16 +50,51 @@ export function updateKeycloakConfig(settings: {
   }
 }) {
   if (settings.keycloak) {
-    if (settings.keycloak.realm) {
-      _keycloakRealm = settings.keycloak.realm
+    keycloakConfig = {
+      url: settings.keycloak.public_url || keycloakConfig.url,
+      realm: settings.keycloak.realm || keycloakConfig.realm,
+      clientId: settings.keycloak.frontend_client_id || keycloakConfig.clientId,
     }
-    if (settings.keycloak.frontend_client_id) {
-      _keycloakClientId = settings.keycloak.frontend_client_id
-    }
-    console.log('[Config] Updated Keycloak config:', {
-      url: keycloakConfig.url,
-      realm: keycloakConfig.realm,
-      clientId: keycloakConfig.clientId
+    console.log('[Config] Updated Keycloak config from backend:', keycloakConfig)
+  }
+}
+
+/**
+ * Register this environment's OAuth redirect URI with Keycloak.
+ * Called on app initialization to enable dynamic redirect URI registration.
+ *
+ * This allows multiple environments running on different ports to register
+ * their callback URLs without pre-configuring them in Keycloak.
+ */
+export async function registerRedirectUri(): Promise<void> {
+  // Build redirect URI for this environment
+  const redirectUri = `${window.location.origin}/oauth/callback`
+  const postLogoutRedirectUri = `${window.location.origin}/`
+
+  try {
+    console.log('[Auth] Registering redirect URI with Keycloak:', redirectUri)
+
+    const response = await fetch(`${backendConfig.url}/api/auth/register-redirect-uri`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        redirect_uri: redirectUri,
+        post_logout_redirect_uri: postLogoutRedirectUri,
+      }),
     })
+
+    if (!response.ok) {
+      const error = await response.text()
+      console.warn('[Auth] Failed to register redirect URI:', error)
+      return
+    }
+
+    const result = await response.json()
+    console.log('[Auth] ✓ Redirect URI registered:', result.redirect_uri)
+  } catch (error) {
+    // Non-critical error - OAuth will fail if not registered, but app can still load
+    console.warn('[Auth] Error registering redirect URI:', error)
   }
 }
diff --git a/ushadow/frontend/src/contexts/KeycloakAuthContext.tsx b/ushadow/frontend/src/contexts/KeycloakAuthContext.tsx
index 577067ee..8e6e8c18 100644
--- a/ushadow/frontend/src/contexts/KeycloakAuthContext.tsx
+++ b/ushadow/frontend/src/contexts/KeycloakAuthContext.tsx
@@ -21,7 +21,7 @@ interface KeycloakAuthContextType {
   login: (redirectUri?: string) => void
   register: (redirectUri?: string) => void
   logout: (redirectUri?: string) => void
-  getAccessToken: () => string | null
+  getAccessToken: () => Promise<string | null>
   handleCallback: (code: string, state: string) => Promise<void>
 }
 
@@ -65,7 +65,7 @@ export function KeycloakAuthProvider({ children }: { children: ReactNode }) {
         setRefreshTimeoutId(null)
       }
 
-      const token = TokenManager.getAccessToken()
+      const token = TokenManager.getAccessTokenSync()
       const refreshToken = TokenManager.getRefreshToken()
 
       if (!token || !refreshToken) {
@@ -170,32 +170,53 @@ export function KeycloakAuthProvider({ children }: { children: ReactNode }) {
   }
 
   useEffect(() => {
-    // Re-check auth state on mount (in case token expired between initial check and mount)
-    const authenticated = TokenManager.isAuthenticated()
-    if (authenticated !== isAuthenticated) {
-      setIsAuthenticated(authenticated)
-      if (authenticated) {
-        const info = TokenManager.getUserInfo()
-        setUserInfo(info)
-        // Fetch MongoDB user data
+    // Check auth state with launcher support (async)
+    const checkAuth = async () => {
+      console.log('[KC-AUTH] Checking authentication (launcher-aware)...')
+      const authenticated = await TokenManager.isAuthenticatedAsync()
+      console.log('[KC-AUTH] Authentication result:', authenticated)
+
+      if (authenticated !== isAuthenticated) {
+        setIsAuthenticated(authenticated)
+        if (authenticated) {
+          const info = TokenManager.getUserInfo()
+          setUserInfo(info)
+          // Fetch MongoDB user data
+          fetchUserData()
+          // Set up token refresh
+          setupTokenRefresh()
+        } else {
+          setUserInfo(null)
+          setUser(null)
+          setIsLoading(false)
+        }
+      } else if (authenticated && !user) {
+        // If already authenticated but no user data, fetch it
         fetchUserData()
-        // Set up token refresh
-        setupTokenRefresh()
-      } else {
-        setUserInfo(null)
-        setUser(null)
+        // Set up token refresh if not already set
+        if (!refreshTimeoutId) {
+          setupTokenRefresh()
+        }
+      } else if (!authenticated) {
+        setIsLoading(false)
       }
-    } else if (authenticated && !user) {
-      // If already authenticated but no user data, fetch it
-      fetchUserData()
-      // Set up token refresh if not already set
-      if (!refreshTimeoutId) {
-        setupTokenRefresh()
+    }
+
+    checkAuth()
+
+    // Listen for token updates from launcher
+    const handleMessage = (event: MessageEvent) => {
+      if (event.data.type === 'KC_TOKENS_UPDATED') {
+        console.log('[KC-AUTH] Received token update notification from launcher, re-checking auth...')
+        checkAuth()
       }
     }
 
+    window.addEventListener('message', handleMessage)
+
     // Clean up on unmount
     return () => {
+      window.removeEventListener('message', handleMessage)
       if (refreshTimeoutId) {
         console.log('[KC-AUTH] Cleaning up token refresh timeout on unmount')
         clearTimeout(refreshTimeoutId)
@@ -288,10 +309,10 @@ export function KeycloakAuthProvider({ children }: { children: ReactNode }) {
 
     // Store tokens
     TokenManager.storeTokens(tokens)
-    console.log('[KC-AUTH] Tokens stored in sessionStorage')
+    console.log('[KC-AUTH] Tokens stored in localStorage')
 
     // Verify storage worked
-    const storedToken = sessionStorage.getItem('kc_access_token')
+    const storedToken = localStorage.getItem('kc_access_token')
     console.log('[KC-AUTH] Verified storage:', {
       hasStoredToken: !!storedToken,
       storedTokenPreview: storedToken?.substring(0, 30) + '...'
@@ -312,8 +333,8 @@ export function KeycloakAuthProvider({ children }: { children: ReactNode }) {
     sessionStorage.removeItem('oauth_state')
   }
 
-  const getAccessToken = () => {
-    return TokenManager.getAccessToken()
+  const getAccessToken = async () => {
+    return await TokenManager.getAccessToken()
   }
 
   return (
diff --git a/ushadow/frontend/src/hooks/useWebRecording.ts b/ushadow/frontend/src/hooks/useWebRecording.ts
index 662b31fb..31454292 100644
--- a/ushadow/frontend/src/hooks/useWebRecording.ts
+++ b/ushadow/frontend/src/hooks/useWebRecording.ts
@@ -303,7 +303,7 @@ export const useWebRecording = (): WebRecordingReturn => {
 
       // Get auth token - prefer Keycloak token, fallback to legacy token
       // This matches the pattern used in api.ts request interceptor
-      const kcToken = sessionStorage.getItem('kc_access_token')
+      const kcToken = localStorage.getItem('kc_access_token')
       const legacyToken = localStorage.getItem(getStorageKey('token'))
       const token = kcToken || legacyToken
 
diff --git a/ushadow/frontend/src/pages/KubernetesClustersPage.tsx b/ushadow/frontend/src/pages/KubernetesClustersPage.tsx
index 1b6f2f00..008cf391 100644
--- a/ushadow/frontend/src/pages/KubernetesClustersPage.tsx
+++ b/ushadow/frontend/src/pages/KubernetesClustersPage.tsx
@@ -90,6 +90,11 @@ export default function KubernetesClustersPage() {
   const [namespace, setNamespace] = useState('default')
   const [error, setError] = useState<string | null>(null)
 
+  // Ingress configuration editing
+  const [editingCluster, setEditingCluster] = useState<string | null>(null)
+  const [ingressDomain, setIngressDomain] = useState('')
+  const [ingressEnabledByDefault, setIngressEnabledByDefault] = useState(false)
+
   useEffect(() => {
     loadClusters()
   }, [])
@@ -196,6 +201,29 @@ export default function KubernetesClustersPage() {
     }
   }
 
+  const handleDeleteInfraScan = async (clusterId: string, namespace: string) => {
+    if (!confirm(`Delete infrastructure scan for namespace "${namespace}"?`)) {
+      return
+    }
+
+    try {
+      await kubernetesApi.deleteInfraScan(clusterId, namespace)
+
+      // Remove from local state
+      setScanResults(prev => {
+        const updated = { ...prev }
+        delete updated[`${clusterId}-${namespace}`]
+        return updated
+      })
+
+      // Refresh clusters to update infra_scans
+      await loadClusters()
+    } catch (err: any) {
+      console.error('Error deleting infrastructure scan:', err)
+      alert(`Failed to delete scan: ${err.response?.data?.detail || err.message}`)
+    }
+  }
+
   const handleOpenNamespaceSelector = (clusterId: string) => {
     const cluster = clusters.find(c => c.cluster_id === clusterId)
     setScanNamespace(cluster?.namespace || 'ushadow')
@@ -454,13 +482,23 @@ export default function KubernetesClustersPage() {
                                 {foundInfra} in <code className="px-1 py-0.5 bg-success-100 dark:bg-success-900/40 rounded text-xs">{namespace}</code>
                               </span>
                             </div>
-                            <button
-                              onClick={() => setShowScanResults(key)}
-                              className="text-xs text-success-600 dark:text-success-400 hover:underline"
-                              data-testid={`view-scan-results-${key}`}
-                            >
-                              View
-                            </button>
+                            <div className="flex items-center space-x-2">
+                              <button
+                                onClick={() => setShowScanResults(key)}
+                                className="text-xs text-success-600 dark:text-success-400 hover:underline"
+                                data-testid={`view-scan-results-${key}`}
+                              >
+                                View
+                              </button>
+                              <button
+                                onClick={() => handleDeleteInfraScan(cluster.cluster_id, namespace)}
+                                className="p-1 text-neutral-500 hover:text-error-600 dark:text-neutral-400 dark:hover:text-error-400"
+                                title={`Delete scan for ${namespace}`}
+                                data-testid={`delete-scan-${key}`}
+                              >
+                                <Trash2 className="h-3.5 w-3.5" />
+                              </button>
+                            </div>
                           </div>
                         </div>
                       )
@@ -482,6 +520,107 @@ export default function KubernetesClustersPage() {
                   </div>
                 )}
 
+                {/* Ingress Configuration */}
+                <div className="mt-4 pt-4 border-t border-neutral-200 dark:border-neutral-700">
+                  <div className="flex items-center justify-between mb-2">
+                    <h4 className="text-sm font-medium text-neutral-700 dark:text-neutral-300">
+                      Ingress Configuration
+                    </h4>
+                    {editingCluster !== cluster.cluster_id && (
+                      <button
+                        onClick={() => {
+                          setEditingCluster(cluster.cluster_id)
+                          setIngressDomain(cluster.ingress_domain || '')
+                          setIngressEnabledByDefault(cluster.ingress_enabled_by_default || false)
+                        }}
+                        className="text-xs text-primary-600 hover:underline"
+                        data-testid={`edit-ingress-${cluster.cluster_id}`}
+                      >
+                        Configure
+                      </button>
+                    )}
+                  </div>
+
+                  {editingCluster === cluster.cluster_id ? (
+                    <div className="space-y-3 p-3 bg-neutral-50 dark:bg-neutral-800/50 rounded">
+                      <div>
+                        <label className="block text-xs text-neutral-600 dark:text-neutral-400 mb-1">
+                          Ingress Domain (e.g., "shadow" for *.shadow)
+                        </label>
+                        <input
+                          type="text"
+                          value={ingressDomain}
+                          onChange={(e) => {
+                            const value = e.target.value.toLowerCase()
+                            if (/^[a-z0-9.-]*$/.test(value)) {
+                              setIngressDomain(value)
+                            }
+                          }}
+                          placeholder="shadow"
+                          className="w-full px-3 py-2 text-sm rounded border border-neutral-300 dark:border-neutral-600 bg-white dark:bg-neutral-800 text-neutral-900 dark:text-neutral-100"
+                          data-testid={`ingress-domain-input-${cluster.cluster_id}`}
+                        />
+                      </div>
+
+                      <label className="flex items-center space-x-2 text-sm">
+                        <input
+                          type="checkbox"
+                          checked={ingressEnabledByDefault}
+                          onChange={(e) => setIngressEnabledByDefault(e.target.checked)}
+                          className="rounded"
+                          data-testid={`ingress-default-checkbox-${cluster.cluster_id}`}
+                        />
+                        <span className="text-neutral-700 dark:text-neutral-300">Enable ingress by default for new deployments</span>
+                      </label>
+
+                      <div className="flex justify-end space-x-2">
+                        <button
+                          onClick={() => setEditingCluster(null)}
+                          className="px-3 py-1 text-sm text-neutral-600 hover:text-neutral-800 dark:text-neutral-400 dark:hover:text-neutral-200"
+                        >
+                          Cancel
+                        </button>
+                        <button
+                          onClick={async () => {
+                            try {
+                              await kubernetesApi.updateCluster(cluster.cluster_id, {
+                                ingress_domain: ingressDomain || undefined,
+                                ingress_enabled_by_default: ingressEnabledByDefault,
+                                tailscale_magicdns_enabled: !!ingressDomain
+                              })
+                              setEditingCluster(null)
+                              await loadClusters()
+                            } catch (err: any) {
+                              alert(`Failed to update cluster: ${err.message}`)
+                            }
+                          }}
+                          className="btn-primary px-3 py-1 text-sm"
+                          data-testid={`save-ingress-${cluster.cluster_id}`}
+                        >
+                          Save
+                        </button>
+                      </div>
+                    </div>
+                  ) : (
+                    <div className="text-sm">
+                      {cluster.ingress_domain ? (
+                        <div className="space-y-1">
+                          <div className="text-neutral-600 dark:text-neutral-400">
+                            Domain: <code className="px-1 bg-neutral-100 dark:bg-neutral-700 rounded">.{cluster.ingress_domain}</code>
+                          </div>
+                          <div className="text-neutral-600 dark:text-neutral-400">
+                            Auto-enable: {cluster.ingress_enabled_by_default ? '✓ Yes' : '✗ No'}
+                          </div>
+                        </div>
+                      ) : (
+                        <div className="text-neutral-500 dark:text-neutral-400 text-xs">
+                          Not configured
+                        </div>
+                      )}
+                    </div>
+                  )}
+                </div>
+
                 {/* Actions */}
                 <div className="flex justify-between items-center pt-4 border-t border-neutral-200 dark:border-neutral-700 gap-2">
                   <div className="flex gap-2">
@@ -614,36 +753,54 @@ export default function KubernetesClustersPage() {
       {showScanResults && renderInfraScanResults(showScanResults)}
 
       {/* Deploy to K8s Modal */}
-      {showDeployModal && selectedClusterForDeploy && (
-        <DeployModal
-          isOpen={showDeployModal}
-          onClose={() => {
-            setShowDeployModal(false)
-            setSelectedClusterForDeploy(null)
-          }}
-          target={{
-            id: selectedClusterForDeploy.deployment_target_id,
-            type: 'k8s',
-            name: selectedClusterForDeploy.name,
-            identifier: selectedClusterForDeploy.cluster_id,
-            environment: selectedClusterForDeploy.environment || 'unknown',
-            status: selectedClusterForDeploy.status || 'unknown',
-            namespace: selectedClusterForDeploy.namespace,
-            infrastructure: Object.keys(scanResults).find(key => key.startsWith(selectedClusterForDeploy.cluster_id))
-              ? scanResults[Object.keys(scanResults).find(key => key.startsWith(selectedClusterForDeploy.cluster_id))!].infra_services
-              : undefined,
-            provider: selectedClusterForDeploy.labels?.provider,
-            region: selectedClusterForDeploy.labels?.region,
-            is_leader: undefined,
-            raw_metadata: selectedClusterForDeploy
-          }}
-          infraServices={
-            Object.keys(scanResults).find(key => key.startsWith(selectedClusterForDeploy.cluster_id))
-              ? scanResults[Object.keys(scanResults).find(key => key.startsWith(selectedClusterForDeploy.cluster_id))!].infra_services
-              : undefined
+      {showDeployModal && selectedClusterForDeploy && (() => {
+        // Get infrastructure services - exclude target namespace as it contains deployed services
+        let infraServices: any = undefined
+        if (selectedClusterForDeploy.infra_scans) {
+          const targetNs = selectedClusterForDeploy.namespace || 'ushadow'
+
+          // Filter out the target namespace from infra scans
+          const infraScanKeys = Object.keys(selectedClusterForDeploy.infra_scans).filter(
+            ns => ns !== targetNs
+          )
+
+          console.log(`🔍 [K8sPage] Target namespace: ${targetNs}, available infra scans:`, infraScanKeys)
+
+          // Use first available infrastructure scan (not the target namespace)
+          if (infraScanKeys.length > 0) {
+            const infraNs = infraScanKeys[0]
+            infraServices = selectedClusterForDeploy.infra_scans[infraNs]
+            console.log(`🔍 [K8sPage] Using infrastructure from '${infraNs}':`, infraServices?.mongo)
+          } else {
+            console.log(`⚠️ [K8sPage] No infrastructure scans available (target namespace excluded)`)
           }
-        />
-      )}
+        }
+
+        return (
+          <DeployModal
+            isOpen={showDeployModal}
+            onClose={() => {
+              setShowDeployModal(false)
+              setSelectedClusterForDeploy(null)
+            }}
+            target={{
+              id: selectedClusterForDeploy.deployment_target_id,
+              type: 'k8s',
+              name: selectedClusterForDeploy.name,
+              identifier: selectedClusterForDeploy.cluster_id,
+              environment: selectedClusterForDeploy.environment || 'unknown',
+              status: selectedClusterForDeploy.status || 'unknown',
+              namespace: selectedClusterForDeploy.namespace,
+              infrastructure: infraServices,
+              provider: selectedClusterForDeploy.labels?.provider,
+              region: selectedClusterForDeploy.labels?.region,
+              is_leader: undefined,
+              raw_metadata: selectedClusterForDeploy
+            }}
+            infraServices={infraServices}
+          />
+        )
+      })()}
 
       {/* Add Cluster Modal */}
       {showAddModal && createPortal(
diff --git a/ushadow/frontend/src/pages/LoginPage.tsx b/ushadow/frontend/src/pages/LoginPage.tsx
index b0a91154..7542a23b 100644
--- a/ushadow/frontend/src/pages/LoginPage.tsx
+++ b/ushadow/frontend/src/pages/LoginPage.tsx
@@ -2,35 +2,72 @@ import React from 'react'
 import { useNavigate, useLocation } from 'react-router-dom'
 import { useKeycloakAuth } from '../contexts/KeycloakAuthContext'
 import AuthHeader from '../components/auth/AuthHeader'
-import { LogIn } from 'lucide-react'
+import { LogIn, ExternalLink, UserPlus } from 'lucide-react'
 
 export default function LoginPage() {
   const navigate = useNavigate()
   const location = useLocation()
   const { isAuthenticated, isLoading, login, register } = useKeycloakAuth()
 
-  // Get the intended destination from router state (set by ProtectedRoute)
-  // or from query param (used by share pages and other public routes)
+  // Parse query parameters once
   const searchParams = new URLSearchParams(location.search)
+  const isLauncherMode = searchParams.get('launcher') === 'true'
   const returnTo = searchParams.get('returnTo')
-  const from = (location.state as { from?: string })?.from || returnTo || '/'
+
+  // Get the intended destination from router state (set by ProtectedRoute) or from query param
+  // Default to /cluster instead of / to avoid redirect loop
+  const from = (location.state as { from?: string })?.from || returnTo || '/cluster'
 
   // After successful login, redirect to intended destination
   // Note: Don't redirect if we're on the callback page - that's handled by OAuthCallback component
   React.useEffect(() => {
     if (isAuthenticated && location.pathname !== '/oauth/callback') {
+      console.log('[LoginPage] Already authenticated, redirecting to:', from)
       navigate(from, { replace: true, state: { fromAuth: true } })
     }
   }, [isAuthenticated, navigate, from, location.pathname])
 
-  const handleLogin = () => {
+  const handleLogin = async () => {
+    console.log('[LoginPage] Login button clicked')
+
+    // If in launcher mode, open in external browser
+    if (isLauncherMode) {
+      console.log('[LoginPage] Launcher mode detected, opening in browser')
+      const url = new URL(window.location.href)
+      url.searchParams.delete('launcher')
+      window.open(url.toString(), '_blank')
+      return
+    }
+
     // Redirect to Keycloak login page
-    login(from)
+    console.log('[LoginPage] Starting Keycloak SSO login, redirect target:', from)
+    try {
+      await login(from)
+    } catch (error) {
+      console.error('[LoginPage] Login failed:', error)
+    }
   }
 
-  const handleRegister = () => {
+  const handleRegister = async () => {
+    console.log('[LoginPage] Register button clicked')
+
+    // If in launcher mode, open in external browser
+    if (isLauncherMode) {
+      console.log('[LoginPage] Launcher mode detected, opening in browser')
+      const url = new URL(window.location.href)
+      url.searchParams.delete('launcher')
+      url.searchParams.set('register', 'true')
+      window.open(url.toString(), '_blank')
+      return
+    }
+
     // Redirect to Keycloak registration page
-    register(from)
+    console.log('[LoginPage] Starting Keycloak SSO registration, redirect target:', from)
+    try {
+      await register(from)
+    } catch (error) {
+      console.error('[LoginPage] Registration failed:', error)
+    }
   }
 
   // Show loading while checking authentication
@@ -95,6 +132,26 @@ export default function LoginPage() {
               border: '1px solid #27272a',
             }}
           >
+            {isLauncherMode && (
+              <div
+                className="rounded-lg p-4 mb-4"
+                style={{
+                  backgroundColor: '#3b82f6',
+                  color: '#ffffff',
+                }}
+              >
+                <div className="flex items-start space-x-3">
+                  <ExternalLink className="h-5 w-5 flex-shrink-0 mt-0.5" />
+                  <div className="text-sm">
+                    <p className="font-semibold mb-1">Authentication Required</p>
+                    <p className="opacity-90">
+                      Authentication must be completed in your browser. Click below to continue.
+                    </p>
+                  </div>
+                </div>
+              </div>
+            )}
+
             <div className="text-center space-y-2">
               <h2 className="text-xl font-semibold" style={{ color: '#ffffff' }}>
                 Welcome to Ushadow
@@ -105,50 +162,40 @@ export default function LoginPage() {
             </div>
 
             {/* Sign in with Keycloak Button */}
-            <button
-              onClick={handleLogin}
-              className="w-full flex items-center justify-center space-x-2 px-6 py-3 rounded-lg font-medium transition-all hover:opacity-90 focus:outline-none focus:ring-2 focus:ring-offset-2"
-              style={{
-                backgroundColor: '#3b82f6',
-                color: '#ffffff',
-                border: 'none',
-              }}
-              data-testid="login-button-keycloak"
-            >
-              <LogIn className="h-5 w-5" />
-              <span>Sign in with Keycloak</span>
-            </button>
-
-            <div className="text-center">
-              <p className="text-xs" style={{ color: '#71717a' }}>
-                You'll be redirected to Keycloak for secure authentication
-              </p>
-            </div>
+            <div className="space-y-4">
+              <button
+                onClick={handleLogin}
+                className="w-full flex items-center justify-center space-x-2 px-6 py-3 rounded-lg font-medium transition-all hover:opacity-90 focus:outline-none focus:ring-2 focus:ring-offset-2"
+                style={{
+                  backgroundColor: '#3b82f6',
+                  color: '#ffffff',
+                  border: 'none',
+                }}
+                data-testid="login-button-keycloak"
+              >
+                <LogIn className="h-5 w-5" />
+                <span>Sign in with Keycloak</span>
+              </button>
 
-            {/* Divider */}
-            <div className="relative my-6">
-              <div className="absolute inset-0 flex items-center">
-                <div className="w-full border-t" style={{ borderColor: '#27272a' }}></div>
-              </div>
-              <div className="relative flex justify-center text-xs uppercase">
-                <span style={{ backgroundColor: '#1a1a1a', color: '#71717a', padding: '0 8px' }}>
-                  Or
-                </span>
-              </div>
-            </div>
+              <button
+                onClick={handleRegister}
+                className="w-full flex items-center justify-center space-x-2 px-6 py-3 rounded-lg font-medium transition-all hover:opacity-90 focus:outline-none focus:ring-2 focus:ring-offset-2"
+                style={{
+                  backgroundColor: '#9333ea',
+                  color: '#ffffff',
+                  border: 'none',
+                }}
+                data-testid="register-button-keycloak"
+              >
+                <UserPlus className="h-5 w-5" />
+                <span>Register with Keycloak</span>
+              </button>
 
-            <div className="text-center">
-              <p className="text-sm" style={{ color: '#a1a1aa' }}>
-                Don't have an account?{' '}
-                <button
-                  onClick={handleRegister}
-                  className="font-medium hover:underline transition-colors"
-                  style={{ color: '#3b82f6' }}
-                  data-testid="register-link"
-                >
-                  Create one now
-                </button>
-              </p>
+              <div className="text-center">
+                <p className="text-xs" style={{ color: '#71717a' }}>
+                  You'll be redirected to Keycloak for authentication
+                </p>
+              </div>
             </div>
           </div>
 
diff --git a/ushadow/frontend/src/services/api.ts b/ushadow/frontend/src/services/api.ts
index 725ad882..6555cc19 100644
--- a/ushadow/frontend/src/services/api.ts
+++ b/ushadow/frontend/src/services/api.ts
@@ -62,14 +62,17 @@ export const api = axios.create({
 
 // Add request interceptor to include auth token
 api.interceptors.request.use((config) => {
-  // Check for Keycloak token first (in sessionStorage)
-  const kcToken = sessionStorage.getItem('kc_access_token')
+  // Check for Keycloak token first (in localStorage)
+  const kcToken = localStorage.getItem('kc_access_token')
+
+  // Check for native login token (in localStorage - persists)
+  const nativeToken = localStorage.getItem('ushadow_access_token')
 
   // Fallback to legacy JWT token (in localStorage)
   const legacyToken = localStorage.getItem(getStorageKey('token'))
 
-  // Prefer Keycloak token if both are present
-  const token = kcToken || legacyToken
+  // Priority: Keycloak > Native > Legacy (all in localStorage now)
+  const token = kcToken || nativeToken || legacyToken
 
   if (token) {
     config.headers.Authorization = `Bearer ${token}`
@@ -94,18 +97,13 @@ api.interceptors.response.use(
         // Let the component handle the service-specific auth error
       } else {
         // Token expired or invalid on core ushadow endpoints, redirect to login
-        console.warn('🔐 API: 401 Unauthorized on ushadow endpoint - clearing all tokens and redirecting to login')
-
-        // Clear legacy token
+        console.warn('🔐 API: 401 Unauthorized on ushadow endpoint - clearing token and redirecting to login')
         localStorage.removeItem(getStorageKey('token'))
-
-        // Clear Keycloak tokens (IMPORTANT: prevents infinite loop with invalid tokens)
-        sessionStorage.removeItem('kc_access_token')
-        sessionStorage.removeItem('kc_refresh_token')
-        sessionStorage.removeItem('kc_id_token')
-        sessionStorage.removeItem('kc_expires_at')
-        sessionStorage.removeItem('kc_refresh_expires_at')
-
+        localStorage.removeItem('ushadow_access_token')
+        localStorage.removeItem('ushadow_user')
+        localStorage.removeItem('kc_access_token')
+        localStorage.removeItem('kc_refresh_token')
+        localStorage.removeItem('kc_id_token')
         window.location.href = '/login'
       }
     } else if (error.code === 'ECONNABORTED') {
@@ -660,7 +658,16 @@ export const kubernetesApi = {
     api.get<KubernetesCluster>(`/api/kubernetes/${clusterId}`),
   removeCluster: (clusterId: string) =>
     api.delete(`/api/kubernetes/${clusterId}`),
-  updateCluster: (clusterId: string, updates: Partial<Pick<KubernetesCluster, 'name' | 'namespace' | 'labels' | 'ingress_domain' | 'ingress_class' | 'ingress_enabled_by_default' | 'tailscale_magicdns_enabled'>>) =>
+  updateCluster: (clusterId: string, updates: {
+    name?: string
+    namespace?: string
+    infra_namespace?: string
+    labels?: Record<string, string>
+    ingress_domain?: string
+    ingress_class?: string
+    ingress_enabled_by_default?: boolean
+    tailscale_magicdns_enabled?: boolean
+  }) =>
     api.patch<KubernetesCluster>(`/api/kubernetes/${clusterId}`, updates),
 
   // Service management
@@ -675,6 +682,10 @@ export const kubernetesApi = {
       `/api/kubernetes/${clusterId}/scan-infra`,
       { namespace }
     ),
+  deleteInfraScan: (clusterId: string, namespace: string) =>
+    api.delete<{ cluster_id: string; namespace: string; message: string }>(
+      `/api/kubernetes/${clusterId}/scan-infra/${namespace}`
+    ),
   createEnvmap: (clusterId: string, data: { service_name: string; namespace?: string; env_vars: Record<string, string> }) =>
     api.post<{ success: boolean; configmap: string | null; secret: string | null; namespace: string }>(
       `/api/kubernetes/${clusterId}/envmap`,
@@ -1620,14 +1631,7 @@ export const tailscaleApi = {
   provisionCertInContainer: (hostname: string) =>
     api.post<CertificateStatus>('/api/tailscale/container/provision-cert', null, { params: { hostname } }),
   configureServe: (config: TailscaleConfig) =>
-    api.post<{
-      status: string;
-      message: string;
-      routes?: string;
-      hostname?: string;
-      keycloak_registered?: boolean;
-      keycloak_message?: string;
-    }>('/api/tailscale/configure-serve', config),
+    api.post<{ status: string; message: string; routes?: string; hostname?: string }>('/api/tailscale/configure-serve', config),
   getServeStatus: () =>
     api.get<{ status: string; routes: string | null; error?: string }>('/api/tailscale/serve-status'),
   updateCorsOrigins: (hostname: string) =>
@@ -2085,10 +2089,7 @@ export const githubImportApi = {
     }),
 }
 
-// =============================================================================
-// Dashboard API - Chronicle activity monitoring
-// =============================================================================
-
+// Dashboard API types
 export enum ActivityType {
   CONVERSATION = 'conversation',
   MEMORY = 'memory',
@@ -2116,13 +2117,13 @@ export interface DashboardData {
   last_updated: string
 }
 
+// Dashboard API endpoints
 export const dashboardApi = {
-  /** Get complete dashboard data (stats + recent conversations & memories) */
-  getDashboardData: (conversationLimit?: number, memoryLimit?: number) =>
-    api.get<DashboardData>('/api/dashboard/', {
+  getDashboardData: (conversationLimit: number = 10, memoryLimit: number = 10) =>
+    api.get<DashboardData>('/api/dashboard', {
       params: {
         conversation_limit: conversationLimit,
-        memory_limit: memoryLimit
+        memory_limit: memoryLimit,
       },
     }),
 }
diff --git a/ushadow/frontend/src/services/chronicleApi.ts b/ushadow/frontend/src/services/chronicleApi.ts
index cff9a332..a62648a5 100644
--- a/ushadow/frontend/src/services/chronicleApi.ts
+++ b/ushadow/frontend/src/services/chronicleApi.ts
@@ -402,7 +402,7 @@ export async function getChronicleAudioUrl(conversationId: string, cropped: bool
   const proxyUrl = await getChronicleProxyUrl()
 
   // Get auth token - prefer Keycloak token, fallback to legacy token
-  const kcToken = sessionStorage.getItem('kc_access_token')
+  const kcToken = localStorage.getItem('kc_access_token')
   const legacyToken = localStorage.getItem(getStorageKey('token'))
   const token = kcToken || legacyToken || ''
 
diff --git a/ushadow/launcher/.claude/hooks/idle-notification.sh b/ushadow/launcher/.claude/hooks/idle-notification.sh
new file mode 100755
index 00000000..9d3ce076
--- /dev/null
+++ b/ushadow/launcher/.claude/hooks/idle-notification.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+# Claude Code Notification hook - fires on idle_prompt
+# Move ticket to in_review when agent is waiting for user input
+
+# Log for debugging
+echo "[$(date)] idle-notification hook fired" >> /tmp/claude-kanban-hooks.log
+
+BRANCH=$(git branch --show-current 2>/dev/null)
+
+if [ -z "$BRANCH" ]; then
+    exit 0
+fi
+
+if command -v kanban-cli >/dev/null 2>&1; then
+    kanban-cli move-to-review "$BRANCH" 2>/dev/null
+    echo "[$(date)] Moved $BRANCH to review" >> /tmp/claude-kanban-hooks.log
+fi
+
+exit 0
diff --git a/ushadow/launcher/.claude/hooks/kanban-status.sh b/ushadow/launcher/.claude/hooks/kanban-status.sh
new file mode 100755
index 00000000..59cfb98e
--- /dev/null
+++ b/ushadow/launcher/.claude/hooks/kanban-status.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+# Claude Code hook for automatic Kanban status updates
+#
+# This script is called by Claude Code hooks to automatically update
+# ticket status based on agent activity.
+
+# Get current branch name
+BRANCH=$(git branch --show-current 2>/dev/null)
+
+if [ -z "$BRANCH" ]; then
+    # Not in a git repository or no branch, skip
+    exit 0
+fi
+
+# Function to update status via kanban-cli
+update_status() {
+    local status="$1"
+    local command="$2"
+
+    if command -v kanban-cli >/dev/null 2>&1; then
+        kanban-cli "$command" "$BRANCH" 2>/dev/null
+    fi
+}
+
+# Determine which hook triggered this script
+case "$CLAUDE_HOOK_NAME" in
+    "SessionStart")
+        # Agent session started - move to in_progress
+        update_status "in_progress" "move-to-progress"
+        ;;
+    "UserPromptSubmit")
+        # User just submitted a response - agent resuming work
+        update_status "in_progress" "move-to-progress"
+        ;;
+    "AssistantWaitingForUser")
+        # Agent is waiting for user input - move to in_review
+        update_status "in_review" "move-to-review"
+        ;;
+    "SessionEnd")
+        # Agent session ended - move to in_review
+        update_status "in_review" "move-to-review"
+        ;;
+esac
+
+exit 0
diff --git a/ushadow/launcher/.claude/hooks/session-end.sh b/ushadow/launcher/.claude/hooks/session-end.sh
new file mode 100755
index 00000000..1289a999
--- /dev/null
+++ b/ushadow/launcher/.claude/hooks/session-end.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# Claude Code SessionEnd hook - agent session ending
+# Move ticket to in_review (waiting for human to review/respond)
+
+BRANCH=$(git branch --show-current 2>/dev/null)
+
+if [ -z "$BRANCH" ]; then
+    exit 0
+fi
+
+if command -v kanban-cli >/dev/null 2>&1; then
+    kanban-cli move-to-review "$BRANCH" 2>/dev/null
+fi
+
+exit 0
diff --git a/ushadow/launcher/.claude/hooks/session-start.sh b/ushadow/launcher/.claude/hooks/session-start.sh
new file mode 100755
index 00000000..d23e8c00
--- /dev/null
+++ b/ushadow/launcher/.claude/hooks/session-start.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# Claude Code SessionStart hook - agent session just started
+# Move ticket to in_progress
+
+BRANCH=$(git branch --show-current 2>/dev/null)
+
+if [ -z "$BRANCH" ]; then
+    exit 0
+fi
+
+if command -v kanban-cli >/dev/null 2>&1; then
+    kanban-cli move-to-progress "$BRANCH" 2>/dev/null
+fi
+
+exit 0
diff --git a/ushadow/launcher/.claude/hooks/user-prompt-submit.sh b/ushadow/launcher/.claude/hooks/user-prompt-submit.sh
new file mode 100755
index 00000000..652975b9
--- /dev/null
+++ b/ushadow/launcher/.claude/hooks/user-prompt-submit.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# Claude Code UserPromptSubmit hook - user just submitted a prompt
+# Move ticket to in_progress (agent resuming work after waiting)
+
+BRANCH=$(git branch --show-current 2>/dev/null)
+
+if [ -z "$BRANCH" ]; then
+    exit 0
+fi
+
+if command -v kanban-cli >/dev/null 2>&1; then
+    kanban-cli move-to-progress "$BRANCH" 2>/dev/null
+fi
+
+exit 0
diff --git a/ushadow/launcher/.claude/settings.local.json b/ushadow/launcher/.claude/settings.local.json
new file mode 100644
index 00000000..5abaafbe
--- /dev/null
+++ b/ushadow/launcher/.claude/settings.local.json
@@ -0,0 +1,10 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git rebase:*)",
+      "Bash(git merge:*)",
+      "Bash(git checkout:*)",
+      "Bash(git add:*)"
+    ]
+  }
+}
diff --git a/ushadow/launcher/AGENT_SELF_REPORTING.md b/ushadow/launcher/AGENT_SELF_REPORTING.md
new file mode 100644
index 00000000..3e94c83e
--- /dev/null
+++ b/ushadow/launcher/AGENT_SELF_REPORTING.md
@@ -0,0 +1,277 @@
+# Agent Self-Reporting - Kanban Status Updates
+
+This document explains how AI agents (like Claude Code) should automatically update Kanban ticket status as they work.
+
+## The Workflow
+
+### 1. Agent Starts Working (Human Provides Input)
+```bash
+kanban-cli move-to-progress "$BRANCH_NAME"
+```
+**Status:** `in_progress` 🤖
+
+**When:** Agent receives a user response and resumes work
+
+**Example:**
+```bash
+# User responds to agent's question
+# Agent runs:
+kanban-cli move-to-progress "generalLamcher"
+# → All tickets for this branch move to "in_progress"
+```
+
+### 2. Agent Waits for Human Input
+```bash
+kanban-cli move-to-review "$BRANCH_NAME"
+```
+**Status:** `in_review` 💬
+
+**When:** Agent has a question or needs human input
+
+**Example:**
+```bash
+# Agent asks: "Should I use TypeScript or JavaScript?"
+# Before showing the prompt, agent runs:
+kanban-cli move-to-review "generalLamcher"
+# → Tickets move to "in_review" (waiting for human)
+```
+
+### 3. Work is Merged (Automatic via Hook)
+```bash
+# This happens automatically when you run:
+workmux merge <branch-name>
+```
+**Status:** `done` ✅
+
+**When:** Human runs `workmux merge` to merge the branch
+
+**Hook runs:** `kanban-cli move-to-done "$WM_BRANCH_NAME"`
+
+## Complete Example Flow
+
+```bash
+# 1. User asks agent to implement a feature
+# Agent starts working
+kanban-cli move-to-progress "feature-auth"
+# Status: in_progress 🤖
+
+# 2. Agent encounters a decision point
+# Agent asks: "Which database? PostgreSQL or MongoDB?"
+kanban-cli move-to-review "feature-auth"
+# Status: in_review 💬
+
+# 3. User responds: "PostgreSQL"
+# Agent resumes work
+kanban-cli move-to-progress "feature-auth"
+# Status: in_progress 🤖
+
+# 4. Agent finishes, asks: "Ready to merge?"
+kanban-cli move-to-review "feature-auth"
+# Status: in_review 💬
+
+# 5. User confirms and merges
+workmux merge feature-auth
+# Hook automatically runs: kanban-cli move-to-done "feature-auth"
+# Status: done ✅
+```
+
+## Implementation in Claude Code
+
+### Option 1: Manual Agent Commands
+
+The agent explicitly calls these commands at appropriate times:
+
+```bash
+# In agent's workflow:
+echo "[AGENT] Starting work on ticket..."
+kanban-cli move-to-progress "$(git branch --show-current)"
+
+# ... do work ...
+
+# When needing input:
+echo "[AGENT] Waiting for human response..."
+kanban-cli move-to-review "$(git branch --show-current)"
+```
+
+### Option 2: Helper Scripts
+
+Source the helper script in your shell:
+
+```bash
+# In ~/.zshrc or ~/.bashrc
+source /path/to/launcher/kanban-status-helpers.sh
+
+# Then the agent can use:
+kb-start      # Start working (move to in_progress)
+kb-waiting    # Wait for human (move to in_review)
+kb-status     # Check current status
+```
+
+### Option 3: Agent Integration (Future)
+
+Ideally, the agent framework itself should call these:
+
+```python
+# Pseudo-code for agent framework
+class ClaudeAgent:
+    def on_user_input(self, message):
+        self.update_kanban_status("in_progress")
+        # ... process input ...
+
+    def ask_user(self, question):
+        self.update_kanban_status("in_review")
+        # ... wait for response ...
+```
+
+## Environment Variables
+
+The agent should know which ticket it's working on. Set these:
+
+```bash
+# When creating a worktree for a ticket
+export TICKET_ID="ticket-abc-123"
+export BRANCH_NAME="feature-auth"
+
+# Then the agent can use:
+kanban-cli move-to-progress "$BRANCH_NAME"
+```
+
+## Detection Strategies
+
+### How Agent Knows When to Call
+
+**Starting Work (move to in_progress):**
+- After receiving user's response to a question
+- When user provides a new task/instruction
+- When resuming from paused state
+
+**Waiting for Human (move to in_review):**
+- Before calling `input()` or equivalent
+- When presenting options/choices
+- When asking for clarification
+- When work is complete and awaiting approval
+
+**Example Patterns to Detect:**
+
+```python
+# Python agent example
+def ask_user(question):
+    # BEFORE asking:
+    run_command("kanban-cli move-to-review $(git branch --show-current)")
+
+    # Now ask:
+    response = input(question)
+
+    # AFTER receiving response:
+    run_command("kanban-cli move-to-progress $(git branch --show-current)")
+
+    return response
+```
+
+## Workmux Hook Configuration
+
+The merge hook is already configured in `~/.config/workmux/config.yaml`:
+
+```yaml
+pre_merge:
+  - kanban-cli move-to-done "$WM_BRANCH_NAME"
+```
+
+This runs automatically when you execute `workmux merge`.
+
+## Testing
+
+Test the full workflow:
+
+```bash
+# 1. Start working
+kanban-cli move-to-progress "generalLamcher"
+kanban-cli find-by-branch "generalLamcher"
+# Should show: in_progress
+
+# 2. Wait for human
+kanban-cli move-to-review "generalLamcher"
+kanban-cli find-by-branch "generalLamcher"
+# Should show: in_review
+
+# 3. Resume work
+kanban-cli move-to-progress "generalLamcher"
+kanban-cli find-by-branch "generalLamcher"
+# Should show: in_progress
+
+# 4. Merge (when ready)
+workmux merge generalLamcher
+# Should show: done
+```
+
+## Debugging
+
+### Check Current Status
+```bash
+kanban-cli find-by-branch "$(git branch --show-current)"
+```
+
+### View Database
+```bash
+sqlite3 ~/Library/Application\ Support/com.ushadow.launcher/kanban.db \
+  "SELECT id, title, status, branch_name FROM tickets"
+```
+
+### Test Hook
+```bash
+# See what workmux will run
+cat ~/.config/workmux/config.yaml
+
+# Test the command manually
+export WM_BRANCH_NAME="test-branch"
+kanban-cli move-to-done "$WM_BRANCH_NAME"
+```
+
+## Best Practices
+
+1. **Always use branch name as identifier** - Most reliable
+2. **Call move-to-progress when resuming** - Keep status accurate
+3. **Call move-to-review before every prompt** - Signal waiting state
+4. **Let workmux handle "done"** - Don't manually mark as done
+5. **Check status with find-by-branch** - Verify updates worked
+
+## Future Enhancements
+
+- [ ] Auto-detect agent activity (no manual calls needed)
+- [ ] Integration with agent frameworks (LangChain, etc.)
+- [ ] Tmux pane monitoring for automatic detection
+- [ ] Web API for external integrations
+- [ ] Slack/Discord notifications on status changes
+
+## Troubleshooting
+
+**Commands not found:**
+```bash
+# Make sure kanban-cli is in PATH
+which kanban-cli
+# Should output: /Users/username/.local/bin/kanban-cli
+```
+
+**No tickets found:**
+```bash
+# Check if tickets are linked to this branch
+kanban-cli find-by-branch "$(git branch --show-current)"
+
+# Verify database exists
+ls ~/Library/Application\ Support/com.ushadow.launcher/kanban.db
+```
+
+**Status not updating:**
+```bash
+# Run with full path
+~/.local/bin/kanban-cli move-to-progress "branch-name"
+
+# Check stderr for errors
+kanban-cli move-to-progress "branch-name" 2>&1
+```
+
+## See Also
+
+- [KANBAN_HOOKS.md](./KANBAN_HOOKS.md) - Technical reference
+- [KANBAN_HOOKS_EXAMPLE.md](./KANBAN_HOOKS_EXAMPLE.md) - Complete walkthrough
+- [README.md](./README.md) - Launcher overview
diff --git a/ushadow/launcher/KANBAN_AUTO_STATUS.md b/ushadow/launcher/KANBAN_AUTO_STATUS.md
new file mode 100644
index 00000000..9bdc7baf
--- /dev/null
+++ b/ushadow/launcher/KANBAN_AUTO_STATUS.md
@@ -0,0 +1,422 @@
+# Automatic Kanban Status Updates - Complete Guide
+
+This document explains how ticket status automatically updates based on agent activity, combining multiple layers of automation.
+
+## Architecture Overview
+
+The system uses **three layers** of automatic status updates:
+
+1. **Launcher Integration** - Updates status when starting agents
+2. **Claude Code Hooks** - Updates status based on session events
+3. **Workmux Hooks** - Updates status when merging branches
+
+This approach is inspired by vibe-kanban's backend service integration but adapted to work with the ushadow launcher's architecture.
+
+## How It Works
+
+### Status Flow
+
+```
+User creates ticket
+    ↓
+Launcher starts agent for ticket → status: in_progress
+    ↓
+Agent working actively → status: in_progress
+    ↓
+Agent finishes, session ends → status: in_review
+    ↓
+User responds to agent → status: in_progress
+    ↓
+(repeat as needed)
+    ↓
+User merges branch → status: done
+```
+
+## Layer 1: Launcher Integration
+
+**File**: `src-tauri/src/commands/kanban.rs`
+
+When you start an agent for a ticket using the launcher, the `start_coding_agent_for_ticket` function automatically moves the ticket to `in_progress`.
+
+**Code** (lines 784-806):
+```rust
+// Automatically move ticket to in_progress when starting agent
+eprintln!("[start_coding_agent_for_ticket] Moving ticket to in_progress...");
+if let Some(branch_name) = &ticket.branch_name {
+    let status_update = shell_command(&format!("kanban-cli move-to-progress \"{}\"", branch_name))
+        .output();
+    // ... error handling ...
+}
+```
+
+**When it triggers**: Immediately when starting an agent for a ticket
+
+**What it does**: Moves ticket from `backlog` or `todo` to `in_progress`
+
+## Layer 2: Claude Code Hooks
+
+**Files**: `.claude/hooks/*.sh`, `.claude/settings.local.json`
+
+Claude Code hooks automatically update status based on session lifecycle events.
+
+### Hook Scripts
+
+1. **session-start.sh** - Runs when Claude Code starts
+   - Moves ticket to `in_progress`
+   - Indicates agent is ready to work
+
+2. **user-prompt-submit.sh** - Runs when user submits a prompt
+   - Moves ticket to `in_progress`
+   - Indicates agent resuming work after user responds
+
+3. **idle-notification.sh** - Runs when Claude Code becomes idle (waiting for input)
+   - Moves ticket to `in_review`
+   - Indicates agent finished responding and is waiting for user
+   - **This is the key hook** - fires after each agent response!
+
+4. **session-end.sh** - Runs when Claude Code exits
+   - Moves ticket to `in_review`
+   - Indicates session ended, waiting for human review
+
+### Configuration
+
+Hooks are configured in `.claude/settings.local.json`:
+
+```json
+{
+  "hooks": {
+    "SessionStart": [{
+      "hooks": [{
+        "type": "command",
+        "command": ".claude/hooks/session-start.sh",
+        "async": true
+      }]
+    }],
+    "UserPromptSubmit": [{
+      "hooks": [{
+        "type": "command",
+        "command": ".claude/hooks/user-prompt-submit.sh",
+        "async": true
+      }]
+    }],
+    "Notification": [{
+      "matcher": "idle_prompt",
+      "hooks": [{
+        "type": "command",
+        "command": ".claude/hooks/idle-notification.sh",
+        "async": true
+      }]
+    }],
+    "SessionEnd": [{
+      "hooks": [{
+        "type": "command",
+        "command": ".claude/hooks/session-end.sh",
+        "async": true
+      }]
+    }]
+  }
+}
+```
+
+**Key features**:
+- Hooks run asynchronously (don't block agent)
+- Automatically detect current branch
+- Silently skip if not in a git repo
+- Require kanban-cli to be in PATH
+- **`idle_prompt` notification** detects when agent finishes each response (not just session end!)
+  - This gives per-turn status updates within a long-running session
+  - Similar to vibe-kanban's approach for ACP-based agents
+
+## Layer 3: Workmux Integration
+
+**File**: `~/.config/workmux/config.yaml`
+
+When you merge a branch using `workmux merge`, it automatically moves tickets to `done`.
+
+**Configuration**:
+```yaml
+pre_merge:
+  - kanban-cli move-to-done "$WM_BRANCH_NAME"
+```
+
+**When it triggers**: Before `workmux merge` completes
+
+**What it does**: Moves all tickets for the branch to `done`
+
+## Installation & Setup
+
+### Prerequisites
+
+1. **kanban-cli must be installed**:
+   ```bash
+   cd ushadow/launcher/src-tauri
+   cargo build --release --bin kanban-cli
+   cp target/release/kanban-cli ~/.local/bin/
+   ```
+
+2. **Verify kanban-cli is in PATH**:
+   ```bash
+   which kanban-cli
+   # Should output: /Users/username/.local/bin/kanban-cli
+   ```
+
+3. **Workmux hook configured** (should already be set):
+   ```bash
+   cat ~/.config/workmux/config.yaml
+   # Should contain: kanban-cli move-to-done "$WM_BRANCH_NAME"
+   ```
+
+### Automatic Hook Setup
+
+The Claude Code hooks are already configured in this repository:
+
+✅ `.claude/hooks/session-start.sh` - Executable
+✅ `.claude/hooks/user-prompt-submit.sh` - Executable
+✅ `.claude/hooks/idle-notification.sh` - Executable (NEW!)
+✅ `.claude/hooks/session-end.sh` - Executable
+✅ `.claude/settings.local.json` - Hooks configured with idle_prompt matcher
+
+**No additional setup needed** - hooks will run automatically when you use Claude Code in this project.
+
+### Manual Setup (for other projects)
+
+To add automatic status updates to another project:
+
+1. Create `.claude/hooks/` directory
+2. Copy hook scripts from this project
+3. Make scripts executable: `chmod +x .claude/hooks/*.sh`
+4. Add hooks configuration to `.claude/settings.local.json`
+
+## Testing
+
+### Test Layer 1: Launcher Integration
+
+```bash
+# Create a test ticket in the launcher UI
+# Start agent for the ticket
+# Check status:
+kanban-cli find-by-branch "ticket-branch-name"
+# Should show: in_progress
+```
+
+### Test Layer 2: Claude Code Hooks
+
+```bash
+# Start Claude Code in a ticket branch
+claude
+
+# Check status during session:
+kanban-cli find-by-branch "$(git branch --show-current)"
+# Should show: in_progress
+
+# Exit Claude Code (Ctrl+C or Ctrl+D)
+# Check status after exit:
+kanban-cli find-by-branch "$(git branch --show-current)"
+# Should show: in_review
+
+# Start Claude Code again
+# Respond to a prompt
+# Should move back to: in_progress
+```
+
+### Test Layer 3: Workmux Integration
+
+```bash
+# After completing work on a ticket
+workmux merge ticket-branch-name
+
+# Check status:
+kanban-cli find-by-branch "ticket-branch-name"
+# Should show: done
+```
+
+### Debug Hooks
+
+To see if hooks are running:
+
+```bash
+# Check Claude Code debug logs
+tail -f ~/.claude/debug/*.log | grep -i kanban
+
+# Check workmux hook execution
+# Should see output when running: workmux merge <branch>
+```
+
+## Comparison with Vibe-Kanban
+
+### Vibe-Kanban Approach
+
+**Architecture**: Backend service with execution process management
+
+**Key insights from code analysis**:
+- `crates/services/src/services/container.rs`
+  - `start_execution` (line 974-992): Updates to `InProgress`
+  - `spawn_exit_monitor` (line 342-540): Waits for process exit or exit signal
+  - `finalize_task` (line 166-213): Updates to `InReview`
+
+**How it detects completion**:
+- **For ACP-based agents** (Gemini, Qwen):
+  - Uses Agent Client Protocol with awaitable `prompt()` method
+  - Sends exit signal when turn completes (container.rs:486-487)
+  - Status updates after each response
+
+- **For Claude Code**:
+  - Spawns **new process for each prompt**! (container.rs:363 - exit_signal is None)
+  - Process exits when response complete
+  - No long-running session
+
+### Ushadow Launcher Approach
+
+**Architecture**: Hook-based with CLI integration + idle detection
+
+**Key components**:
+- Rust CLI tool (`kanban-cli`)
+- Claude Code hooks (shell scripts)
+- **`idle_prompt` notification** - detects when agent waits for input
+- Launcher integration (Rust code)
+- Workmux hooks (YAML config)
+
+**How it detects completion**:
+- **Long-running Claude Code session**
+- `Notification(idle_prompt)` hook fires when agent finishes responding
+- Status updates after each response (just like vibe-kanban's ACP agents!)
+- Single process for entire conversation
+
+**Advantages over vibe-kanban's Claude Code approach**:
+- ✅ **Keeps conversation context** - single long-running session
+- ✅ **Per-response status updates** - via idle_prompt notification
+- ✅ Works with any CLI tool (not just Claude Code)
+- ✅ No backend service required
+- ✅ Easy to debug (just check CLI calls)
+- ✅ No process spawn overhead per prompt
+
+**Key difference**:
+- Vibe-kanban: Short-lived processes (one per prompt)
+- Ushadow launcher: Long-lived session + idle detection hooks
+
+## Troubleshooting
+
+### Hooks Not Running
+
+**Check if kanban-cli is in PATH**:
+```bash
+which kanban-cli
+# If not found, install it (see Installation section)
+```
+
+**Check hook permissions**:
+```bash
+ls -la .claude/hooks/
+# All .sh files should be executable (rwxr-xr-x)
+chmod +x .claude/hooks/*.sh
+```
+
+**Check Claude Code hook configuration**:
+```bash
+cat .claude/settings.local.json
+# Should contain hooks configuration
+```
+
+**Enable Claude Code debug logging**:
+```bash
+CLAUDE_DEBUG=1 claude
+tail -f ~/.claude/debug/*.log
+```
+
+### Status Not Updating
+
+**Verify ticket is linked to branch**:
+```bash
+kanban-cli find-by-branch "$(git branch --show-current)"
+# Should return ticket(s)
+```
+
+**Manually test CLI command**:
+```bash
+kanban-cli move-to-progress "$(git branch --show-current)"
+# Should succeed and update status
+```
+
+**Check database**:
+```bash
+sqlite3 ~/Library/Application\ Support/com.ushadow.launcher/kanban.db \
+  "SELECT id, title, status, branch_name FROM tickets WHERE branch_name = 'your-branch'"
+```
+
+### Wrong Status After Merge
+
+**Check workmux hook**:
+```bash
+cat ~/.config/workmux/config.yaml
+# Should contain: kanban-cli move-to-done "$WM_BRANCH_NAME"
+```
+
+**Test hook manually**:
+```bash
+export WM_BRANCH_NAME="test-branch"
+kanban-cli move-to-done "$WM_BRANCH_NAME"
+```
+
+## Future Enhancements
+
+### Potential Improvements
+
+1. **Mid-session detection**: Detect when agent is waiting for user input during a session
+   - Could use tmux pane monitoring
+   - Could integrate with Claude Code's message flow
+   - Would enable more granular status updates
+
+2. **Activity monitoring**: Detect if agent is actively working vs idle
+   - Monitor tmux pane activity
+   - Track time since last command
+   - Auto-move to in_review after inactivity
+
+3. **Web API**: Expose status updates via HTTP API
+   - Allow external tools to update status
+   - Enable integrations with other systems
+   - Support webhooks for status changes
+
+4. **Notifications**: Alert on status changes
+   - Slack/Discord notifications
+   - Desktop notifications
+   - Email alerts
+
+5. **Analytics**: Track ticket lifecycle metrics
+   - Time in each status
+   - Agent productivity metrics
+   - Bottleneck identification
+
+## See Also
+
+- [AGENT_SELF_REPORTING.md](./AGENT_SELF_REPORTING.md) - Agent-side status reporting
+- [KANBAN_HOOKS.md](./KANBAN_HOOKS.md) - Technical hook reference
+- [KANBAN_HOOKS_EXAMPLE.md](./KANBAN_HOOKS_EXAMPLE.md) - Complete walkthrough
+- [README.md](./README.md) - Launcher overview
+
+## Implementation Notes
+
+### Why Three Layers?
+
+Each layer covers a different lifecycle event:
+
+1. **Launcher**: Knows when agent starts (one-time event)
+2. **Claude Code Hooks**: Knows session boundaries (start/end/resume)
+3. **Workmux**: Knows when work is merged (completion event)
+
+No single layer can cover all cases, so we use all three together.
+
+### Why Async Hooks?
+
+Hooks run with `"async": true` to avoid blocking:
+- Agent can start immediately while status updates in background
+- Prevents delays if database is slow
+- Failures don't break agent workflow
+
+### Why CLI Tool?
+
+Using `kanban-cli` instead of direct database access:
+- Consistent error handling
+- Easier to debug (run manually)
+- Portable (works from shell, scripts, hooks)
+- Single source of truth for status logic
+- Can be called from any environment
diff --git a/ushadow/launcher/KANBAN_HOOKS.md b/ushadow/launcher/KANBAN_HOOKS.md
new file mode 100644
index 00000000..36a46e5e
--- /dev/null
+++ b/ushadow/launcher/KANBAN_HOOKS.md
@@ -0,0 +1,289 @@
+# Kanban Hooks Integration
+
+This document explains how to automatically update Kanban ticket status based on workmux/tmux events.
+
+## Overview
+
+The launcher includes a CLI tool (`kanban-cli`) that can be called from workmux hooks to automatically update ticket status. The most common use case is moving tickets to "In Review" when an agent stops working and the branch is ready for merge.
+
+## Installation
+
+### 1. Build the CLI Tool
+
+```bash
+cd ushadow/launcher/src-tauri
+cargo build --release --bin kanban-cli
+
+# The binary will be at: target/release/kanban-cli
+```
+
+### 2. Install the CLI Tool
+
+Copy the binary to a location in your PATH:
+
+```bash
+# Option 1: System-wide installation
+sudo cp target/release/kanban-cli /usr/local/bin/
+
+# Option 2: User installation
+mkdir -p ~/.local/bin
+cp target/release/kanban-cli ~/.local/bin/
+# Make sure ~/.local/bin is in your PATH
+
+# Verify installation
+kanban-cli --help
+```
+
+## CLI Usage
+
+The `kanban-cli` tool provides several commands:
+
+### Set Ticket Status
+
+```bash
+kanban-cli set-status <ticket-id> <status>
+```
+
+Statuses: `backlog`, `todo`, `in_progress`, `in_review`, `done`, `archived`
+
+Example:
+```bash
+kanban-cli set-status ticket-abc123 in_review
+```
+
+### Find Tickets
+
+```bash
+# Find by worktree path
+kanban-cli find-by-path /path/to/worktree
+
+# Find by branch name
+kanban-cli find-by-branch feature-branch
+
+# Find by tmux window name
+kanban-cli find-by-window ushadow-feature-branch
+```
+
+### Move to Review (Most Useful)
+
+The `move-to-review` command is designed for use in hooks. It accepts a flexible identifier and automatically finds matching tickets:
+
+```bash
+kanban-cli move-to-review <identifier>
+```
+
+The identifier can be:
+- Worktree path
+- Branch name
+- Tmux window name
+
+It will:
+- Find all tickets matching the identifier
+- Skip tickets already in "in_review" or "done" status
+- Move remaining tickets to "in_review"
+- Exit cleanly even if no tickets are found (not all worktrees have tickets)
+
+## Workmux Hook Configuration
+
+### Option 1: Global Configuration (Recommended)
+
+Edit `~/.config/workmux/config.yaml`:
+
+```yaml
+# Commands to run before merging
+pre_merge:
+  # Move associated tickets to "in_review" status
+  - kanban-cli move-to-review "$WM_BRANCH_NAME"
+
+  # Optional: Run tests before merge
+  - pytest
+  - cargo test
+```
+
+This applies to **all** workmux projects. The hook will:
+1. Find tickets associated with the branch being merged
+2. Move them to "in_review" status
+3. Continue with the merge process
+
+### Option 2: Project-Specific Configuration
+
+Edit `.workmux.yaml` in your project root:
+
+```yaml
+pre_merge:
+  - "<global>"  # Inherit global hooks
+  - kanban-cli move-to-review "$WM_WORKTREE_PATH"
+  # Or use branch name:
+  # - kanban-cli move-to-review "$WM_BRANCH_NAME"
+```
+
+### Available Environment Variables in Hooks
+
+Workmux provides these variables in hook scripts:
+
+- `$WM_BRANCH_NAME`: The branch being merged (e.g., "feature-login")
+- `$WM_TARGET_BRANCH`: The target branch (e.g., "main")
+- `$WM_WORKTREE_PATH`: Absolute path to the worktree
+- `$WM_PROJECT_ROOT`: Absolute path to the main project
+- `$WM_HANDLE`: The worktree handle/window name
+
+## Other Hook Opportunities
+
+### Post-Create Hook
+
+Move tickets to "in_progress" when a worktree is created:
+
+```yaml
+post_create:
+  - kanban-cli move-to-review "$WM_WORKTREE_PATH"
+  # Note: You'd need to add a "move-to-progress" command for this
+```
+
+### Pre-Remove Hook
+
+Archive tickets when a worktree is removed:
+
+```yaml
+pre_remove:
+  - kanban-cli set-status <ticket-id> archived
+```
+
+## Workflow Example
+
+Here's a typical workflow with automatic status updates:
+
+1. **Create Ticket in Kanban Board**
+   - Status: Backlog
+   - Create worktree for the ticket (links ticket to branch)
+
+2. **Start Working**
+   - Manually move ticket to "In Progress" in UI
+   - Or add a post-create hook to do this automatically
+
+3. **Finish Work**
+   - Run `workmux merge` to merge the branch
+   - **pre_merge hook automatically moves ticket to "In Review"**
+   - Merge completes
+
+4. **Review & Complete**
+   - Reviewer checks the code
+   - Manually move ticket to "Done" after approval
+
+## Troubleshooting
+
+### CLI Not Found
+
+```bash
+# Check if it's in your PATH
+which kanban-cli
+
+# If not, add ~/.local/bin to PATH in ~/.zshrc or ~/.bashrc:
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+### No Tickets Found
+
+This is normal! Not all worktrees have associated Kanban tickets. The `move-to-review` command exits successfully even when no tickets are found.
+
+To debug, manually check for tickets:
+
+```bash
+# See what workmux sees
+echo "Branch: $WM_BRANCH_NAME"
+echo "Path: $WM_WORKTREE_PATH"
+
+# Check for tickets
+kanban-cli find-by-branch "$WM_BRANCH_NAME"
+```
+
+### Database Not Found
+
+The CLI looks for the Kanban database at:
+- macOS: `~/Library/Application Support/com.ushadow.launcher/kanban.db`
+- Linux: `~/.local/share/com.ushadow.launcher/kanban.db`
+- Windows: `%APPDATA%\com.ushadow.launcher\kanban.db`
+
+If the database doesn't exist, you need to:
+1. Run the Ushadow Launcher at least once
+2. Create at least one ticket (this initializes the database)
+
+### Hook Not Running
+
+Verify your workmux configuration:
+
+```bash
+# Check global config
+cat ~/.config/workmux/config.yaml
+
+# Check project config
+cat .workmux.yaml
+
+# Test the command manually
+kanban-cli move-to-review "your-branch-name"
+```
+
+## Advanced: Custom Status Transitions
+
+You can create custom scripts for different status transitions:
+
+### Script: `move-to-progress.sh`
+
+```bash
+#!/bin/bash
+kanban-cli set-status "$1" in_progress
+```
+
+### Script: `complete-ticket.sh`
+
+```bash
+#!/bin/bash
+# Move to done and close tmux window
+kanban-cli set-status "$1" done
+workmux close "$WM_HANDLE"
+```
+
+Make them executable and add to your PATH:
+
+```bash
+chmod +x move-to-progress.sh complete-ticket.sh
+mv *.sh ~/.local/bin/
+```
+
+## Integration with Other Tools
+
+### Git Hooks
+
+You can also use `kanban-cli` in git hooks:
+
+```bash
+# .git/hooks/pre-push
+#!/bin/bash
+BRANCH=$(git rev-parse --abbrev-ref HEAD)
+kanban-cli move-to-review "$BRANCH"
+```
+
+### CI/CD
+
+Update ticket status from CI pipelines:
+
+```bash
+# In your CI script
+kanban-cli set-status "$TICKET_ID" done
+```
+
+## Future Enhancements
+
+Potential improvements to this system:
+
+- [ ] Auto-detect ticket ID from branch name (e.g., `ticket-123-feature`)
+- [ ] Support for custom status workflows
+- [ ] Slack/Discord notifications on status change
+- [ ] Integration with GitHub/GitLab issues
+- [ ] Web API for external integrations
+- [ ] Rollback command for accidental status changes
+
+## See Also
+
+- [Workmux Documentation](https://github.com/joshka/workmux)
+- [Launcher README](./README.md)
+- [Kanban Board Usage](./README.md#managing-work-with-kanban-board)
diff --git a/ushadow/launcher/README.md b/ushadow/launcher/README.md
index 407c618d..6b87917b 100644
--- a/ushadow/launcher/README.md
+++ b/ushadow/launcher/README.md
@@ -1,6 +1,17 @@
 # Ushadow Desktop Launcher
 
-A Tauri-based desktop application for orchestrating parallel development environments with git worktrees, tmux sessions, and Docker containers.
+A Tauri-based desktop application for orchestrating parallel development environments with git worktrees, tmux sessions, and Docker containers. Includes integrated Kanban board for ticket management, making it a complete development workflow tool that bridges task tracking and environment management.
+
+## What Can It Do?
+
+- 🚀 **One-Click Launch** - Install prerequisites and start Ushadow automatically
+- 🌲 **Git Worktrees** - Work on multiple branches simultaneously in isolated environments
+- 💻 **Tmux Integration** - Persistent terminal sessions that survive app restarts
+- 🐳 **Docker Orchestration** - Start/stop containers per environment with visual status
+- 📋 **Kanban Board** - Integrated ticket management with epics and environment linking
+- ⚙️ **Smart Setup** - Auto-configure credentials for new worktrees
+- 🔄 **One-Click Merge** - Rebase and merge worktrees back to main with cleanup
+- 📊 **Multi-Project** - Manage multiple repositories with independent configurations
 
 ## Features
 
@@ -10,6 +21,7 @@ A Tauri-based desktop application for orchestrating parallel development environ
 - **Container Orchestration**: Start/stop Docker containers per environment
 - **Environment Discovery**: Auto-detect and manage multiple environments
 - **Fast Status Checks**: Cached Tailscale/Docker polling for instant feedback
+- **Kanban Board**: Integrated ticket management system for tracking work and epics
 
 ### Developer Experience
 - **One-Click Terminal Access**: Open Terminal.app directly into environment's tmux session
@@ -17,14 +29,18 @@ A Tauri-based desktop application for orchestrating parallel development environ
 - **Real-time Status Badges**: Visual indicators for tmux activity (Working/Waiting/Done/Error)
 - **Quick Environment Switching**: Manage multiple parallel tasks/features simultaneously
 - **Merge & Cleanup**: Rebase and merge worktrees back to main with one click
+- **Ticket Management**: Create, track, and organize tickets with epics, descriptions, and environments
 
 ### Infrastructure
 - **Prerequisite Checking**: Verifies Docker, Tailscale, Git, and Tmux
 - **System Tray**: Runs in background with quick access menu
 - **Cross-Platform**: Builds for macOS (DMG), Windows (EXE), and Linux (DEB/AppImage)
+- **Default Credentials**: Configure default admin credentials for new worktrees
 
 ## Quick Start
 
+### For Developers (Running from Source)
+
 ```bash
 # Install dependencies
 npm install
@@ -38,15 +54,35 @@ npm run tauri:dev
 # 3. Show all environments with real-time status
 ```
 
+### For Users (Installing the App)
+
+1. Download the appropriate installer for your platform:
+   - **macOS**: `Ushadow-{version}.dmg`
+   - **Windows**: `Ushadow-{version}.exe` or `.msi`
+   - **Linux**: `ushadow_{version}_amd64.deb` or `.AppImage`
+
+2. Run the installer and launch the Ushadow Launcher
+
+3. Follow the first-time setup wizard
+
 ### First-Time Usage
 
 1. **Set Project Root**: Click the folder icon to point to your Ushadow repo
 2. **Check Prerequisites**: Verify Docker, Tailscale, Git, Tmux are installed
 3. **Start Infrastructure**: Start required containers (postgres, redis, etc.)
 4. **Create Environment**: Click "New Environment" and choose:
-   - **Clone** - Create new git clone (traditional)
+   - **Link** - Link to an existing directory
    - **Worktree** - Create git worktree (recommended for parallel dev)
 
+### Multi-Project Mode
+
+The launcher supports managing multiple projects with independent configurations:
+
+- Switch between projects from the Install tab
+- Each project maintains its own worktrees directory
+- Independent infrastructure and environment settings per project
+- Useful for working on multiple repositories or client projects
+
 ### Using Tmux Sessions
 
 - **Purple Terminal Icon** on environment cards - Click to open Terminal and attach to tmux
@@ -55,6 +91,63 @@ npm run tauri:dev
 
 **Note**: Terminal opening currently works on **macOS only** (via Terminal.app). Linux/Windows support is planned. See [CROSS_PLATFORM_TERMINAL.md](./CROSS_PLATFORM_TERMINAL.md) for details.
 
+### Configuring Default Credentials
+
+The **Credentials** button in the header allows you to configure default admin credentials that will be automatically written to new worktrees:
+
+1. Click **Credentials** button in the header
+2. Enter default admin email, password, and name
+3. Save settings
+4. All newly created worktrees will automatically have these credentials configured in `secrets.yaml`
+
+This eliminates the need to manually configure credentials for each new environment, streamlining the development workflow.
+
+### Managing Work with Kanban Board
+
+The launcher includes an integrated Kanban board for ticket and epic management:
+
+- **Kanban Tab** in the header - View all tickets organized by status (Backlog, To Do, In Progress, Done)
+- **Create Tickets** - Add new tickets with title, description, and link them to epics
+- **Create Epics** - Organize related tickets into epics for better project structure
+- **Environment Linking** - Associate tickets with specific development environments
+- **Drag & Drop** - Move tickets between columns to update their status
+- **Ticket Details** - View full ticket information including descriptions and metadata
+
+The Kanban board integrates with your backend API, allowing you to track work directly from the launcher while managing development environments.
+
+### Automatic Ticket Status Updates
+
+The launcher automatically updates ticket status as you work, using a three-layer system:
+
+**1. Launcher Integration**: When starting an agent → status: `in_progress`
+**2. Claude Code Hooks**: Session lifecycle events → status: `in_progress` / `in_review`
+**3. Workmux Integration**: When merging → status: `done`
+
+**Quick Setup:**
+
+```bash
+# Install kanban-cli (required)
+cd src-tauri
+cargo build --release --bin kanban-cli
+cp target/release/kanban-cli ~/.local/bin/
+```
+
+**That's it!** Claude Code hooks are pre-configured in `.claude/` and workmux hooks are already set up.
+
+**How it works:**
+- ✅ Start agent for ticket → Automatically moves to `in_progress`
+- ✅ Agent finishes/waits → Automatically moves to `in_review`
+- ✅ You respond → Automatically moves back to `in_progress`
+- ✅ Merge branch → Automatically moves to `done`
+
+See **[KANBAN_AUTO_STATUS.md](./KANBAN_AUTO_STATUS.md)** for complete documentation:
+- Architecture overview and how each layer works
+- Comparison with vibe-kanban's approach
+- Testing and troubleshooting
+- Future enhancements
+
+For manual CLI usage and advanced integration, see **[KANBAN_HOOKS.md](./KANBAN_HOOKS.md)**.
+
 ## Documentation
 
 - **[TMUX_INTEGRATION.md](./TMUX_INTEGRATION.md)** - Complete guide to tmux integration features (Phase 1)
@@ -170,23 +263,52 @@ This generates all required icon sizes for each platform.
 launcher/
 ├── dist/                    # Bootstrap UI (shown before containers start)
 │   └── index.html
+├── src/                     # React frontend
+│   ├── components/          # UI components
+│   │   ├── KanbanBoard.tsx
+│   │   ├── EnvironmentsPanel.tsx
+│   │   ├── TmuxManagerDialog.tsx
+│   │   └── ...
+│   ├── hooks/              # React hooks (useTauri, useTmuxMonitoring)
+│   ├── store/              # Zustand state management
+│   └── App.tsx             # Main application
 ├── src-tauri/
 │   ├── Cargo.toml          # Rust dependencies
 │   ├── tauri.conf.json     # Tauri configuration
 │   ├── icons/              # App icons
 │   └── src/
-│       └── main.rs         # Rust backend (Docker management)
+│       ├── main.rs         # Rust backend entry point
+│       ├── commands/       # Tauri command implementations
+│       │   ├── kanban.rs   # Kanban board operations
+│       │   ├── settings.rs # Settings management
+│       │   └── ...
+│       └── models.rs       # Data structures
 └── package.json            # Node scripts for Tauri CLI
 ```
 
 ## How It Works
 
-1. **On Launch**: Shows bootstrap UI with prerequisite checks
-2. **Start Services**: Runs `docker compose up` for infrastructure and app
-3. **Health Check**: Polls backend until healthy
-4. **Open App**: Navigates webview to `http://localhost:3000`
-5. **System Tray**: Minimizes to tray, stays running in background
-6. **On Quit**: Optionally stops containers (configurable)
+### Application Lifecycle
+
+1. **On Launch**: Shows Install page with one-click quick launch
+2. **Prerequisite Check**: Verifies Docker, Git, Python, Tmux are installed
+3. **Infrastructure Setup**: Starts shared services (Postgres, Redis, etc.)
+4. **Environment Discovery**: Auto-detects existing worktrees and containers
+5. **Tmux Integration**: Auto-starts tmux server and monitors sessions
+6. **System Tray**: Minimizes to tray, stays running in background
+7. **On Quit**: Optionally stops containers (configurable)
+
+### Development Workflow
+
+1. **Navigate to Kanban tab** - View and manage tickets
+2. **Create a ticket** - Define the work to be done
+3. **Navigate to Environments tab** - View all development environments
+4. **Create worktree** - Click "New Environment" → Choose branch name
+5. **Auto-setup** - Launcher creates worktree, tmux window, and starts containers
+6. **Open terminal** - Click purple terminal icon to attach tmux session
+7. **Develop** - Code in VS Code, run commands in tmux
+8. **Track progress** - Update ticket status in Kanban board
+9. **Merge & Cleanup** - When done, merge worktree back to main with one click
 
 ## Configuration
 
@@ -204,17 +326,97 @@ The app uses Tauri's security features:
 - **CSP**: Restricts content sources to localhost
 - **Shell Scope**: Only allows specific Docker/Tailscale commands
 - **No Node.js**: Runs native Rust, not Node (unlike Electron)
+- **Credential Storage**: Settings stored locally, never transmitted
+- **Tauri Permissions**: Minimal permission model (no file system access beyond project paths)
+
+## Tips & Tricks
+
+### Productivity Tips
+
+**Use Worktrees for Parallel Development**
+- Create a worktree for each feature/bug you're working on
+- Switch between worktrees instantly without git stash
+- Each worktree has its own containers and ports
+
+**Organize with Epics**
+- Group related tickets into epics in the Kanban board
+- Track progress across multiple related features
+- Link tickets to environments for better context
+
+**Leverage Tmux Sessions**
+- Keep long-running commands in tmux (tests, servers, logs)
+- Sessions persist even if you close the launcher
+- Use tmux windows to organize different tasks
+
+**Set Default Credentials**
+- Configure default admin credentials once
+- All new worktrees automatically get these credentials
+- No more manual secrets.yaml editing
+
+### Keyboard Shortcuts
+
+- **Cmd/Ctrl + R**: Refresh all status
+- **Native clipboard shortcuts work**: Cmd/Ctrl+C, V, X, Z, etc.
+
+### Best Practices
+
+1. **Name worktrees clearly**: Use descriptive names like `fix-login-bug` or `add-auth-feature`
+2. **Clean up regularly**: Merge and delete completed worktrees to save disk space
+3. **Use the Log Panel**: Expand it when troubleshooting to see detailed output
+4. **Keep main up-to-date**: Regularly pull latest changes to avoid merge conflicts
+5. **Link tickets to environments**: Use the Kanban board to track which ticket is in which environment
 
 ## Troubleshooting
 
-### "Docker not found"
-Ensure Docker Desktop is installed and the `docker` CLI is in your PATH.
+### Environment Issues
+
+**"Docker not found"**
+- Ensure Docker Desktop is installed and the `docker` CLI is in your PATH
+- On macOS: `which docker` should show `/usr/local/bin/docker`
+- Try restarting the launcher after installing Docker
+
+**"Tailscale not found"**
+- Install Tailscale from https://tailscale.com/download
+- Tailscale is optional but recommended for remote access
+
+**Environment won't start**
+- Check that Docker is running (`docker ps` should work)
+- Verify ports aren't already in use (default: 8000, 3000)
+- Check logs in the Log Panel at the bottom of the launcher
+- Try stopping and restarting the environment
+
+**Tmux window not created**
+- Ensure tmux is installed: `tmux -V`
+- Check if tmux server is running: `tmux list-sessions`
+- Restart the launcher to auto-start tmux server
+
+### Kanban Board Issues
+
+**Tickets not loading**
+- Ensure at least one environment is running (backend API needed)
+- Check backend URL in Kanban tab matches running environment
+- Verify backend is healthy at `http://localhost:8000/health`
+
+**Can't create tickets**
+- Verify you have a running backend environment
+- Check browser console for API errors
+- Ensure credentials are configured (Settings button)
+
+### Build Issues
+
+**Build fails on Linux**
+- Install all webkit/gtk dependencies listed in Prerequisites section
+- Run: `sudo apt install libwebkit2gtk-4.0-dev build-essential`
 
-### "Tailscale not found"
-Install Tailscale from https://tailscale.com/download
+**Windows build fails**
+- Ensure WebView2 runtime is installed
+- Install Visual Studio Build Tools
+- Restart terminal after installing dependencies
 
-### Build fails on Linux
-Install all webkit/gtk dependencies listed in Prerequisites.
+### General Tips
 
-### Windows build fails
-Ensure WebView2 runtime is installed and Visual Studio Build Tools are set up.
+- **Check the Log Panel** - Most errors appear in the bottom log panel
+- **Refresh Status** - Click the refresh button to update environment status
+- **Restart the Launcher** - Many issues resolve after a fresh start
+- **Check Disk Space** - Worktrees and containers can use significant space
+- **Review Configuration** - Verify project root and worktrees directory paths
diff --git a/ushadow/launcher/claude-with-kanban b/ushadow/launcher/claude-with-kanban
new file mode 100755
index 00000000..badbbe52
--- /dev/null
+++ b/ushadow/launcher/claude-with-kanban
@@ -0,0 +1,43 @@
+#!/bin/bash
+# Wrapper for Claude Code that automatically updates Kanban status
+#
+# Usage: claude-with-kanban [claude args...]
+#
+# What it does:
+# 1. Moves tickets to "in_progress" when agent starts
+# 2. Runs claude with all your arguments
+# 3. Moves tickets to "in_review" when agent finishes
+#
+# Install:
+#   chmod +x claude-with-kanban
+#   cp claude-with-kanban ~/.local/bin/
+#   alias claude='claude-with-kanban'
+
+# Get the current branch
+BRANCH=$(git branch --show-current 2>/dev/null)
+
+if [ -z "$BRANCH" ]; then
+    echo "⚠ Not in a git repository, skipping kanban updates"
+    # Run claude without status updates
+    exec claude "$@"
+fi
+
+echo "🤖 Starting agent for branch: $BRANCH"
+echo "   Moving tickets to 'in_progress'..."
+
+# Move to in_progress
+kanban-cli move-to-progress "$BRANCH" 2>/dev/null
+
+# Run the actual claude command
+# Use exec to replace this process
+claude "$@"
+EXIT_CODE=$?
+
+# After claude finishes
+echo ""
+echo "💬 Agent finished, moving tickets to 'in_review'..."
+kanban-cli move-to-review "$BRANCH" 2>/dev/null
+
+echo "✓ Tickets updated and ready for review"
+
+exit $EXIT_CODE
diff --git a/ushadow/launcher/install-kanban-hooks.sh b/ushadow/launcher/install-kanban-hooks.sh
new file mode 100755
index 00000000..f1ca9a98
--- /dev/null
+++ b/ushadow/launcher/install-kanban-hooks.sh
@@ -0,0 +1,147 @@
+#!/bin/bash
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${BLUE}  Ushadow Launcher - Kanban Hooks Setup${NC}"
+echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo
+
+# Check if we're in the right directory
+if [ ! -f "src-tauri/Cargo.toml" ]; then
+    echo -e "${RED}Error: Must run from launcher directory (ushadow/launcher)${NC}"
+    exit 1
+fi
+
+# Step 1: Build the CLI tool
+echo -e "${YELLOW}Step 1: Building kanban-cli...${NC}"
+cd src-tauri
+if cargo build --release --bin kanban-cli; then
+    echo -e "${GREEN}✓ Built successfully${NC}"
+else
+    echo -e "${RED}✗ Build failed${NC}"
+    exit 1
+fi
+cd ..
+echo
+
+# Step 2: Install the CLI tool
+echo -e "${YELLOW}Step 2: Installing kanban-cli...${NC}"
+INSTALL_DIR="$HOME/.local/bin"
+CLI_SOURCE="src-tauri/target/release/kanban-cli"
+
+# Create installation directory if it doesn't exist
+mkdir -p "$INSTALL_DIR"
+
+# Copy the binary
+cp "$CLI_SOURCE" "$INSTALL_DIR/"
+chmod +x "$INSTALL_DIR/kanban-cli"
+
+echo -e "${GREEN}✓ Installed to: $INSTALL_DIR/kanban-cli${NC}"
+
+# Check if directory is in PATH
+if [[ ":$PATH:" != *":$INSTALL_DIR:"* ]]; then
+    echo -e "${YELLOW}⚠  $INSTALL_DIR is not in your PATH${NC}"
+    echo
+    echo "Add this to your ~/.zshrc or ~/.bashrc:"
+    echo -e "${BLUE}export PATH=\"\$HOME/.local/bin:\$PATH\"${NC}"
+    echo
+fi
+echo
+
+# Step 3: Verify installation
+echo -e "${YELLOW}Step 3: Verifying installation...${NC}"
+if command -v kanban-cli &> /dev/null; then
+    echo -e "${GREEN}✓ kanban-cli is available in PATH${NC}"
+    kanban-cli --help | head -5
+else
+    echo -e "${RED}✗ kanban-cli not found in PATH${NC}"
+    echo "You may need to restart your shell or run:"
+    echo -e "${BLUE}export PATH=\"\$HOME/.local/bin:\$PATH\"${NC}"
+fi
+echo
+
+# Step 4: Configure workmux hooks
+echo -e "${YELLOW}Step 4: Configuring workmux hooks...${NC}"
+
+WORKMUX_CONFIG="$HOME/.config/workmux/config.yaml"
+WORKMUX_DIR="$HOME/.config/workmux"
+
+# Create workmux config directory if it doesn't exist
+if [ ! -d "$WORKMUX_DIR" ]; then
+    echo "Creating workmux config directory..."
+    mkdir -p "$WORKMUX_DIR"
+fi
+
+# Check if config exists
+if [ -f "$WORKMUX_CONFIG" ]; then
+    echo -e "${YELLOW}⚠  Workmux config already exists${NC}"
+    echo "Location: $WORKMUX_CONFIG"
+    echo
+
+    # Check if hook is already configured
+    if grep -q "kanban-cli move-to-review" "$WORKMUX_CONFIG" 2>/dev/null; then
+        echo -e "${GREEN}✓ Kanban hook already configured${NC}"
+    else
+        echo "To enable automatic status updates, add this to your pre_merge hooks:"
+        echo
+        echo -e "${BLUE}pre_merge:"
+        echo "  - kanban-cli move-to-review \"\$WM_BRANCH_NAME\"${NC}"
+        echo
+    fi
+else
+    echo "Creating workmux config with kanban hooks..."
+    cat > "$WORKMUX_CONFIG" << 'EOF'
+# Workmux global configuration
+# See: workmux init for all options
+
+#-------------------------------------------------------------------------------
+# Hooks
+#-------------------------------------------------------------------------------
+
+# Commands to run before merging (e.g., linting, tests).
+# Aborts the merge if any command fails.
+pre_merge:
+  # Automatically move tickets to "in_review" status
+  - kanban-cli move-to-review "$WM_BRANCH_NAME"
+
+  # Uncomment to run tests before merge:
+  # - npm test
+  # - cargo test
+  # - pytest
+
+EOF
+    echo -e "${GREEN}✓ Created workmux config with kanban hooks${NC}"
+    echo "Location: $WORKMUX_CONFIG"
+fi
+echo
+
+# Summary
+echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${GREEN}Setup Complete!${NC}"
+echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo
+echo "What's next?"
+echo
+echo "1. ${GREEN}Test the CLI:${NC}"
+echo "   kanban-cli --help"
+echo
+echo "2. ${GREEN}Create a ticket in the Kanban board${NC}"
+echo "   - Link it to a worktree/branch"
+echo
+echo "3. ${GREEN}Test the hook:${NC}"
+echo "   - Make changes in the worktree"
+echo "   - Run: workmux merge"
+echo "   - The ticket should automatically move to 'In Review'"
+echo
+echo "4. ${GREEN}View documentation:${NC}"
+echo "   cat KANBAN_HOOKS.md"
+echo
+echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
diff --git a/ushadow/launcher/kanban-status-helpers.sh b/ushadow/launcher/kanban-status-helpers.sh
new file mode 100644
index 00000000..c608fb74
--- /dev/null
+++ b/ushadow/launcher/kanban-status-helpers.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+# Kanban Status Helper Functions
+# Source this file in your shell: source kanban-status-helpers.sh
+
+# Get the current ticket ID from branch name or environment
+get_current_ticket_id() {
+    # Check if TICKET_ID is set
+    if [ -n "$TICKET_ID" ]; then
+        echo "$TICKET_ID"
+        return 0
+    fi
+
+    # Try to get from branch name
+    local branch=$(git branch --show-current 2>/dev/null)
+    if [ -n "$branch" ]; then
+        echo "$branch"
+        return 0
+    fi
+
+    # Fallback to worktree path
+    echo "$(pwd)"
+}
+
+# Agent starts working (after receiving human input)
+kanban-start-working() {
+    local identifier=$(get_current_ticket_id)
+    echo "📝 Moving ticket to 'in_progress'..."
+    kanban-cli find-by-branch "$identifier" | grep -o 'ticket-[a-f0-9-]*' | while read ticket_id; do
+        kanban-cli set-status "$ticket_id" in_progress
+    done
+}
+
+# Agent stops and waits for human (needs input)
+kanban-waiting-for-human() {
+    local identifier=$(get_current_ticket_id)
+    echo "💬 Moving ticket to 'in_review' (waiting for human)..."
+    kanban-cli find-by-branch "$identifier" | grep -o 'ticket-[a-f0-9-]*' | while read ticket_id; do
+        kanban-cli set-status "$ticket_id" in_review
+    done
+}
+
+# Mark ticket as done (usually via workmux merge hook)
+kanban-mark-done() {
+    local identifier=$(get_current_ticket_id)
+    echo "✅ Moving ticket to 'done'..."
+    kanban-cli find-by-branch "$identifier" | grep -o 'ticket-[a-f0-9-]*' | while read ticket_id; do
+        kanban-cli set-status "$ticket_id" done
+    done
+}
+
+# Quick status check
+kanban-status() {
+    local identifier=$(get_current_ticket_id)
+    echo "Current identifier: $identifier"
+    echo ""
+    kanban-cli find-by-branch "$identifier"
+}
+
+# Aliases for convenience
+alias kb-start='kanban-start-working'
+alias kb-waiting='kanban-waiting-for-human'
+alias kb-done='kanban-mark-done'
+alias kb-status='kanban-status'
+
+echo "✓ Kanban status helpers loaded"
+echo ""
+echo "Commands available:"
+echo "  kanban-start-working       (or: kb-start)   - Move to 'in_progress'"
+echo "  kanban-waiting-for-human   (or: kb-waiting) - Move to 'in_review'"
+echo "  kanban-mark-done           (or: kb-done)    - Move to 'done'"
+echo "  kanban-status              (or: kb-status)  - Check current status"
diff --git a/ushadow/launcher/package.json b/ushadow/launcher/package.json
index 5e9a979b..3fe4d0db 100644
--- a/ushadow/launcher/package.json
+++ b/ushadow/launcher/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ushadow-launcher",
-  "version": "0.7.15",
+  "version": "0.8.0",
   "description": "Ushadow Desktop Launcher",
   "private": true,
   "type": "module",
diff --git a/ushadow/launcher/public/oauth-callback.html b/ushadow/launcher/public/oauth-callback.html
new file mode 100644
index 00000000..af04e9a9
--- /dev/null
+++ b/ushadow/launcher/public/oauth-callback.html
@@ -0,0 +1,165 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <title>Completing Login...</title>
+  <style>
+    body {
+      margin: 0;
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', sans-serif;
+      background: #0a0a0a;
+      color: #e5e7eb;
+      display: flex;
+      align-items: center;
+      justify-center;
+      min-height: 100vh;
+    }
+    .container {
+      text-align: center;
+      max-width: 500px;
+      padding: 40px;
+    }
+    .spinner {
+      border: 3px solid rgba(59, 130, 246, 0.1);
+      border-top-color: #3b82f6;
+      border-radius: 50%;
+      width: 48px;
+      height: 48px;
+      animation: spin 1s linear infinite;
+      margin: 0 auto 20px;
+    }
+    @keyframes spin {
+      to { transform: rotate(360deg); }
+    }
+    .success {
+      color: #10b981;
+      font-size: 24px;
+      margin-bottom: 12px;
+    }
+    .error {
+      color: #ef4444;
+      font-size: 18px;
+      margin-bottom: 12px;
+    }
+    .message {
+      color: #9ca3af;
+      font-size: 14px;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="spinner" id="spinner"></div>
+    <div id="status">Completing authentication...</div>
+    <div class="message" id="message">Please wait while we process your login</div>
+  </div>
+
+  <script>
+    (async function() {
+      const statusEl = document.getElementById('status')
+      const messageEl = document.getElementById('message')
+      const spinnerEl = document.getElementById('spinner')
+
+      try {
+        // Extract code and state from URL
+        const params = new URLSearchParams(window.location.search)
+        const code = params.get('code')
+        const state = params.get('state')
+        const error = params.get('error')
+        const errorDescription = params.get('error_description')
+
+        // Check for OAuth errors
+        if (error) {
+          throw new Error(errorDescription || error)
+        }
+
+        if (!code) {
+          throw new Error('Missing authorization code')
+        }
+
+        if (!state) {
+          throw new Error('Missing state parameter')
+        }
+
+        // Verify state (CSRF protection)
+        const savedState = localStorage.getItem('oauth_state')
+        if (state !== savedState) {
+          throw new Error('Invalid state parameter')
+        }
+
+        // Get code verifier
+        const codeVerifier = localStorage.getItem('pkce_code_verifier')
+        if (!codeVerifier) {
+          throw new Error('Missing PKCE code verifier')
+        }
+
+        // Get backend URL from localStorage (set by AuthButton before opening auth window)
+        const backendUrl = localStorage.getItem('oauth_backend_url')
+        if (!backendUrl) {
+          throw new Error('Missing backend URL configuration')
+        }
+
+        // Exchange code for tokens via backend
+        const response = await fetch(`${backendUrl}/api/auth/token`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify({
+            code,
+            code_verifier: codeVerifier,
+            redirect_uri: window.location.origin + window.location.pathname,
+          }),
+        })
+
+        if (!response.ok) {
+          const error = await response.text()
+          throw new Error(`Token exchange failed: ${error}`)
+        }
+
+        const tokens = await response.json()
+
+        // Store tokens in localStorage
+        localStorage.setItem('kc_access_token', tokens.access_token)
+        if (tokens.refresh_token) {
+          localStorage.setItem('kc_refresh_token', tokens.refresh_token)
+        }
+        if (tokens.id_token) {
+          localStorage.setItem('kc_id_token', tokens.id_token)
+        }
+
+        // Store expiry times
+        const now = Math.floor(Date.now() / 1000)
+        if (tokens.expires_in) {
+          localStorage.setItem('kc_expires_at', (now + tokens.expires_in).toString())
+        }
+        if (tokens.refresh_expires_in) {
+          localStorage.setItem('kc_refresh_expires_at', (now + tokens.refresh_expires_in).toString())
+        }
+
+        // Clean up
+        localStorage.removeItem('oauth_state')
+        localStorage.removeItem('pkce_code_verifier')
+        localStorage.removeItem('oauth_backend_url')
+
+        // Show success message
+        spinnerEl.style.display = 'none'
+        statusEl.className = 'success'
+        statusEl.textContent = '✓ Authentication Successful!'
+        messageEl.textContent = 'You can close this window and return to the launcher'
+
+        // Close window after 2 seconds
+        setTimeout(() => {
+          window.close()
+        }, 2000)
+      } catch (error) {
+        console.error('OAuth callback error:', error)
+        spinnerEl.style.display = 'none'
+        statusEl.className = 'error'
+        statusEl.textContent = 'Authentication Failed'
+        messageEl.textContent = error.message || 'An error occurred during login'
+      }
+    })()
+  </script>
+</body>
+</html>
diff --git a/ushadow/launcher/src-tauri/Cargo.lock b/ushadow/launcher/src-tauri/Cargo.lock
index a1a8fb15..af48cd0a 100644
--- a/ushadow/launcher/src-tauri/Cargo.lock
+++ b/ushadow/launcher/src-tauri/Cargo.lock
@@ -8,6 +8,18 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -719,6 +731,12 @@ dependencies = [
  "syn 2.0.113",
 ]
 
+[[package]]
+name = "data-encoding"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
+
 [[package]]
 name = "deranged"
 version = "0.5.5"
@@ -953,6 +971,18 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -1105,6 +1135,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
  "futures-core",
+ "futures-sink",
 ]
 
 [[package]]
@@ -1175,6 +1206,7 @@ dependencies = [
  "futures-core",
  "futures-io",
  "futures-macro",
+ "futures-sink",
  "futures-task",
  "memchr",
  "pin-project-lite",
@@ -1515,7 +1547,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "futures-util",
- "http",
+ "http 0.2.12",
  "indexmap 2.12.1",
  "slab",
  "tokio",
@@ -1540,6 +1572,15 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
@@ -1555,6 +1596,39 @@ version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 
+[[package]]
+name = "hashlink"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+dependencies = [
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "headers"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270"
+dependencies = [
+ "base64 0.21.7",
+ "bytes",
+ "headers-core",
+ "http 0.2.12",
+ "httpdate",
+ "mime",
+ "sha1",
+]
+
+[[package]]
+name = "headers-core"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7f66481bfee273957b1f20485a4ff3362987f85b2c236580d81b4eb7a326429"
+dependencies = [
+ "http 0.2.12",
+]
+
 [[package]]
 name = "heck"
 version = "0.3.3"
@@ -1613,6 +1687,16 @@ dependencies = [
  "itoa 1.0.17",
 ]
 
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa 1.0.17",
+]
+
 [[package]]
 name = "http-body"
 version = "0.4.6"
@@ -1620,7 +1704,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
- "http",
+ "http 0.2.12",
  "pin-project-lite",
 ]
 
@@ -1653,7 +1737,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2",
- "http",
+ "http 0.2.12",
  "http-body",
  "httparse",
  "httpdate",
@@ -2096,6 +2180,17 @@ dependencies = [
  "redox_syscall 0.7.0",
 ]
 
+[[package]]
+name = "libsqlite3-sys"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c10584274047cb335c23d3e61bcef8e323adae7c5c8c760540f73610177fc3f"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.11.0"
@@ -2233,6 +2328,16 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -2264,6 +2369,24 @@ dependencies = [
  "pxfm",
 ]
 
+[[package]]
+name = "multer"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01acbdc23469fd8fe07ab135923371d5f5a422fbf9c522158677c8eb15bc51c2"
+dependencies = [
+ "bytes",
+ "encoding_rs",
+ "futures-util",
+ "http 0.2.12",
+ "httparse",
+ "log",
+ "memchr",
+ "mime",
+ "spin",
+ "version_check",
+]
+
 [[package]]
 name = "native-tls"
 version = "0.2.14"
@@ -2850,6 +2973,26 @@ dependencies = [
  "siphasher 1.0.1",
 ]
 
+[[package]]
+name = "pin-project"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.113",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
@@ -3266,7 +3409,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2",
- "http",
+ "http 0.2.12",
  "http-body",
  "hyper",
  "hyper-tls",
@@ -3318,6 +3461,20 @@ dependencies = [
  "windows 0.37.0",
 ]
 
+[[package]]
+name = "rusqlite"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b838eba278d213a8beaf485bd313fd580ca4505a00d5871caeb1457c55322cae"
+dependencies = [
+ "bitflags 2.10.0",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+]
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -3662,6 +3819,17 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -3824,6 +3992,12 @@ dependencies = [
  "system-deps 5.0.0",
 ]
 
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -4058,7 +4232,7 @@ dependencies = [
  "glob",
  "gtk",
  "heck 0.5.0",
- "http",
+ "http 0.2.12",
  "ignore",
  "log",
  "nix 0.26.4",
@@ -4161,7 +4335,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8066855882f00172935e3fa7d945126580c34dcbabab43f5d4f0c2398a67d47b"
 dependencies = [
  "gtk",
- "http",
+ "http 0.2.12",
  "http-range",
  "rand 0.8.5",
  "raw-window-handle",
@@ -4428,6 +4602,18 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-tungstenite"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c83b561d025642014097b66e6c1bb422783339e0909e4429cde4749d1990bc38"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.18"
@@ -4558,6 +4744,7 @@ version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -4630,6 +4817,25 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "tungstenite"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http 1.4.0",
+ "httparse",
+ "log",
+ "rand 0.8.5",
+ "sha1",
+ "thiserror 1.0.69",
+ "url",
+ "utf-8",
+]
+
 [[package]]
 name = "typenum"
 version = "1.19.0"
@@ -4647,6 +4853,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.22"
@@ -4679,13 +4891,14 @@ dependencies = [
 
 [[package]]
 name = "ushadow-launcher"
-version = "0.7.14"
+version = "0.8.0"
 dependencies = [
  "chrono",
  "dirs",
  "open 5.3.3",
  "portable-pty",
  "reqwest",
+ "rusqlite",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -4693,6 +4906,7 @@ dependencies = [
  "tauri-build",
  "tokio",
  "uuid",
+ "warp",
 ]
 
 [[package]]
@@ -4788,6 +5002,35 @@ dependencies = [
  "try-lock",
 ]
 
+[[package]]
+name = "warp"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4378d202ff965b011c64817db11d5829506d3404edeadb61f190d111da3f231c"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "headers",
+ "http 0.2.12",
+ "hyper",
+ "log",
+ "mime",
+ "mime_guess",
+ "multer",
+ "percent-encoding",
+ "pin-project",
+ "scoped-tls",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "tokio",
+ "tokio-tungstenite",
+ "tokio-util",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "wasi"
 version = "0.9.0+wasi-snapshot-preview1"
@@ -5727,7 +5970,7 @@ dependencies = [
  "glib",
  "gtk",
  "html5ever",
- "http",
+ "http 0.2.12",
  "kuchikiki",
  "libc",
  "log",
diff --git a/ushadow/launcher/src-tauri/Cargo.toml b/ushadow/launcher/src-tauri/Cargo.toml
index 766cb06b..bc542963 100644
--- a/ushadow/launcher/src-tauri/Cargo.toml
+++ b/ushadow/launcher/src-tauri/Cargo.toml
@@ -1,27 +1,34 @@
 [package]
 name = "ushadow-launcher"
-version = "0.7.15"
+version = "0.8.0"
 description = "Ushadow Desktop Launcher"
 authors = ["Ushadow"]
 license = "MIT"
 repository = ""
 edition = "2021"
 
+# Additional binaries
+[[bin]]
+name = "kanban-cli"
+path = "src/bin/kanban-cli.rs"
+
 [build-dependencies]
 tauri-build = { version = "1", features = [] }
 
 [dependencies]
-tauri = { version = "1", features = [ "clipboard-all", "path-all", "process-exit", "shell-execute", "process-relaunch", "shell-open", "process-command-api", "dialog-all", "notification-all", "system-tray"] }
+tauri = { version = "1", features = [ "window-set-focus", "window-close", "window-set-size", "window-hide", "window-create", "window-show", "window-center", "window-set-position", "window-set-always-on-top", "window-set-title", "window-set-resizable", "clipboard-all", "path-all", "process-exit", "shell-execute", "process-relaunch", "shell-open", "process-command-api", "dialog-all", "notification-all", "system-tray"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml = "0.9"
 tokio = { version = "1", features = ["process", "time", "macros", "rt-multi-thread", "io-util", "sync"] }
 reqwest = { version = "0.11", features = ["blocking"] }
+warp = "0.3"
 open = "5"
 portable-pty = "0.8"
 uuid = { version = "1.6", features = ["v4", "serde"] }
 dirs = "5"
 chrono = "0.4"
+rusqlite = { version = "0.31", features = ["bundled"] }
 
 [features]
 default = ["custom-protocol"]
diff --git a/ushadow/launcher/src-tauri/src/bin/kanban-cli.rs b/ushadow/launcher/src-tauri/src/bin/kanban-cli.rs
new file mode 100644
index 00000000..3689416c
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/bin/kanban-cli.rs
@@ -0,0 +1,474 @@
+use rusqlite::{Connection, params};
+use std::path::PathBuf;
+use std::env;
+
+#[derive(Debug)]
+struct Ticket {
+    id: String,
+    title: String,
+    status: String,
+    worktree_path: Option<String>,
+    branch_name: Option<String>,
+    tmux_window_name: Option<String>,
+}
+
+/// Get the path to the SQLite database
+fn get_db_path() -> Result<PathBuf, String> {
+    let data_dir = dirs::data_dir().ok_or("Failed to get data directory")?;
+    let launcher_dir = data_dir.join("com.ushadow.launcher");
+
+    if !launcher_dir.exists() {
+        return Err(format!("Launcher data directory does not exist: {:?}", launcher_dir));
+    }
+
+    Ok(launcher_dir.join("kanban.db"))
+}
+
+/// Get a database connection
+fn get_db_connection() -> Result<Connection, String> {
+    let db_path = get_db_path()?;
+    Connection::open(&db_path)
+        .map_err(|e| format!("Failed to open database: {}", e))
+}
+
+/// Find tickets by worktree path
+fn find_tickets_by_worktree(worktree_path: &str) -> Result<Vec<Ticket>, String> {
+    let conn = get_db_connection()?;
+
+    let mut stmt = conn.prepare(
+        "SELECT id, title, status, worktree_path, branch_name, tmux_window_name
+         FROM tickets
+         WHERE worktree_path = ?"
+    ).map_err(|e| format!("Failed to prepare statement: {}", e))?;
+
+    let tickets = stmt.query_map([worktree_path], |row| {
+        Ok(Ticket {
+            id: row.get(0)?,
+            title: row.get(1)?,
+            status: row.get(2)?,
+            worktree_path: row.get(3)?,
+            branch_name: row.get(4)?,
+            tmux_window_name: row.get(5)?,
+        })
+    })
+    .map_err(|e| format!("Failed to query tickets: {}", e))?
+    .filter_map(|r| r.ok())
+    .collect();
+
+    Ok(tickets)
+}
+
+/// Find tickets by branch name
+fn find_tickets_by_branch(branch_name: &str) -> Result<Vec<Ticket>, String> {
+    let conn = get_db_connection()?;
+
+    let mut stmt = conn.prepare(
+        "SELECT id, title, status, worktree_path, branch_name, tmux_window_name
+         FROM tickets
+         WHERE branch_name = ?"
+    ).map_err(|e| format!("Failed to prepare statement: {}", e))?;
+
+    let tickets = stmt.query_map([branch_name], |row| {
+        Ok(Ticket {
+            id: row.get(0)?,
+            title: row.get(1)?,
+            status: row.get(2)?,
+            worktree_path: row.get(3)?,
+            branch_name: row.get(4)?,
+            tmux_window_name: row.get(5)?,
+        })
+    })
+    .map_err(|e| format!("Failed to query tickets: {}", e))?
+    .filter_map(|r| r.ok())
+    .collect();
+
+    Ok(tickets)
+}
+
+/// Find tickets by tmux window name
+fn find_tickets_by_tmux_window(window_name: &str) -> Result<Vec<Ticket>, String> {
+    let conn = get_db_connection()?;
+
+    let mut stmt = conn.prepare(
+        "SELECT id, title, status, worktree_path, branch_name, tmux_window_name
+         FROM tickets
+         WHERE tmux_window_name = ?"
+    ).map_err(|e| format!("Failed to prepare statement: {}", e))?;
+
+    let tickets = stmt.query_map([window_name], |row| {
+        Ok(Ticket {
+            id: row.get(0)?,
+            title: row.get(1)?,
+            status: row.get(2)?,
+            worktree_path: row.get(3)?,
+            branch_name: row.get(4)?,
+            tmux_window_name: row.get(5)?,
+        })
+    })
+    .map_err(|e| format!("Failed to query tickets: {}", e))?
+    .filter_map(|r| r.ok())
+    .collect();
+
+    Ok(tickets)
+}
+
+/// Update ticket status
+fn update_ticket_status(ticket_id: &str, new_status: &str) -> Result<(), String> {
+    // Validate status
+    let valid_statuses = ["backlog", "todo", "in_progress", "in_review", "done", "archived"];
+    if !valid_statuses.contains(&new_status) {
+        return Err(format!(
+            "Invalid status '{}'. Must be one of: {}",
+            new_status,
+            valid_statuses.join(", ")
+        ));
+    }
+
+    let conn = get_db_connection()?;
+    let now = chrono::Utc::now().to_rfc3339();
+
+    let rows_affected = conn.execute(
+        "UPDATE tickets SET status = ?, updated_at = ? WHERE id = ?",
+        params![new_status, &now, ticket_id],
+    ).map_err(|e| format!("Failed to update ticket: {}", e))?;
+
+    if rows_affected == 0 {
+        return Err(format!("Ticket not found: {}", ticket_id));
+    }
+
+    Ok(())
+}
+
+fn print_usage() {
+    eprintln!("Usage: kanban-cli <command> [options]");
+    eprintln!();
+    eprintln!("Commands:");
+    eprintln!("  set-status <ticket-id> <status>     Update ticket status");
+    eprintln!("  find-by-path <worktree-path>         Find tickets by worktree path");
+    eprintln!("  find-by-branch <branch-name>         Find tickets by branch name");
+    eprintln!("  find-by-window <tmux-window>         Find tickets by tmux window name");
+    eprintln!("  move-to-review <identifier>          Move ticket(s) to 'in_review' status");
+    eprintln!("  move-to-progress <identifier>        Move ticket(s) to 'in_progress' status");
+    eprintln!("  move-to-done <identifier>            Move ticket(s) to 'done' status");
+    eprintln!("                                       (identifier can be path, branch, or window)");
+    eprintln!();
+    eprintln!("Statuses:");
+    eprintln!("  backlog, todo, in_progress, in_review, done, archived");
+    eprintln!();
+    eprintln!("Examples:");
+    eprintln!("  # Update specific ticket");
+    eprintln!("  kanban-cli set-status ticket-123 in_review");
+    eprintln!();
+    eprintln!("  # Find tickets by worktree path");
+    eprintln!("  kanban-cli find-by-path /path/to/worktree");
+    eprintln!();
+    eprintln!("  # Agent self-reporting workflow");
+    eprintln!("  kanban-cli move-to-progress $BRANCH_NAME  # Agent starts working");
+    eprintln!("  kanban-cli move-to-review $BRANCH_NAME    # Agent waits for human");
+    eprintln!("  kanban-cli move-to-done $BRANCH_NAME      # Work merged");
+}
+
+fn main() {
+    let args: Vec<String> = env::args().collect();
+
+    if args.len() < 2 {
+        print_usage();
+        std::process::exit(1);
+    }
+
+    let command = &args[1];
+
+    let result = match command.as_str() {
+        "set-status" => {
+            if args.len() < 4 {
+                eprintln!("Error: set-status requires ticket ID and status");
+                print_usage();
+                std::process::exit(1);
+            }
+            let ticket_id = &args[2];
+            let status = &args[3];
+
+            match update_ticket_status(ticket_id, status) {
+                Ok(_) => {
+                    println!("✓ Updated ticket {} to status: {}", ticket_id, status);
+                    Ok(())
+                }
+                Err(e) => Err(e),
+            }
+        }
+        "find-by-path" => {
+            if args.len() < 3 {
+                eprintln!("Error: find-by-path requires worktree path");
+                print_usage();
+                std::process::exit(1);
+            }
+            let path = &args[2];
+
+            match find_tickets_by_worktree(path) {
+                Ok(tickets) => {
+                    if tickets.is_empty() {
+                        println!("No tickets found for path: {}", path);
+                    } else {
+                        println!("Found {} ticket(s):", tickets.len());
+                        for ticket in tickets {
+                            println!("  {} - {} ({})", ticket.id, ticket.title, ticket.status);
+                        }
+                    }
+                    Ok(())
+                }
+                Err(e) => Err(e),
+            }
+        }
+        "find-by-branch" => {
+            if args.len() < 3 {
+                eprintln!("Error: find-by-branch requires branch name");
+                print_usage();
+                std::process::exit(1);
+            }
+            let branch = &args[2];
+
+            match find_tickets_by_branch(branch) {
+                Ok(tickets) => {
+                    if tickets.is_empty() {
+                        println!("No tickets found for branch: {}", branch);
+                    } else {
+                        println!("Found {} ticket(s):", tickets.len());
+                        for ticket in tickets {
+                            println!("  {} - {} ({})", ticket.id, ticket.title, ticket.status);
+                        }
+                    }
+                    Ok(())
+                }
+                Err(e) => Err(e),
+            }
+        }
+        "find-by-window" => {
+            if args.len() < 3 {
+                eprintln!("Error: find-by-window requires tmux window name");
+                print_usage();
+                std::process::exit(1);
+            }
+            let window = &args[2];
+
+            match find_tickets_by_tmux_window(window) {
+                Ok(tickets) => {
+                    if tickets.is_empty() {
+                        println!("No tickets found for tmux window: {}", window);
+                    } else {
+                        println!("Found {} ticket(s):", tickets.len());
+                        for ticket in tickets {
+                            println!("  {} - {} ({})", ticket.id, ticket.title, ticket.status);
+                        }
+                    }
+                    Ok(())
+                }
+                Err(e) => Err(e),
+            }
+        }
+        "move-to-review" => {
+            if args.len() < 3 {
+                eprintln!("Error: move-to-review requires identifier (path, branch, or window)");
+                print_usage();
+                std::process::exit(1);
+            }
+            let identifier = &args[2];
+
+            // Try to find tickets by different methods - try all methods until we find some tickets
+            let mut tickets = Vec::new();
+
+            // Try worktree path
+            if let Ok(found) = find_tickets_by_worktree(identifier) {
+                if !found.is_empty() {
+                    tickets = found;
+                }
+            }
+
+            // If no tickets found, try branch name
+            if tickets.is_empty() {
+                if let Ok(found) = find_tickets_by_branch(identifier) {
+                    if !found.is_empty() {
+                        tickets = found;
+                    }
+                }
+            }
+
+            // If still no tickets, try tmux window
+            if tickets.is_empty() {
+                if let Ok(found) = find_tickets_by_tmux_window(identifier) {
+                    tickets = found;
+                }
+            }
+
+            if tickets.is_empty() {
+                eprintln!("⚠ No tickets found for identifier: {}", identifier);
+                eprintln!("  This is OK - not all worktrees have associated tickets");
+                Ok(())
+            } else {
+                let mut errors = Vec::new();
+                let mut updated = 0;
+
+                for ticket in &tickets {
+                    // Only update if not already in review or done
+                    if ticket.status != "in_review" && ticket.status != "done" {
+                        match update_ticket_status(&ticket.id, "in_review") {
+                            Ok(_) => {
+                                println!("✓ Moved ticket to review: {} - {}", ticket.id, ticket.title);
+                                updated += 1;
+                            }
+                            Err(e) => {
+                                errors.push(format!("Failed to update {}: {}", ticket.id, e));
+                            }
+                        }
+                    } else {
+                        println!("  Skipped {} - already in status: {}", ticket.id, ticket.status);
+                    }
+                }
+
+                if !errors.is_empty() {
+                    Err(errors.join("\n"))
+                } else {
+                    if updated > 0 {
+                        println!("✓ Moved {} ticket(s) to review", updated);
+                    }
+                    Ok(())
+                }
+            }
+        }
+        "move-to-progress" => {
+            if args.len() < 3 {
+                eprintln!("Error: move-to-progress requires identifier (path, branch, or window)");
+                print_usage();
+                std::process::exit(1);
+            }
+            let identifier = &args[2];
+
+            // Try to find tickets by different methods
+            let mut tickets = Vec::new();
+
+            if let Ok(found) = find_tickets_by_worktree(identifier) {
+                if !found.is_empty() {
+                    tickets = found;
+                }
+            }
+
+            if tickets.is_empty() {
+                if let Ok(found) = find_tickets_by_branch(identifier) {
+                    if !found.is_empty() {
+                        tickets = found;
+                    }
+                }
+            }
+
+            if tickets.is_empty() {
+                if let Ok(found) = find_tickets_by_tmux_window(identifier) {
+                    tickets = found;
+                }
+            }
+
+            if tickets.is_empty() {
+                eprintln!("⚠ No tickets found for identifier: {}", identifier);
+                eprintln!("  This is OK - not all worktrees have associated tickets");
+                Ok(())
+            } else {
+                let mut errors = Vec::new();
+                let mut updated = 0;
+
+                for ticket in &tickets {
+                    match update_ticket_status(&ticket.id, "in_progress") {
+                        Ok(_) => {
+                            println!("✓ Moved ticket to in_progress: {} - {}", ticket.id, ticket.title);
+                            updated += 1;
+                        }
+                        Err(e) => {
+                            errors.push(format!("Failed to update {}: {}", ticket.id, e));
+                        }
+                    }
+                }
+
+                if !errors.is_empty() {
+                    Err(errors.join("\n"))
+                } else {
+                    if updated > 0 {
+                        println!("✓ Moved {} ticket(s) to in_progress", updated);
+                    }
+                    Ok(())
+                }
+            }
+        }
+        "move-to-done" => {
+            if args.len() < 3 {
+                eprintln!("Error: move-to-done requires identifier (path, branch, or window)");
+                print_usage();
+                std::process::exit(1);
+            }
+            let identifier = &args[2];
+
+            // Try to find tickets by different methods
+            let mut tickets = Vec::new();
+
+            if let Ok(found) = find_tickets_by_worktree(identifier) {
+                if !found.is_empty() {
+                    tickets = found;
+                }
+            }
+
+            if tickets.is_empty() {
+                if let Ok(found) = find_tickets_by_branch(identifier) {
+                    if !found.is_empty() {
+                        tickets = found;
+                    }
+                }
+            }
+
+            if tickets.is_empty() {
+                if let Ok(found) = find_tickets_by_tmux_window(identifier) {
+                    tickets = found;
+                }
+            }
+
+            if tickets.is_empty() {
+                eprintln!("⚠ No tickets found for identifier: {}", identifier);
+                eprintln!("  This is OK - not all worktrees have associated tickets");
+                Ok(())
+            } else {
+                let mut errors = Vec::new();
+                let mut updated = 0;
+
+                for ticket in &tickets {
+                    match update_ticket_status(&ticket.id, "done") {
+                        Ok(_) => {
+                            println!("✓ Moved ticket to done: {} - {}", ticket.id, ticket.title);
+                            updated += 1;
+                        }
+                        Err(e) => {
+                            errors.push(format!("Failed to update {}: {}", ticket.id, e));
+                        }
+                    }
+                }
+
+                if !errors.is_empty() {
+                    Err(errors.join("\n"))
+                } else {
+                    if updated > 0 {
+                        println!("✓ Moved {} ticket(s) to done", updated);
+                    }
+                    Ok(())
+                }
+            }
+        }
+        "--help" | "-h" => {
+            print_usage();
+            Ok(())
+        }
+        _ => {
+            eprintln!("Error: Unknown command '{}'", command);
+            print_usage();
+            std::process::exit(1);
+        }
+    };
+
+    if let Err(e) = result {
+        eprintln!("Error: {}", e);
+        std::process::exit(1);
+    }
+}
diff --git a/ushadow/launcher/src-tauri/src/commands/config_commands.rs b/ushadow/launcher/src-tauri/src/commands/config_commands.rs
new file mode 100644
index 00000000..a563cb94
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/commands/config_commands.rs
@@ -0,0 +1,48 @@
+use crate::config::LauncherConfig;
+use std::path::PathBuf;
+use tauri::State;
+
+use super::docker::AppState;
+
+/// Load project configuration from .launcher-config.yaml
+#[tauri::command]
+pub async fn load_project_config(
+    project_root: String,
+    state: State<'_, AppState>,
+) -> Result<LauncherConfig, String> {
+    let config = LauncherConfig::load(&PathBuf::from(&project_root))?;
+
+    // Store the loaded config in application state
+    let mut config_lock = state.config.lock().map_err(|e| e.to_string())?;
+    *config_lock = Some(config.clone());
+
+    Ok(config)
+}
+
+/// Get the currently loaded configuration
+#[tauri::command]
+pub async fn get_current_config(
+    state: State<'_, AppState>,
+) -> Result<Option<LauncherConfig>, String> {
+    let config_lock = state.config.lock().map_err(|e| e.to_string())?;
+    Ok(config_lock.clone())
+}
+
+/// Check if a launcher config file exists in the given directory
+#[tauri::command]
+pub async fn check_launcher_config_exists(project_root: String) -> Result<bool, String> {
+    let config_path = PathBuf::from(&project_root).join(".launcher-config.yaml");
+    Ok(config_path.exists())
+}
+
+/// Validate a config file without loading it into state
+#[tauri::command]
+pub async fn validate_config_file(project_root: String) -> Result<String, String> {
+    match LauncherConfig::load(&PathBuf::from(&project_root)) {
+        Ok(config) => Ok(format!(
+            "Configuration is valid for project '{}'",
+            config.project.display_name
+        )),
+        Err(e) => Err(e),
+    }
+}
diff --git a/ushadow/launcher/src-tauri/src/commands/container_discovery.rs b/ushadow/launcher/src-tauri/src/commands/container_discovery.rs
new file mode 100644
index 00000000..647b2813
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/commands/container_discovery.rs
@@ -0,0 +1,307 @@
+use crate::config::LauncherConfig;
+use crate::models::{EnvironmentStatus, InfraService, UshadowEnvironment};
+use serde_json::Value;
+use std::process::Command;
+
+/// Information about a discovered container
+#[derive(Debug, Clone)]
+pub struct ContainerInfo {
+    pub name: String,
+    pub service_name: String,
+    pub status: String,
+    pub ports: Vec<PortMapping>,
+    pub compose_project: String,
+}
+
+/// Port mapping from container to host
+#[derive(Debug, Clone)]
+pub struct PortMapping {
+    pub host_port: u16,
+    pub container_port: u16,
+    pub protocol: String,
+}
+
+/// Discover all containers for a specific environment using Docker Compose labels
+pub fn discover_environment_containers(
+    config: &LauncherConfig,
+    env_name: &str,
+) -> Result<Vec<ContainerInfo>, String> {
+    // Determine the compose project name for this environment
+    // For ushadow: "ushadow-orange", "ushadow-blue", or "ushadow" for default
+    let compose_project = if env_name == "default" || env_name.is_empty() {
+        config.project.name.clone()
+    } else {
+        format!("{}-{}", config.project.name, env_name)
+    };
+
+    // Query Docker for containers with this compose project label
+    let output = Command::new("docker")
+        .args([
+            "ps",
+            "-a",
+            "--filter",
+            &format!("label=com.docker.compose.project={}", compose_project),
+            "--format",
+            "{{.Names}}",
+        ])
+        .output()
+        .map_err(|e| format!("Failed to query Docker: {}", e))?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(format!("Docker command failed: {}", stderr));
+    }
+
+    let container_names = String::from_utf8_lossy(&output.stdout);
+    let mut containers = Vec::new();
+
+    for container_name in container_names.lines() {
+        if container_name.trim().is_empty() {
+            continue;
+        }
+
+        // Inspect each container to get detailed information
+        if let Ok(info) = inspect_container(container_name) {
+            containers.push(info);
+        }
+    }
+
+    Ok(containers)
+}
+
+/// Inspect a single container to extract service name, status, and ports
+fn inspect_container(container_name: &str) -> Result<ContainerInfo, String> {
+    let output = Command::new("docker")
+        .args(["inspect", container_name])
+        .output()
+        .map_err(|e| format!("Failed to inspect container: {}", e))?;
+
+    if !output.status.success() {
+        return Err("Docker inspect failed".to_string());
+    }
+
+    let json_str = String::from_utf8_lossy(&output.stdout);
+    let json: Vec<Value> = serde_json::from_str(&json_str)
+        .map_err(|e| format!("Failed to parse Docker inspect JSON: {}", e))?;
+
+    let container = json
+        .first()
+        .ok_or("No container info returned".to_string())?;
+
+    // Extract labels
+    let labels = container["Config"]["Labels"]
+        .as_object()
+        .ok_or("No labels found")?;
+
+    let service_name = labels
+        .get("com.docker.compose.service")
+        .and_then(|v| v.as_str())
+        .unwrap_or("unknown")
+        .to_string();
+
+    let compose_project = labels
+        .get("com.docker.compose.project")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+
+    // Extract status
+    let status = container["State"]["Status"]
+        .as_str()
+        .unwrap_or("unknown")
+        .to_string();
+
+    // Extract port mappings
+    let ports = extract_port_mappings(container)?;
+
+    Ok(ContainerInfo {
+        name: container_name.to_string(),
+        service_name,
+        status,
+        ports,
+        compose_project,
+    })
+}
+
+/// Extract port mappings from Docker inspect JSON
+fn extract_port_mappings(container: &Value) -> Result<Vec<PortMapping>, String> {
+    let mut mappings = Vec::new();
+
+    let ports_obj = match container["NetworkSettings"]["Ports"].as_object() {
+        Some(obj) => obj,
+        None => return Ok(mappings), // No ports exposed
+    };
+
+    for (container_port_proto, host_bindings) in ports_obj {
+        // container_port_proto format: "8000/tcp"
+        let parts: Vec<&str> = container_port_proto.split('/').collect();
+        if parts.len() != 2 {
+            continue;
+        }
+
+        let container_port = parts[0].parse::<u16>().unwrap_or(0);
+        let protocol = parts[1].to_string();
+
+        // host_bindings is an array of {"HostIp": "0.0.0.0", "HostPort": "8240"}
+        if let Some(bindings) = host_bindings.as_array() {
+            for binding in bindings {
+                if let Some(host_port_str) = binding["HostPort"].as_str() {
+                    if let Ok(host_port) = host_port_str.parse::<u16>() {
+                        mappings.push(PortMapping {
+                            host_port,
+                            container_port,
+                            protocol: protocol.clone(),
+                        });
+                    }
+                }
+            }
+        }
+    }
+
+    Ok(mappings)
+}
+
+/// Discover infrastructure containers using compose project label
+pub fn discover_infrastructure_containers(
+    config: &LauncherConfig,
+) -> Result<Vec<InfraService>, String> {
+    let output = Command::new("docker")
+        .args([
+            "ps",
+            "-a",
+            "--filter",
+            &format!(
+                "label=com.docker.compose.project={}",
+                config.infrastructure.project_name
+            ),
+            "--format",
+            "{{.Names}}",
+        ])
+        .output()
+        .map_err(|e| format!("Failed to query Docker: {}", e))?;
+
+    if !output.status.success() {
+        return Ok(Vec::new()); // Infrastructure not running
+    }
+
+    let container_names = String::from_utf8_lossy(&output.stdout);
+    let mut services = Vec::new();
+
+    for container_name in container_names.lines() {
+        if container_name.trim().is_empty() {
+            continue;
+        }
+
+        if let Ok(info) = inspect_container(container_name) {
+            // Format ports string for display
+            let ports_str = if info.ports.is_empty() {
+                None
+            } else {
+                Some(
+                    info.ports
+                        .iter()
+                        .map(|p| format!("{}:{}", p.host_port, p.container_port))
+                        .collect::<Vec<_>>()
+                        .join(", "),
+                )
+            };
+
+            services.push(InfraService {
+                name: info.service_name.clone(),
+                display_name: capitalize(&info.service_name),
+                running: info.status == "running",
+                ports: ports_str,
+            });
+        }
+    }
+
+    Ok(services)
+}
+
+/// Capitalize first letter of a string
+fn capitalize(s: &str) -> String {
+    let mut chars = s.chars();
+    match chars.next() {
+        None => String::new(),
+        Some(first) => first.to_uppercase().chain(chars).collect(),
+    }
+}
+
+/// Determine environment status from container list
+pub fn determine_environment_status(containers: &[ContainerInfo]) -> EnvironmentStatus {
+    if containers.is_empty() {
+        return EnvironmentStatus::Available;
+    }
+
+    let running_count = containers.iter().filter(|c| c.status == "running").count();
+
+    if running_count == containers.len() {
+        EnvironmentStatus::Running
+    } else if running_count > 0 {
+        EnvironmentStatus::Partial
+    } else {
+        EnvironmentStatus::Stopped
+    }
+}
+
+/// Find the primary service port from container list
+pub fn get_primary_service_port(
+    containers: &[ContainerInfo],
+    primary_service_name: &str,
+) -> Option<u16> {
+    containers
+        .iter()
+        .find(|c| c.service_name == primary_service_name)
+        .and_then(|c| c.ports.first())
+        .map(|p| p.host_port)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_capitalize() {
+        assert_eq!(capitalize("mongo"), "Mongo");
+        assert_eq!(capitalize("redis"), "Redis");
+        assert_eq!(capitalize(""), "");
+    }
+
+    #[test]
+    fn test_determine_status() {
+        let running_containers = vec![
+            ContainerInfo {
+                name: "test-backend".to_string(),
+                service_name: "backend".to_string(),
+                status: "running".to_string(),
+                ports: vec![],
+                compose_project: "test".to_string(),
+            },
+            ContainerInfo {
+                name: "test-webui".to_string(),
+                service_name: "webui".to_string(),
+                status: "running".to_string(),
+                ports: vec![],
+                compose_project: "test".to_string(),
+            },
+        ];
+
+        assert_eq!(
+            determine_environment_status(&running_containers),
+            EnvironmentStatus::Running
+        );
+
+        let mut partial_containers = running_containers.clone();
+        partial_containers[1].status = "exited".to_string();
+
+        assert_eq!(
+            determine_environment_status(&partial_containers),
+            EnvironmentStatus::Partial
+        );
+
+        assert_eq!(
+            determine_environment_status(&[]),
+            EnvironmentStatus::Available
+        );
+    }
+}
diff --git a/ushadow/launcher/src-tauri/src/commands/discovery.rs b/ushadow/launcher/src-tauri/src/commands/discovery.rs
index 363c9c00..5ae5fa1c 100644
--- a/ushadow/launcher/src-tauri/src/commands/discovery.rs
+++ b/ushadow/launcher/src-tauri/src/commands/discovery.rs
@@ -9,6 +9,7 @@ use super::worktree::{list_worktrees, get_colors_for_name};
 /// Infrastructure service patterns
 const INFRA_PATTERNS: &[(&str, &str)] = &[
     ("mongo", "MongoDB"),
+    ("postgres", "PostgreSQL"),
     ("redis", "Redis"),
     ("neo4j", "Neo4j"),
     ("qdrant", "Qdrant"),
@@ -169,7 +170,18 @@ pub async fn discover_environments_with_config(
 
                 // Check infrastructure services
                 for (pattern, display_name) in INFRA_PATTERNS {
-                    if name == *pattern || name.ends_with(&format!("-{}", pattern)) || name.ends_with(&format!("-{}-1", pattern)) {
+                    // Match various container name patterns:
+                    // - exact: "postgres"
+                    // - hyphen suffix: "infra-postgres", "infra-postgres-1"
+                    // - underscore suffix: "hash_postgres", "d5904eb91d56_postgres"
+                    // - contains: any container with the service name in it
+                    let is_match = name == *pattern
+                        || name.ends_with(&format!("-{}", pattern))
+                        || name.ends_with(&format!("-{}-1", pattern))
+                        || name.ends_with(&format!("_{}", pattern))
+                        || name.contains(&format!("_{}", pattern));
+
+                    if is_match {
                         if !found_infra.contains(*pattern) {
                             found_infra.insert(pattern.to_string());
                             infrastructure.push(InfraService {
@@ -178,6 +190,11 @@ pub async fn discover_environments_with_config(
                                 running: is_running,
                                 ports: ports.clone(),
                             });
+                        } else if is_running {
+                            // Update existing entry to running if we find a running instance
+                            if let Some(service) = infrastructure.iter_mut().find(|s| s.name == *pattern) {
+                                service.running = true;
+                            }
                         }
                     }
                 }
diff --git a/ushadow/launcher/src-tauri/src/commands/discovery_v2.rs b/ushadow/launcher/src-tauri/src/commands/discovery_v2.rs
new file mode 100644
index 00000000..573d18f1
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/commands/discovery_v2.rs
@@ -0,0 +1,137 @@
+use crate::config::LauncherConfig;
+use crate::models::{DiscoveryResult, EnvironmentStatus, UshadowEnvironment, WorktreeInfo};
+use super::container_discovery::{
+    discover_environment_containers, discover_infrastructure_containers,
+    determine_environment_status, get_primary_service_port,
+};
+use super::prerequisites::{check_docker, check_tailscale};
+use super::worktree::{list_worktrees, get_colors_for_name};
+use std::collections::HashMap;
+
+/// Discover environments using config-based Docker Compose labels
+/// Note: The project_root parameter is required to load the config
+/// The frontend should provide this from the user's project selection
+#[tauri::command]
+pub async fn discover_environments_v2(
+    project_root: String,
+    main_repo: Option<String>,
+) -> Result<DiscoveryResult, String> {
+    // Check prerequisites
+    let (docker_installed, docker_running, _) = check_docker();
+    let (tailscale_installed, tailscale_connected, _) = check_tailscale();
+
+    let docker_ok = docker_installed && docker_running;
+    let tailscale_ok = tailscale_installed && tailscale_connected;
+
+    // Load config from project root
+    let config = LauncherConfig::load(&std::path::PathBuf::from(&project_root))?;
+
+    // Use provided main_repo or default to project_root
+    let main_repo = main_repo.unwrap_or_else(|| project_root.clone());
+
+    // Get worktrees (source of truth for environments)
+    let worktrees = match list_worktrees(main_repo.clone()).await {
+        Ok(wt) => {
+            eprintln!("[discovery_v2] Found {} worktrees from {}", wt.len(), main_repo);
+            wt
+        }
+        Err(e) => {
+            eprintln!("[discovery_v2] Failed to list worktrees from {}: {}", main_repo, e);
+            Vec::new()
+        }
+    };
+
+    // Build worktree map
+    let mut worktree_map: HashMap<String, WorktreeInfo> = HashMap::new();
+    for wt in worktrees {
+        worktree_map.insert(wt.name.clone(), wt);
+    }
+
+    // Discover infrastructure
+    let infrastructure = if docker_ok {
+        discover_infrastructure_containers(&config).unwrap_or_else(|e| {
+            eprintln!("[discovery_v2] Infrastructure discovery error: {}", e);
+            Vec::new()
+        })
+    } else {
+        Vec::new()
+    };
+
+    // Discover environments
+    let mut environments = Vec::new();
+
+    for (env_name, wt) in &worktree_map {
+        let (primary_color, _) = get_colors_for_name(env_name);
+
+        // Discover containers for this environment using Docker Compose labels
+        let containers = if docker_ok {
+            discover_environment_containers(&config, env_name).unwrap_or_else(|e| {
+                eprintln!("[discovery_v2] Container discovery error for {}: {}", env_name, e);
+                Vec::new()
+            })
+        } else {
+            Vec::new()
+        };
+
+        // Determine status from containers
+        let status = determine_environment_status(&containers);
+
+        // Get primary service port
+        let backend_port = get_primary_service_port(&containers, &config.containers.primary_service);
+
+        // Find webui port from containers (look for webui service)
+        // Falls back to backend - 5000 if webui service not found
+        let webui_port = containers
+            .iter()
+            .find(|c| c.service_name == "webui" || c.service_name == "frontend")
+            .and_then(|c| c.ports.first())
+            .map(|p| p.host_port)
+            .or_else(|| backend_port.and_then(|p| if p >= 5000 { Some(p - 5000) } else { None }));
+
+        // Build localhost URL (prefer webui port, fallback to backend)
+        let localhost_url = if status == EnvironmentStatus::Running {
+            webui_port.or(backend_port).map(|p| format!("http://localhost:{}", p))
+        } else {
+            None
+        };
+
+        // Generate Tailscale URL using the host's tailnet
+        let tailscale_url = super::port_utils::generate_tailscale_url(
+            env_name,
+            config.containers.tailscale_project_prefix.as_deref(),
+        )
+        .unwrap_or(None);
+
+        let tailscale_active = tailscale_url.is_some() && status == EnvironmentStatus::Running;
+
+        // Container names for display
+        let container_names: Vec<String> = containers.iter().map(|c| c.name.clone()).collect();
+
+        let running = status == EnvironmentStatus::Running || status == EnvironmentStatus::Partial;
+
+        environments.push(UshadowEnvironment {
+            name: env_name.clone(),
+            color: primary_color,
+            path: Some(wt.path.clone()),
+            branch: Some(wt.branch.clone()),
+            status,
+            running,
+            localhost_url,
+            tailscale_url,
+            backend_port,
+            webui_port,
+            tailscale_active,
+            containers: container_names,
+            is_worktree: true,
+            created_at: None,  // TODO: Get actual creation timestamp from git worktree
+            base_branch: None,  // TODO: Determine base branch (main/dev) from worktree
+        });
+    }
+
+    Ok(DiscoveryResult {
+        infrastructure,
+        environments,
+        docker_ok,
+        tailscale_ok,
+    })
+}
diff --git a/ushadow/launcher/src-tauri/src/commands/docker.rs b/ushadow/launcher/src-tauri/src/commands/docker.rs
index 21a73f0a..3c0a2ba9 100644
--- a/ushadow/launcher/src-tauri/src/commands/docker.rs
+++ b/ushadow/launcher/src-tauri/src/commands/docker.rs
@@ -3,10 +3,11 @@ use std::sync::Mutex;
 use std::collections::HashMap;
 use std::path::Path;
 use tauri::State;
-use crate::models::{ContainerStatus, ServiceInfo};
+use crate::models::{ContainerStatus, ServiceInfo, InfraService};
 use super::utils::{silent_command, shell_command, quote_path_buf};
 use super::platform::{Platform, PlatformOps};
 use super::bundled;
+use serde_yaml::Value;
 
 /// Recursively copy a directory and all its contents
 fn copy_dir_recursive(src: &Path, dst: &Path) -> std::io::Result<()> {
@@ -122,12 +123,16 @@ fn find_available_ports(default_backend: u16, default_webui: u16) -> (u16, u16)
 /// Application state
 pub struct AppState {
     pub project_root: Mutex<Option<String>>,
+    pub containers_running: Mutex<bool>,
+    pub config: Mutex<Option<crate::config::LauncherConfig>>,
 }
 
 impl AppState {
     pub fn new() -> Self {
         Self {
             project_root: Mutex::new(None),
+            containers_running: Mutex::new(false),
+            config: Mutex::new(None),
         }
     }
 }
@@ -154,7 +159,7 @@ pub async fn start_infrastructure(state: State<'_, AppState>) -> Result<String,
     log_messages.push("Creating Docker networks...".to_string());
 
     // Create Docker networks directly (don't require uv/Python)
-    let networks = vec!["ushadow-network""];
+    let networks = vec!["ushadow-network", "infra-network"];
     for network in networks {
         log_messages.push(format!("Checking network: {}", network));
 
@@ -837,6 +842,135 @@ pub async fn create_environment(state: State<'_, AppState>, name: String, mode:
     Ok(format!("Environment '{}' started{}", name, port_info))
 }
 
+/// Parse docker-compose.infra.yml to get list of available services
+#[tauri::command]
+pub fn get_infra_services_from_compose(state: State<AppState>) -> Result<Vec<InfraService>, String> {
+    let root = state.project_root.lock().map_err(|e| e.to_string())?;
+    let project_root = root.clone().ok_or("Project root not set")?;
+    drop(root);
+
+    // Try to find compose file (bundled or working directory)
+    let bundled_compose_file = bundled::get_compose_file(&project_root, "docker-compose.infra.yml");
+
+    // Also check working directory
+    let working_compose_file = std::path::Path::new(&project_root)
+        .join("compose")
+        .join("docker-compose.infra.yml");
+
+    let compose_file = if working_compose_file.exists() {
+        working_compose_file
+    } else {
+        bundled_compose_file
+    };
+
+    if !compose_file.exists() {
+        return Err(format!("docker-compose.infra.yml not found at {:?}", compose_file));
+    }
+
+    // Read and parse YAML
+    let contents = std::fs::read_to_string(&compose_file)
+        .map_err(|e| format!("Failed to read compose file: {}", e))?;
+
+    let yaml: Value = serde_yaml::from_str(&contents)
+        .map_err(|e| format!("Failed to parse compose YAML: {}", e))?;
+
+    // Extract services
+    let services = yaml.get("services")
+        .ok_or("No 'services' section found in compose file")?
+        .as_mapping()
+        .ok_or("'services' is not a mapping")?;
+
+    let mut result = Vec::new();
+
+    // Map of service IDs to display names
+    let display_names: HashMap<&str, &str> = [
+        ("postgres", "PostgreSQL"),
+        ("mongodb", "MongoDB"),
+        ("mongo", "MongoDB"),
+        ("redis", "Redis"),
+        ("mysql", "MySQL"),
+        ("elasticsearch", "Elasticsearch"),
+        ("rabbitmq", "RabbitMQ"),
+        ("kafka", "Kafka"),
+        ("qdrant", "Qdrant"),
+        ("neo4j", "Neo4j"),
+    ].iter().copied().collect();
+
+    for (service_id, service_config) in services {
+        let service_name = service_id.as_str()
+            .ok_or("Service name is not a string")?
+            .to_string();
+
+        // Get display name (capitalize if not in map)
+        let display_name = display_names.get(service_name.as_str())
+            .copied()
+            .unwrap_or_else(|| &service_name)
+            .to_string();
+
+        // Extract default port from exposed ports
+        let default_port = service_config.get("ports")
+            .and_then(|ports| ports.as_sequence())
+            .and_then(|seq| seq.first())
+            .and_then(|port_mapping| port_mapping.as_str())
+            .and_then(|mapping| {
+                // Parse port mapping like "5432:5432" or "5432"
+                let parts: Vec<&str> = mapping.split(':').collect();
+                parts.first().and_then(|p| p.parse::<u16>().ok())
+            });
+
+        // Extract profiles
+        let profiles = service_config.get("profiles")
+            .and_then(|p| p.as_sequence())
+            .map(|seq| {
+                seq.iter()
+                    .filter_map(|v| v.as_str().map(String::from))
+                    .collect()
+            })
+            .unwrap_or_else(Vec::new);
+
+        // Check if this service is actually running
+        let running = check_service_running(&service_name);
+
+        // Format ports string
+        let ports_str = default_port.map(|p| p.to_string());
+
+        result.push(InfraService {
+            name: service_name,
+            display_name,
+            running,
+            ports: ports_str,
+        });
+    }
+
+    Ok(result)
+}
+
+/// Check if a service container is running
+fn check_service_running(service_name: &str) -> bool {
+    use std::process::Command;
+
+    // Check if container exists and is running
+    let output = Command::new("docker")
+        .args([
+            "ps",
+            "--filter",
+            &format!("name={}", service_name),
+            "--filter",
+            "status=running",
+            "--format",
+            "{{.Names}}",
+        ])
+        .output();
+
+    match output {
+        Ok(output) if output.status.success() => {
+            let stdout = String::from_utf8_lossy(&output.stdout);
+            stdout.lines().any(|line| line.contains(service_name))
+        }
+        _ => false,
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/ushadow/launcher/src-tauri/src/commands/env_scanner.rs b/ushadow/launcher/src-tauri/src/commands/env_scanner.rs
new file mode 100644
index 00000000..a15f2e5b
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/commands/env_scanner.rs
@@ -0,0 +1,236 @@
+use std::path::Path;
+use std::fs;
+use serde::{Serialize, Deserialize};
+
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct DetectedPort {
+    pub name: String,
+    pub default_value: Option<String>,
+    pub base_port: Option<u16>,
+    pub is_database: bool,
+}
+
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct DetectedEnvVar {
+    pub name: String,
+    pub default_value: Option<String>,
+    pub is_port: bool,
+    pub is_database_port: bool,
+    pub should_append_env_name: bool,  // For DB names, user names, etc.
+}
+
+/// Scan .env.template, .env.example, or .env for port-related variables
+#[tauri::command]
+pub fn scan_env_file(project_root: String) -> Result<Vec<DetectedPort>, String> {
+    let project_path = Path::new(&project_root);
+
+    // Try different env file names in order of preference
+    let env_files = vec![
+        ".env.template",
+        ".env.example",
+        ".env.sample",
+        ".env",
+    ];
+
+    let mut found_file = None;
+    for file_name in &env_files {
+        let file_path = project_path.join(file_name);
+        if file_path.exists() {
+            found_file = Some(file_path);
+            break;
+        }
+    }
+
+    let env_file = found_file.ok_or("No .env file found in project root")?;
+
+    eprintln!("[scan_env_file] Scanning: {:?}", env_file);
+
+    let content = fs::read_to_string(&env_file)
+        .map_err(|e| format!("Failed to read env file: {}", e))?;
+
+    let mut detected_ports = Vec::new();
+
+    for line in content.lines() {
+        let line = line.trim();
+
+        // Skip comments and empty lines
+        if line.starts_with('#') || line.is_empty() {
+            continue;
+        }
+
+        // Parse VAR=value format
+        if let Some((key, value)) = line.split_once('=') {
+            let key = key.trim();
+            let value = value.trim().trim_matches('"').trim_matches('\'');
+
+            // Check if this looks like a port variable
+            if is_port_variable(key) {
+                let base_port = value.parse::<u16>().ok();
+                let is_database = is_database_port(key);
+
+                detected_ports.push(DetectedPort {
+                    name: key.to_string(),
+                    default_value: Some(value.to_string()),
+                    base_port,
+                    is_database,
+                });
+            }
+        }
+    }
+
+    eprintln!("[scan_env_file] Detected {} port variables", detected_ports.len());
+
+    Ok(detected_ports)
+}
+
+/// Scan all environment variables from .env files
+#[tauri::command]
+pub fn scan_all_env_vars(project_root: String) -> Result<Vec<DetectedEnvVar>, String> {
+    let project_path = Path::new(&project_root);
+
+    // Try different env file names in order of preference
+    let env_files = vec![
+        ".env.template",
+        ".env.example",
+        ".env.sample",
+        ".env",
+    ];
+
+    let mut found_file = None;
+    for file_name in &env_files {
+        let file_path = project_path.join(file_name);
+        if file_path.exists() {
+            found_file = Some(file_path);
+            break;
+        }
+    }
+
+    let env_file = found_file.ok_or("No .env file found in project root")?;
+
+    eprintln!("[scan_all_env_vars] Scanning: {:?}", env_file);
+
+    let content = fs::read_to_string(&env_file)
+        .map_err(|e| format!("Failed to read env file: {}", e))?;
+
+    let mut detected_vars = Vec::new();
+
+    for line in content.lines() {
+        let line = line.trim();
+
+        // Skip comments and empty lines
+        if line.starts_with('#') || line.is_empty() {
+            continue;
+        }
+
+        // Parse VAR=value format
+        if let Some((key, value)) = line.split_once('=') {
+            let key = key.trim();
+            let value = value.trim().trim_matches('"').trim_matches('\'');
+
+            let is_port = is_port_variable(key);
+            let is_database_port = is_database_port(key);
+            let should_append_env_name = should_append_env_name(key);
+
+            detected_vars.push(DetectedEnvVar {
+                name: key.to_string(),
+                default_value: Some(value.to_string()),
+                is_port,
+                is_database_port,
+                should_append_env_name,
+            });
+        }
+    }
+
+    eprintln!("[scan_all_env_vars] Detected {} variables", detected_vars.len());
+
+    Ok(detected_vars)
+}
+
+/// Check if a variable name looks like a port variable
+fn is_port_variable(key: &str) -> bool {
+    let key_upper = key.to_uppercase();
+
+    // Explicit port variables
+    if key_upper.contains("PORT") {
+        return true;
+    }
+
+    // Common database/service port patterns
+    let patterns = [
+        "POSTGRES", "MYSQL", "MONGODB", "MONGO", "REDIS", "MEMCACHED",
+        "ELASTICSEARCH", "RABBITMQ", "KAFKA", "CASSANDRA",
+        "BACKEND", "API", "WEBUI", "FRONTEND", "WEB",
+    ];
+
+    for pattern in &patterns {
+        if key_upper.contains(pattern) && key_upper.contains("PORT") {
+            return true;
+        }
+    }
+
+    false
+}
+
+/// Check if a port variable is for a database
+fn is_database_port(key: &str) -> bool {
+    let key_upper = key.to_uppercase();
+
+    let db_keywords = [
+        "POSTGRES", "MYSQL", "MONGODB", "MONGO", "REDIS", "MEMCACHED",
+        "ELASTICSEARCH", "CASSANDRA", "MARIADB", "MSSQL", "ORACLE",
+        "DB", "DATABASE",
+    ];
+
+    db_keywords.iter().any(|kw| key_upper.contains(kw))
+}
+
+/// Check if a variable should have the environment name appended
+/// (e.g., database names, user names, bucket names)
+fn should_append_env_name(key: &str) -> bool {
+    let key_upper = key.to_uppercase();
+
+    // Variables that typically need env-specific values
+    let patterns = [
+        "DB_NAME", "DATABASE_NAME", "POSTGRES_DB", "MYSQL_DATABASE", "MONGO_DATABASE",
+        "DB_USER", "DATABASE_USER", "POSTGRES_USER", "MYSQL_USER",
+        "BUCKET_NAME", "QUEUE_NAME", "TOPIC_NAME", "STREAM_NAME",
+        "SCHEMA_NAME", "TENANT_", "NAMESPACE",
+    ];
+
+    patterns.iter().any(|pattern| key_upper.contains(pattern))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_is_port_variable() {
+        assert!(is_port_variable("BACKEND_PORT"));
+        assert!(is_port_variable("postgres_port"));
+        assert!(is_port_variable("REDIS_PORT"));
+        assert!(is_port_variable("API_PORT"));
+        assert!(!is_port_variable("API_KEY"));
+        assert!(!is_port_variable("DATABASE_URL"));
+    }
+
+    #[test]
+    fn test_is_database_port() {
+        assert!(is_database_port("POSTGRES_PORT"));
+        assert!(is_database_port("REDIS_PORT"));
+        assert!(is_database_port("MONGODB_PORT"));
+        assert!(!is_database_port("BACKEND_PORT"));
+        assert!(!is_database_port("WEBUI_PORT"));
+    }
+
+    #[test]
+    fn test_should_append_env_name() {
+        assert!(should_append_env_name("POSTGRES_DB"));
+        assert!(should_append_env_name("DB_NAME"));
+        assert!(should_append_env_name("DATABASE_NAME"));
+        assert!(should_append_env_name("BUCKET_NAME"));
+        assert!(should_append_env_name("POSTGRES_USER"));
+        assert!(!should_append_env_name("POSTGRES_PASSWORD"));
+        assert!(!should_append_env_name("API_KEY"));
+    }
+}
diff --git a/ushadow/launcher/src-tauri/src/commands/http_client.rs b/ushadow/launcher/src-tauri/src/commands/http_client.rs
new file mode 100644
index 00000000..2fac6d8b
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/commands/http_client.rs
@@ -0,0 +1,81 @@
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct HttpResponse {
+    pub status: u16,
+    pub body: String,
+    pub headers: HashMap<String, String>,
+}
+
+/// Make an HTTP request from Rust (bypasses CORS)
+#[tauri::command]
+pub async fn http_request(
+    url: String,
+    method: String,
+    headers: Option<HashMap<String, String>>,
+    body: Option<String>,
+) -> Result<HttpResponse, String> {
+    eprintln!("[HTTP] Making {} request to: {}", method, url);
+
+    let client = reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(30))
+        .build()
+        .map_err(|e| format!("Failed to create HTTP client: {}", e))?;
+
+    let mut request: reqwest::RequestBuilder = match method.to_uppercase().as_str() {
+        "GET" => client.get(&url),
+        "POST" => client.post(&url),
+        "PUT" => client.put(&url),
+        "DELETE" => client.delete(&url),
+        "PATCH" => client.patch(&url),
+        _ => return Err(format!("Unsupported HTTP method: {}", method)),
+    };
+
+    // Add headers
+    if let Some(headers) = headers {
+        for (key, value) in headers {
+            request = request.header(key, value);
+        }
+    }
+
+    // Add body for POST/PUT/PATCH
+    if let Some(body_content) = body {
+        eprintln!("[HTTP] Request body: {}", body_content);
+        request = request.body(body_content);
+    }
+
+    // Send request
+    eprintln!("[HTTP] Sending request...");
+    let response = request
+        .send()
+        .await
+        .map_err(|e| {
+            eprintln!("[HTTP] Request failed: {}", e);
+            format!("HTTP request failed: {}", e)
+        })?;
+
+    eprintln!("[HTTP] Response status: {}", response.status());
+
+    let status = response.status().as_u16();
+
+    // Extract headers
+    let mut response_headers = HashMap::new();
+    for (key, value) in response.headers() {
+        if let Ok(value_str) = value.to_str() {
+            response_headers.insert(key.to_string(), value_str.to_string());
+        }
+    }
+
+    // Get body
+    let body = response
+        .text()
+        .await
+        .map_err(|e| format!("Failed to read response body: {}", e))?;
+
+    Ok(HttpResponse {
+        status,
+        body,
+        headers: response_headers,
+    })
+}
diff --git a/ushadow/launcher/src-tauri/src/commands/kanban.rs b/ushadow/launcher/src-tauri/src/commands/kanban.rs
new file mode 100644
index 00000000..55cfb13c
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/commands/kanban.rs
@@ -0,0 +1,999 @@
+use crate::models::{Epic, Ticket, TicketPriority, TicketStatus};
+use super::worktree::create_worktree_with_workmux;
+use super::utils::shell_command;
+use std::path::PathBuf;
+use std::fs;
+use serde::{Deserialize, Serialize};
+use tauri::api::path::data_dir;
+
+/// Request to create a ticket with worktree and tmux
+#[derive(Debug, Deserialize)]
+pub struct CreateTicketWorktreeRequest {
+    pub ticket_id: String,
+    pub ticket_title: String,
+    pub project_root: String,
+    pub branch_name: Option<String>, // If None, will be generated from ticket_id
+    pub base_branch: Option<String>, // Default to "main"
+    pub epic_branch: Option<String>, // If part of epic with shared branch
+}
+
+/// Result of creating a ticket worktree
+#[derive(Debug, Serialize)]
+pub struct CreateTicketWorktreeResult {
+    pub worktree_path: String,
+    pub branch_name: String,
+    pub tmux_window_name: String,
+    pub tmux_session_name: String,
+}
+
+/// Create a worktree and tmux window for a kanban ticket
+///
+/// This command handles two scenarios:
+/// 1. Ticket has its own branch (epic_branch is None)
+/// 2. Ticket shares a branch with epic (epic_branch is Some)
+#[tauri::command]
+pub async fn create_ticket_worktree(
+    request: CreateTicketWorktreeRequest,
+) -> Result<CreateTicketWorktreeResult, String> {
+    eprintln!("[create_ticket_worktree] Creating worktree for ticket: {}", request.ticket_title);
+
+    // Determine branch to use
+    let branch_name = if let Some(epic_branch) = request.epic_branch {
+        // Use epic's shared branch
+        eprintln!("[create_ticket_worktree] Using epic's shared branch: {}", epic_branch);
+        epic_branch
+    } else if let Some(branch_name) = request.branch_name {
+        // Use provided branch name
+        branch_name
+    } else {
+        // Generate branch name from ticket ID
+        format!("ticket-{}", request.ticket_id)
+    };
+
+    let base_branch = request.base_branch.unwrap_or_else(|| "main".to_string());
+
+    // Create worktree with tmux integration
+    // The worktree name will be the branch name
+    let worktree_info = create_worktree_with_workmux(
+        request.project_root.clone(),
+        branch_name.clone(),
+        Some(base_branch),
+        Some(false), // Not background
+    ).await?;
+
+    // Create a unique window name for this ticket (include ticket ID to ensure uniqueness)
+    let ticket_id_short = &request.ticket_id[request.ticket_id.len().saturating_sub(6)..]; // Last 6 chars
+    let tmux_window_name = format!("ushadow-{}-{}", branch_name, ticket_id_short);
+    let tmux_session_name = "workmux".to_string(); // Default session
+
+    eprintln!("[create_ticket_worktree] ✓ Worktree created at: {}", worktree_info.path);
+    eprintln!("[create_ticket_worktree] ✓ Tmux window: {}", tmux_window_name);
+
+    Ok(CreateTicketWorktreeResult {
+        worktree_path: worktree_info.path,
+        branch_name,
+        tmux_window_name,
+        tmux_session_name,
+    })
+}
+
+/// Attach an existing ticket to an existing worktree (for epic-shared branches)
+#[tauri::command]
+pub async fn attach_ticket_to_worktree(
+    ticket_id: String,
+    worktree_path: String,
+    branch_name: String,
+) -> Result<CreateTicketWorktreeResult, String> {
+    eprintln!("[attach_ticket_to_worktree] Attaching ticket {} to existing worktree: {}", ticket_id, worktree_path);
+
+    // Verify worktree exists
+    let path_buf = PathBuf::from(&worktree_path);
+    if !path_buf.exists() {
+        eprintln!("[attach_ticket_to_worktree] ERROR: Worktree path does not exist: {}", worktree_path);
+        return Err(format!("Worktree path does not exist: {}", worktree_path));
+    }
+
+    // Create a unique window name for this ticket (include ticket ID to ensure uniqueness)
+    let ticket_id_short = &ticket_id[ticket_id.len().saturating_sub(6)..]; // Last 6 chars
+    let tmux_window_name = format!("ushadow-{}-{}", branch_name, ticket_id_short);
+    let tmux_session_name = "workmux".to_string();
+
+    // Ensure tmux server is running
+    shell_command("tmux start-server")
+        .output()
+        .map_err(|e| format!("Failed to start tmux server: {}", e))?;
+
+    // Check if the workmux session exists
+    let check_session = shell_command("tmux has-session -t workmux")
+        .output();
+
+    if check_session.is_err() || !check_session.unwrap().status.success() {
+        eprintln!("[attach_ticket_to_worktree] Creating workmux session...");
+        shell_command("tmux new-session -d -s workmux")
+            .output()
+            .map_err(|e| format!("Failed to create workmux session: {}", e))?;
+    }
+
+    // Check if tmux window exists
+    let check_window = shell_command(&format!(
+        "tmux list-windows -t {} -F '#W'",
+        tmux_session_name
+    ))
+    .output()
+    .map_err(|e| format!("Failed to check tmux windows: {}", e))?;
+
+    let stdout = String::from_utf8_lossy(&check_window.stdout);
+    let window_exists = stdout.lines().any(|line| line == tmux_window_name);
+
+    if window_exists {
+        eprintln!("[attach_ticket_to_worktree] ✓ Found existing tmux window: {}", tmux_window_name);
+    } else {
+        eprintln!("[attach_ticket_to_worktree] Creating tmux window: {}", tmux_window_name);
+
+        // Create the tmux window
+        let create_result = shell_command(&format!(
+            "tmux new-window -t {} -n {} -c '{}'",
+            tmux_session_name, tmux_window_name, worktree_path
+        ))
+        .output()
+        .map_err(|e| format!("Failed to create tmux window: {}", e))?;
+
+        if !create_result.status.success() {
+            let stderr = String::from_utf8_lossy(&create_result.stderr);
+            return Err(format!("Failed to create tmux window: {}", stderr));
+        }
+
+        eprintln!("[attach_ticket_to_worktree] ✓ Created tmux window: {}", tmux_window_name);
+    }
+
+    eprintln!("[attach_ticket_to_worktree] ✓ Ticket attached to worktree with tmux window: {}", tmux_window_name);
+
+    Ok(CreateTicketWorktreeResult {
+        worktree_path,
+        branch_name,
+        tmux_window_name,
+        tmux_session_name,
+    })
+}
+
+/// List all tickets associated with a specific tmux window
+/// Returns ticket IDs that are using this tmux window
+#[tauri::command]
+pub async fn get_tickets_for_tmux_window(
+    window_name: String,
+) -> Result<Vec<String>, String> {
+    // This will need to query the backend API
+    // For now, return empty list as placeholder
+    eprintln!("[get_tickets_for_tmux_window] Getting tickets for window: {}", window_name);
+    Ok(vec![])
+}
+
+/// Get tmux window information for a ticket
+#[tauri::command]
+pub async fn get_ticket_tmux_info(
+    ticket_id: String,
+) -> Result<Option<CreateTicketWorktreeResult>, String> {
+    // This will need to query the backend API to get ticket's tmux details
+    // For now, return None as placeholder
+    eprintln!("[get_ticket_tmux_info] Getting tmux info for ticket: {}", ticket_id);
+    Ok(None)
+}
+
+// ============================================================================
+// Local Ticket & Epic Storage (SQLite-based)
+// ============================================================================
+
+use rusqlite::{Connection, params};
+
+/// Get the path to the SQLite database
+fn get_db_path() -> Result<PathBuf, String> {
+    let data_dir = data_dir().ok_or("Failed to get data directory")?;
+    let launcher_dir = data_dir.join("com.ushadow.launcher");
+
+    // Create directory if it doesn't exist
+    if !launcher_dir.exists() {
+        fs::create_dir_all(&launcher_dir)
+            .map_err(|e| format!("Failed to create launcher data directory: {}", e))?;
+    }
+
+    Ok(launcher_dir.join("kanban.db"))
+}
+
+/// Get a database connection and ensure schema is initialized
+fn get_db_connection() -> Result<Connection, String> {
+    let db_path = get_db_path()?;
+    let conn = Connection::open(&db_path)
+        .map_err(|e| format!("Failed to open database: {}", e))?;
+
+    // Create tables if they don't exist
+    conn.execute(
+        "CREATE TABLE IF NOT EXISTS epics (
+            id TEXT PRIMARY KEY,
+            title TEXT NOT NULL,
+            description TEXT,
+            color TEXT NOT NULL,
+            branch_name TEXT,
+            base_branch TEXT NOT NULL,
+            project_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+        )",
+        [],
+    ).map_err(|e| format!("Failed to create epics table: {}", e))?;
+
+    conn.execute(
+        "CREATE TABLE IF NOT EXISTS tickets (
+            id TEXT PRIMARY KEY,
+            title TEXT NOT NULL,
+            description TEXT,
+            status TEXT NOT NULL,
+            priority TEXT NOT NULL,
+            epic_id TEXT,
+            tags TEXT NOT NULL,
+            color TEXT,
+            tmux_window_name TEXT,
+            tmux_session_name TEXT,
+            branch_name TEXT,
+            worktree_path TEXT,
+            environment_name TEXT,
+            project_id TEXT,
+            assigned_to TEXT,
+            \"order\" INTEGER NOT NULL,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            FOREIGN KEY (epic_id) REFERENCES epics (id) ON DELETE SET NULL
+        )",
+        [],
+    ).map_err(|e| format!("Failed to create tickets table: {}", e))?;
+
+    // Create indexes for common queries
+    conn.execute(
+        "CREATE INDEX IF NOT EXISTS idx_tickets_status ON tickets(status)",
+        [],
+    ).map_err(|e| format!("Failed to create index: {}", e))?;
+
+    conn.execute(
+        "CREATE INDEX IF NOT EXISTS idx_tickets_project ON tickets(project_id)",
+        [],
+    ).map_err(|e| format!("Failed to create index: {}", e))?;
+
+    conn.execute(
+        "CREATE INDEX IF NOT EXISTS idx_epics_project ON epics(project_id)",
+        [],
+    ).map_err(|e| format!("Failed to create index: {}", e))?;
+
+    Ok(conn)
+}
+
+/// Get all tickets, optionally filtered by project
+#[tauri::command]
+pub async fn get_tickets(project_id: Option<String>) -> Result<Vec<Ticket>, String> {
+    let conn = get_db_connection()?;
+
+    // Build query based on filter
+    let query = if project_id.is_some() {
+        "SELECT * FROM tickets WHERE project_id = ? ORDER BY \"order\""
+    } else {
+        "SELECT * FROM tickets ORDER BY \"order\""
+    };
+
+    let mut stmt = conn.prepare(query)
+        .map_err(|e| format!("Failed to prepare statement: {}", e))?;
+
+    // Helper function to map row to Ticket
+    let map_row = |row: &rusqlite::Row| -> Result<Ticket, rusqlite::Error> {
+        Ok(Ticket {
+            id: row.get(0)?,
+            title: row.get(1)?,
+            description: row.get(2)?,
+            status: match row.get::<_, String>(3)?.as_str() {
+                "backlog" => TicketStatus::Backlog,
+                "todo" => TicketStatus::Todo,
+                "in_progress" => TicketStatus::InProgress,
+                "in_review" => TicketStatus::InReview,
+                "done" => TicketStatus::Done,
+                "archived" => TicketStatus::Archived,
+                _ => TicketStatus::Backlog,
+            },
+            priority: match row.get::<_, String>(4)?.as_str() {
+                "low" => TicketPriority::Low,
+                "medium" => TicketPriority::Medium,
+                "high" => TicketPriority::High,
+                "urgent" => TicketPriority::Urgent,
+                _ => TicketPriority::Medium,
+            },
+            epic_id: row.get(5)?,
+            tags: serde_json::from_str(&row.get::<_, String>(6)?).unwrap_or_default(),
+            color: row.get(7)?,
+            tmux_window_name: row.get(8)?,
+            tmux_session_name: row.get(9)?,
+            branch_name: row.get(10)?,
+            worktree_path: row.get(11)?,
+            environment_name: row.get(12)?,
+            project_id: row.get(13)?,
+            assigned_to: row.get(14)?,
+            order: row.get(15)?,
+            created_at: row.get(16)?,
+            updated_at: row.get(17)?,
+        })
+    };
+
+    // Execute query with or without parameter
+    let tickets: Vec<Ticket> = if let Some(pid) = project_id {
+        stmt.query_map([pid], map_row)
+            .map_err(|e| format!("Failed to query tickets: {}", e))?
+            .filter_map(|r| r.ok())
+            .collect()
+    } else {
+        stmt.query_map([], map_row)
+            .map_err(|e| format!("Failed to query tickets: {}", e))?
+            .filter_map(|r| r.ok())
+            .collect()
+    };
+
+    Ok(tickets)
+}
+
+/// Get all epics, optionally filtered by project
+#[tauri::command]
+pub async fn get_epics(project_id: Option<String>) -> Result<Vec<Epic>, String> {
+    let conn = get_db_connection()?;
+
+    // Build query based on filter
+    let query = if project_id.is_some() {
+        "SELECT * FROM epics WHERE project_id = ? ORDER BY created_at DESC"
+    } else {
+        "SELECT * FROM epics ORDER BY created_at DESC"
+    };
+
+    let mut stmt = conn.prepare(query)
+        .map_err(|e| format!("Failed to prepare statement: {}", e))?;
+
+    // Helper function to map row to Epic
+    let map_row = |row: &rusqlite::Row| -> Result<Epic, rusqlite::Error> {
+        Ok(Epic {
+            id: row.get(0)?,
+            title: row.get(1)?,
+            description: row.get(2)?,
+            color: row.get(3)?,
+            branch_name: row.get(4)?,
+            base_branch: row.get(5)?,
+            project_id: row.get(6)?,
+            created_at: row.get(7)?,
+            updated_at: row.get(8)?,
+        })
+    };
+
+    // Execute query with or without parameter
+    let epics: Vec<Epic> = if let Some(pid) = project_id {
+        stmt.query_map([pid], map_row)
+            .map_err(|e| format!("Failed to query epics: {}", e))?
+            .filter_map(|r| r.ok())
+            .collect()
+    } else {
+        stmt.query_map([], map_row)
+            .map_err(|e| format!("Failed to query epics: {}", e))?
+            .filter_map(|r| r.ok())
+            .collect()
+    };
+
+    Ok(epics)
+}
+
+/// Create a new ticket
+#[tauri::command]
+pub async fn create_ticket(
+    title: String,
+    description: Option<String>,
+    priority: String,
+    epic_id: Option<String>,
+    tags: Vec<String>,
+    environment_name: Option<String>,
+    project_id: Option<String>,
+) -> Result<Ticket, String> {
+    let conn = get_db_connection()?;
+
+    // Parse priority
+    let priority_enum = match priority.as_str() {
+        "low" => TicketPriority::Low,
+        "medium" => TicketPriority::Medium,
+        "high" => TicketPriority::High,
+        "urgent" => TicketPriority::Urgent,
+        _ => TicketPriority::Medium,
+    };
+
+    // Generate sequential ticket ID (e.g., ush-1, ush-2, etc.)
+    let prefix = "ush";
+    let next_number = get_next_ticket_number(&conn, prefix)?;
+    let id = format!("{}-{}", prefix, next_number);
+
+    // Get current timestamp
+    let now = chrono::Utc::now().to_rfc3339();
+
+    // Calculate order (highest + 1 for backlog status)
+    let max_order: i32 = conn.query_row(
+        "SELECT COALESCE(MAX(\"order\"), -1) FROM tickets WHERE status = 'backlog'",
+        [],
+        |row| row.get(0),
+    ).unwrap_or(-1);
+
+    let order = max_order + 1;
+
+    // Serialize tags to JSON
+    let tags_json = serde_json::to_string(&tags)
+        .map_err(|e| format!("Failed to serialize tags: {}", e))?;
+
+    // Insert ticket into database
+    conn.execute(
+        "INSERT INTO tickets (id, title, description, status, priority, epic_id, tags, color, tmux_window_name, tmux_session_name, branch_name, worktree_path, environment_name, project_id, assigned_to, \"order\", created_at, updated_at)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18)",
+        params![
+            &id,
+            &title,
+            &description,
+            "backlog",
+            &priority,
+            &epic_id,
+            &tags_json,
+            None::<String>,  // color
+            None::<String>,  // tmux_window_name
+            None::<String>,  // tmux_session_name
+            None::<String>,  // branch_name
+            None::<String>,  // worktree_path
+            &environment_name,
+            &project_id,
+            None::<String>,  // assigned_to
+            order,
+            &now,
+            &now,
+        ],
+    ).map_err(|e| format!("Failed to insert ticket: {}", e))?;
+
+    Ok(Ticket {
+        id,
+        title,
+        description,
+        status: TicketStatus::Backlog,
+        priority: priority_enum,
+        epic_id,
+        tags,
+        color: None,
+        tmux_window_name: None,
+        tmux_session_name: None,
+        branch_name: None,
+        worktree_path: None,
+        environment_name,
+        project_id,
+        assigned_to: None,
+        order,
+        created_at: now.clone(),
+        updated_at: now,
+    })
+}
+
+/// Update a ticket
+#[tauri::command]
+pub async fn update_ticket(
+    id: String,
+    title: Option<String>,
+    description: Option<String>,
+    status: Option<String>,
+    priority: Option<String>,
+    epic_id: Option<String>,
+    tags: Option<Vec<String>>,
+    order: Option<i32>,
+    worktree_path: Option<String>,
+    branch_name: Option<String>,
+    tmux_window_name: Option<String>,
+    tmux_session_name: Option<String>,
+    environment_name: Option<String>,
+) -> Result<Ticket, String> {
+    let conn = get_db_connection()?;
+
+    // First, get the current ticket to return updated version
+    let mut stmt = conn.prepare("SELECT * FROM tickets WHERE id = ?")
+        .map_err(|e| format!("Failed to prepare statement: {}", e))?;
+
+    let mut ticket = stmt.query_row([&id], |row| {
+        Ok(Ticket {
+            id: row.get(0)?,
+            title: row.get(1)?,
+            description: row.get(2)?,
+            status: match row.get::<_, String>(3)?.as_str() {
+                "backlog" => TicketStatus::Backlog,
+                "todo" => TicketStatus::Todo,
+                "in_progress" => TicketStatus::InProgress,
+                "in_review" => TicketStatus::InReview,
+                "done" => TicketStatus::Done,
+                "archived" => TicketStatus::Archived,
+                _ => TicketStatus::Backlog,
+            },
+            priority: match row.get::<_, String>(4)?.as_str() {
+                "low" => TicketPriority::Low,
+                "medium" => TicketPriority::Medium,
+                "high" => TicketPriority::High,
+                "urgent" => TicketPriority::Urgent,
+                _ => TicketPriority::Medium,
+            },
+            epic_id: row.get(5)?,
+            tags: serde_json::from_str(&row.get::<_, String>(6)?).unwrap_or_default(),
+            color: row.get(7)?,
+            tmux_window_name: row.get(8)?,
+            tmux_session_name: row.get(9)?,
+            branch_name: row.get(10)?,
+            worktree_path: row.get(11)?,
+            environment_name: row.get(12)?,
+            project_id: row.get(13)?,
+            assigned_to: row.get(14)?,
+            order: row.get(15)?,
+            created_at: row.get(16)?,
+            updated_at: row.get(17)?,
+        })
+    }).map_err(|e| format!("Ticket not found: {}", e))?;
+
+    // Update fields in memory
+    if let Some(t) = title {
+        ticket.title = t;
+    }
+    if let Some(d) = description {
+        ticket.description = Some(d);
+    }
+    if let Some(s) = status {
+        ticket.status = match s.as_str() {
+            "backlog" => TicketStatus::Backlog,
+            "todo" => TicketStatus::Todo,
+            "in_progress" => TicketStatus::InProgress,
+            "in_review" => TicketStatus::InReview,
+            "done" => TicketStatus::Done,
+            "archived" => TicketStatus::Archived,
+            _ => ticket.status,
+        };
+    }
+    if let Some(p) = priority {
+        ticket.priority = match p.as_str() {
+            "low" => TicketPriority::Low,
+            "medium" => TicketPriority::Medium,
+            "high" => TicketPriority::High,
+            "urgent" => TicketPriority::Urgent,
+            _ => ticket.priority,
+        };
+    }
+    if let Some(e) = epic_id {
+        ticket.epic_id = Some(e);
+    }
+    if let Some(t) = tags {
+        ticket.tags = t;
+    }
+    if let Some(o) = order {
+        ticket.order = o;
+    }
+    if let Some(wp) = worktree_path {
+        ticket.worktree_path = Some(wp);
+    }
+    if let Some(bn) = branch_name {
+        ticket.branch_name = Some(bn);
+    }
+    if let Some(twn) = tmux_window_name {
+        ticket.tmux_window_name = Some(twn);
+    }
+    if let Some(tsn) = tmux_session_name {
+        ticket.tmux_session_name = Some(tsn);
+    }
+    if let Some(en) = environment_name {
+        ticket.environment_name = Some(en);
+    }
+
+    ticket.updated_at = chrono::Utc::now().to_rfc3339();
+
+    // Serialize tags to JSON
+    let tags_json = serde_json::to_string(&ticket.tags)
+        .map_err(|e| format!("Failed to serialize tags: {}", e))?;
+
+    // Convert status and priority to strings
+    let status_str = match ticket.status {
+        TicketStatus::Backlog => "backlog",
+        TicketStatus::Todo => "todo",
+        TicketStatus::InProgress => "in_progress",
+        TicketStatus::InReview => "in_review",
+        TicketStatus::Done => "done",
+        TicketStatus::Archived => "archived",
+    };
+
+    let priority_str = match ticket.priority {
+        TicketPriority::Low => "low",
+        TicketPriority::Medium => "medium",
+        TicketPriority::High => "high",
+        TicketPriority::Urgent => "urgent",
+    };
+
+    // Update in database
+    conn.execute(
+        "UPDATE tickets SET title = ?1, description = ?2, status = ?3, priority = ?4, epic_id = ?5, tags = ?6, \"order\" = ?7, worktree_path = ?8, branch_name = ?9, tmux_window_name = ?10, tmux_session_name = ?11, environment_name = ?12, updated_at = ?13 WHERE id = ?14",
+        params![
+            &ticket.title,
+            &ticket.description,
+            status_str,
+            priority_str,
+            &ticket.epic_id,
+            &tags_json,
+            ticket.order,
+            &ticket.worktree_path,
+            &ticket.branch_name,
+            &ticket.tmux_window_name,
+            &ticket.tmux_session_name,
+            &ticket.environment_name,
+            &ticket.updated_at,
+            &id,
+        ],
+    ).map_err(|e| format!("Failed to update ticket: {}", e))?;
+
+    Ok(ticket)
+}
+
+/// Delete a ticket
+#[tauri::command]
+pub async fn delete_ticket(id: String) -> Result<(), String> {
+    let conn = get_db_connection()?;
+
+    conn.execute("DELETE FROM tickets WHERE id = ?", params![&id])
+        .map_err(|e| format!("Failed to delete ticket: {}", e))?;
+
+    Ok(())
+}
+
+/// Create a new epic
+#[tauri::command]
+pub async fn create_epic(
+    title: String,
+    description: Option<String>,
+    color: String,
+    base_branch: String,
+    branch_name: Option<String>,
+    project_id: Option<String>,
+) -> Result<Epic, String> {
+    let conn = get_db_connection()?;
+
+    let id = format!("epic-{}", uuid::Uuid::new_v4());
+    let now = chrono::Utc::now().to_rfc3339();
+
+    // Insert epic into database
+    conn.execute(
+        "INSERT INTO epics (id, title, description, color, branch_name, base_branch, project_id, created_at, updated_at)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
+        params![
+            &id,
+            &title,
+            &description,
+            &color,
+            &branch_name,
+            &base_branch,
+            &project_id,
+            &now,
+            &now,
+        ],
+    ).map_err(|e| format!("Failed to insert epic: {}", e))?;
+
+    Ok(Epic {
+        id,
+        title,
+        description,
+        color,
+        branch_name,
+        base_branch,
+        project_id,
+        created_at: now.clone(),
+        updated_at: now,
+    })
+}
+
+/// Update an epic
+#[tauri::command]
+pub async fn update_epic(
+    id: String,
+    title: Option<String>,
+    description: Option<String>,
+    color: Option<String>,
+    branch_name: Option<String>,
+) -> Result<Epic, String> {
+    let conn = get_db_connection()?;
+
+    // First, get the current epic to return updated version
+    let mut stmt = conn.prepare("SELECT * FROM epics WHERE id = ?")
+        .map_err(|e| format!("Failed to prepare statement: {}", e))?;
+
+    let mut epic = stmt.query_row([&id], |row| {
+        Ok(Epic {
+            id: row.get(0)?,
+            title: row.get(1)?,
+            description: row.get(2)?,
+            color: row.get(3)?,
+            branch_name: row.get(4)?,
+            base_branch: row.get(5)?,
+            project_id: row.get(6)?,
+            created_at: row.get(7)?,
+            updated_at: row.get(8)?,
+        })
+    }).map_err(|e| format!("Epic not found: {}", e))?;
+
+    // Update fields in memory
+    if let Some(t) = title {
+        epic.title = t;
+    }
+    if let Some(d) = description {
+        epic.description = Some(d);
+    }
+    if let Some(c) = color {
+        epic.color = c;
+    }
+    if let Some(b) = branch_name {
+        epic.branch_name = Some(b);
+    }
+
+    epic.updated_at = chrono::Utc::now().to_rfc3339();
+
+    // Update in database
+    conn.execute(
+        "UPDATE epics SET title = ?1, description = ?2, color = ?3, branch_name = ?4, updated_at = ?5 WHERE id = ?6",
+        params![
+            &epic.title,
+            &epic.description,
+            &epic.color,
+            &epic.branch_name,
+            &epic.updated_at,
+            &id,
+        ],
+    ).map_err(|e| format!("Failed to update epic: {}", e))?;
+
+    Ok(epic)
+}
+
+/// Delete an epic
+#[tauri::command]
+pub async fn delete_epic(id: String) -> Result<(), String> {
+    let conn = get_db_connection()?;
+
+    conn.execute("DELETE FROM epics WHERE id = ?", params![&id])
+        .map_err(|e| format!("Failed to delete epic: {}", e))?;
+
+    Ok(())
+}
+
+/// Start a coding agent in the tmux window for a ticket
+#[tauri::command]
+pub async fn start_coding_agent_for_ticket(
+    ticket_id: String,
+    tmux_window_name: String,
+    tmux_session_name: String,
+    worktree_path: String,
+) -> Result<(), String> {
+    use super::settings::load_launcher_settings;
+
+    eprintln!("[start_coding_agent_for_ticket] Starting agent for ticket: {}", ticket_id);
+    eprintln!("[start_coding_agent_for_ticket] Tmux window: {}, session: {}", tmux_window_name, tmux_session_name);
+    eprintln!("[start_coding_agent_for_ticket] Worktree path: {}", worktree_path);
+
+    // Load settings to get coding agent configuration
+    let settings = load_launcher_settings().await?;
+
+    if !settings.coding_agent.auto_start {
+        eprintln!("[start_coding_agent_for_ticket] Auto-start is disabled, skipping");
+        return Ok(());
+    }
+
+    // Get ticket details
+    let ticket = get_ticket_by_id(&ticket_id)?;
+
+    // Automatically move ticket to in_progress when starting agent
+    eprintln!("[start_coding_agent_for_ticket] Moving ticket to in_progress...");
+    if let Some(branch_name) = &ticket.branch_name {
+        // Use kanban-cli to move to in_progress
+        let status_update = shell_command(&format!("kanban-cli move-to-progress \"{}\"", branch_name))
+            .output();
+
+        match status_update {
+            Ok(output) if output.status.success() => {
+                eprintln!("[start_coding_agent_for_ticket] ✓ Ticket moved to in_progress");
+            }
+            Ok(output) => {
+                let stderr = String::from_utf8_lossy(&output.stderr);
+                eprintln!("[start_coding_agent_for_ticket] Warning: Failed to update status: {}", stderr);
+            }
+            Err(e) => {
+                eprintln!("[start_coding_agent_for_ticket] Warning: Failed to run kanban-cli: {}", e);
+            }
+        }
+    }
+
+    eprintln!("[start_coding_agent_for_ticket] Found ticket: {}", ticket.title);
+
+    // Build the agent prompt with ticket context
+    let prompt = format!(
+        "You are working on the following ticket:\n\nTitle: {}\n\nDescription: {}\n\nPlease help implement this feature.",
+        ticket.title,
+        ticket.description.as_ref().unwrap_or(&"No description".to_string())
+    );
+
+    // Build the command to send to tmux
+    // Format: tmux send-keys -t session:window "command" Enter
+    let agent_command = if settings.coding_agent.args.is_empty() {
+        settings.coding_agent.command.clone()
+    } else {
+        format!("{} {}", settings.coding_agent.command, settings.coding_agent.args.join(" "))
+    };
+
+    eprintln!("[start_coding_agent_for_ticket] Running agent command: {}", agent_command);
+
+    // First verify the tmux window exists
+    let check_window = shell_command(&format!(
+        "tmux list-windows -t {} -F '#{{window_name}}'",
+        tmux_session_name
+    ))
+    .output()
+    .map_err(|e| format!("Failed to check tmux windows: {}", e))?;
+
+    let windows_output = String::from_utf8_lossy(&check_window.stdout);
+    eprintln!("[start_coding_agent_for_ticket] Available windows in session {}:", tmux_session_name);
+    eprintln!("{}", windows_output);
+
+    if !windows_output.contains(&tmux_window_name) {
+        return Err(format!("Tmux window '{}' not found in session '{}'", tmux_window_name, tmux_session_name));
+    }
+
+    // Send a test echo command first to verify tmux communication works
+    let test_cmd = format!("tmux send-keys -t {}:{} 'echo \"[LAUNCHER] Starting coding agent...\"' Enter", tmux_session_name, tmux_window_name);
+    eprintln!("[start_coding_agent_for_ticket] Test command: {}", test_cmd);
+    let test_result = shell_command(&test_cmd)
+        .output()
+        .map_err(|e| format!("Failed to send test command: {}", e))?;
+
+    if !test_result.status.success() {
+        let stderr = String::from_utf8_lossy(&test_result.stderr);
+        return Err(format!("Test command failed: {}", stderr));
+    }
+
+    std::thread::sleep(std::time::Duration::from_millis(300));
+
+    // CD to worktree directory
+    let cd_cmd = format!("tmux send-keys -t {}:{} 'cd \"{}\"' Enter", tmux_session_name, tmux_window_name, worktree_path);
+    eprintln!("[start_coding_agent_for_ticket] CD command: {}", cd_cmd);
+    let cd_result = shell_command(&cd_cmd)
+        .output()
+        .map_err(|e| format!("Failed to send cd command: {}", e))?;
+
+    if !cd_result.status.success() {
+        let stderr = String::from_utf8_lossy(&cd_result.stderr);
+        return Err(format!("CD command failed: {}", stderr));
+    }
+
+    std::thread::sleep(std::time::Duration::from_millis(300));
+
+    // Send PWD to verify we're in the right directory
+    let pwd_cmd = format!("tmux send-keys -t {}:{} 'pwd' Enter", tmux_session_name, tmux_window_name);
+    eprintln!("[start_coding_agent_for_ticket] PWD command: {}", pwd_cmd);
+    shell_command(&pwd_cmd)
+        .output()
+        .map_err(|e| format!("Failed to send pwd command: {}", e))?;
+
+    std::thread::sleep(std::time::Duration::from_millis(500));
+
+    // Finally, start the coding agent
+    let agent_cmd = format!("tmux send-keys -t {}:{} '{}' Enter", tmux_session_name, tmux_window_name, agent_command);
+    eprintln!("[start_coding_agent_for_ticket] Agent command: {}", agent_cmd);
+    let start_agent = shell_command(&agent_cmd)
+        .output()
+        .map_err(|e| format!("Failed to send agent command: {}", e))?;
+
+    if !start_agent.status.success() {
+        let stderr = String::from_utf8_lossy(&start_agent.stderr);
+        return Err(format!("Failed to start coding agent: {}", stderr));
+    }
+
+    // Wait for agent to start up
+    eprintln!("[start_coding_agent_for_ticket] Waiting for agent to start...");
+    std::thread::sleep(std::time::Duration::from_secs(3));
+
+    // Send the ticket context as a prompt
+    // We need to escape the prompt for shell safety
+    let escaped_prompt = prompt
+        .replace("\\", "\\\\")
+        .replace("\"", "\\\"")
+        .replace("$", "\\$")
+        .replace("`", "\\`");
+
+    let prompt_cmd = format!("tmux send-keys -t {}:{} \"{}\"", tmux_session_name, tmux_window_name, escaped_prompt);
+    eprintln!("[start_coding_agent_for_ticket] Sending ticket prompt to agent...");
+    let send_prompt = shell_command(&prompt_cmd)
+        .output()
+        .map_err(|e| format!("Failed to send prompt: {}", e))?;
+
+    if !send_prompt.status.success() {
+        let stderr = String::from_utf8_lossy(&send_prompt.stderr);
+        eprintln!("[start_coding_agent_for_ticket] Warning: Failed to send prompt: {}", stderr);
+        // Don't fail the whole operation if prompt sending fails
+    }
+
+    // Send Enter to submit the prompt
+    std::thread::sleep(std::time::Duration::from_millis(500));
+    let enter_cmd = format!("tmux send-keys -t {}:{} Enter", tmux_session_name, tmux_window_name);
+    shell_command(&enter_cmd)
+        .output()
+        .map_err(|e| format!("Failed to send Enter: {}", e))?;
+
+    eprintln!("[start_coding_agent_for_ticket] ✓ All commands sent successfully");
+
+    Ok(())
+}
+
+/// Get the next ticket number for a given prefix
+fn get_next_ticket_number(conn: &rusqlite::Connection, prefix: &str) -> Result<i32, String> {
+    // Query all ticket IDs that match the prefix pattern
+    let pattern = format!("{}-%%", prefix);
+    let mut stmt = conn.prepare("SELECT id FROM tickets WHERE id LIKE ?")
+        .map_err(|e| format!("Failed to prepare statement: {}", e))?;
+
+    let ticket_ids = stmt.query_map([&pattern], |row| {
+        row.get::<_, String>(0)
+    }).map_err(|e| format!("Failed to query tickets: {}", e))?;
+
+    // Find the highest number
+    let mut max_number = 0;
+    for id_result in ticket_ids {
+        if let Ok(id) = id_result {
+            // Extract number from "ush-123" format
+            if let Some(number_str) = id.strip_prefix(&format!("{}-", prefix)) {
+                if let Ok(number) = number_str.parse::<i32>() {
+                    if number > max_number {
+                        max_number = number;
+                    }
+                }
+            }
+        }
+    }
+
+    Ok(max_number + 1)
+}
+
+/// Helper to get a ticket by ID (internal use)
+fn get_ticket_by_id(id: &str) -> Result<Ticket, String> {
+    let conn = get_db_connection()?;
+
+    let mut stmt = conn.prepare("SELECT * FROM tickets WHERE id = ?")
+        .map_err(|e| format!("Failed to prepare statement: {}", e))?;
+
+    stmt.query_row([id], |row| {
+        Ok(Ticket {
+            id: row.get(0)?,
+            title: row.get(1)?,
+            description: row.get(2)?,
+            status: match row.get::<_, String>(3)?.as_str() {
+                "backlog" => TicketStatus::Backlog,
+                "todo" => TicketStatus::Todo,
+                "in_progress" => TicketStatus::InProgress,
+                "in_review" => TicketStatus::InReview,
+                "done" => TicketStatus::Done,
+                "archived" => TicketStatus::Archived,
+                _ => TicketStatus::Backlog,
+            },
+            priority: match row.get::<_, String>(4)?.as_str() {
+                "low" => TicketPriority::Low,
+                "medium" => TicketPriority::Medium,
+                "high" => TicketPriority::High,
+                "urgent" => TicketPriority::Urgent,
+                _ => TicketPriority::Medium,
+            },
+            epic_id: row.get(5)?,
+            tags: serde_json::from_str(&row.get::<_, String>(6)?).unwrap_or_default(),
+            color: row.get(7)?,
+            tmux_window_name: row.get(8)?,
+            tmux_session_name: row.get(9)?,
+            branch_name: row.get(10)?,
+            worktree_path: row.get(11)?,
+            environment_name: row.get(12)?,
+            project_id: row.get(13)?,
+            assigned_to: row.get(14)?,
+            order: row.get(15)?,
+            created_at: row.get(16)?,
+            updated_at: row.get(17)?,
+        })
+    }).map_err(|e| format!("Ticket not found: {}", e))
+}
diff --git a/ushadow/launcher/src-tauri/src/commands/mod.rs b/ushadow/launcher/src-tauri/src/commands/mod.rs
index 6c49cd67..cdd97928 100644
--- a/ushadow/launcher/src-tauri/src/commands/mod.rs
+++ b/ushadow/launcher/src-tauri/src/commands/mod.rs
@@ -1,5 +1,6 @@
 mod docker;
 mod discovery;
+mod discovery_v2;
 mod prerequisites;
 mod prerequisites_config;
 mod repository;  // Repository and Git operations
@@ -10,11 +11,19 @@ mod settings;
 mod bundled;  // Bundled resources locator
 pub mod worktree;
 pub mod platform;  // Platform abstraction layer
+mod kanban;  // Kanban ticket integration
+mod oauth_server;  // OAuth callback server for desktop auth
+mod http_client;  // HTTP client for CORS-free requests
 // Embedded terminal module (PTY-based) - DEPRECATED in favor of native terminal integration (iTerm2/Terminal.app/gnome-terminal)
 // pub mod terminal;
+mod config_commands;
+mod container_discovery;
+mod port_utils;
+mod env_scanner;
 
 pub use docker::*;
 pub use discovery::*;
+pub use discovery_v2::*;
 pub use prerequisites::*;
 pub use prerequisites_config::*;
 pub use repository::*;  // Export repository management functions
@@ -22,4 +31,11 @@ pub use generic_installer::*;  // Export generic installer functions
 pub use permissions::*;
 pub use settings::*;
 pub use worktree::*;
+pub use kanban::*;  // Export kanban ticket functions
+pub use oauth_server::*;  // Export OAuth server functions
+pub use http_client::*;  // Export HTTP client functions
 // pub use terminal::*;
+pub use config_commands::*;
+pub use container_discovery::*;
+pub use port_utils::*;
+pub use env_scanner::*;
diff --git a/ushadow/launcher/src-tauri/src/commands/oauth_server.rs b/ushadow/launcher/src-tauri/src/commands/oauth_server.rs
new file mode 100644
index 00000000..27229e85
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/commands/oauth_server.rs
@@ -0,0 +1,191 @@
+/// OAuth callback server for desktop authentication
+///
+/// Implements the standard OAuth flow for desktop apps:
+/// 1. Start temporary HTTP server on random port
+/// 2. Register http://localhost:PORT/callback with Keycloak
+/// 3. Open system browser for login
+/// 4. Catch redirect, exchange code for tokens
+/// 5. Shut down server
+
+use std::sync::{Arc, Mutex};
+use tauri::State;
+use tokio::sync::oneshot;
+use warp::{Filter, Reply};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct OAuthCallbackParams {
+    pub code: String,
+    pub state: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct OAuthResult {
+    pub success: bool,
+    pub code: Option<String>,
+    pub state: Option<String>,
+    pub error: Option<String>,
+}
+
+/// Start OAuth callback server and return the port and callback URL
+///
+/// This starts a temporary HTTP server that waits for the OAuth callback.
+/// The server automatically shuts down after receiving the callback or timing out.
+#[tauri::command]
+pub async fn start_oauth_server() -> Result<(u16, String), String> {
+    use warp::Filter;
+
+    // Find available port
+    let listener = std::net::TcpListener::bind("127.0.0.1:0")
+        .map_err(|e| format!("Failed to bind to port: {}", e))?;
+    let port = listener.local_addr()
+        .map_err(|e| format!("Failed to get local address: {}", e))?
+        .port();
+    drop(listener);
+
+    let callback_url = format!("http://localhost:{}/callback", port);
+
+    println!("[OAuth] Started callback server on port {}", port);
+    println!("[OAuth] Callback URL: {}", callback_url);
+
+    Ok((port, callback_url))
+}
+
+/// Wait for OAuth callback
+///
+/// This blocks until the callback is received or times out (5 minutes).
+/// Returns the authorization code and state from the callback.
+#[tauri::command]
+pub async fn wait_for_oauth_callback(port: u16) -> Result<OAuthResult, String> {
+    use std::time::Duration;
+    use tokio::time::timeout;
+
+    let result = Arc::new(Mutex::new(None));
+    let result_clone = result.clone();
+
+    // Create shutdown signal
+    let (tx, rx) = oneshot::channel::<()>();
+    let tx = Arc::new(Mutex::new(Some(tx)));
+
+    // Callback route handler
+    let callback_route = warp::path("callback")
+        .and(warp::query::<OAuthCallbackParams>())
+        .map(move |params: OAuthCallbackParams| {
+            println!("[OAuth] Callback received: code={}, state={}",
+                params.code.chars().take(10).collect::<String>(),
+                params.state.chars().take(10).collect::<String>()
+            );
+
+            // Store result
+            {
+                let mut result = result_clone.lock().unwrap();
+                *result = Some(OAuthResult {
+                    success: true,
+                    code: Some(params.code.clone()),
+                    state: Some(params.state.clone()),
+                    error: None,
+                });
+            }
+
+            // Trigger shutdown
+            if let Some(tx) = tx.lock().unwrap().take() {
+                let _ = tx.send(());
+            }
+
+            // Return success page
+            warp::reply::html(
+                r#"
+                <!DOCTYPE html>
+                <html>
+                <head>
+                    <title>Login Successful</title>
+                    <style>
+                        body {
+                            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+                            display: flex;
+                            align-items: center;
+                            justify-content: center;
+                            height: 100vh;
+                            margin: 0;
+                            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+                        }
+                        .container {
+                            text-align: center;
+                            background: white;
+                            padding: 3rem;
+                            border-radius: 1rem;
+                            box-shadow: 0 20px 60px rgba(0,0,0,0.3);
+                        }
+                        h1 {
+                            color: #667eea;
+                            margin: 0 0 1rem 0;
+                        }
+                        p {
+                            color: #555;
+                            margin: 0;
+                        }
+                        .checkmark {
+                            font-size: 4rem;
+                            color: #48bb78;
+                            margin-bottom: 1rem;
+                        }
+                    </style>
+                </head>
+                <body>
+                    <div class="container">
+                        <div class="checkmark">✓</div>
+                        <h1>Login Successful!</h1>
+                        <p>You can close this window and return to the Ushadow Launcher.</p>
+                    </div>
+                    <script>
+                        // Auto-close after 2 seconds
+                        setTimeout(() => window.close(), 2000);
+                    </script>
+                </body>
+                </html>
+                "#
+            )
+        });
+
+    // Start server
+    let server = warp::serve(callback_route)
+        .bind_with_graceful_shutdown(([127, 0, 0, 1], port), async {
+            rx.await.ok();
+        });
+
+    // Run server with timeout
+    let server_task = tokio::spawn(server.1);
+
+    // Wait for callback or timeout (5 minutes)
+    match timeout(Duration::from_secs(300), async {
+        loop {
+            if result.lock().unwrap().is_some() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(100)).await;
+        }
+    }).await {
+        Ok(_) => {
+            // Got callback
+            let result = result.lock().unwrap().take().unwrap();
+            println!("[OAuth] Callback processed successfully");
+
+            // Shut down server
+            server_task.abort();
+
+            Ok(result)
+        }
+        Err(_) => {
+            // Timeout
+            println!("[OAuth] Callback timeout (5 minutes)");
+            server_task.abort();
+
+            Ok(OAuthResult {
+                success: false,
+                code: None,
+                state: None,
+                error: Some("Timeout waiting for login".to_string()),
+            })
+        }
+    }
+}
diff --git a/ushadow/launcher/src-tauri/src/commands/port_utils.rs b/ushadow/launcher/src-tauri/src/commands/port_utils.rs
new file mode 100644
index 00000000..2b2c47f1
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/commands/port_utils.rs
@@ -0,0 +1,147 @@
+use std::process::Command;
+
+/// Port pair for backend and frontend (webui)
+#[derive(Debug, Clone)]
+pub struct PortPair {
+    pub backend: u16,
+    pub frontend: u16,
+}
+
+/// Find available ports by calling Python's validate_ports from setup_utils.py
+/// This uses the existing port validation logic and maintains the 5000 port separation
+pub fn find_available_ports(
+    project_root: &str,
+    preferred_backend_port: u16,
+) -> Result<PortPair, String> {
+    // Frontend port is always backend - 5000
+    let preferred_frontend_port = if preferred_backend_port >= 5000 {
+        preferred_backend_port - 5000
+    } else {
+        return Err(format!(
+            "Backend port {} too low (must be >= 5000 to maintain frontend separation)",
+            preferred_backend_port
+        ));
+    };
+
+    // Call Python to check if these ports are available
+    // Using the same logic as setup/run.py
+    if are_ports_available(project_root, preferred_backend_port, preferred_frontend_port)? {
+        return Ok(PortPair {
+            backend: preferred_backend_port,
+            frontend: preferred_frontend_port,
+        });
+    }
+
+    // Ports not available, find alternatives by incrementing offset
+    // This mirrors the logic in setup/run.py:145-160
+    let base_backend = 8000;
+    let base_frontend = 3000;
+    let initial_offset = preferred_backend_port - base_backend;
+
+    for attempt in 1..=100 {
+        let new_offset = initial_offset + (attempt * 10);
+        let backend = base_backend + new_offset;
+        let frontend = base_frontend + new_offset;
+
+        if are_ports_available(project_root, backend, frontend)? {
+            return Ok(PortPair { backend, frontend });
+        }
+    }
+
+    Err("Could not find available ports after 100 attempts".to_string())
+}
+
+/// Check if both backend and frontend ports are available
+/// Uses native Rust implementation (faster than calling Python subprocess)
+/// This mirrors the logic from setup/setup_utils.py::check_port_in_use
+fn are_ports_available(
+    _project_root: &str,
+    backend_port: u16,
+    frontend_port: u16,
+) -> Result<bool, String> {
+    Ok(is_port_available(backend_port) && is_port_available(frontend_port))
+}
+
+/// Check if a single port is available by attempting to bind to it
+fn is_port_available(port: u16) -> bool {
+    use std::net::TcpListener;
+
+    match TcpListener::bind(("127.0.0.1", port)) {
+        Ok(_) => true,  // Port is available
+        Err(_) => false, // Port is in use
+    }
+}
+
+/// Get the Tailscale tailnet name from the host machine
+/// Returns the tailnet domain (e.g., "thestumonkey.github")
+pub fn get_tailnet_name() -> Result<String, String> {
+    let output = Command::new("tailscale")
+        .args(["status", "--json"])
+        .output()
+        .map_err(|e| format!("Failed to run tailscale command: {}", e))?;
+
+    if !output.status.success() {
+        return Err("Tailscale not running or not available".to_string());
+    }
+
+    let json_str = String::from_utf8_lossy(&output.stdout);
+    let json: serde_json::Value = serde_json::from_str(&json_str)
+        .map_err(|e| format!("Failed to parse tailscale JSON: {}", e))?;
+
+    let tailnet = json["CurrentTailnet"]["Name"]
+        .as_str()
+        .ok_or("Could not find tailnet name in status")?;
+
+    Ok(tailnet.to_string())
+}
+
+/// Generate Tailscale URL for an environment
+/// Format: https://{env_name}.{tailnet} or https://{project}-{env_name}.{tailnet}
+///
+/// # Arguments
+/// * `env_name` - Environment name (e.g., "orange", "blue")
+/// * `project_prefix` - Optional project prefix for multi-project setups (e.g., Some("ushadow"))
+pub fn generate_tailscale_url(
+    env_name: &str,
+    project_prefix: Option<&str>,
+) -> Result<Option<String>, String> {
+    // Get the tailnet name from the host
+    let tailnet = match get_tailnet_name() {
+        Ok(t) => t,
+        Err(_) => return Ok(None), // Tailscale not available, return None instead of error
+    };
+
+    // Build hostname: either "envname" or "project-envname"
+    let hostname = if let Some(prefix) = project_prefix {
+        format!("{}-{}", prefix, env_name)
+    } else {
+        env_name.to_string()
+    };
+
+    let url = format!("https://{}.{}", hostname, tailnet);
+
+    Ok(Some(url))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_port_availability() {
+        // Test that port checking works
+        // Note: This test might be flaky if ports are actually in use
+        let available = is_port_available(65432); // Use high port unlikely to be used
+        assert!(available, "High port should be available");
+    }
+
+    #[test]
+    fn test_port_pair_separation() {
+        let pair = PortPair {
+            backend: 8000,
+            frontend: 3000,
+        };
+
+        assert_eq!(pair.backend - pair.frontend, 5000);
+    }
+}
diff --git a/ushadow/launcher/src-tauri/src/commands/settings.rs b/ushadow/launcher/src-tauri/src/commands/settings.rs
index ceb3f7c1..8cbe47e2 100644
--- a/ushadow/launcher/src-tauri/src/commands/settings.rs
+++ b/ushadow/launcher/src-tauri/src/commands/settings.rs
@@ -2,11 +2,36 @@ use serde::{Deserialize, Serialize};
 use std::fs;
 use std::path::PathBuf;
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CodingAgentConfig {
+    /// Name/type of the coding agent (e.g., "claude", "aider", "cursor")
+    pub agent_type: String,
+    /// Command to run the agent (e.g., "claude", "aider")
+    pub command: String,
+    /// Additional arguments to pass to the agent
+    pub args: Vec<String>,
+    /// Whether to auto-start the agent when a ticket is assigned
+    pub auto_start: bool,
+}
+
+impl Default for CodingAgentConfig {
+    fn default() -> Self {
+        Self {
+            agent_type: "claude".to_string(),
+            command: "claude".to_string(),
+            args: vec!["--dangerously-skip-permissions".to_string()],
+            auto_start: true,
+        }
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct LauncherSettings {
     pub default_admin_email: Option<String>,
     pub default_admin_password: Option<String>,
     pub default_admin_name: Option<String>,
+    #[serde(default)]
+    pub coding_agent: CodingAgentConfig,
 }
 
 impl Default for LauncherSettings {
@@ -15,6 +40,7 @@ impl Default for LauncherSettings {
             default_admin_email: None,
             default_admin_password: None,
             default_admin_name: Some("Administrator".to_string()),
+            coding_agent: CodingAgentConfig::default(),
         }
     }
 }
diff --git a/ushadow/launcher/src-tauri/src/commands/worktree.rs b/ushadow/launcher/src-tauri/src/commands/worktree.rs
index 17697af5..b5f43b6e 100644
--- a/ushadow/launcher/src-tauri/src/commands/worktree.rs
+++ b/ushadow/launcher/src-tauri/src/commands/worktree.rs
@@ -1,4 +1,4 @@
-use crate::models::{WorktreeInfo, TmuxSessionInfo, TmuxWindowInfo, ClaudeStatus};
+use crate::models::{WorktreeInfo, TmuxSessionInfo, TmuxWindowInfo, ClaudeStatus, EnvironmentConflict};
 use std::collections::HashMap;
 use std::path::PathBuf;
 use std::process::Command;
@@ -32,6 +32,35 @@ pub fn get_colors_for_name(name: &str) -> (String, String) {
     (name.to_string(), name.to_string())
 }
 
+/// Delete a git branch (best effort - won't fail if branch doesn't exist)
+fn delete_branch(main_repo: &str, branch_name: &str) {
+    eprintln!("[delete_branch] Attempting to delete branch '{}'", branch_name);
+
+    // Try to delete the branch with -D (force delete)
+    let output = silent_command("git")
+        .args(["branch", "-D", branch_name])
+        .current_dir(main_repo)
+        .output();
+
+    match output {
+        Ok(result) if result.status.success() => {
+            eprintln!("[delete_branch] ✓ Successfully deleted branch '{}'", branch_name);
+        }
+        Ok(result) => {
+            let stderr = String::from_utf8_lossy(&result.stderr);
+            // Don't error if branch doesn't exist
+            if !stderr.contains("not found") && !stderr.contains("does not exist") {
+                eprintln!("[delete_branch] Warning: Failed to delete branch '{}': {}", branch_name, stderr);
+            } else {
+                eprintln!("[delete_branch] Branch '{}' already deleted or doesn't exist", branch_name);
+            }
+        }
+        Err(e) => {
+            eprintln!("[delete_branch] Warning: Failed to run git branch -D: {}", e);
+        }
+    }
+}
+
 /// Check if a worktree exists for a given branch
 #[tauri::command]
 pub async fn check_worktree_exists(main_repo: String, branch: String) -> Result<Option<WorktreeInfo>, String> {
@@ -105,6 +134,32 @@ pub async fn check_worktree_exists(main_repo: String, branch: String) -> Result<
     Ok(None)
 }
 
+/// Check if an environment with this name already exists and return conflict info
+#[tauri::command]
+pub async fn check_environment_conflict(
+    main_repo: String,
+    env_name: String,
+) -> Result<Option<EnvironmentConflict>, String> {
+    let env_name = env_name.to_lowercase();
+
+    // Check if a worktree with this name exists
+    let worktrees = list_worktrees(main_repo.clone()).await?;
+
+    if let Some(worktree) = worktrees.iter().find(|wt| wt.name == env_name) {
+        // Worktree exists - return conflict info
+        // Note: is_running will be set to false here, but the frontend can check
+        // the actual running status from its discovery data
+        return Ok(Some(EnvironmentConflict {
+            name: env_name,
+            current_branch: worktree.branch.clone(),
+            path: worktree.path.clone(),
+            is_running: false,  // Frontend will populate this from discovery
+        }));
+    }
+
+    Ok(None)
+}
+
 /// List all git worktrees in a repository
 #[tauri::command]
 pub async fn list_worktrees(main_repo: String) -> Result<Vec<WorktreeInfo>, String> {
@@ -348,6 +403,48 @@ pub async fn create_worktree(
 
     let branch_exists = check_output.status.success();
 
+    // Check for branch naming conflicts (e.g., can't create test/foo if test exists, or vice versa)
+    if !branch_exists {
+        // Check if any part of the branch path conflicts with existing branches
+        let all_branches_output = silent_command("git")
+            .args(["for-each-ref", "--format=%(refname:short)", "refs/heads/"])
+            .current_dir(&main_repo)
+            .output()
+            .map_err(|e| format!("Failed to list branches: {}", e))?;
+
+        let all_branches = String::from_utf8_lossy(&all_branches_output.stdout);
+
+        for existing_branch in all_branches.lines() {
+            // Check if desired_branch would conflict with existing_branch
+            // Conflict cases:
+            // 1. Want to create "test/foo" but "test" exists
+            // 2. Want to create "test" but "test/foo" exists
+            if desired_branch.starts_with(&format!("{}/", existing_branch)) {
+                return Err(format!(
+                    "Cannot create branch '{}' because branch '{}' already exists. Git doesn't allow 'foo' and 'foo/bar' to both exist as branches.",
+                    desired_branch, existing_branch
+                ));
+            }
+            if existing_branch.starts_with(&format!("{}/", desired_branch)) {
+                return Err(format!(
+                    "Cannot create branch '{}' because branch '{}' already exists. Git doesn't allow 'foo' and 'foo/bar' to both exist as branches.",
+                    desired_branch, existing_branch
+                ));
+            }
+        }
+    }
+
+    // Before creating, clean up any locked/missing worktrees at this path
+    eprintln!("[create_worktree] Checking for locked/missing worktrees...");
+    let _ = silent_command("git")
+        .args(["worktree", "unlock", worktree_path.to_str().unwrap()])
+        .current_dir(&main_repo)
+        .output();
+    let _ = silent_command("git")
+        .args(["worktree", "prune"])
+        .current_dir(&main_repo)
+        .output();
+
     let (output, final_branch) = if branch_exists {
         // Branch exists - checkout directly into worktree
         let output = silent_command("git")
@@ -644,7 +741,12 @@ pub async fn remove_worktree(main_repo: String, name: String) -> Result<(), Stri
         .find(|wt| wt.name == name)
         .ok_or_else(|| format!("Worktree '{}' not found", name))?;
 
-    // Remove the worktree
+    eprintln!("[remove_worktree] Removing worktree at: {}", worktree.path);
+
+    // Store branch name for deletion after worktree removal
+    let branch_name = worktree.branch.clone();
+
+    // Try to remove the worktree
     let output = silent_command("git")
         .args(["worktree", "remove", &worktree.path])
         .current_dir(&main_repo)
@@ -653,9 +755,64 @@ pub async fn remove_worktree(main_repo: String, name: String) -> Result<(), Stri
 
     if !output.status.success() {
         let stderr = String::from_utf8_lossy(&output.stderr);
+
+        // If it contains modified/untracked files, use --force
+        if stderr.contains("modified or untracked files") || stderr.contains("use --force") {
+            eprintln!("[remove_worktree] Worktree has uncommitted changes, forcing removal...");
+
+            let force_output = silent_command("git")
+                .args(["worktree", "remove", "--force", &worktree.path])
+                .current_dir(&main_repo)
+                .output()
+                .map_err(|e| format!("Failed to force remove worktree: {}", e))?;
+
+            if force_output.status.success() {
+                eprintln!("[remove_worktree] ✓ Successfully force-removed worktree");
+                // Delete the associated branch
+                delete_branch(&main_repo, &branch_name);
+                return Ok(());
+            } else {
+                let force_stderr = String::from_utf8_lossy(&force_output.stderr);
+                return Err(format!("Failed to force remove worktree: {}", force_stderr));
+            }
+        }
+
+        // If it's locked or missing, try to unlock and prune
+        if stderr.contains("locked") || stderr.contains("missing") {
+            eprintln!("[remove_worktree] Worktree is locked/missing, attempting to unlock and prune...");
+
+            // Try to unlock
+            let _ = silent_command("git")
+                .args(["worktree", "unlock", &worktree.path])
+                .current_dir(&main_repo)
+                .output();
+
+            // Try to prune
+            let prune_output = silent_command("git")
+                .args(["worktree", "prune"])
+                .current_dir(&main_repo)
+                .output()
+                .map_err(|e| format!("Failed to prune worktrees: {}", e))?;
+
+            if prune_output.status.success() {
+                eprintln!("[remove_worktree] ✓ Successfully pruned locked/missing worktree");
+                // Delete the associated branch
+                delete_branch(&main_repo, &branch_name);
+                return Ok(());
+            } else {
+                let prune_stderr = String::from_utf8_lossy(&prune_output.stderr);
+                return Err(format!("Failed to prune worktree: {}", prune_stderr));
+            }
+        }
+
         return Err(format!("Git command failed: {}", stderr));
     }
 
+    eprintln!("[remove_worktree] ✓ Worktree removed successfully");
+
+    // Delete the associated branch
+    delete_branch(&main_repo, &branch_name);
+
     Ok(())
 }
 
@@ -761,11 +918,16 @@ pub async fn create_worktree_with_workmux(
     // Use the launcher's own worktree creation logic instead of workmux
     // This ensures consistent directory structure
     let main_repo_path = PathBuf::from(&main_repo);
+
+    // Calculate worktrees directory: ../worktrees (sibling to project root)
     let worktrees_dir = main_repo_path.parent()
-        .ok_or("Could not determine worktrees directory")?
+        .ok_or("Could not determine parent directory")?
+        .join("worktrees")
         .to_string_lossy()
         .to_string();
 
+    eprintln!("[create_worktree_with_workmux] Worktrees directory: {}", worktrees_dir);
+
     // Create the worktree directly
     let worktree = create_worktree(main_repo.clone(), worktrees_dir, name.clone(), base_branch).await?;
 
@@ -1244,12 +1406,9 @@ pub async fn open_tmux_in_terminal(window_name: String, worktree_path: String) -
             let temp_script = format!("/tmp/ushadow_iterm_{}.sh", window_name.replace("/", "_"));
 
             let script_content = format!(
-                "#!/bin/bash\nprintf '\\033]0;{}\\007\\033]6;1;bg;red;brightness;{}\\007\\033]6;1;bg;green;brightness;{}\\007\\033]6;1;bg;blue;brightness;{}\\007'\n# Create dedicated session for this environment if it doesn't exist\ntmux has-session -t {} 2>/dev/null || tmux new-session -d -s {} -c '{}'\n# Attach to this environment's dedicated session\nexec tmux attach-session -t {}\n",
+                "#!/bin/bash\nprintf '\\033]0;{}\\007\\033]6;1;bg;red;brightness;{}\\007\\033]6;1;bg;green;brightness;{}\\007\\033]6;1;bg;blue;brightness;{}\\007'\n# Attach to the workmux session and select the specific window\nexec tmux attach-session -t workmux:{}\n",
                 display_name,
                 r, g, b,
-                window_name,
-                window_name,
-                worktree_path,
                 window_name
             );
             fs::write(&temp_script, script_content)
@@ -1259,16 +1418,38 @@ pub async fn open_tmux_in_terminal(window_name: String, worktree_path: String) -
                 .output()
                 .map_err(|e| format!("Failed to chmod: {}", e))?;
 
-            // Simple iTerm2 AppleScript that executes the script
+            // iTerm2 AppleScript that reuses existing windows with matching name
             let applescript = format!(
                 r#"tell application "iTerm"
     activate
-    set newWindow to (create window with default profile)
-    tell current session of newWindow
-        set name to "{}"
-        write text "{} && exit"
-    end tell
+
+    -- Try to find existing window with this name
+    set foundWindow to false
+    repeat with aWindow in windows
+        repeat with aTab in tabs of aWindow
+            repeat with aSession in sessions of aTab
+                if name of aSession is "{}" then
+                    -- Found existing window, select it
+                    select aSession
+                    set foundWindow to true
+                    exit repeat
+                end if
+            end repeat
+            if foundWindow then exit repeat
+        end repeat
+        if foundWindow then exit repeat
+    end repeat
+
+    -- If no existing window found, create new one
+    if not foundWindow then
+        set newWindow to (create window with default profile)
+        tell current session of newWindow
+            set name to "{}"
+            write text "{} && exit"
+        end tell
+    end if
 end tell"#,
+                display_name,
                 display_name,
                 temp_script
             );
diff --git a/ushadow/launcher/src-tauri/src/config.rs b/ushadow/launcher/src-tauri/src/config.rs
new file mode 100644
index 00000000..8a466751
--- /dev/null
+++ b/ushadow/launcher/src-tauri/src/config.rs
@@ -0,0 +1,356 @@
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+/// Main launcher configuration loaded from .launcher-config.yaml
+#[derive(Deserialize, Serialize, Clone, Debug)]
+pub struct LauncherConfig {
+    pub project: ProjectConfig,
+    pub prerequisites: PrerequisitesConfig,
+    pub setup: SetupConfig,
+    pub infrastructure: InfrastructureConfig,
+    pub containers: ContainersConfig,
+    pub ports: PortsConfig,
+    pub worktrees: WorktreesConfig,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+pub struct ProjectConfig {
+    pub name: String,
+    pub display_name: String,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+pub struct PrerequisitesConfig {
+    pub required: Vec<String>,
+    #[serde(default)]
+    pub optional: Vec<String>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+pub struct SetupConfig {
+    pub command: String,
+    #[serde(default)]
+    pub env_vars: Vec<String>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+pub struct InfrastructureConfig {
+    pub compose_file: String,
+    pub project_name: String,
+    pub profile: Option<String>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+pub struct ContainersConfig {
+    pub naming_pattern: String,
+    pub primary_service: String,
+    pub health_endpoint: String,
+    /// Optional project prefix for Tailscale hostnames (for multi-project setups)
+    /// If set, Tailscale URLs will be: https://{prefix}-{env}.{tailnet}
+    /// If not set, Tailscale URLs will be: https://{env}.{tailnet}
+    #[serde(default)]
+    pub tailscale_project_prefix: Option<String>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+pub struct PortsConfig {
+    #[serde(default = "default_allocation_strategy")]
+    pub allocation_strategy: String, // "hash", "sequential", "random"
+    pub base_port: u16,
+    pub offset: PortOffset,
+}
+
+fn default_allocation_strategy() -> String {
+    "hash".to_string()
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+pub struct PortOffset {
+    pub min: u16,
+    pub max: u16,
+    pub step: u16,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+pub struct WorktreesConfig {
+    pub default_parent: String,
+    #[serde(default)]
+    pub branch_prefix: String,
+}
+
+impl LauncherConfig {
+    /// Load configuration from .launcher-config.yaml in the project root
+    pub fn load(project_root: &PathBuf) -> Result<Self, String> {
+        let config_path = project_root.join(".launcher-config.yaml");
+
+        if !config_path.exists() {
+            return Err(format!(
+                "Configuration file not found: {}\n\n\
+                This repository is not configured for the launcher.\n\
+                Please create a .launcher-config.yaml file in the repository root.",
+                config_path.display()
+            ));
+        }
+
+        let contents = std::fs::read_to_string(&config_path)
+            .map_err(|e| format!("Failed to read config file: {}", e))?;
+
+        let config: LauncherConfig = serde_yaml::from_str(&contents)
+            .map_err(|e| format!("Failed to parse config YAML: {}", e))?;
+
+        // Validate the configuration
+        config.validate()?;
+
+        Ok(config)
+    }
+
+    /// Validate the configuration structure and constraints
+    fn validate(&self) -> Result<(), String> {
+        // Validate project basics
+        if self.project.name.is_empty() {
+            return Err("project.name cannot be empty".to_string());
+        }
+
+        // Validate setup command
+        if self.setup.command.is_empty() {
+            return Err("setup.command cannot be empty".to_string());
+        }
+
+        // Validate port ranges
+        if self.ports.base_port == 0 {
+            return Err("ports.base_port must be greater than 0".to_string());
+        }
+
+        if self.ports.offset.max > 60000 {
+            return Err(format!(
+                "ports.offset.max ({}) too large - max allowed is 60000 to prevent exceeding port 65535",
+                self.ports.offset.max
+            ));
+        }
+
+        // Validate container naming pattern contains required variables
+        if !self.containers.naming_pattern.contains("{project_name}") {
+            return Err("containers.naming_pattern must contain {project_name}".to_string());
+        }
+
+        if !self.containers.naming_pattern.contains("{service_name}") {
+            return Err("containers.naming_pattern must contain {service_name}".to_string());
+        }
+
+        // Validate infrastructure config
+        if self.infrastructure.compose_file.is_empty() {
+            return Err("infrastructure.compose_file cannot be empty".to_string());
+        }
+
+        Ok(())
+    }
+
+    /// Expand variables in a string template using provided context
+    pub fn expand_variables(&self, template: &str, vars: &HashMap<String, String>) -> String {
+        let mut result = template.to_string();
+        for (key, value) in vars {
+            result = result.replace(&format!("{{{}}}", key), value);
+        }
+        result
+    }
+
+    /// Generate container name from pattern
+    pub fn generate_container_name(&self, env_name: &str, service_name: &str) -> String {
+        let env_suffix = if env_name == "default" || env_name.is_empty() {
+            String::new()
+        } else {
+            format!("-{}", env_name)
+        };
+
+        self.containers
+            .naming_pattern
+            .replace("{project_name}", &self.project.name)
+            .replace("{env_name}", &env_suffix)
+            .replace("{service_name}", service_name)
+            .replace("--", "-") // Clean up double dashes
+    }
+
+    /// Calculate port for an environment given the base port and env name
+    pub fn calculate_port(&self, env_name: &str) -> u16 {
+        if env_name == "default" || env_name == "main" || env_name.is_empty() {
+            return self.ports.base_port;
+        }
+
+        match self.ports.allocation_strategy.as_str() {
+            "hash" => {
+                let hash: u32 = env_name.bytes().map(|b| b as u32).sum();
+                let offset_steps = (self.ports.offset.max - self.ports.offset.min) / self.ports.offset.step;
+                let offset = ((hash % offset_steps as u32) * self.ports.offset.step as u32) as u16;
+                self.ports.base_port + offset
+            }
+            "sequential" => {
+                // For sequential, would need to track allocated ports in state
+                // For now, fall back to hash
+                let hash: u32 = env_name.bytes().map(|b| b as u32).sum();
+                let offset_steps = (self.ports.offset.max - self.ports.offset.min) / self.ports.offset.step;
+                let offset = ((hash % offset_steps as u32) * self.ports.offset.step as u32) as u16;
+                self.ports.base_port + offset
+            }
+            _ => self.ports.base_port, // Default/random strategy
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_container_naming() {
+        let config = LauncherConfig {
+            project: ProjectConfig {
+                name: "myapp".to_string(),
+                display_name: "My App".to_string(),
+            },
+            containers: ContainersConfig {
+                naming_pattern: "{project_name}{env_name}-{service_name}".to_string(),
+                primary_service: "backend".to_string(),
+                health_endpoint: "/health".to_string(),
+                tailscale_project_prefix: None,
+            },
+            prerequisites: PrerequisitesConfig {
+                required: vec![],
+                optional: vec![],
+            },
+            setup: SetupConfig {
+                command: "setup.sh".to_string(),
+                env_vars: vec![],
+            },
+            infrastructure: InfrastructureConfig {
+                compose_file: "docker-compose.yml".to_string(),
+                project_name: "infra".to_string(),
+                profile: None,
+            },
+            ports: PortsConfig {
+                allocation_strategy: "hash".to_string(),
+                base_port: 8000,
+                offset: PortOffset {
+                    min: 0,
+                    max: 500,
+                    step: 10,
+                },
+            },
+            worktrees: WorktreesConfig {
+                default_parent: "~/repos".to_string(),
+                branch_prefix: "".to_string(),
+            },
+        };
+
+        assert_eq!(
+            config.generate_container_name("default", "backend"),
+            "myapp-backend"
+        );
+        assert_eq!(
+            config.generate_container_name("staging", "backend"),
+            "myapp-staging-backend"
+        );
+    }
+
+    #[test]
+    fn test_variable_expansion() {
+        let config = LauncherConfig {
+            project: ProjectConfig {
+                name: "test".to_string(),
+                display_name: "Test".to_string(),
+            },
+            prerequisites: PrerequisitesConfig {
+                required: vec![],
+                optional: vec![],
+            },
+            setup: SetupConfig {
+                command: "setup.sh {ENV_NAME} {PORT}".to_string(),
+                env_vars: vec![],
+            },
+            containers: ContainersConfig {
+                naming_pattern: "test-{service_name}".to_string(),
+                primary_service: "backend".to_string(),
+                health_endpoint: "/health".to_string(),
+                tailscale_project_prefix: None,
+            },
+            infrastructure: InfrastructureConfig {
+                compose_file: "docker-compose.yml".to_string(),
+                project_name: "infra".to_string(),
+                profile: None,
+            },
+            ports: PortsConfig {
+                allocation_strategy: "hash".to_string(),
+                base_port: 8000,
+                offset: PortOffset {
+                    min: 0,
+                    max: 500,
+                    step: 10,
+                },
+            },
+            worktrees: WorktreesConfig {
+                default_parent: "~/repos".to_string(),
+                branch_prefix: "".to_string(),
+            },
+        };
+
+        let mut vars = HashMap::new();
+        vars.insert("ENV_NAME".to_string(), "staging".to_string());
+        vars.insert("PORT".to_string(), "8080".to_string());
+
+        let expanded = config.expand_variables(&config.setup.command, &vars);
+        assert_eq!(expanded, "setup.sh staging 8080");
+    }
+
+    #[test]
+    fn test_port_calculation() {
+        let config = LauncherConfig {
+            project: ProjectConfig {
+                name: "test".to_string(),
+                display_name: "Test".to_string(),
+            },
+            prerequisites: PrerequisitesConfig {
+                required: vec![],
+                optional: vec![],
+            },
+            setup: SetupConfig {
+                command: "setup.sh".to_string(),
+                env_vars: vec![],
+            },
+            containers: ContainersConfig {
+                naming_pattern: "test-{service_name}".to_string(),
+                primary_service: "backend".to_string(),
+                health_endpoint: "/health".to_string(),
+                tailscale_project_prefix: None,
+            },
+            infrastructure: InfrastructureConfig {
+                compose_file: "docker-compose.yml".to_string(),
+                project_name: "infra".to_string(),
+                profile: None,
+            },
+            ports: PortsConfig {
+                allocation_strategy: "hash".to_string(),
+                base_port: 8000,
+                offset: PortOffset {
+                    min: 0,
+                    max: 500,
+                    step: 10,
+                },
+            },
+            worktrees: WorktreesConfig {
+                default_parent: "~/repos".to_string(),
+                branch_prefix: "".to_string(),
+            },
+        };
+
+        // Default environment gets base port
+        assert_eq!(config.calculate_port("default"), 8000);
+        assert_eq!(config.calculate_port("main"), 8000);
+
+        // Other environments get offset ports (deterministic hash)
+        let staging_port = config.calculate_port("staging");
+        assert!(staging_port >= 8000 && staging_port <= 8500);
+
+        // Same env name should always give same port
+        assert_eq!(staging_port, config.calculate_port("staging"));
+    }
+}
diff --git a/ushadow/launcher/src-tauri/src/main.rs b/ushadow/launcher/src-tauri/src/main.rs
index f4dfa294..25a8f177 100644
--- a/ushadow/launcher/src-tauri/src/main.rs
+++ b/ushadow/launcher/src-tauri/src/main.rs
@@ -4,31 +4,47 @@
 )]
 
 mod commands;
+mod config;
 mod models;
 
 use commands::{AppState, check_prerequisites, discover_environments, get_os_type,
-    discover_environments_with_config,
+    discover_environments_with_config, discover_environments_v2,
     start_containers, stop_containers, get_container_status,
     start_infrastructure, stop_infrastructure, restart_infrastructure,
     start_environment, stop_environment, check_ports,
     check_backend_health, check_webui_health, open_browser, focus_window, set_project_root,
     create_environment,
+    // OAuth server commands
+    start_oauth_server, wait_for_oauth_callback,
+    // HTTP client
+    http_request,
     // Project/repo management (from repository.rs)
     get_default_project_dir, check_project_dir, clone_ushadow_repo,
     update_ushadow_repo, get_current_branch, checkout_branch, get_base_branch,
     // Worktree commands
-    list_worktrees, list_git_branches, check_worktree_exists, create_worktree, create_worktree_with_workmux,
+    list_worktrees, list_git_branches, check_worktree_exists, check_environment_conflict, create_worktree, create_worktree_with_workmux,
     merge_worktree_with_rebase, list_tmux_sessions, get_tmux_window_status,
     get_environment_tmux_status, get_tmux_info, ensure_tmux_running, attach_tmux_to_worktree,
     open_in_vscode, open_in_vscode_with_tmux, remove_worktree, delete_environment,
     get_tmux_sessions, kill_tmux_window, kill_tmux_server,
     open_tmux_in_terminal, capture_tmux_pane, get_claude_status,
+    // Kanban ticket commands
+    create_ticket_worktree, attach_ticket_to_worktree, get_tickets_for_tmux_window, get_ticket_tmux_info,
+    start_coding_agent_for_ticket,
+    // Kanban ticket/epic CRUD (local storage)
+    get_tickets, get_epics, create_ticket, update_ticket, delete_ticket, create_epic, update_epic, delete_epic,
     // Settings
     load_launcher_settings, save_launcher_settings, write_credentials_to_worktree,
     // Prerequisites config (from prerequisites_config.rs)
     get_prerequisites_config, get_platform_prerequisites_config,
     // Generic installer (from generic_installer.rs) - replaces all platform-specific installers
     install_prerequisite, start_prerequisite,
+    // Config commands (from 4bdc-ushadow-launchge)
+    load_project_config, get_current_config, check_launcher_config_exists, validate_config_file,
+    // Environment scanning
+    scan_env_file, scan_all_env_vars,
+    // Infrastructure discovery
+    get_infra_services_from_compose,
     // Permissions
     check_install_path};
 use tauri::{
@@ -51,15 +67,54 @@ fn create_tray_menu() -> SystemTrayMenu {
 fn create_app_menu() -> Menu {
     let launcher = CustomMenuItem::new("show_launcher", "Show Launcher");
 
+    // App menu (File on Windows/Linux, App name on macOS)
     let app_menu = Submenu::new(
         "Ushadow",
         Menu::new()
             .add_item(launcher)
             .add_native_item(MenuItem::Separator)
+            .add_native_item(MenuItem::Hide)
+            .add_native_item(MenuItem::HideOthers)
+            .add_native_item(MenuItem::ShowAll)
+            .add_native_item(MenuItem::Separator)
             .add_native_item(MenuItem::Quit),
     );
 
-    Menu::new().add_submenu(app_menu)
+    // Edit menu with all standard shortcuts
+    let edit_menu = Submenu::new(
+        "Edit",
+        Menu::new()
+            .add_native_item(MenuItem::Undo)
+            .add_native_item(MenuItem::Redo)
+            .add_native_item(MenuItem::Separator)
+            .add_native_item(MenuItem::Cut)
+            .add_native_item(MenuItem::Copy)
+            .add_native_item(MenuItem::Paste)
+            .add_native_item(MenuItem::SelectAll),
+    );
+
+    // View menu
+    let view_menu = Submenu::new(
+        "View",
+        Menu::new()
+            .add_native_item(MenuItem::EnterFullScreen),
+    );
+
+    // Window menu
+    let window_menu = Submenu::new(
+        "Window",
+        Menu::new()
+            .add_native_item(MenuItem::Minimize)
+            .add_native_item(MenuItem::Zoom)
+            .add_native_item(MenuItem::Separator)
+            .add_native_item(MenuItem::CloseWindow),
+    );
+
+    Menu::new()
+        .add_submenu(app_menu)
+        .add_submenu(edit_menu)
+        .add_submenu(view_menu)
+        .add_submenu(window_menu)
 }
 
 fn main() {
@@ -138,9 +193,11 @@ fn main() {
             get_base_branch,
             // Worktree management
             discover_environments_with_config,
+            discover_environments_v2,
             list_worktrees,
             list_git_branches,
             check_worktree_exists,
+            check_environment_conflict,
             create_worktree,
             create_worktree_with_workmux,
             merge_worktree_with_rebase,
@@ -160,6 +217,21 @@ fn main() {
             open_tmux_in_terminal,
             capture_tmux_pane,
             get_claude_status,
+            // Kanban ticket integration
+            create_ticket_worktree,
+            attach_ticket_to_worktree,
+            get_tickets_for_tmux_window,
+            get_ticket_tmux_info,
+            start_coding_agent_for_ticket,
+            // Kanban ticket/epic CRUD (local storage)
+            get_tickets,
+            get_epics,
+            create_ticket,
+            update_ticket,
+            delete_ticket,
+            create_epic,
+            update_epic,
+            delete_epic,
             // Settings
             load_launcher_settings,
             save_launcher_settings,
@@ -170,6 +242,21 @@ fn main() {
             // Generic installer
             install_prerequisite,
             start_prerequisite,
+            // Config management (from 4bdc-ushadow-launchge)
+            load_project_config,
+            get_current_config,
+            check_launcher_config_exists,
+            validate_config_file,
+            // Environment scanning
+            scan_env_file,
+            scan_all_env_vars,
+            // Infrastructure discovery
+            get_infra_services_from_compose,
+            // OAuth server
+            start_oauth_server,
+            wait_for_oauth_callback,
+            // HTTP client
+            http_request,
         ])
         .setup(|app| {
             let window = app.get_window("main").unwrap();
diff --git a/ushadow/launcher/src-tauri/src/models.rs b/ushadow/launcher/src-tauri/src/models.rs
index 1a4f89b8..3500d17f 100644
--- a/ushadow/launcher/src-tauri/src/models.rs
+++ b/ushadow/launcher/src-tauri/src/models.rs
@@ -143,3 +143,87 @@ pub struct ClaudeStatus {
     pub current_task: Option<String>,
     pub last_output: Option<String>,
 }
+
+/// Environment conflict info - when creating environment that already exists
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct EnvironmentConflict {
+    pub name: String,
+    pub current_branch: String,
+    pub path: String,
+    pub is_running: bool,
+}
+
+/// Compose service definition from docker-compose.yml
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct ComposeServiceDefinition {
+    pub id: String,           // Service name from compose (e.g., "postgres", "redis")
+    pub display_name: String, // Human-readable name (e.g., "PostgreSQL", "Redis")
+    pub default_port: Option<u16>, // Primary exposed port
+    pub profiles: Vec<String>, // Profiles this service belongs to
+}
+
+/// Kanban ticket status
+#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum TicketStatus {
+    Backlog,
+    Todo,
+    InProgress,
+    InReview,
+    Done,
+    Archived,
+}
+
+/// Kanban ticket priority
+#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
+#[serde(rename_all = "lowercase")]
+pub enum TicketPriority {
+    Low,
+    Medium,
+    High,
+    Urgent,
+}
+
+/// Epic (collection of related tickets)
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct Epic {
+    pub id: String,
+    pub title: String,
+    pub description: Option<String>,
+    pub color: String,
+    pub branch_name: Option<String>,
+    pub base_branch: String,
+    pub project_id: Option<String>,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+/// Kanban ticket
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct Ticket {
+    pub id: String,
+    pub title: String,
+    pub description: Option<String>,
+    pub status: TicketStatus,
+    pub priority: TicketPriority,
+    pub epic_id: Option<String>,
+    pub tags: Vec<String>,
+    pub color: Option<String>,
+    pub tmux_window_name: Option<String>,
+    pub tmux_session_name: Option<String>,
+    pub branch_name: Option<String>,
+    pub worktree_path: Option<String>,
+    pub environment_name: Option<String>,
+    pub project_id: Option<String>,
+    pub assigned_to: Option<String>,
+    pub order: i32,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+/// Kanban data storage structure
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct KanbanData {
+    pub tickets: Vec<Ticket>,
+    pub epics: Vec<Epic>,
+}
diff --git a/ushadow/launcher/src-tauri/tauri.conf.json b/ushadow/launcher/src-tauri/tauri.conf.json
index ba821f18..5b01c193 100644
--- a/ushadow/launcher/src-tauri/tauri.conf.json
+++ b/ushadow/launcher/src-tauri/tauri.conf.json
@@ -8,7 +8,7 @@
   },
   "package": {
     "productName": "Ushadow",
-    "version": "0.7.15"
+    "version": "0.8.0"
   },
   "tauri": {
     "allowlist": {
@@ -59,6 +59,20 @@
       },
       "notification": {
         "all": true
+      },
+      "window": {
+        "all": false,
+        "create": true,
+        "center": true,
+        "close": true,
+        "hide": true,
+        "show": true,
+        "setFocus": true,
+        "setTitle": true,
+        "setSize": true,
+        "setPosition": true,
+        "setResizable": true,
+        "setAlwaysOnTop": true
       }
     },
     "bundle": {
@@ -95,7 +109,14 @@
       }
     },
     "security": {
-      "csp": "default-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' http://localhost:* https://localhost:* ws://localhost:* wss://localhost:*; img-src 'self' data: http://localhost:* https://localhost:*; style-src 'self' 'unsafe-inline'; frame-src http://localhost:* https://localhost:*"
+      "csp": "default-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' http://localhost:* https://localhost:* ws://localhost:* wss://localhost:*; img-src 'self' data: http://localhost:* https://localhost:*; style-src 'self' 'unsafe-inline'; frame-src http://localhost:* https://localhost:*",
+      "dangerousRemoteDomainIpcAccess": [
+        {
+          "domain": "localhost",
+          "windows": ["main", "oauth-window"],
+          "enableTauriAPI": false
+        }
+      ]
     },
     "systemTray": {
       "iconPath": "icons/icon.png",
diff --git a/ushadow/launcher/src/App.tsx b/ushadow/launcher/src/App.tsx
index b8eb562d..0c0d6692 100644
--- a/ushadow/launcher/src/App.tsx
+++ b/ushadow/launcher/src/App.tsx
@@ -1,21 +1,25 @@
 import { useState, useEffect, useCallback, useRef } from 'react'
-import { tauri, type Prerequisites, type Discovery, type UshadowEnvironment, type PlatformPrerequisitesConfig } from './hooks/useTauri'
+import { tauri, type Prerequisites, type Discovery, type UshadowEnvironment, type PlatformPrerequisitesConfig, type EnvironmentConflict } from './hooks/useTauri'
 import { useAppStore, type BranchType } from './store/appStore'
 import { useWindowFocus } from './hooks/useWindowFocus'
 import { useTmuxMonitoring } from './hooks/useTmuxMonitoring'
-import { writeText, readText } from '@tauri-apps/api/clipboard'
 import { DevToolsPanel } from './components/DevToolsPanel'
 import { PrerequisitesPanel } from './components/PrerequisitesPanel'
 import { InfrastructurePanel } from './components/InfrastructurePanel'
+import { InfraConfigPanel } from './components/InfraConfigPanel'
 import { EnvironmentsPanel } from './components/EnvironmentsPanel'
 import { LogPanel, type LogEntry, type LogLevel } from './components/LogPanel'
 import { ProjectSetupDialog } from './components/ProjectSetupDialog'
 import { NewEnvironmentDialog } from './components/NewEnvironmentDialog'
+import { EnvironmentConflictDialog } from './components/EnvironmentConflictDialog'
 import { TmuxManagerDialog } from './components/TmuxManagerDialog'
 import { SettingsDialog } from './components/SettingsDialog'
 import { EmbeddedView } from './components/EmbeddedView'
-import { RefreshCw, Settings, Zap, Loader2, FolderOpen, Pencil, Terminal, Sliders, Package, FolderGit2 } from 'lucide-react'
+import { ProjectManager } from './components/ProjectManager'
+import { AuthButton } from './components/AuthButton'
+import { RefreshCw, Settings, Zap, Loader2, FolderOpen, Pencil, Terminal, Sliders, Package, FolderGit2, Trello } from 'lucide-react'
 import { getColors } from './utils/colors'
+import { KanbanBoard } from './components/KanbanBoard'
 
 function App() {
   // Store
@@ -33,8 +37,19 @@ function App() {
     setProjectRoot,
     worktreesDir,
     setWorktreesDir,
+    multiProjectMode,
+    kanbanEnabled,
+    projects,
+    activeProjectId,
   } = useAppStore()
 
+  // Get active project in multi-project mode, or use legacy projectRoot
+  const activeProject = multiProjectMode && activeProjectId
+    ? projects.find(p => p.id === activeProjectId)
+    : null
+  const effectiveProjectRoot = activeProject?.rootPath || projectRoot
+  const effectiveWorktreesDir = activeProject?.worktreesPath || worktreesDir
+
   // State
   const [platform, setPlatform] = useState<string>('')
   const [prerequisites, setPrerequisites] = useState<Prerequisites | null>(null)
@@ -45,7 +60,7 @@ function App() {
   const [installingItem, setInstallingItem] = useState<string | null>(null)
   const [isLaunching, setIsLaunching] = useState(false)
   const [loadingInfra, setLoadingInfra] = useState(false)
-  const [loadingEnv, setLoadingEnv] = useState<string | null>(null)
+  const [loadingEnv, setLoadingEnv] = useState<{ name: string; action: 'starting' | 'stopping' | 'deleting' | 'merging' } | null>(null)
   const [showProjectDialog, setShowProjectDialog] = useState(false)
   const [showNewEnvDialog, setShowNewEnvDialog] = useState(false)
   const [showTmuxManager, setShowTmuxManager] = useState(false)
@@ -55,6 +70,42 @@ function App() {
   const [shouldAutoLaunch, setShouldAutoLaunch] = useState(false)
   const [leftColumnWidth, setLeftColumnWidth] = useState(350) // pixels
   const [isResizing, setIsResizing] = useState(false)
+  const [environmentConflict, setEnvironmentConflict] = useState<EnvironmentConflict | null>(null)
+  const [pendingEnvCreation, setPendingEnvCreation] = useState<{ name: string; branch: string } | null>(null)
+  const [selectedEnvironment, setSelectedEnvironment] = useState<UshadowEnvironment | null>(null)
+
+  // Auto-select environment matching current directory's ENV_NAME, or first running
+  useEffect(() => {
+    if (!selectedEnvironment && discovery?.environments) {
+      // Try to find environment matching the current project root
+      const currentEnv = discovery.environments.find(e =>
+        e.running && e.path === projectRoot
+      )
+      // Fallback to first running environment
+      const envToSelect = currentEnv || discovery.environments.find(e => e.running)
+      if (envToSelect) {
+        console.log('[App] Auto-selecting environment:', {
+          name: envToSelect.name,
+          backend_port: envToSelect.backend_port,
+          path: envToSelect.path,
+          projectRoot,
+          matched: !!currentEnv
+        })
+        setSelectedEnvironment(envToSelect)
+      }
+    }
+  }, [discovery?.environments, selectedEnvironment, projectRoot])
+
+  // Debug: expose selectedEnvironment to console
+  useEffect(() => {
+    if (selectedEnvironment) {
+      (window as any).selectedEnv = selectedEnvironment
+      console.log('[App] Selected environment updated:', {
+        name: selectedEnvironment.name,
+        backend_port: selectedEnvironment.backend_port
+      })
+    }
+  }, [selectedEnvironment])
 
   // Window focus detection for smart polling
   const isWindowFocused = useWindowFocus()
@@ -63,6 +114,40 @@ function App() {
   const environmentNames = discovery?.environments.map(e => e.name) ?? []
   const tmuxStatuses = useTmuxMonitoring(environmentNames, isWindowFocused && environmentNames.length > 0)
 
+  // Infrastructure service selection
+  const [selectedInfraServices, setSelectedInfraServices] = useState<string[]>([])
+
+  // Auto-select running infrastructure services
+  useEffect(() => {
+    if (discovery?.infrastructure) {
+      const runningServiceIds = discovery.infrastructure
+        .filter(service => service.running)
+        .map(service => service.name)
+
+      // Only update if the running services have changed
+      setSelectedInfraServices(prev => {
+        const prevSet = new Set(prev)
+        const newSet = new Set(runningServiceIds)
+
+        // Check if sets are different
+        if (prevSet.size !== newSet.size) return runningServiceIds
+        for (const id of runningServiceIds) {
+          if (!prevSet.has(id)) return runningServiceIds
+        }
+
+        return prev // No change needed
+      })
+    }
+  }, [discovery?.infrastructure])
+
+  const handleToggleInfraService = (serviceId: string) => {
+    setSelectedInfraServices(prev =>
+      prev.includes(serviceId)
+        ? prev.filter(id => id !== serviceId)
+        : [...prev, serviceId]
+    )
+  }
+
   const logIdRef = useRef(0)
   const lastStateRef = useRef<string>('')
 
@@ -118,85 +203,54 @@ function App() {
     }
   }, [isResizing, handleMouseMove, handleMouseUp])
 
-  // Enable keyboard shortcuts for copy/paste
-  useEffect(() => {
-    const handleKeyDown = async (e: KeyboardEvent) => {
-      const isMac = navigator.platform.toUpperCase().indexOf('MAC') >= 0
-      const modifier = isMac ? e.metaKey : e.ctrlKey
-
-      // Only handle copy/paste/cut if modifier key is pressed
-      if (!modifier) return
-
-      // Get the active element
-      const target = e.target as HTMLElement
-      const isInputField = target.tagName === 'INPUT' || target.tagName === 'TEXTAREA' || target.isContentEditable
+  // Enable native clipboard operations (undo/redo/copy/paste/cut/select-all)
+  // Tauri webview supports standard browser clipboard API
+  // All native keyboard shortcuts work by default: Cmd/Ctrl+Z (undo), Cmd/Ctrl+Shift+Z (redo), Cmd/Ctrl+A (select all), etc.
 
-      try {
-        if (e.key.toLowerCase() === 'c') {
-          // Copy: get selection from input field or window selection
-          let textToCopy = ''
-          if (isInputField && (target instanceof HTMLInputElement || target instanceof HTMLTextAreaElement)) {
-            const start = target.selectionStart || 0
-            const end = target.selectionEnd || 0
-            textToCopy = target.value.substring(start, end)
-          } else {
-            const selection = window.getSelection()
-            textToCopy = selection?.toString() || ''
-          }
+  // Token sharing API: Listen for token requests from environment iframes
+  useEffect(() => {
+    const handleMessage = (event: MessageEvent) => {
+      // Security: Only respond to messages from embedded environments
+      // TODO: Add origin validation if needed
+
+      if (event.data.type === 'GET_KC_TOKEN') {
+        // Get tokens from localStorage
+        const token = localStorage.getItem('kc_access_token')
+        const refreshToken = localStorage.getItem('kc_refresh_token')
+        const idToken = localStorage.getItem('kc_id_token')
+
+        // Send tokens back to requesting iframe
+        event.source?.postMessage(
+          {
+            type: 'KC_TOKEN_RESPONSE',
+            tokens: { token, refreshToken, idToken },
+          },
+          '*' // TODO: Restrict to specific origins in production
+        )
+      }
 
-          if (textToCopy) {
-            await writeText(textToCopy)
-            e.preventDefault()
-          }
-        } else if (e.key.toLowerCase() === 'v') {
-          // Paste: handle input fields specially, but allow pasting anywhere
-          const text = await readText()
-          if (!text) return
-
-          if (target instanceof HTMLInputElement || target instanceof HTMLTextAreaElement) {
-            // Paste into input/textarea
-            const start = target.selectionStart || 0
-            const end = target.selectionEnd || 0
-            const currentValue = target.value
-            target.value = currentValue.substring(0, start) + text + currentValue.substring(end)
-            target.selectionStart = target.selectionEnd = start + text.length
-
-            // Trigger input event so React state updates
-            const event = new Event('input', { bubbles: true })
-            target.dispatchEvent(event)
-            e.preventDefault()
-          } else if (target.isContentEditable) {
-            // Paste into contenteditable
-            document.execCommand('insertText', false, text)
-            e.preventDefault()
-          }
-        } else if (e.key.toLowerCase() === 'x') {
-          // Cut: only from input fields
-          if (target instanceof HTMLInputElement || target instanceof HTMLTextAreaElement) {
-            const start = target.selectionStart || 0
-            const end = target.selectionEnd || 0
-            const selectedText = target.value.substring(start, end)
-            if (selectedText) {
-              await writeText(selectedText)
-              const currentValue = target.value
-              target.value = currentValue.substring(0, start) + currentValue.substring(end)
-              target.selectionStart = target.selectionEnd = start
-
-              // Trigger input event so React state updates
-              const event = new Event('input', { bubbles: true })
-              target.dispatchEvent(event)
-              e.preventDefault()
-            }
-          }
-        }
-      } catch (err) {
-        // Silently fail if clipboard access is denied
-        console.warn('Clipboard access failed:', err)
+      if (event.data.type === 'REFRESH_KC_TOKEN') {
+        // TODO: Implement token refresh logic
+        // For now, just return current tokens
+        const token = localStorage.getItem('kc_access_token')
+        const refreshToken = localStorage.getItem('kc_refresh_token')
+        const idToken = localStorage.getItem('kc_id_token')
+
+        event.source?.postMessage(
+          {
+            type: 'KC_TOKEN_REFRESHED',
+            tokens: { token, refreshToken, idToken },
+          },
+          '*'
+        )
       }
     }
 
-    document.addEventListener('keydown', handleKeyDown, true) // Use capture phase
-    return () => document.removeEventListener('keydown', handleKeyDown, true)
+    window.addEventListener('message', handleMessage)
+
+    return () => {
+      window.removeEventListener('message', handleMessage)
+    }
   }, [])
 
   // Apply spoofed values to prerequisites
@@ -295,22 +349,16 @@ function App() {
     const init = async () => {
       try {
         log('Initializing...', 'step')
-        console.log('[Init] Starting initialization...')
 
         const os = await tauri.getOsType()
-        console.log('[Init] OS:', os)
         setPlatform(os)
         log(`Platform: ${os}`)
 
         // Load prerequisites configuration for this platform
-        console.log('[Init] Loading prerequisites config...')
         const config = await tauri.getPlatformPrerequisitesConfig(os)
-        console.log('[Init] Prerequisites config:', config)
         setPrerequisitesConfig(config)
 
-        console.log('[Init] Getting default project dir...')
         const defaultDir = await tauri.getDefaultProjectDir()
-        console.log('[Init] Default dir:', defaultDir)
 
         // Track if this is first time setup (showing project dialog)
         let isFirstTimeSetup = false
@@ -323,22 +371,18 @@ function App() {
           log('Please configure your repository location', 'step')
         } else {
           // Sync existing project root to Rust backend
-          console.log('[Init] Setting project root:', projectRoot)
           await tauri.setProjectRoot(projectRoot)
         }
 
         // Check prerequisites immediately (system-wide, no project needed)
-        console.log('[Init] Checking prerequisites...')
         await refreshPrerequisites()
 
         // Only run discovery if we have a valid project root
         if (!isFirstTimeSetup) {
-          console.log('[Init] Running discovery...')
           await refreshDiscovery()
         }
 
         log('Ready', 'success')
-        console.log('[Init] Initialization complete')
       } catch (err) {
         console.error('[Init] Initialization error:', err)
         log(`Initialization failed: ${err}`, 'error')
@@ -378,6 +422,15 @@ function App() {
     return () => clearInterval(interval)
   }, [refreshPrerequisites, refreshDiscovery, isWindowFocused, projectRoot])
 
+  // Sync active project root to Rust backend when it changes (multi-project mode)
+  useEffect(() => {
+    if (effectiveProjectRoot && effectiveProjectRoot !== projectRoot) {
+      tauri.setProjectRoot(effectiveProjectRoot).catch(err => {
+        console.error('Failed to sync project root to backend:', err)
+      })
+    }
+  }, [effectiveProjectRoot, projectRoot])
+
   // Install handlers
   const handleInstall = async (item: string) => {
     setIsInstalling(true)
@@ -560,8 +613,7 @@ function App() {
 
   // Environment handlers
   const handleStartEnv = async (envName: string, explicitPath?: string) => {
-    console.log(`DEBUG: handleStartEnv called for ${envName}`)
-    setLoadingEnv(envName)
+    setLoadingEnv({ name: envName, action: 'starting' })
     log(`Starting ${envName}...`, 'step')
 
     // Use explicit path if provided, otherwise look up the environment
@@ -636,9 +688,7 @@ function App() {
           }
         })
       } else {
-        console.log(`DEBUG: Calling tauri.startEnvironment(${envName}, ${envPath})`)
         const result = await tauri.startEnvironment(envName, envPath)
-        console.log(`DEBUG: tauri.startEnvironment returned: ${result}`)
         // Only log summary to activity log (full detail is in console/detail pane)
         log(`✓ Environment ${envName} started successfully`, 'success')
 
@@ -673,7 +723,7 @@ function App() {
   }
 
   const handleStopEnv = async (envName: string) => {
-    setLoadingEnv(envName)
+    setLoadingEnv({ name: envName, action: 'stopping' })
     log(`Stopping ${envName}...`, 'step')
 
     try {
@@ -728,7 +778,7 @@ function App() {
 
     if (!confirmed) return
 
-    setLoadingEnv(envName)
+    setLoadingEnv({ name: envName, action: 'merging' })
     log(`Merging worktree "${envName}" to main...`, 'step')
 
     try {
@@ -776,24 +826,24 @@ function App() {
       ? `Delete environment "${envName}"?\n\n` +
         `This will:\n` +
         `• Stop all containers\n` +
-        `• Remove the worktree\n` +
+        `• Remove the worktree (including any uncommitted changes)\n` +
         `• Close the tmux session\n\n` +
-        `This action cannot be undone!`
+        `⚠️  This action cannot be undone!`
       : `Delete environment "${envName}"?\n\n` +
         `This will:\n` +
         `• Stop all containers\n` +
         `• Close the tmux session\n\n` +
-        `This action cannot be undone!`
+        `⚠️  This action cannot be undone!`
 
     const confirmed = window.confirm(message)
 
     if (!confirmed) return
 
-    setLoadingEnv(envName)
+    setLoadingEnv({ name: envName, action: 'deleting' })
     log(`Deleting environment "${envName}"...`, 'step')
 
     try {
-      const result = await tauri.deleteEnvironment(projectRoot, envName)
+      const result = await tauri.deleteEnvironment(effectiveProjectRoot, envName)
       log(result, 'success')
       log(`✓ Environment "${envName}" deleted`, 'success')
 
@@ -832,7 +882,7 @@ function App() {
     // Force lowercase to avoid Docker Compose naming issues
     name = name.toLowerCase()
 
-    const envPath = `${projectRoot}/../${name}` // Expected clone location
+    const envPath = `${effectiveProjectRoot}/../${name}` // Expected clone location
     const modeLabel = serverMode === 'dev' ? 'hot reload' : 'production'
 
     // Check port availability in dev mode (non-quick launch)
@@ -889,17 +939,17 @@ function App() {
     name = name.toLowerCase()
     branch = branch.toLowerCase()
 
-    if (!worktreesDir) {
+    if (!effectiveWorktreesDir) {
       log('Worktrees directory not configured', 'error')
       throw new Error('Worktrees directory not configured')
     }
 
     log(`Creating worktree "${name}" from branch "${branch}"...`, 'step')
-    log(`Project root: ${projectRoot}`, 'info')
-    log(`Worktrees dir: ${worktreesDir}`, 'info')
+    log(`Project root: ${effectiveProjectRoot}`, 'info')
+    log(`Worktrees dir: ${effectiveWorktreesDir}`, 'info')
 
     try {
-      const worktree = await tauri.createWorktreeWithWorkmux(projectRoot, name, branch, true)
+      const worktree = await tauri.createWorktreeWithWorkmux(effectiveProjectRoot, name, branch, true)
       log(`✓ Worktree created successfully`, 'success')
       log(`Path: ${worktree.path}`, 'info')
       log(`Branch: ${worktree.branch}`, 'info')
@@ -937,12 +987,30 @@ function App() {
     name = name.toLowerCase()
     branch = branch.toLowerCase()
 
-    if (!worktreesDir) {
+    if (!effectiveWorktreesDir) {
       log('Worktrees directory not configured', 'error')
       return
     }
 
-    const envPath = `${worktreesDir}/${name}`
+    // Check for conflicts first
+    try {
+      const conflict = await tauri.checkEnvironmentConflict(effectiveProjectRoot, name)
+      if (conflict) {
+        // Check if the environment is actually running (from discovery data)
+        const env = discovery?.environments.find(e => e.name === name)
+        conflict.is_running = env?.running || false
+
+        // Show conflict dialog
+        setEnvironmentConflict(conflict)
+        setPendingEnvCreation({ name, branch })
+        return
+      }
+    } catch (err) {
+      log(`Failed to check for conflicts: ${err}`, 'warning')
+      // Continue anyway
+    }
+
+    const envPath = `${effectiveWorktreesDir}/${name}`
 
     // Add to creating environments list
     setCreatingEnvs(prev => [...prev, { name, status: 'cloning', path: envPath }])
@@ -957,7 +1025,7 @@ function App() {
       } else {
         // Step 1: Create the git worktree with workmux (includes tmux integration)
         log(`Creating git worktree at ${envPath}...`, 'info')
-        const worktree = await tauri.createWorktreeWithWorkmux(projectRoot, name, branch || undefined, true)
+        const worktree = await tauri.createWorktreeWithWorkmux(effectiveProjectRoot, name, branch || undefined, true)
         log(`✓ Worktree created at ${worktree.path}`, 'success')
 
         // Step 1.5: Write default admin credentials if configured
@@ -1015,6 +1083,120 @@ function App() {
     }
   }
 
+  // Conflict resolution handlers
+  const handleConflictStartExisting = async () => {
+    if (!environmentConflict) return
+
+    setEnvironmentConflict(null)
+    setPendingEnvCreation(null)
+    log(`Starting existing environment "${environmentConflict.name}"...`, 'step')
+
+    // Start the existing environment
+    await handleStartEnv(environmentConflict.name, environmentConflict.path)
+  }
+
+  const handleConflictSwitchBranch = async () => {
+    if (!environmentConflict || !pendingEnvCreation) return
+
+    const { name, branch } = pendingEnvCreation
+    setEnvironmentConflict(null)
+    setPendingEnvCreation(null)
+
+    log(`Switching "${name}" to branch "${branch}"...`, 'step')
+
+    try {
+      // Stop if running
+      if (environmentConflict.is_running) {
+        log('Stopping environment before switching branch...', 'info')
+        await tauri.stopEnvironment(name)
+      }
+
+      // Checkout the new branch
+      log(`Checking out branch ${branch}...`, 'info')
+      await tauri.checkoutBranch(environmentConflict.path, branch)
+      log(`✓ Switched to ${branch}`, 'success')
+
+      // Start the environment
+      await handleStartEnv(name, environmentConflict.path)
+    } catch (err) {
+      log(`Failed to switch branch: ${err}`, 'error')
+    }
+  }
+
+  const handleConflictDeleteAndRecreate = async () => {
+    if (!environmentConflict || !pendingEnvCreation) return
+
+    const { name, branch } = pendingEnvCreation
+    setEnvironmentConflict(null)
+    setPendingEnvCreation(null)
+
+    log(`Deleting and recreating "${name}"...`, 'step')
+
+    try {
+      // Delete the old environment (stops containers, removes worktree, closes tmux)
+      await tauri.deleteEnvironment(effectiveProjectRoot, name)
+      log(`✓ Old environment deleted`, 'success')
+
+      // Wait a moment for cleanup
+      await new Promise(r => setTimeout(r, 1000))
+
+      // Now create the new environment (reuse existing logic from handleNewEnvWorktree)
+      const envPath = `${effectiveWorktreesDir}/${name}`
+      setCreatingEnvs(prev => [...prev, { name, status: 'cloning', path: envPath }])
+      log(`Creating worktree "${name}" from branch "${branch}"...`, 'step')
+
+      if (dryRunMode) {
+        log(`[DRY RUN] Would create worktree "${name}" for branch "${branch}"`, 'warning')
+        setCreatingEnvs(prev => prev.map(e => e.name === name ? { ...e, status: 'starting' } : e))
+        await new Promise(r => setTimeout(r, 2000))
+        log(`[DRY RUN] Worktree environment "${name}" created`, 'success')
+      } else {
+        log(`Creating git worktree at ${envPath}...`, 'info')
+        const worktree = await tauri.createWorktreeWithWorkmux(effectiveProjectRoot, name, branch || undefined, true)
+        log(`✓ Worktree created at ${worktree.path}`, 'success')
+
+        // Write credentials if configured
+        try {
+          const settings = await tauri.loadLauncherSettings()
+          if (settings.default_admin_email && settings.default_admin_password) {
+            log(`Writing admin credentials to secrets.yaml...`, 'info')
+            await tauri.writeCredentialsToWorktree(
+              worktree.path,
+              settings.default_admin_email,
+              settings.default_admin_password,
+              settings.default_admin_name || undefined
+            )
+            log(`✓ Admin credentials configured`, 'success')
+          }
+        } catch (err) {
+          log(`Could not write credentials: ${err}`, 'warning')
+        }
+
+        setCreatingEnvs(prev => prev.map(e => e.name === name ? { ...e, status: 'starting', path: worktree.path } : e))
+
+        // Start the environment
+        log(`Starting environment "${name}"...`, 'step')
+        await handleStartEnv(name, worktree.path)
+
+        log(`✓ Worktree environment "${name}" created and started!`, 'success')
+      }
+
+      setTimeout(() => {
+        setCreatingEnvs(prev => prev.filter(e => e.name !== name))
+      }, 15000)
+
+      await refreshDiscovery()
+    } catch (err) {
+      log(`Failed to delete and recreate: ${err}`, 'error')
+      setCreatingEnvs(prev => prev.map(e => e.name === name ? { ...e, status: 'error', error: String(err) } : e))
+    }
+  }
+
+  const handleConflictCancel = () => {
+    setEnvironmentConflict(null)
+    setPendingEnvCreation(null)
+  }
+
   // Project setup handler - saves paths, doesn't clone yet
   const handleProjectSetup = async (path: string, worktreesPath: string) => {
     setShowProjectDialog(false)
@@ -1053,12 +1235,8 @@ function App() {
 
   const handleClone = async (path: string, branch?: string) => {
     try {
-      console.log('DEBUG handleClone: Starting clone for path:', path, 'branch:', branch)
-      console.log('DEBUG handleClone: dryRunMode =', dryRunMode)
-
       // Check if repo already exists at this location
       const status = await tauri.checkProjectDir(path)
-      console.log('DEBUG handleClone: checkProjectDir status =', status)
 
       if (status.exists && status.is_valid_repo) {
         // Repo exists - pull latest instead of cloning
@@ -1083,9 +1261,7 @@ function App() {
           await new Promise(r => setTimeout(r, 2000))
           log('[DRY RUN] Clone simulated', 'success')
         } else {
-          console.log('DEBUG handleClone: Calling tauri.cloneUshadowRepo with path:', path, 'branch:', branch)
           const result = await tauri.cloneUshadowRepo(path, branch)
-          console.log('DEBUG handleClone: Clone result from Rust:', result)
           log(result, 'success')
         }
       }
@@ -1120,7 +1296,6 @@ function App() {
 
   // Quick launch (for quick mode)
   const handleQuickLaunch = async () => {
-    console.log('DEBUG: handleQuickLaunch started')
     setIsLaunching(true)
     setLogExpanded(true)
     log('🚀 Starting Ushadow quick launch...', 'step')
@@ -1347,7 +1522,7 @@ function App() {
             <button
               onClick={() => setAppMode('install')}
               className={`px-3 py-1.5 rounded-md text-xs font-medium transition-colors ${
-                appMode === 'infra' ? 'bg-surface-600 text-text-primary' : 'text-text-muted hover:text-text-secondary'
+                appMode === 'install' ? 'bg-surface-600 text-text-primary' : 'text-text-muted hover:text-text-secondary'
               }`}
               data-testid="nav-install"
             >
@@ -1374,6 +1549,18 @@ function App() {
               <FolderGit2 className="w-3 h-3 inline mr-1" />
               Environments
             </button>
+            {kanbanEnabled && (
+              <button
+                onClick={() => setAppMode('kanban')}
+                className={`px-3 py-1.5 rounded-md text-xs font-medium transition-colors ${
+                  appMode === 'kanban' ? 'bg-surface-600 text-text-primary' : 'text-text-muted hover:text-text-secondary'
+                }`}
+                data-testid="nav-kanban"
+              >
+                <Trello className="w-3 h-3 inline mr-1" />
+                Kanban
+              </button>
+            )}
           </div>
 
           {/* Tmux Manager */}
@@ -1386,15 +1573,21 @@ function App() {
             <Terminal className="w-4 h-4" />
           </button>
 
-          {/* Settings / Credentials Button */}
+          {/* Auth Button */}
+          <AuthButton
+            environment={selectedEnvironment}
+            variant="header"
+          />
+
+          {/* Settings Button */}
           <button
             onClick={() => setShowSettingsDialog(true)}
             className="px-3 py-1.5 rounded-lg bg-primary-500 hover:bg-primary-600 transition-colors flex items-center gap-2 font-medium text-sm"
-            title="Configure default credentials"
+            title="Configure launcher settings"
             data-testid="open-settings-button"
           >
             <Sliders className="w-4 h-4" />
-            Credentials
+            Settings
           </button>
 
           {/* Refresh */}
@@ -1412,53 +1605,71 @@ function App() {
       {/* Main Content */}
       <main className="flex-1 overflow-hidden p-4">
         {appMode === 'install' ? (
-          /* Install Page - One-Click Launch (Landing Page) */
-          <div className="h-full flex flex-col items-center justify-center">
-            <div className="text-center mb-8">
-              <h2 className="text-2xl font-bold mb-2">One-Click Launch</h2>
-              <p className="text-text-secondary">
-                Automatically install prerequisites and start Ushadow
-              </p>
-            </div>
+          /* Install Page - Project Configuration */
+          <div className="h-full flex flex-col overflow-y-auto p-8">
+            {multiProjectMode ? (
+              /* Multi-Project Mode - Project Manager */
+              <>
+                <div className="text-center mb-8">
+                  <h2 className="text-2xl font-bold mb-2">Project Management</h2>
+                  <p className="text-text-secondary">
+                    Manage multiple projects with independent configurations
+                  </p>
+                </div>
+                <div className="max-w-4xl mx-auto w-full">
+                  <ProjectManager />
+                </div>
+              </>
+            ) : (
+              /* Single-Project Mode - One-Click Launch */
+              <div className="flex flex-col items-center justify-center flex-1">
+                <div className="text-center mb-8">
+                  <h2 className="text-2xl font-bold mb-2">One-Click Launch</h2>
+                  <p className="text-text-secondary">
+                    Automatically install prerequisites and start Ushadow
+                  </p>
+                </div>
 
-            {/* Project Folder Display */}
-            <div className="flex items-center gap-2 px-4 py-2 bg-surface-800 rounded-lg mb-6 text-sm">
-              <FolderOpen className="w-4 h-4 text-text-muted" />
-              <span className="text-text-muted">Project folder:</span>
-              <span className="text-text-secondary truncate max-w-md" title={projectRoot}>
-                {projectRoot || 'Not set'}
-              </span>
-              <button
-                onClick={() => setShowProjectDialog(true)}
-                className="p-1 rounded hover:bg-surface-700 transition-colors text-text-muted hover:text-text-primary ml-1"
-                title="Change folder locations"
-              >
-                <Pencil className="w-3.5 h-3.5" />
-              </button>
-            </div>
+                {/* Project Folder Display */}
+                <div className="flex items-center gap-2 px-4 py-2 bg-surface-800 rounded-lg mb-6 text-sm">
+                  <FolderOpen className="w-4 h-4 text-text-muted" />
+                  <span className="text-text-muted">Project folder:</span>
+                  <span className="text-text-secondary truncate max-w-md" title={projectRoot}>
+                    {projectRoot || 'Not set'}
+                  </span>
+                  <button
+                    onClick={() => setShowProjectDialog(true)}
+                    className="p-1 rounded hover:bg-surface-700 transition-colors text-text-muted hover:text-text-primary ml-1"
+                    title="Change folder locations"
+                  >
+                    <Pencil className="w-3.5 h-3.5" />
+                  </button>
+                </div>
 
-            <button
-              onClick={handleQuickLaunch}
-              disabled={isLaunching}
-              className={`px-12 py-4 rounded-xl transition-all font-semibold text-lg flex items-center justify-center gap-3 ${
-                isLaunching
-                  ? 'bg-surface-600 cursor-not-allowed'
-                  : 'bg-gradient-brand hover:opacity-90 hover:shadow-lg hover:shadow-primary-500/20 active:scale-95'
-              }`}
-              data-testid="quick-launch-button"
-            >
-              {isLaunching ? (
-                <>
-                  <Loader2 className="w-6 h-6 animate-spin" />
-                  Launching...
-                </>
-              ) : (
-                <>
-                  <Zap className="w-6 h-6" />
-                  Launch Ushadow
-                </>
-              )}
-            </button>
+                <button
+                  onClick={handleQuickLaunch}
+                  disabled={isLaunching}
+                  className={`px-12 py-4 rounded-xl transition-all font-semibold text-lg flex items-center justify-center gap-3 ${
+                    isLaunching
+                      ? 'bg-surface-600 cursor-not-allowed'
+                      : 'bg-gradient-brand hover:opacity-90 hover:shadow-lg hover:shadow-primary-500/20 active:scale-95'
+                  }`}
+                  data-testid="quick-launch-button"
+                >
+                  {isLaunching ? (
+                    <>
+                      <Loader2 className="w-6 h-6 animate-spin" />
+                      Launching...
+                    </>
+                  ) : (
+                    <>
+                      <Zap className="w-6 h-6" />
+                      Launch Ushadow
+                    </>
+                  )}
+                </button>
+              </div>
+            )}
           </div>
         ) : appMode === 'infra' ? (
           /* Infra Page - Prerequisites & Infrastructure Setup */
@@ -1466,7 +1677,7 @@ function App() {
             <div className="text-center mb-4">
               <h2 className="text-2xl font-bold mb-2">Setup & Installation</h2>
               <p className="text-text-secondary">
-                Install prerequisites and configure your single environment
+                Install prerequisites and configure shared infrastructure
               </p>
             </div>
 
@@ -1493,70 +1704,23 @@ function App() {
                 onStop={handleStopInfra}
                 onRestart={handleRestartInfra}
                 isLoading={loadingInfra}
+                selectedServices={selectedInfraServices}
+                onToggleService={handleToggleInfraService}
               />
             </div>
 
-            {/* Single Environment Section for Consumers */}
-            <div className="bg-surface-800 rounded-lg p-6 border border-surface-700">
-              <h3 className="text-lg font-semibold mb-4">Your Environment</h3>
-              {!discovery || discovery.environments.length === 0 ? (
-                <div className="text-center py-8">
-                  <p className="text-text-muted mb-4">No environment created yet</p>
-                  <button
-                    onClick={() => handleNewEnvClone('main', 'dev')}
-                    className="px-6 py-2 rounded-lg bg-primary-500 hover:bg-primary-600 transition-colors font-medium"
-                  >
-                    Create Main Environment
-                  </button>
-                </div>
-              ) : (
-                <div className="space-y-3">
-                  {discovery.environments.map(env => (
-                    <div key={env.name} className="flex items-center justify-between p-4 bg-surface-700 rounded-lg">
-                      <div className="flex items-center gap-3">
-                        <div
-                          className="w-3 h-3 rounded-full"
-                          style={{ backgroundColor: getColors(env.color || env.name).primary }}
-                        />
-                        <span className="font-medium">{env.name}</span>
-                        <span className={`text-xs px-2 py-0.5 rounded ${
-                          env.running ? 'bg-success-500/20 text-success-400' : 'bg-surface-600 text-text-muted'
-                        }`}>
-                          {env.status}
-                        </span>
-                      </div>
-                      <div className="flex gap-2">
-                        {env.running ? (
-                          <>
-                            <button
-                              onClick={() => handleOpenInApp(env)}
-                              className="px-3 py-1 rounded bg-primary-500 hover:bg-primary-600 transition-colors text-sm"
-                            >
-                              Open
-                            </button>
-                            <button
-                              onClick={() => handleStopEnv(env.name)}
-                              className="px-3 py-1 rounded bg-surface-600 hover:bg-surface-500 transition-colors text-sm"
-                            >
-                              Stop
-                            </button>
-                          </>
-                        ) : (
-                          <button
-                            onClick={() => handleStartEnv(env.name, env.path || undefined)}
-                            className="px-3 py-1 rounded bg-success-500 hover:bg-success-600 transition-colors text-sm"
-                          >
-                            Start
-                          </button>
-                        )}
-                      </div>
-                    </div>
-                  ))}
-                </div>
-              )}
-            </div>
+            {/* Infrastructure Configuration */}
+            {effectiveProjectRoot && (
+              <InfraConfigPanel
+                projectRoot={effectiveProjectRoot}
+                selectedInfraServices={selectedInfraServices}
+                onSave={(config) => {
+                  // TODO: Save to backend
+                }}
+              />
+            )}
           </div>
-        ) : (
+        ) : appMode === 'environments' ? (
           /* Environments Page - Worktree Management */
           <div className="h-full flex flex-col overflow-hidden p-4">
             <EnvironmentsPanel
@@ -1572,9 +1736,30 @@ function App() {
               onDismissError={(name) => setCreatingEnvs(prev => prev.filter(e => e.name !== name))}
               loadingEnv={loadingEnv}
               tmuxStatuses={tmuxStatuses}
+              selectedEnvironment={selectedEnvironment}
+              onSelectEnvironment={(env) => {
+                console.log('[App] onSelectEnvironment called with:', env?.name)
+                setSelectedEnvironment(env)
+              }}
             />
           </div>
-        )}
+        ) : appMode === 'kanban' && kanbanEnabled ? (
+          /* Kanban Page - Ticket Management */
+          (() => {
+            // Use the first available backend (running or not)
+            const backendUrl = discovery?.environments.find(e => e.running)?.localhost_url
+                            || discovery?.environments[0]?.localhost_url
+                            || 'http://localhost:8000'
+
+            return (
+              <KanbanBoard
+                projectId={projectRoot}
+                backendUrl={backendUrl}
+                projectRoot={projectRoot || ''}
+              />
+            )
+          })()
+        ) : null}
       </main>
 
       {/* Log Panel - Bottom */}
@@ -1601,7 +1786,7 @@ function App() {
       {/* New Environment Dialog */}
       <NewEnvironmentDialog
         isOpen={showNewEnvDialog}
-        projectRoot={projectRoot}
+        projectRoot={effectiveProjectRoot}
         onClose={() => setShowNewEnvDialog(false)}
         onLink={handleNewEnvLink}
         onWorktree={handleNewEnvWorktree}
@@ -1619,6 +1804,16 @@ function App() {
         isOpen={showSettingsDialog}
         onClose={() => setShowSettingsDialog(false)}
       />
+
+      {/* Environment Conflict Dialog */}
+      <EnvironmentConflictDialog
+        conflict={environmentConflict}
+        newBranch={pendingEnvCreation?.branch || ''}
+        onStartExisting={handleConflictStartExisting}
+        onSwitchBranch={handleConflictSwitchBranch}
+        onDeleteAndRecreate={handleConflictDeleteAndRecreate}
+        onCancel={handleConflictCancel}
+      />
     </div>
   )
 }
diff --git a/ushadow/launcher/src/components/AuthButton.tsx b/ushadow/launcher/src/components/AuthButton.tsx
new file mode 100644
index 00000000..dc833cf1
--- /dev/null
+++ b/ushadow/launcher/src/components/AuthButton.tsx
@@ -0,0 +1,294 @@
+import { useState, useEffect } from 'react'
+import { LogIn, LogOut, User, Loader2 } from 'lucide-react'
+import { tauri, type UshadowEnvironment } from '../hooks/useTauri'
+import { TokenManager } from '../services/tokenManager'
+import { generateCodeVerifier, generateCodeChallenge, generateState } from '../utils/pkce'
+
+interface AuthButtonProps {
+  // Optional: Pass specific environment to auth against
+  // If not provided, will use first running environment
+  environment?: UshadowEnvironment | null
+  // Show as large button in center of page (for login prompt)
+  variant?: 'header' | 'centered'
+}
+
+export function AuthButton({ environment, variant = 'header' }: AuthButtonProps) {
+  const [isAuthenticated, setIsAuthenticated] = useState(false)
+  const [username, setUsername] = useState<string | null>(null)
+  const [isLoading, setIsLoading] = useState(true)
+
+  // Check auth status when environment changes
+  useEffect(() => {
+    if (!environment) {
+      setIsLoading(false)
+      return
+    }
+
+    checkAuthStatus()
+
+    // Periodically check for token expiration (every 30 seconds)
+    const intervalId = setInterval(() => {
+      checkAuthStatus()
+    }, 30000)
+
+    return () => clearInterval(intervalId)
+  }, [environment])
+
+  const checkAuthStatus = () => {
+    if (TokenManager.isAuthenticated()) {
+      const userInfo = TokenManager.getUserInfo()
+      setIsAuthenticated(true)
+      setUsername(userInfo?.preferred_username || userInfo?.email || 'User')
+    } else {
+      setIsAuthenticated(false)
+    }
+    setIsLoading(false)
+  }
+
+  const handleLogin = async () => {
+    if (!environment) {
+      alert('No environment selected. Please start an environment first.')
+      return
+    }
+
+    setIsLoading(true)
+
+    try {
+      console.log('[AuthButton] Starting OAuth flow with HTTP callback server...')
+
+      // Get backend URL from environment
+      const backendUrl = `http://localhost:${environment.backend_port}`
+      console.log('[AuthButton] Backend URL:', backendUrl)
+
+      // Declare variables at function scope
+      let keycloakUrl: string
+      let port: number
+      let callbackUrl: string
+
+      // Fetch Keycloak config from backend (using Tauri HTTP client to bypass CORS)
+      console.log('[AuthButton] Fetching Keycloak config from backend...')
+      const configResponse = await tauri.httpRequest(`${backendUrl}/api/settings/config`, 'GET')
+      console.log('[AuthButton] Config response status:', configResponse.status)
+      if (configResponse.status !== 200) {
+        throw new Error(`Failed to fetch config from backend: ${configResponse.status} - ${configResponse.body}`)
+      }
+      const config = JSON.parse(configResponse.body)
+      keycloakUrl = config.keycloak?.public_url || 'http://localhost:8081'
+      console.log('[AuthButton] Using Keycloak URL:', keycloakUrl)
+
+      // Start OAuth callback server
+      console.log('[AuthButton] Starting OAuth callback server...')
+      ;[port, callbackUrl] = await tauri.startOAuthServer()
+      console.log('[AuthButton] ✓ Callback server running on port:', port)
+      console.log('[AuthButton] Callback URL:', callbackUrl)
+
+      // Register callback URL with Keycloak (using Tauri HTTP client to bypass CORS)
+      console.log('[AuthButton] Registering callback URL with Keycloak...')
+      const registerResponse = await tauri.httpRequest(
+        `${backendUrl}/api/auth/register-redirect-uri`,
+        'POST',
+        { 'Content-Type': 'application/json' },
+        JSON.stringify({ redirect_uri: callbackUrl })
+      )
+
+      console.log('[AuthButton] Register response status:', registerResponse.status)
+      if (registerResponse.status !== 200) {
+        throw new Error(`Failed to register callback URL: ${registerResponse.status} - ${registerResponse.body}`)
+      }
+      console.log('[AuthButton] ✓ Callback URL registered')
+
+      // Generate PKCE parameters
+      const codeVerifier = generateCodeVerifier()
+      const codeChallenge = await generateCodeChallenge(codeVerifier)
+      const state = generateState()
+
+      // Store for callback validation
+      localStorage.setItem('pkce_code_verifier', codeVerifier)
+      localStorage.setItem('oauth_state', state)
+      localStorage.setItem('oauth_backend_url', backendUrl)
+
+      // Build Keycloak login URL
+      const authUrl = new URL(`${keycloakUrl}/realms/ushadow/protocol/openid-connect/auth`)
+      authUrl.searchParams.set('client_id', 'ushadow-frontend')
+      authUrl.searchParams.set('redirect_uri', callbackUrl)
+      authUrl.searchParams.set('response_type', 'code')
+      authUrl.searchParams.set('scope', 'openid profile email')
+      authUrl.searchParams.set('state', state)
+      authUrl.searchParams.set('code_challenge', codeChallenge)
+      authUrl.searchParams.set('code_challenge_method', 'S256')
+
+      // Open system browser
+      console.log('[AuthButton] Opening system browser...')
+      await tauri.openBrowser(authUrl.toString())
+      console.log('[AuthButton] ✓ Browser opened, waiting for callback...')
+
+      // Wait for OAuth callback (this will block until callback or timeout)
+      const result = await tauri.waitForOAuthCallback(port)
+
+      if (!result.success || !result.code || !result.state) {
+        throw new Error(result.error || 'Login failed or cancelled')
+      }
+
+      console.log('[AuthButton] ✓ Callback received')
+
+      // Validate state (CSRF protection)
+      const savedState = localStorage.getItem('oauth_state')
+      if (result.state !== savedState) {
+        throw new Error('Invalid state parameter - possible CSRF attack')
+      }
+
+      // Exchange code for tokens
+      const savedCodeVerifier = localStorage.getItem('pkce_code_verifier')
+      if (!savedCodeVerifier) {
+        throw new Error('Missing PKCE code verifier')
+      }
+
+      console.log('[AuthButton] Exchanging code for tokens...')
+      const tokenResponse = await tauri.httpRequest(
+        `${backendUrl}/api/auth/token`,
+        'POST',
+        { 'Content-Type': 'application/json' },
+        JSON.stringify({
+          code: result.code,
+          code_verifier: savedCodeVerifier,
+          redirect_uri: callbackUrl,
+        })
+      )
+
+      if (tokenResponse.status !== 200) {
+        throw new Error(`Token exchange failed: ${tokenResponse.body}`)
+      }
+
+      const tokens = JSON.parse(tokenResponse.body)
+
+      // Store tokens
+      TokenManager.storeTokens(tokens)
+      console.log('[AuthButton] ✓ Login successful')
+
+      // Clean up
+      localStorage.removeItem('oauth_state')
+      localStorage.removeItem('pkce_code_verifier')
+      localStorage.removeItem('oauth_backend_url')
+
+      // Notify embedded environments that tokens are now available
+      const iframe = document.getElementById('embedded-iframe') as HTMLIFrameElement
+      if (iframe && iframe.contentWindow) {
+        console.log('[AuthButton] Notifying embedded environment to refresh authentication')
+        iframe.contentWindow.postMessage(
+          { type: 'KC_TOKENS_UPDATED' },
+          '*' // Send to iframe regardless of origin
+        )
+      }
+
+      // Update UI
+      checkAuthStatus()
+    } catch (error) {
+      console.error('[AuthButton] Login error:', error)
+      alert(`Login failed: ${error}`)
+      setIsLoading(false)
+    }
+  }
+
+  const handleLogout = async () => {
+    TokenManager.clearTokens()
+    setIsAuthenticated(false)
+    setUsername(null)
+
+    // Optionally open Keycloak logout page
+    if (environment) {
+      try {
+        const backendUrl = `http://localhost:${environment.backend_port}`
+        const configResponse = await tauri.httpRequest(`${backendUrl}/api/settings/config`, 'GET')
+        if (configResponse.status === 200) {
+          const config = JSON.parse(configResponse.body)
+          const keycloakUrl = config.keycloak?.public_url || 'http://localhost:8081'
+          const logoutUrl = `${keycloakUrl}/realms/ushadow/protocol/openid-connect/logout`
+          await tauri.openBrowser(logoutUrl)
+        }
+      } catch (error) {
+        console.error('[AuthButton] Logout error:', error)
+      }
+    }
+  }
+
+  // Don't show button if no environment
+  if (!environment) {
+    return null
+  }
+
+  if (isLoading) {
+    return (
+      <div className="flex items-center gap-2 px-3 py-1.5 rounded-lg bg-surface-800">
+        <Loader2 className="w-4 h-4 animate-spin text-text-muted" />
+      </div>
+    )
+  }
+
+  if (isAuthenticated) {
+    if (variant === 'centered') {
+      return null // Don't show anything when authenticated in centered mode
+    }
+
+    return (
+      <div className="flex items-center gap-2">
+        <div className="flex items-center gap-2 px-3 py-1.5 rounded-lg bg-surface-800">
+          <User className="w-4 h-4 text-primary-400" />
+          <span className="text-sm text-text-primary">{username}</span>
+        </div>
+        <button
+          onClick={handleLogout}
+          className="p-1.5 rounded-lg hover:bg-surface-700 transition-colors text-text-muted hover:text-text-primary"
+          title="Logout"
+          data-testid="logout-button"
+        >
+          <LogOut className="w-4 h-4" />
+        </button>
+      </div>
+    )
+  }
+
+  // Centered variant - large button in middle of page
+  if (variant === 'centered') {
+    return (
+      <div className="flex flex-col items-center justify-center flex-1 p-8">
+        <div className="text-center mb-8 max-w-md">
+          <h2 className="text-2xl font-bold mb-4 text-text-primary">Authentication Required</h2>
+          <p className="text-text-secondary mb-2">
+            You need to log in to access Ushadow environments.
+          </p>
+          <p className="text-sm text-text-muted">
+            Click below to open the login page in your browser.
+          </p>
+        </div>
+
+        <button
+          onClick={handleLogin}
+          className="flex items-center gap-3 px-8 py-4 rounded-xl bg-primary-500 hover:bg-primary-600 transition-all text-white font-semibold text-lg hover:shadow-lg hover:shadow-primary-500/20 active:scale-95"
+          data-testid="login-button-centered"
+        >
+          <LogIn className="w-6 h-6" />
+          Login with Keycloak
+        </button>
+
+        {environment && (
+          <p className="text-xs text-text-muted mt-6">
+            Environment: <span className="text-text-secondary">{environment.name}</span> •
+            Port: <span className="text-text-secondary">{environment.webui_port}</span>
+          </p>
+        )}
+      </div>
+    )
+  }
+
+  // Header variant - compact button
+  return (
+    <button
+      onClick={handleLogin}
+      className="flex items-center gap-2 px-4 py-2 rounded-lg bg-primary-500 hover:bg-primary-600 transition-colors text-white font-medium text-sm"
+      data-testid="login-button"
+    >
+      <LogIn className="w-4 h-4" />
+      Login
+    </button>
+  )
+}
diff --git a/ushadow/launcher/src/components/CreateEpicDialog.tsx b/ushadow/launcher/src/components/CreateEpicDialog.tsx
new file mode 100644
index 00000000..d43c7a89
--- /dev/null
+++ b/ushadow/launcher/src/components/CreateEpicDialog.tsx
@@ -0,0 +1,180 @@
+import { useState } from 'react'
+
+interface CreateEpicDialogProps {
+  isOpen: boolean
+  onClose: () => void
+  onCreated: () => void
+  projectId?: string
+  backendUrl: string
+}
+
+const PRESET_COLORS = [
+  '#3B82F6', // blue
+  '#8B5CF6', // purple
+  '#EC4899', // pink
+  '#F59E0B', // amber
+  '#10B981', // green
+  '#06B6D4', // cyan
+  '#F97316', // orange
+  '#EF4444', // red
+]
+
+export function CreateEpicDialog({
+  isOpen,
+  onClose,
+  onCreated,
+  projectId,
+  backendUrl,
+}: CreateEpicDialogProps) {
+  const [title, setTitle] = useState('')
+  const [description, setDescription] = useState('')
+  const [color, setColor] = useState(PRESET_COLORS[0])
+  const [baseBranch, setBaseBranch] = useState('main')
+  const [creating, setCreating] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  if (!isOpen) return null
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setError(null)
+    setCreating(true)
+
+    try {
+      const { tauri } = await import('../hooks/useTauri')
+
+      await tauri.createEpic(
+        title,
+        description || null,
+        color,
+        baseBranch,
+        null, // branch_name (not set during creation)
+        projectId || null
+      )
+
+      onCreated()
+      // Reset form
+      setTitle('')
+      setDescription('')
+      setColor(PRESET_COLORS[0])
+      setBaseBranch('main')
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to create epic')
+    } finally {
+      setCreating(false)
+    }
+  }
+
+  return (
+    <div
+      className="fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50"
+      onClick={onClose}
+      data-testid="create-epic-dialog"
+    >
+      <div
+        className="bg-gray-800 rounded-lg p-6 w-full max-w-md"
+        onClick={(e) => e.stopPropagation()}
+      >
+        <h2 className="text-xl font-semibold text-white mb-4">Create New Epic</h2>
+
+        <form onSubmit={handleSubmit} className="space-y-4">
+          {/* Title */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-1">
+              Title *
+            </label>
+            <input
+              type="text"
+              value={title}
+              onChange={(e) => setTitle(e.target.value)}
+              className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white"
+              placeholder="Epic title"
+              required
+              data-testid="create-epic-title"
+            />
+          </div>
+
+          {/* Description */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-1">
+              Description
+            </label>
+            <textarea
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+              className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white h-24"
+              placeholder="Epic description"
+              data-testid="create-epic-description"
+            />
+          </div>
+
+          {/* Color */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-2">
+              Team Color
+            </label>
+            <div className="flex gap-2 flex-wrap">
+              {PRESET_COLORS.map((presetColor) => (
+                <button
+                  key={presetColor}
+                  type="button"
+                  onClick={() => setColor(presetColor)}
+                  className={`w-10 h-10 rounded border-2 ${
+                    color === presetColor ? 'border-white' : 'border-gray-700'
+                  }`}
+                  style={{ backgroundColor: presetColor }}
+                  data-testid={`create-epic-color-${presetColor}`}
+                />
+              ))}
+            </div>
+          </div>
+
+          {/* Base Branch */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-1">
+              Base Branch
+            </label>
+            <input
+              type="text"
+              value={baseBranch}
+              onChange={(e) => setBaseBranch(e.target.value)}
+              className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white"
+              placeholder="main"
+              data-testid="create-epic-base-branch"
+            />
+            <p className="text-xs text-gray-500 mt-1">
+              New branches for tickets in this epic will be created from this branch
+            </p>
+          </div>
+
+          {/* Error */}
+          {error && (
+            <div className="text-sm text-red-400" data-testid="create-epic-error">
+              {error}
+            </div>
+          )}
+
+          {/* Actions */}
+          <div className="flex items-center gap-3 pt-4">
+            <button
+              type="button"
+              onClick={onClose}
+              className="flex-1 px-4 py-2 bg-gray-700 hover:bg-gray-600 text-white rounded"
+              data-testid="create-epic-cancel"
+            >
+              Cancel
+            </button>
+            <button
+              type="submit"
+              disabled={creating || !title.trim()}
+              className="flex-1 px-4 py-2 bg-purple-600 hover:bg-purple-700 disabled:bg-gray-700 disabled:cursor-not-allowed text-white rounded"
+              data-testid="create-epic-submit"
+            >
+              {creating ? 'Creating...' : 'Create Epic'}
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/components/CreateTicketDialog.tsx b/ushadow/launcher/src/components/CreateTicketDialog.tsx
new file mode 100644
index 00000000..7898fbcd
--- /dev/null
+++ b/ushadow/launcher/src/components/CreateTicketDialog.tsx
@@ -0,0 +1,284 @@
+import { useState, useEffect } from 'react'
+import type { Epic, TicketPriority, UshadowEnvironment } from '../hooks/useTauri'
+
+interface CreateTicketDialogProps {
+  isOpen: boolean
+  onClose: () => void
+  onCreated: () => void
+  epics: Epic[]
+  projectId?: string
+  projectRoot: string
+  backendUrl: string
+  initialEnvironment?: string // For "Create from Environment" flow
+}
+
+export function CreateTicketDialog({
+  isOpen,
+  onClose,
+  onCreated,
+  epics,
+  projectId,
+  projectRoot,
+  backendUrl,
+  initialEnvironment,
+}: CreateTicketDialogProps) {
+  const [title, setTitle] = useState('')
+  const [description, setDescription] = useState('')
+  const [priority, setPriority] = useState<TicketPriority>('medium')
+  const [epicId, setEpicId] = useState<string>('')
+  const [tags, setTags] = useState<string>('')
+  const [environment, setEnvironment] = useState<string>(initialEnvironment || '')
+  const [environments, setEnvironments] = useState<UshadowEnvironment[]>([])
+  const [creating, setCreating] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  // Load environments when dialog opens
+  useEffect(() => {
+    if (isOpen) {
+      loadEnvironments()
+    }
+  }, [isOpen])
+
+  const loadEnvironments = async () => {
+    try {
+      const { tauri } = await import('../hooks/useTauri')
+      const discovery = await tauri.discoverEnvironments()
+      setEnvironments(discovery.environments.filter(env => env.is_worktree && env.path && env.branch))
+    } catch (err) {
+      console.error('Failed to load environments:', err)
+    }
+  }
+
+  if (!isOpen) return null
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setError(null)
+    setCreating(true)
+
+    try {
+      const { tauri } = await import('../hooks/useTauri')
+
+      const tagsList = tags ? tags.split(',').map(t => t.trim()).filter(Boolean) : []
+
+      console.log('[CreateTicket] Creating ticket with Tauri command')
+      console.log('[CreateTicket] Data:', { title, description, priority, epicId, tags: tagsList, projectId, environment })
+
+      // Create the ticket first
+      const ticket = await tauri.createTicket(
+        title,
+        description || null,
+        priority,
+        epicId || null,
+        tagsList,
+        environment || null,
+        projectId || null
+      )
+
+      // If environment is selected, attach to worktree
+      if (environment) {
+        const env = environments.find(e => e.name === environment)
+        if (env && env.path && env.branch) {
+          console.log('[CreateTicket] Attaching to environment:', environment)
+          const result = await tauri.attachTicketToWorktree(ticket.id, env.path, env.branch)
+
+          // Update ticket with worktree info
+          await tauri.updateTicket(
+            ticket.id,
+            undefined, // title
+            undefined, // description
+            'in_progress', // status
+            undefined, // priority
+            undefined, // epicId
+            undefined, // tags
+            undefined, // order
+            result.worktree_path,
+            result.branch_name,
+            result.tmux_window_name,
+            result.tmux_session_name,
+            environment
+          )
+
+          // Start coding agent in the tmux window
+          console.log('[CreateTicket] Starting coding agent for ticket:', ticket.id)
+          try {
+            await tauri.startCodingAgentForTicket(
+              ticket.id,
+              result.tmux_window_name,
+              result.tmux_session_name,
+              result.worktree_path
+            )
+            console.log('[CreateTicket] ✓ Coding agent started')
+          } catch (err) {
+            console.error('[CreateTicket] Failed to start coding agent:', err)
+            // Don't fail the whole operation if agent fails to start
+          }
+        }
+      }
+
+      onCreated()
+      // Reset form
+      setTitle('')
+      setDescription('')
+      setPriority('medium')
+      setEpicId('')
+      setTags('')
+      setEnvironment('')
+    } catch (err) {
+      console.error('[CreateTicket] Exception:', err)
+      setError(err instanceof Error ? err.message : 'Failed to create ticket')
+    } finally {
+      setCreating(false)
+    }
+  }
+
+  return (
+    <div
+      className="fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50"
+      onClick={onClose}
+      data-testid="create-ticket-dialog"
+    >
+      <div
+        className="bg-gray-800 rounded-lg p-6 w-full max-w-md"
+        onClick={(e) => e.stopPropagation()}
+      >
+        <h2 className="text-xl font-semibold text-white mb-4">Create New Ticket</h2>
+
+        <form onSubmit={handleSubmit} className="space-y-4">
+          {/* Title */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-1">
+              Title *
+            </label>
+            <input
+              type="text"
+              value={title}
+              onChange={(e) => setTitle(e.target.value)}
+              className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white"
+              placeholder="Ticket title"
+              required
+              data-testid="create-ticket-title"
+            />
+          </div>
+
+          {/* Description */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-1">
+              Description
+            </label>
+            <textarea
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+              className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white h-24"
+              placeholder="Ticket description"
+              data-testid="create-ticket-description"
+            />
+          </div>
+
+          {/* Priority */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-1">
+              Priority
+            </label>
+            <select
+              value={priority}
+              onChange={(e) => setPriority(e.target.value as TicketPriority)}
+              className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white"
+              data-testid="create-ticket-priority"
+            >
+              <option value="low">Low</option>
+              <option value="medium">Medium</option>
+              <option value="high">High</option>
+              <option value="urgent">Urgent</option>
+            </select>
+          </div>
+
+          {/* Epic */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-1">
+              Epic (optional)
+            </label>
+            <select
+              value={epicId}
+              onChange={(e) => setEpicId(e.target.value)}
+              className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white"
+              data-testid="create-ticket-epic"
+            >
+              <option value="">No Epic</option>
+              {epics.map((epic) => (
+                <option key={epic.id} value={epic.id}>
+                  {epic.title}
+                </option>
+              ))}
+            </select>
+          </div>
+
+          {/* Environment */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-1">
+              Environment (optional)
+            </label>
+            <select
+              value={environment}
+              onChange={(e) => setEnvironment(e.target.value)}
+              className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white"
+              data-testid="create-ticket-environment"
+            >
+              <option value="">No Environment</option>
+              {environments.map((env) => (
+                <option key={env.name} value={env.name}>
+                  {env.name}
+                </option>
+              ))}
+            </select>
+            <p className="text-xs text-gray-500 mt-1">
+              Assign this ticket to an environment immediately (will set status to In Progress)
+            </p>
+          </div>
+
+          {/* Tags */}
+          <div>
+            <label className="block text-sm font-medium text-gray-300 mb-1">
+              Tags (comma-separated)
+            </label>
+            <input
+              type="text"
+              value={tags}
+              onChange={(e) => setTags(e.target.value)}
+              className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white"
+              placeholder="feature, bug, documentation"
+              data-testid="create-ticket-tags"
+            />
+          </div>
+
+          {/* Error */}
+          {error && (
+            <div className="text-sm text-red-400" data-testid="create-ticket-error">
+              {error}
+            </div>
+          )}
+
+          {/* Actions */}
+          <div className="flex items-center gap-3 pt-4">
+            <button
+              type="button"
+              onClick={onClose}
+              className="flex-1 px-4 py-2 bg-gray-700 hover:bg-gray-600 text-white rounded"
+              data-testid="create-ticket-cancel"
+            >
+              Cancel
+            </button>
+            <button
+              type="submit"
+              disabled={creating || !title.trim()}
+              className="flex-1 px-4 py-2 bg-blue-600 hover:bg-blue-700 disabled:bg-gray-700 disabled:cursor-not-allowed text-white rounded"
+              data-testid="create-ticket-submit"
+            >
+              {creating ? 'Creating...' : 'Create Ticket'}
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/components/EmbeddedView.tsx b/ushadow/launcher/src/components/EmbeddedView.tsx
index 8bc9e15e..9b9397f6 100644
--- a/ushadow/launcher/src/components/EmbeddedView.tsx
+++ b/ushadow/launcher/src/components/EmbeddedView.tsx
@@ -1,4 +1,5 @@
-import { X, ExternalLink, RefreshCw, ArrowLeft, Terminal } from 'lucide-react'
+import { useState, useEffect } from 'react'
+import { X, ExternalLink, RefreshCw, ArrowLeft, Terminal, AlertCircle, Loader2 } from 'lucide-react'
 import { tauri } from '../hooks/useTauri'
 
 interface EmbeddedViewProps {
@@ -10,14 +11,37 @@ interface EmbeddedViewProps {
 }
 
 export function EmbeddedView({ url, envName, envColor, envPath, onClose }: EmbeddedViewProps) {
+  const [iframeError, setIframeError] = useState(false)
+  const [iframeLoading, setIframeLoading] = useState(true)
+
   // Add launcher query param so frontend knows to hide footer
+  // Add timestamp to force reload and avoid cookie conflicts
   const displayUrl = url
+  const timestamp = Date.now()
   const iframeUrl = url
     ? url.includes('?')
-      ? `${url}&launcher=true`
-      : `${url}?launcher=true`
+      ? `${url}&launcher=true&_t=${timestamp}`
+      : `${url}?launcher=true&_t=${timestamp}`
     : ''
 
+  // Reset error state when environment changes
+  useEffect(() => {
+    setIframeError(false)
+    setIframeLoading(true)
+  }, [envName, iframeUrl])
+
+  const handleIframeLoad = () => {
+    console.log(`[EmbeddedView] Iframe loaded successfully for ${envName}`)
+    setIframeLoading(false)
+    setIframeError(false)
+  }
+
+  const handleIframeError = () => {
+    console.error(`[EmbeddedView] Iframe failed to load for ${envName}`)
+    setIframeLoading(false)
+    setIframeError(true)
+  }
+
   const handleOpenExternal = () => {
     tauri.openBrowser(displayUrl)
   }
@@ -122,13 +146,37 @@ export function EmbeddedView({ url, envName, envColor, envPath, onClose }: Embed
 
       {/* iframe container */}
       <div className="flex-1 relative">
+        {iframeLoading && !iframeError && (
+          <div className="absolute inset-0 flex flex-col items-center justify-center bg-surface-900 z-10">
+            <Loader2 className="w-16 h-16 text-primary-400 animate-spin mb-4" />
+            <p className="text-lg font-semibold text-text-primary mb-2">Loading {envName}...</p>
+            <p className="text-sm text-text-muted font-mono">{displayUrl}</p>
+          </div>
+        )}
+        {iframeError && (
+          <div className="absolute inset-0 flex flex-col items-center justify-center bg-surface-900 z-10">
+            <AlertCircle className="w-16 h-16 text-error-400 mb-4" />
+            <p className="text-lg font-semibold text-text-primary mb-2">Failed to load {envName}</p>
+            <p className="text-sm text-text-muted mb-4 font-mono">{displayUrl}</p>
+            <button
+              onClick={() => window.location.reload()}
+              className="px-4 py-2 rounded-lg bg-primary-500 hover:bg-primary-600 transition-colors flex items-center gap-2"
+            >
+              <RefreshCw className="w-4 h-4" />
+              Reload Page
+            </button>
+          </div>
+        )}
         <iframe
+          key={envName}
           id="embedded-iframe"
           src={iframeUrl}
           className="absolute inset-0 w-full h-full border-0"
           title={`${envName} environment`}
           data-testid="embedded-iframe"
           allow="microphone; camera; autoplay; clipboard-write"
+          onLoad={handleIframeLoad}
+          onError={handleIframeError}
         />
       </div>
     </div>
diff --git a/ushadow/launcher/src/components/EnvironmentBadge.tsx b/ushadow/launcher/src/components/EnvironmentBadge.tsx
new file mode 100644
index 00000000..438f4be1
--- /dev/null
+++ b/ushadow/launcher/src/components/EnvironmentBadge.tsx
@@ -0,0 +1,66 @@
+import { Terminal } from 'lucide-react'
+import { getColors } from '../utils/colors'
+
+interface EnvironmentBadgeProps {
+  name: string
+  variant?: 'badge' | 'label' | 'text'
+  showIcon?: boolean
+  className?: string
+  testId?: string
+}
+
+/**
+ * Reusable component for displaying environment names with consistent color styling.
+ * Uses the getColors() utility to map environment names to their theme colors.
+ */
+export function EnvironmentBadge({
+  name,
+  variant = 'badge',
+  showIcon = true,
+  className = '',
+  testId,
+}: EnvironmentBadgeProps) {
+  const colors = getColors(name)
+
+  // Badge variant: Small inline badge with background
+  if (variant === 'badge') {
+    return (
+      <div
+        className={`flex items-center gap-1.5 text-xs px-2 py-1 rounded font-medium ${className}`}
+        style={{
+          backgroundColor: `${colors.primary}20`,
+          color: colors.primary,
+        }}
+        data-testid={testId}
+      >
+        {showIcon && <Terminal className="w-3 h-3" />}
+        <span>{name}</span>
+      </div>
+    )
+  }
+
+  // Label variant: Larger text with icon, no background
+  if (variant === 'label') {
+    return (
+      <div
+        className={`flex items-center gap-2 text-lg font-semibold ${className}`}
+        style={{ color: colors.primary }}
+        data-testid={testId}
+      >
+        {showIcon && <Terminal className="w-5 h-5" />}
+        <span>{name}</span>
+      </div>
+    )
+  }
+
+  // Text variant: Plain text with color, no background or icon
+  return (
+    <span
+      className={`font-medium ${className}`}
+      style={{ color: colors.primary }}
+      data-testid={testId}
+    >
+      {name}
+    </span>
+  )
+}
diff --git a/ushadow/launcher/src/components/EnvironmentConflictDialog.tsx b/ushadow/launcher/src/components/EnvironmentConflictDialog.tsx
new file mode 100644
index 00000000..ea26fd41
--- /dev/null
+++ b/ushadow/launcher/src/components/EnvironmentConflictDialog.tsx
@@ -0,0 +1,144 @@
+import { AlertCircle, GitBranch, Play, X } from 'lucide-react'
+import type { EnvironmentConflict } from '../hooks/useTauri'
+
+interface EnvironmentConflictDialogProps {
+  conflict: EnvironmentConflict | null
+  newBranch: string
+  onStartExisting: () => void
+  onSwitchBranch: () => void
+  onDeleteAndRecreate: () => void
+  onCancel: () => void
+}
+
+export function EnvironmentConflictDialog({
+  conflict,
+  newBranch,
+  onStartExisting,
+  onSwitchBranch,
+  onDeleteAndRecreate,
+  onCancel,
+}: EnvironmentConflictDialogProps) {
+  if (!conflict) return null
+
+  return (
+    <div
+      className="fixed inset-0 bg-black/50 flex items-center justify-center z-50"
+      data-testid="env-conflict-dialog"
+    >
+      <div className="bg-surface-800 rounded-xl p-6 w-full max-w-md mx-4 shadow-xl">
+        {/* Header */}
+        <div className="flex items-center justify-between mb-4">
+          <h2 className="text-lg font-semibold flex items-center gap-2">
+            <AlertCircle className="w-5 h-5 text-yellow-400" />
+            Environment Already Exists
+          </h2>
+          <button
+            onClick={onCancel}
+            className="p-1 rounded hover:bg-surface-700 transition-colors"
+            data-testid="close-conflict-dialog"
+          >
+            <X className="w-5 h-5" />
+          </button>
+        </div>
+
+        {/* Conflict Info */}
+        <div className="mb-6 p-4 bg-surface-700/50 rounded-lg">
+          <div className="flex items-center gap-2 mb-2">
+            <GitBranch className="w-4 h-4 text-text-muted" />
+            <span className="text-sm text-text-muted">Current branch:</span>
+          </div>
+          <div className="text-base font-medium text-text-primary mb-1">
+            {conflict.current_branch}
+          </div>
+          <div className="text-xs text-text-muted">
+            Path: {conflict.path}
+          </div>
+          {conflict.is_running && (
+            <div className="mt-2 px-2 py-1 bg-success-500/20 text-success-400 text-xs rounded inline-block">
+              Currently running
+            </div>
+          )}
+        </div>
+
+        {/* New Branch Info */}
+        <div className="mb-6 p-3 bg-blue-500/10 border border-blue-500/30 rounded-lg">
+          <div className="text-xs text-blue-300 mb-1">You want to create:</div>
+          <div className="text-sm font-medium text-blue-200">{newBranch}</div>
+        </div>
+
+        {/* Options */}
+        <div className="space-y-3 mb-4">
+          <button
+            onClick={onStartExisting}
+            className="w-full p-3 rounded-lg bg-surface-700 hover:bg-surface-600 transition-colors text-left"
+            data-testid="conflict-start-existing"
+          >
+            <div className="flex items-start gap-3">
+              <div className="flex-shrink-0 w-6 h-6 rounded-full bg-primary-500/20 flex items-center justify-center mt-0.5">
+                <Play className="w-3.5 h-3.5 text-primary-400" />
+              </div>
+              <div>
+                <div className="font-medium text-sm mb-1">Start existing environment</div>
+                <div className="text-xs text-text-muted">
+                  Keep current branch ({conflict.current_branch}) and start containers
+                </div>
+              </div>
+            </div>
+          </button>
+
+          <button
+            onClick={onSwitchBranch}
+            className="w-full p-3 rounded-lg bg-surface-700 hover:bg-surface-600 transition-colors text-left"
+            data-testid="conflict-switch-branch"
+          >
+            <div className="flex items-start gap-3">
+              <div className="flex-shrink-0 w-6 h-6 rounded-full bg-blue-500/20 flex items-center justify-center mt-0.5">
+                <GitBranch className="w-3.5 h-3.5 text-blue-400" />
+              </div>
+              <div>
+                <div className="font-medium text-sm mb-1">Switch to new branch</div>
+                <div className="text-xs text-text-muted">
+                  Checkout {newBranch} in existing environment
+                </div>
+                {conflict.is_running && (
+                  <div className="text-xs text-yellow-400 mt-1">
+                    ⚠ Will stop containers first
+                  </div>
+                )}
+              </div>
+            </div>
+          </button>
+
+          <button
+            onClick={onDeleteAndRecreate}
+            className="w-full p-3 rounded-lg bg-error-500/20 hover:bg-error-500/30 transition-colors text-left border border-error-500/30"
+            data-testid="conflict-delete-recreate"
+          >
+            <div className="flex items-start gap-3">
+              <div className="flex-shrink-0 w-6 h-6 rounded-full bg-error-500/30 flex items-center justify-center mt-0.5">
+                <X className="w-3.5 h-3.5 text-error-400" />
+              </div>
+              <div>
+                <div className="font-medium text-sm mb-1 text-error-300">Delete and recreate</div>
+                <div className="text-xs text-text-muted">
+                  Remove old environment and create new one with {newBranch}
+                </div>
+                <div className="text-xs text-error-400 mt-1">
+                  ⚠ This will delete all uncommitted changes!
+                </div>
+              </div>
+            </div>
+          </button>
+        </div>
+
+        {/* Cancel */}
+        <button
+          onClick={onCancel}
+          className="w-full py-2 rounded-lg bg-surface-700 hover:bg-surface-600 transition-colors text-sm"
+        >
+          Cancel
+        </button>
+      </div>
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/components/EnvironmentsPanel.tsx b/ushadow/launcher/src/components/EnvironmentsPanel.tsx
index 9ed5ce5f..d767d874 100644
--- a/ushadow/launcher/src/components/EnvironmentsPanel.tsx
+++ b/ushadow/launcher/src/components/EnvironmentsPanel.tsx
@@ -1,9 +1,10 @@
-import { useState, useEffect } from 'react'
-import { Plus, Play, Square, Settings, Loader2, AppWindow, Box, X, AlertCircle, GitMerge, Terminal, FolderOpen, ArrowLeft, ArrowRight } from 'lucide-react'
+import { useState, useEffect, useMemo } from 'react'
+import { Plus, Play, Square, Settings, Loader2, AppWindow, Box, X, AlertCircle, GitMerge, Terminal, FolderOpen, ArrowLeft, ArrowRight, RefreshCw, Trello } from 'lucide-react'
 import type { UshadowEnvironment, TmuxStatus } from '../hooks/useTauri'
 import { tauri } from '../hooks/useTauri'
 import { getColors } from '../utils/colors'
 import { TmuxManagerDialog } from './TmuxManagerDialog'
+import { CreateTicketDialog } from './CreateTicketDialog'
 
 interface CreatingEnv {
   name: string
@@ -23,8 +24,10 @@ interface EnvironmentsPanelProps {
   onDelete?: (envName: string) => void
   onDismissError?: (name: string) => void
   onAttachTmux?: (env: UshadowEnvironment) => void
-  loadingEnv: string | null
+  loadingEnv: { name: string; action: 'starting' | 'stopping' | 'deleting' | 'merging' } | null
   tmuxStatuses?: { [envName: string]: TmuxStatus }
+  selectedEnvironment?: UshadowEnvironment | null
+  onSelectEnvironment?: (env: UshadowEnvironment | null) => void
 }
 
 export function EnvironmentsPanel({
@@ -40,13 +43,19 @@ export function EnvironmentsPanel({
   onAttachTmux,
   loadingEnv,
   tmuxStatuses = {},
+  selectedEnvironment,
+  onSelectEnvironment,
 }: EnvironmentsPanelProps) {
   const [activeTab, setActiveTab] = useState<'running' | 'detected'>('running')
   const [showTmuxManager, setShowTmuxManager] = useState(false)
-  const [selectedEnv, setSelectedEnv] = useState<UshadowEnvironment | null>(null)
+  // Use parent's selected environment, fallback to local state for backward compat
+  const selectedEnv = selectedEnvironment
+  const setSelectedEnv = onSelectEnvironment || (() => {})
   const [showBrowserView, setShowBrowserView] = useState(false)
   const [leftColumnWidth, setLeftColumnWidth] = useState(320)
   const [isResizing, setIsResizing] = useState(false)
+  const [showCreateTicket, setShowCreateTicket] = useState(false)
+  const [ticketEnvironment, setTicketEnvironment] = useState<string | null>(null)
 
   // Sort environments: worktrees first, then reverse to show newest first
   const sortedEnvironments = [...environments].sort((a, b) => {
@@ -65,8 +74,8 @@ export function EnvironmentsPanel({
     const isCreating = creatingEnvs.some(ce => ce.name === env.name)
     if (isCreating) return true
 
-    // Check if environment is being loaded (loadingEnv)
-    if (loadingEnv === env.name) return true
+    // Check if environment is being started (not deleted/stopped)
+    if (loadingEnv?.name === env.name && loadingEnv.action === 'starting') return true
 
     return false
   }
@@ -114,7 +123,18 @@ export function EnvironmentsPanel({
 
   // Handle environment selection
   const handleEnvSelect = (env: UshadowEnvironment) => {
+    console.log('[EnvironmentsPanel] Selecting environment:', env.name, {
+      hasCallback: !!onSelectEnvironment,
+      callbackType: typeof onSelectEnvironment
+    })
     setSelectedEnv(env)
+    console.log('[EnvironmentsPanel] Called setSelectedEnv')
+  }
+
+  // Handle creating ticket from environment
+  const handleCreateTicket = (envName: string) => {
+    setTicketEnvironment(envName)
+    setShowCreateTicket(true)
   }
 
   // Handle opening in browser view
@@ -207,7 +227,8 @@ export function EnvironmentsPanel({
                     onStart={() => onStart(env.name)}
                     onStop={() => onStop(env.name)}
                     onOpenInApp={() => onOpenInApp(env)}
-                    isLoading={loadingEnv === env.name}
+                    onCreateTicket={() => handleCreateTicket(env.name)}
+                    isLoading={loadingEnv?.name === env.name}
                     isSelected={selectedEnv?.name === env.name}
                     onSelect={() => handleEnvSelect(env)}
                   />
@@ -224,7 +245,8 @@ export function EnvironmentsPanel({
                     onStart={() => onStart(env.name)}
                     onStop={() => onStop(env.name)}
                     onOpenInApp={() => onOpenInApp(env)}
-                    isLoading={loadingEnv === env.name}
+                    onCreateTicket={() => handleCreateTicket(env.name)}
+                    isLoading={loadingEnv?.name === env.name}
                     isSelected={selectedEnv?.name === env.name}
                     onSelect={() => handleEnvSelect(env)}
                   />
@@ -252,7 +274,8 @@ export function EnvironmentsPanel({
               environment={selectedEnv}
               onClose={() => setShowBrowserView(false)}
               onStop={() => onStop(selectedEnv.name)}
-              isLoading={loadingEnv === selectedEnv.name}
+              isLoading={loadingEnv?.name === selectedEnv.name}
+              loadingAction={loadingEnv?.name === selectedEnv.name ? loadingEnv.action : undefined}
               tmuxStatus={tmuxStatuses[selectedEnv.name]}
             />
           ) : (
@@ -264,7 +287,8 @@ export function EnvironmentsPanel({
               onMerge={onMerge ? () => onMerge(selectedEnv.name) : undefined}
               onDelete={onDelete ? () => onDelete(selectedEnv.name) : undefined}
               onAttachTmux={onAttachTmux ? () => onAttachTmux(selectedEnv) : undefined}
-              isLoading={loadingEnv === selectedEnv.name}
+              isLoading={loadingEnv?.name === selectedEnv.name}
+              loadingAction={loadingEnv?.name === selectedEnv.name ? loadingEnv.action : undefined}
               tmuxStatus={tmuxStatuses[selectedEnv.name]}
             />
           )
@@ -283,6 +307,24 @@ export function EnvironmentsPanel({
         isOpen={showTmuxManager}
         onClose={() => setShowTmuxManager(false)}
       />
+
+      {/* Create Ticket Dialog */}
+      {showCreateTicket && (
+        <CreateTicketDialog
+          isOpen={showCreateTicket}
+          onClose={() => {
+            setShowCreateTicket(false)
+            setTicketEnvironment(null)
+          }}
+          onCreated={() => {
+            setShowCreateTicket(false)
+            setTicketEnvironment(null)
+          }}
+          epics={[]}
+          backendUrl={environments.find(e => e.running)?.localhost_url || 'http://localhost:8000'}
+          initialEnvironment={ticketEnvironment || undefined}
+        />
+      )}
     </div>
   )
 }
@@ -333,21 +375,46 @@ interface BrowserViewProps {
   onClose: () => void
   onStop: () => void
   isLoading: boolean
+  loadingAction?: 'starting' | 'stopping' | 'deleting' | 'merging'
   tmuxStatus?: TmuxStatus
 }
 
-function BrowserView({ environment, onClose, onStop, isLoading, tmuxStatus }: BrowserViewProps) {
+function BrowserView({ environment, onClose, onStop, isLoading, loadingAction, tmuxStatus }: BrowserViewProps) {
   const colors = getColors(environment.color || environment.name)
+  const [iframeError, setIframeError] = useState(false)
+  const [iframeLoading, setIframeLoading] = useState(true)
+
   // Prefer Tailscale URL if available, otherwise use localhost
   const baseUrl = environment.tailscale_url || environment.localhost_url || (environment.backend_port ? `http://localhost:${environment.webui_port || environment.backend_port}` : '')
-  // Add launcher query param so frontend knows to hide footer
-  const url = baseUrl
-    ? baseUrl.includes('?')
-      ? `${baseUrl}&launcher=true`
-      : `${baseUrl}?launcher=true`
-    : ''
   const displayUrl = environment.tailscale_url || environment.localhost_url || (environment.backend_port ? `http://localhost:${environment.webui_port || environment.backend_port}` : '')
 
+  // Add launcher query param so frontend knows to hide footer
+  // Use useMemo to calculate URL only when environment changes (not on every render)
+  const url = useMemo(() => {
+    if (!baseUrl) return ''
+    const timestamp = Date.now()
+    return baseUrl.includes('?')
+      ? `${baseUrl}&launcher=true&_t=${timestamp}`
+      : `${baseUrl}?launcher=true&_t=${timestamp}`
+  }, [baseUrl, environment.name])
+
+  // Reset error state when environment changes
+  useEffect(() => {
+    setIframeError(false)
+    setIframeLoading(true)
+  }, [environment.name, url])
+
+  const handleIframeLoad = () => {
+    setIframeLoading(false)
+    setIframeError(false)
+  }
+
+  const handleIframeError = () => {
+    console.error(`[BrowserView] Iframe failed to load for ${environment.name}`)
+    setIframeLoading(false)
+    setIframeError(true)
+  }
+
   const handleOpenVscode = () => {
     if (environment.path) {
       tauri.openInVscode(environment.path, environment.name)
@@ -362,8 +429,9 @@ function BrowserView({ environment, onClose, onStop, isLoading, tmuxStatus }: Br
   }
 
   const handleOpenInNewTab = () => {
-    if (url) {
-      window.open(url, '_blank')
+    // Open in new tab without launcher param (so footer shows normally)
+    if (displayUrl) {
+      tauri.openBrowser(displayUrl)
     }
   }
 
@@ -441,7 +509,7 @@ function BrowserView({ environment, onClose, onStop, isLoading, tmuxStatus }: Br
         <div className="flex items-center justify-between px-4 py-2 bg-surface-800">
           <div className="flex items-center gap-4 text-xs">
             <button
-              onClick={() => window.open(displayUrl, '_blank')}
+              onClick={() => tauri.openBrowser(displayUrl)}
               className="text-text-muted hover:text-primary-400 font-mono transition-colors cursor-pointer underline decoration-dotted"
               title="Open in external browser"
               data-testid="browser-view-url"
@@ -480,16 +548,48 @@ function BrowserView({ environment, onClose, onStop, isLoading, tmuxStatus }: Br
           /* Loading Animation Overlay */
           <div className="absolute inset-0 flex flex-col items-center justify-center bg-surface-800 z-10">
             <Loader2 className="w-16 h-16 text-primary-400 animate-spin mb-4" />
-            <p className="text-lg font-semibold text-text-primary mb-2">Starting containers...</p>
+            <p className="text-lg font-semibold text-text-primary mb-2">
+              {loadingAction === 'starting' && 'Starting containers...'}
+              {loadingAction === 'stopping' && 'Stopping containers...'}
+              {loadingAction === 'deleting' && 'Deleting environment...'}
+              {loadingAction === 'merging' && 'Merging worktree...'}
+              {!loadingAction && 'Processing...'}
+            </p>
             <p className="text-sm text-text-muted">This may take a moment</p>
           </div>
         ) : (
-          <iframe
-            src={url}
-            className="absolute inset-0 w-full h-full border-0"
-            title={`${environment.name} web interface`}
-            data-testid="browser-view-iframe"
-          />
+          <>
+            {iframeLoading && !iframeError && (
+              <div className="absolute inset-0 flex flex-col items-center justify-center bg-surface-800 z-10">
+                <Loader2 className="w-16 h-16 text-primary-400 animate-spin mb-4" />
+                <p className="text-lg font-semibold text-text-primary mb-2">Loading {environment.name}...</p>
+                <p className="text-sm text-text-muted font-mono">{displayUrl}</p>
+              </div>
+            )}
+            {iframeError && (
+              <div className="absolute inset-0 flex flex-col items-center justify-center bg-surface-800 z-10">
+                <AlertCircle className="w-16 h-16 text-error-400 mb-4" />
+                <p className="text-lg font-semibold text-text-primary mb-2">Failed to load {environment.name}</p>
+                <p className="text-sm text-text-muted mb-4 font-mono">{displayUrl}</p>
+                <button
+                  onClick={() => window.location.reload()}
+                  className="px-4 py-2 rounded-lg bg-primary-500 hover:bg-primary-600 transition-colors flex items-center gap-2"
+                >
+                  <RefreshCw className="w-4 h-4" />
+                  Reload Page
+                </button>
+              </div>
+            )}
+            <iframe
+              key={environment.name}
+              src={url}
+              className="absolute inset-0 w-full h-full border-0"
+              title={`${environment.name} web interface`}
+              data-testid="browser-view-iframe"
+              onLoad={handleIframeLoad}
+              onError={handleIframeError}
+            />
+          </>
         )}
       </div>
     </div>
@@ -505,10 +605,11 @@ interface DetailViewProps {
   onDelete?: () => void
   onAttachTmux?: () => void
   isLoading: boolean
+  loadingAction?: 'starting' | 'stopping' | 'deleting' | 'merging'
   tmuxStatus?: TmuxStatus
 }
 
-function DetailView({ environment, onStart, onStop, onOpenInBrowser, onMerge, onDelete, onAttachTmux, isLoading, tmuxStatus }: DetailViewProps) {
+function DetailView({ environment, onStart, onStop, onOpenInBrowser, onMerge, onDelete, onAttachTmux, isLoading, loadingAction, tmuxStatus }: DetailViewProps) {
   const colors = getColors(environment.color || environment.name)
   const displayUrl = environment.tailscale_url || environment.localhost_url || (environment.backend_port ? `http://localhost:${environment.webui_port || environment.backend_port}` : '')
 
@@ -615,7 +716,7 @@ function DetailView({ environment, onStart, onStop, onOpenInBrowser, onMerge, on
           <div className="flex items-center justify-between px-4 py-2 bg-surface-800">
             <div className="flex items-center gap-4 text-xs">
               <button
-                onClick={() => window.open(displayUrl, '_blank')}
+                onClick={() => tauri.openBrowser(displayUrl)}
                 className="text-text-muted hover:text-primary-400 font-mono transition-colors cursor-pointer underline decoration-dotted"
                 title="Open in external browser"
                 data-testid="detail-view-url"
@@ -651,11 +752,17 @@ function DetailView({ environment, onStart, onStop, onOpenInBrowser, onMerge, on
 
       {/* Content */}
       <div className="flex-1 p-6 overflow-auto relative">
-        {isLoading && !environment.running ? (
+        {isLoading && (!environment.running || loadingAction === 'deleting' || loadingAction === 'stopping') ? (
           /* Loading Animation Overlay */
           <div className="absolute inset-0 flex flex-col items-center justify-center bg-surface-800/95 backdrop-blur-sm z-10">
             <Loader2 className="w-16 h-16 text-primary-400 animate-spin mb-4" />
-            <p className="text-lg font-semibold text-text-primary mb-2">Starting containers...</p>
+            <p className="text-lg font-semibold text-text-primary mb-2">
+              {loadingAction === 'starting' && 'Starting containers...'}
+              {loadingAction === 'stopping' && 'Stopping containers...'}
+              {loadingAction === 'deleting' && 'Deleting environment...'}
+              {loadingAction === 'merging' && 'Merging worktree...'}
+              {!loadingAction && 'Processing...'}
+            </p>
             <p className="text-sm text-text-muted">This may take a moment</p>
           </div>
         ) : null}
@@ -823,12 +930,13 @@ interface EnvironmentCardProps {
   onStart: () => void
   onStop: () => void
   onOpenInApp: () => void
+  onCreateTicket: () => void
   isLoading: boolean
   isSelected: boolean
   onSelect: () => void
 }
 
-function EnvironmentCard({ environment, onStart, onStop, isLoading, isSelected, onSelect }: EnvironmentCardProps) {
+function EnvironmentCard({ environment, onStart, onStop, onCreateTicket, isLoading, isSelected, onSelect }: EnvironmentCardProps) {
   const colors = getColors(environment.color || environment.name)
 
   return (
@@ -912,6 +1020,17 @@ function EnvironmentCard({ environment, onStart, onStop, isLoading, isSelected,
             {environment.name}
           </span>
         </div>
+        <button
+          onClick={(e) => {
+            e.stopPropagation()
+            onCreateTicket()
+          }}
+          className="p-1.5 rounded hover:bg-surface-700 transition-colors opacity-0 group-hover:opacity-100"
+          title="Create ticket for this environment"
+          data-testid={`env-${environment.name}-create-ticket`}
+        >
+          <Trello className="w-3.5 h-3.5 text-text-muted hover:text-primary-400" />
+        </button>
         {environment.base_branch && (
           <span className={`px-1.5 py-0.5 rounded text-xs font-bold flex-shrink-0 ${
             environment.base_branch === 'dev'
diff --git a/ushadow/launcher/src/components/InfraConfigPanel.tsx b/ushadow/launcher/src/components/InfraConfigPanel.tsx
new file mode 100644
index 00000000..dc30d882
--- /dev/null
+++ b/ushadow/launcher/src/components/InfraConfigPanel.tsx
@@ -0,0 +1,297 @@
+import { useState, useEffect } from 'react'
+import { FileSearch, Check, Save, Search, ChevronRight, ChevronLeft } from 'lucide-react'
+import { tauri, type DetectedEnvVar } from '../hooks/useTauri'
+
+interface InfraConfigPanelProps {
+  projectRoot: string
+  selectedInfraServices: string[]
+  onSave?: (config: InfraConfiguration) => void
+}
+
+export interface InfraConfiguration {
+  managedPorts: string[]
+  sharedInfraPorts: string[]
+  appendEnvName: Record<string, boolean>
+}
+
+export function InfraConfigPanel({ projectRoot, selectedInfraServices, onSave }: InfraConfigPanelProps) {
+  const [allEnvVars, setAllEnvVars] = useState<DetectedEnvVar[]>([])
+  const [managedPorts, setManagedPorts] = useState<DetectedEnvVar[]>([])
+  const [sharedInfraPorts, setSharedInfraPorts] = useState<DetectedEnvVar[]>([])
+  const [otherVars, setOtherVars] = useState<DetectedEnvVar[]>([])
+  const [appendEnvName, setAppendEnvName] = useState<Record<string, boolean>>({})
+  const [isLoading, setIsLoading] = useState(false)
+  const [isSaved, setIsSaved] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [searchFilter, setSearchFilter] = useState('')
+
+  useEffect(() => {
+    if (projectRoot) {
+      scanAllEnvVars()
+    }
+  }, [projectRoot])
+
+  // Auto-categorize ports when selected infrastructure services change
+  useEffect(() => {
+    if (allEnvVars.length > 0) {
+      categorizePorts()
+    }
+  }, [selectedInfraServices])
+
+  const scanAllEnvVars = async () => {
+    setIsLoading(true)
+    setError(null)
+    try {
+      const vars = await tauri.scanAllEnvVars(projectRoot)
+      setAllEnvVars(vars)
+
+      const ports = vars.filter(v => v.is_port)
+      const nonPorts = vars.filter(v => !v.is_port)
+
+      // Initial categorization
+      categorizePorts(ports)
+      setOtherVars(nonPorts)
+
+      const appendFlags: Record<string, boolean> = {}
+      nonPorts.forEach(v => {
+        appendFlags[v.name] = v.should_append_env_name
+      })
+      setAppendEnvName(appendFlags)
+    } catch (err) {
+      console.error('Failed to scan env vars:', err)
+      setError(`Failed to scan .env file: ${err}`)
+    } finally {
+      setIsLoading(false)
+    }
+  }
+
+  const categorizePorts = (portsToCategorize?: DetectedEnvVar[]) => {
+    const ports = portsToCategorize || allEnvVars.filter(v => v.is_port)
+
+    // Smart categorization based on selected infrastructure
+    const shared: DetectedEnvVar[] = []
+    const managed: DetectedEnvVar[] = []
+
+    ports.forEach(port => {
+      const portName = port.name.toLowerCase()
+      const isShared = selectedInfraServices.some(service =>
+        portName.includes(service.toLowerCase())
+      )
+
+      if (isShared || port.is_database_port) {
+        shared.push(port)
+      } else {
+        managed.push(port)
+      }
+    })
+
+    setSharedInfraPorts(shared)
+    setManagedPorts(managed)
+  }
+
+  // Move ports between columns
+  const moveToManaged = (port: DetectedEnvVar) => {
+    setSharedInfraPorts(prev => prev.filter(p => p.name !== port.name))
+    setManagedPorts(prev => [...prev, port])
+  }
+
+  const moveToShared = (port: DetectedEnvVar) => {
+    setManagedPorts(prev => prev.filter(p => p.name !== port.name))
+    setSharedInfraPorts(prev => [...prev, port])
+  }
+
+  const toggleAppendEnvName = (varName: string) => {
+    setAppendEnvName(prev => ({
+      ...prev,
+      [varName]: !prev[varName]
+    }))
+  }
+
+  const handleSave = () => {
+    const config: InfraConfiguration = {
+      managedPorts: managedPorts.map(p => p.name),
+      sharedInfraPorts: sharedInfraPorts.map(p => p.name),
+      appendEnvName
+    }
+
+    console.log('Saving infra config:', config)
+    if (onSave) onSave(config)
+
+    setIsSaved(true)
+    setTimeout(() => setIsSaved(false), 2000)
+  }
+
+  const hasEnvVars = allEnvVars.length > 0
+
+  if (!hasEnvVars) {
+    return (
+      <div className="bg-surface-800 rounded-lg p-6">
+        <button
+          onClick={scanAllEnvVars}
+          disabled={isLoading}
+          className="flex items-center gap-2 px-4 py-2 rounded bg-primary-500 hover:bg-primary-600 text-white transition-colors disabled:opacity-50"
+          data-testid="scan-env-button"
+        >
+          <FileSearch className="w-4 h-4" />
+          {isLoading ? 'Scanning...' : 'Scan .env Files'}
+        </button>
+      </div>
+    )
+  }
+
+  return (
+    <div className="space-y-3" data-testid="infra-config-panel">
+      {/* Two Column Layout */}
+      <div className="grid grid-cols-2 gap-3" style={{ maxHeight: '50vh' }}>
+        {/* Left Column: Port Management */}
+        <div className="bg-surface-800 rounded-lg p-4 flex flex-col">
+          <div className="flex items-center justify-between mb-3">
+            <h3 className="font-medium">Port Management</h3>
+            <button
+              onClick={scanAllEnvVars}
+              className="text-xs text-primary-400 hover:text-primary-300"
+            >
+              Rescan
+            </button>
+          </div>
+          <p className="text-xs text-text-muted mb-3">
+            Drag ports between columns to categorize
+          </p>
+
+          <div className="flex-1 grid grid-cols-2 gap-2 overflow-hidden">
+            {/* Managed Ports */}
+            <div className="bg-surface-700/30 rounded-lg p-2 border border-green-500/30 flex flex-col overflow-hidden">
+              <h4 className="text-xs font-medium mb-2 text-green-400">Managed (Offset)</h4>
+              <div className="flex-1 overflow-y-auto space-y-1">
+                {managedPorts.length === 0 ? (
+                  <p className="text-xs text-text-muted text-center py-4">Drop ports here</p>
+                ) : (
+                  managedPorts.map((port) => (
+                    <button
+                      key={port.name}
+                      onClick={() => moveToShared(port)}
+                      className="w-full flex items-center gap-1.5 p-1.5 bg-surface-700 rounded text-xs cursor-pointer hover:bg-blue-500/20 hover:border-blue-500/50 border border-transparent transition-all text-left"
+                      data-testid={`managed-port-${port.name}`}
+                      title="Click to move to Shared (No Offset)"
+                    >
+                      <code className="flex-1 text-primary-400 truncate text-xs">{port.name}</code>
+                      <span className="text-text-muted text-xs">{port.default_value}</span>
+                      <ChevronRight className="w-3 h-3 text-blue-400/50" />
+                    </button>
+                  ))
+                )}
+              </div>
+            </div>
+
+            {/* Shared Infrastructure Ports */}
+            <div className="bg-surface-700/30 rounded-lg p-2 border border-blue-500/30 flex flex-col overflow-hidden">
+              <h4 className="text-xs font-medium mb-2 text-blue-400">Shared (No Offset)</h4>
+              <div className="flex-1 overflow-y-auto space-y-1">
+                {sharedInfraPorts.length === 0 ? (
+                  <p className="text-xs text-text-muted text-center py-4">Drop ports here</p>
+                ) : (
+                  sharedInfraPorts.map((port) => (
+                    <button
+                      key={port.name}
+                      onClick={() => moveToManaged(port)}
+                      className="w-full flex items-center gap-1.5 p-1.5 bg-surface-700 rounded text-xs cursor-pointer hover:bg-green-500/20 hover:border-green-500/50 border border-transparent transition-all text-left"
+                      data-testid={`shared-port-${port.name}`}
+                      title="Click to move to Managed (Offset)"
+                    >
+                      <ChevronLeft className="w-3 h-3 text-green-400/50" />
+                      <code className="flex-1 text-blue-400 truncate text-xs">{port.name}</code>
+                      <span className="text-text-muted text-xs">{port.default_value}</span>
+                    </button>
+                  ))
+                )}
+              </div>
+            </div>
+          </div>
+        </div>
+
+        {/* Right Column: Environment Variables */}
+        <div className="bg-surface-800 rounded-lg p-4 flex flex-col overflow-hidden">
+          <h3 className="font-medium mb-3">Environment Variables</h3>
+          <p className="text-xs text-text-muted mb-2">
+            Check vars that should have environment name appended
+          </p>
+
+          {/* Search Filter */}
+          <div className="relative mb-3">
+            <Search className="absolute left-2 top-1/2 -translate-y-1/2 w-3.5 h-3.5 text-text-muted" />
+            <input
+              type="text"
+              value={searchFilter}
+              onChange={(e) => setSearchFilter(e.target.value)}
+              placeholder="Search variables..."
+              className="w-full bg-surface-700 rounded px-8 py-1.5 text-xs outline-none focus:ring-1 focus:ring-primary-500/50"
+              data-testid="env-var-search"
+            />
+          </div>
+
+          <div className="flex-1 overflow-y-auto space-y-1">
+            {(() => {
+              const filteredVars = otherVars.filter(envVar =>
+                searchFilter === '' ||
+                envVar.name.toLowerCase().includes(searchFilter.toLowerCase())
+              )
+
+              if (otherVars.length === 0) {
+                return <p className="text-xs text-text-muted text-center py-8">No other variables found</p>
+              }
+
+              if (filteredVars.length === 0) {
+                return <p className="text-xs text-text-muted text-center py-8">No variables match "{searchFilter}"</p>
+              }
+
+              return filteredVars.map((envVar) => (
+                <button
+                  key={envVar.name}
+                  onClick={() => toggleAppendEnvName(envVar.name)}
+                  className="w-full flex items-center gap-2 p-2 bg-surface-700/50 rounded-lg hover:bg-surface-700 transition-colors text-left"
+                  data-testid={`env-var-${envVar.name}`}
+                >
+                  <div className={`
+                    w-4 h-4 rounded border flex items-center justify-center transition-colors flex-shrink-0
+                    ${appendEnvName[envVar.name]
+                      ? 'bg-primary-500 border-primary-500'
+                      : 'border-surface-500'
+                    }
+                  `}>
+                    {appendEnvName[envVar.name] && <Check className="w-2.5 h-2.5 text-white" />}
+                  </div>
+                  <code className="flex-1 text-xs text-text-primary truncate">{envVar.name}</code>
+                  <span className="text-xs text-text-muted font-mono">{envVar.default_value}</span>
+                </button>
+              ))
+            })()}
+          </div>
+        </div>
+      </div>
+
+      {/* Save Button */}
+      <div className="bg-surface-800 rounded-lg p-4 flex justify-end">
+        <button
+          onClick={handleSave}
+          className={`
+            flex items-center gap-2 px-4 py-2 rounded-lg transition-all
+            ${isSaved
+              ? 'bg-green-500/20 text-green-400'
+              : 'bg-primary-500 hover:bg-primary-600 text-white'
+            }
+          `}
+          data-testid="save-infra-config"
+        >
+          <Save className="w-4 h-4" />
+          {isSaved ? 'Saved!' : 'Save Configuration'}
+        </button>
+      </div>
+
+      {error && (
+        <div className="p-3 bg-red-500/20 border border-red-500/30 rounded-lg text-red-400 text-sm">
+          {error}
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/components/InfrastructurePanel.tsx b/ushadow/launcher/src/components/InfrastructurePanel.tsx
index 52196eb3..aa238159 100644
--- a/ushadow/launcher/src/components/InfrastructurePanel.tsx
+++ b/ushadow/launcher/src/components/InfrastructurePanel.tsx
@@ -1,6 +1,6 @@
-import { useState } from 'react'
-import { Play, Square, RotateCcw, Loader2, ChevronDown, ChevronRight } from 'lucide-react'
-import type { InfraService } from '../hooks/useTauri'
+import { useState, useEffect } from 'react'
+import { Play, Square, RotateCcw, Loader2, ChevronDown, ChevronRight, Check } from 'lucide-react'
+import { tauri, type InfraService, type ComposeServiceDefinition } from '../hooks/useTauri'
 
 interface InfrastructurePanelProps {
   services: InfraService[]
@@ -8,14 +8,125 @@ interface InfrastructurePanelProps {
   onStop: () => void
   onRestart: () => void
   isLoading: boolean
+  selectedServices?: string[]
+  onToggleService?: (serviceId: string) => void
 }
 
-export function InfrastructurePanel({ services, onStart, onStop, onRestart, isLoading }: InfrastructurePanelProps) {
-  const hasRunningServices = services.some(s => s.running)
-  const allRunning = services.length > 0 && services.every(s => s.running)
+// Parse Docker port mappings into clean port numbers
+// Input: "0.0.0.0:27017->27017/tcp, [::]:27017->27017/tcp"
+// Output: ["27017"]
+function parsePortMapping(ports: string | null): string[] {
+  if (!ports) return []
 
-  // Always start expanded
+  const portSet = new Set<string>()
+
+  // Match patterns like "27017->27017" or "6333-6334->6333-6334"
+  const regex = /(\d+(?:-\d+)?)->(\d+(?:-\d+)?)/g
+  let match
+
+  while ((match = regex.exec(ports)) !== null) {
+    portSet.add(match[1]) // Extract the host port (before ->)
+  }
+
+  return Array.from(portSet).sort((a, b) => {
+    // Sort by first port number
+    const aNum = parseInt(a.split('-')[0])
+    const bNum = parseInt(b.split('-')[0])
+    return aNum - bNum
+  })
+}
+
+export function InfrastructurePanel({
+  services,
+  onStart,
+  onStop,
+  onRestart,
+  isLoading,
+  selectedServices = [],
+  onToggleService
+}: InfrastructurePanelProps) {
   const [expanded, setExpanded] = useState(true)
+  const [composeServices, setComposeServices] = useState<InfraService[]>([])
+
+  // Load services from docker-compose.infra.yml
+  useEffect(() => {
+    tauri.getInfraServicesFromCompose()
+      .then(setComposeServices)
+      .catch(err => {
+        console.error('[InfrastructurePanel] Failed to load compose services:', err)
+        // Fallback to empty array on error
+        setComposeServices([])
+      })
+  }, [])
+
+  // Debug: log discovered services (only once when services change)
+  useEffect(() => {
+    if (services.length > 0) {
+      console.log('[InfrastructurePanel] Discovered services:', services.map(s => ({
+        name: s.name,
+        display_name: s.display_name,
+        running: s.running,
+        ports: s.ports
+      })))
+    }
+  }, [services.length])
+
+  // Build unified list of services (now composeServices already includes running status)
+  const predefinedServices = composeServices.map(composeSvc => {
+    const serviceId = composeSvc.name.toLowerCase()
+    const isSelected = selectedServices.includes(serviceId)
+
+    return {
+      id: serviceId,
+      displayName: composeSvc.display_name,
+      defaultPort: composeSvc.ports ? parseInt(composeSvc.ports) : null,
+      isSelected,
+      isRunning: composeSvc.running,
+      ports: composeSvc.ports,
+      serviceName: composeSvc.name
+    }
+  })
+
+  // Add discovered services not in compose list (for dynamic container discovery)
+  const additionalServices = services
+    .filter(s => {
+      const matchesPredefined = composeServices.some(composeSvc =>
+        s.name.toLowerCase() === composeSvc.name.toLowerCase() ||
+        s.name.toLowerCase().includes(composeSvc.name.toLowerCase()) ||
+        s.display_name?.toLowerCase().includes(composeSvc.name.toLowerCase())
+      )
+      return !matchesPredefined
+    })
+    .map(s => {
+      const serviceId = s.name.toLowerCase().replace(/[^a-z0-9]/g, '')
+      const isSelected = selectedServices.includes(serviceId)
+
+      return {
+        id: serviceId,
+        displayName: s.display_name || s.name,
+        defaultPort: null,
+        isSelected,
+        isRunning: s.running,
+        ports: s.ports,
+        serviceName: s.name
+      }
+    })
+
+  // Sort: running and selected first, then others
+  const unifiedServices = [...predefinedServices, ...additionalServices].sort((a, b) => {
+    // Running and selected at top
+    const aScore = (a.isRunning ? 2 : 0) + (a.isSelected ? 1 : 0)
+    const bScore = (b.isRunning ? 2 : 0) + (b.isSelected ? 1 : 0)
+    return bScore - aScore
+  })
+
+  const runningCount = unifiedServices.filter(s => s.isRunning).length
+
+  // Calculate what actions are available based on selected services
+  const selectedServicesList = unifiedServices.filter(s => s.isSelected)
+  const hasSelectedServices = selectedServicesList.length > 0
+  const hasSelectedNotRunning = selectedServicesList.some(s => !s.isRunning)
+  const hasSelectedRunning = selectedServicesList.some(s => s.isRunning)
 
   return (
     <div className="bg-surface-800 rounded-lg" data-testid="infrastructure-panel">
@@ -28,78 +139,146 @@ export function InfrastructurePanel({ services, onStart, onStop, onRestart, isLo
           <span className="font-medium">Shared Infrastructure</span>
           {expanded ? <ChevronDown className="w-4 h-4" /> : <ChevronRight className="w-4 h-4" />}
         </button>
-        {allRunning && services.length > 0 && (
-          <span className="text-xs px-2 py-1 rounded-full bg-success-500/20 text-success-400">
-            {services.length} core service{services.length !== 1 ? 's' : ''} started
-          </span>
-        )}
-        <div className="flex gap-1">
-          {!allRunning && (
-            <button
-              onClick={onStart}
-              disabled={isLoading}
-              className="p-1.5 rounded bg-success-500/20 text-success-400 hover:bg-success-500/30 transition-colors disabled:opacity-50"
-              title="Start infrastructure"
-              data-testid="infra-start-button"
-            >
-              {isLoading ? <Loader2 className="w-3.5 h-3.5 animate-spin" /> : <Play className="w-3.5 h-3.5" />}
-            </button>
+        <div className="flex items-center gap-3">
+          {runningCount > 0 && (
+            <span className="text-xs px-2 py-1 rounded-full bg-success-500/20 text-success-400">
+              {runningCount} running
+            </span>
           )}
-          {hasRunningServices && (
-            <>
+          <div className="flex gap-1">
+            {/* Start: only show if there are selected services that are NOT running */}
+            {hasSelectedNotRunning && (
+              <button
+                onClick={onStart}
+                disabled={isLoading}
+                className="p-1.5 rounded bg-success-500/20 text-success-400 hover:bg-success-500/30 transition-colors disabled:opacity-50"
+                title="Start selected services that aren't running"
+                data-testid="infra-start-button"
+              >
+                {isLoading ? <Loader2 className="w-3.5 h-3.5 animate-spin" /> : <Play className="w-3.5 h-3.5" />}
+              </button>
+            )}
+            {/* Restart: only show if there are selected services that ARE running */}
+            {hasSelectedRunning && (
               <button
                 onClick={onRestart}
                 disabled={isLoading}
                 className="p-1.5 rounded bg-warning-500/20 text-warning-400 hover:bg-warning-500/30 transition-colors disabled:opacity-50"
-                title="Restart infrastructure"
+                title="Restart selected running services"
                 data-testid="infra-restart-button"
               >
                 {isLoading ? <Loader2 className="w-3.5 h-3.5 animate-spin" /> : <RotateCcw className="w-3.5 h-3.5" />}
               </button>
+            )}
+            {/* Stop: only show if there are selected services that ARE running */}
+            {hasSelectedRunning && (
               <button
                 onClick={onStop}
                 disabled={isLoading}
                 className="p-1.5 rounded bg-error-500/20 text-error-400 hover:bg-error-500/30 transition-colors disabled:opacity-50"
-                title="Stop infrastructure"
+                title="Stop selected running services"
                 data-testid="infra-stop-button"
               >
                 {isLoading ? <Loader2 className="w-3.5 h-3.5 animate-spin" /> : <Square className="w-3.5 h-3.5" />}
               </button>
-            </>
-          )}
+            )}
+          </div>
         </div>
       </div>
 
-      {/* Content - only show when expanded */}
+      {/* Content */}
       {expanded && (
         <div className="px-4 pb-4">
-          {services.length === 0 ? (
-            <p className="text-xs text-text-muted">No services detected</p>
-          ) : (
-            <div className="space-y-2">
-              {services.map((svc) => (
-                <ServiceCard key={svc.name} service={svc} />
-              ))}
-            </div>
-          )}
+          <p className="text-xs text-text-muted mb-3">
+            Select services for group actions (start/stop/restart):
+          </p>
+          <div className="space-y-1">
+            {unifiedServices.map((service) => (
+              <UnifiedServiceCard
+                key={service.id}
+                service={service}
+                onToggle={onToggleService ? () => onToggleService(service.id) : undefined}
+              />
+            ))}
+          </div>
         </div>
       )}
     </div>
   )
 }
 
-function ServiceCard({ service }: { service: InfraService }) {
+interface UnifiedServiceCardProps {
+  service: {
+    id: string
+    displayName: string
+    defaultPort: number | null
+    isSelected: boolean
+    isRunning: boolean
+    ports?: string | null
+    serviceName?: string
+  }
+  onToggle?: () => void
+}
+
+function UnifiedServiceCard({ service, onToggle }: UnifiedServiceCardProps) {
+  const parsedPorts = parsePortMapping(service.ports)
+
   return (
-    <div
-      className={`flex items-center gap-2 px-3 py-2 rounded transition-colors ${
-        service.running ? 'bg-success-500/10' : 'bg-surface-700/50'
-      }`}
-      data-testid={`service-${service.name}`}
+    <button
+      onClick={onToggle}
+      disabled={!onToggle}
+      className={`
+        w-full flex items-center gap-3 px-3 py-2 rounded-lg transition-all text-left
+        ${service.isRunning
+          ? 'bg-success-500/20 border border-success-500/40'
+          : 'bg-surface-700/30 border border-transparent hover:bg-surface-700/50'
+        }
+        ${onToggle ? 'cursor-pointer' : 'cursor-default'}
+      `}
+      data-testid={`infra-service-${service.id}`}
     >
-      <div className={`w-2 h-2 rounded-full ${service.running ? 'bg-success-400' : 'bg-surface-500'}`} />
-      <span className={`text-sm ${service.running ? 'text-text-primary' : 'text-text-muted'}`}>
-        {service.display_name || service.name}
-      </span>
-    </div>
+      {/* Checkbox for selection */}
+      {onToggle && (
+        <div className={`
+          w-4 h-4 rounded border flex items-center justify-center flex-shrink-0
+          ${service.isSelected ? 'bg-primary-500 border-primary-500' : 'border-surface-500'}
+        `}>
+          {service.isSelected && <Check className="w-3 h-3 text-white" />}
+        </div>
+      )}
+
+      {/* Status Indicator */}
+      <div className={`
+        w-2 h-2 rounded-full flex-shrink-0
+        ${service.isRunning ? 'bg-success-400' : 'bg-surface-500'}
+      `} />
+
+      {/* Service Name */}
+      <div className="flex-1 min-w-0">
+        <p className={`text-sm font-medium truncate ${
+          service.isRunning ? 'text-success-300' : 'text-text-primary'
+        }`}>
+          {service.displayName}
+        </p>
+      </div>
+
+      {/* Port Info - Clean badges */}
+      <div className="flex items-center gap-1.5">
+        {parsedPorts.length > 0 ? (
+          parsedPorts.map((port, idx) => (
+            <span
+              key={idx}
+              className="px-2 py-0.5 rounded text-xs font-mono bg-surface-700 text-text-secondary border border-surface-600"
+            >
+              :{port}
+            </span>
+          ))
+        ) : service.defaultPort ? (
+          <span className="px-2 py-0.5 rounded text-xs font-mono bg-surface-700 text-text-muted border border-surface-600">
+            :{service.defaultPort}
+          </span>
+        ) : null}
+      </div>
+    </button>
   )
 }
diff --git a/ushadow/launcher/src/components/KanbanBoard.tsx b/ushadow/launcher/src/components/KanbanBoard.tsx
new file mode 100644
index 00000000..2d187a9f
--- /dev/null
+++ b/ushadow/launcher/src/components/KanbanBoard.tsx
@@ -0,0 +1,236 @@
+import { useState, useEffect, useCallback } from 'react'
+import { Plus, Tag, Folder } from 'lucide-react'
+import { TicketCard } from './TicketCard'
+import { CreateTicketDialog } from './CreateTicketDialog'
+import { CreateEpicDialog } from './CreateEpicDialog'
+
+export type TicketStatus = 'backlog' | 'todo' | 'in_progress' | 'in_review' | 'done' | 'archived'
+export type TicketPriority = 'low' | 'medium' | 'high' | 'urgent'
+
+export interface Epic {
+  id: string
+  title: string
+  description?: string
+  color: string
+  branch_name?: string
+  base_branch: string
+  project_id?: string
+  created_at: string
+  updated_at: string
+}
+
+export interface Ticket {
+  id: string
+  title: string
+  description?: string
+  status: TicketStatus
+  priority: TicketPriority
+  epic_id?: string
+  tags: string[]
+  color?: string
+  tmux_window_name?: string
+  tmux_session_name?: string
+  branch_name?: string
+  worktree_path?: string
+  environment_name?: string
+  project_id?: string
+  assigned_to?: string
+  order: number
+  created_at: string
+  updated_at: string
+}
+
+interface KanbanBoardProps {
+  projectId?: string
+  backendUrl: string
+  projectRoot: string
+}
+
+const COLUMNS: { status: TicketStatus; title: string }[] = [
+  { status: 'backlog', title: 'Backlog' },
+  { status: 'todo', title: 'To Do' },
+  { status: 'in_progress', title: 'In Progress' },
+  { status: 'in_review', title: 'In Review' },
+  { status: 'done', title: 'Done' },
+]
+
+export function KanbanBoard({ projectId, backendUrl, projectRoot }: KanbanBoardProps) {
+  const [tickets, setTickets] = useState<Ticket[]>([])
+  const [epics, setEpics] = useState<Epic[]>([])
+  const [initialLoading, setInitialLoading] = useState(true)
+  const [showCreateTicket, setShowCreateTicket] = useState(false)
+  const [showCreateEpic, setShowCreateEpic] = useState(false)
+  const [selectedEpic, setSelectedEpic] = useState<string | null>(null)
+
+  // Fetch tickets and epics (using Tauri commands)
+  const fetchData = useCallback(async (isInitialLoad = false) => {
+    try {
+      // Only show loading overlay on initial load, not during background polling
+      if (isInitialLoad) {
+        setInitialLoading(true)
+      }
+
+      const { tauri } = await import('../hooks/useTauri')
+
+      const [ticketsData, epicsData] = await Promise.all([
+        tauri.getTickets(projectId || undefined),
+        tauri.getEpics(projectId || undefined),
+      ])
+
+      setTickets(ticketsData)
+      setEpics(epicsData)
+    } catch (error) {
+      console.error('Failed to fetch kanban data:', error)
+    } finally {
+      if (isInitialLoad) {
+        setInitialLoading(false)
+      }
+    }
+  }, [projectId])
+
+  useEffect(() => {
+    fetchData(true) // Initial load - show loading overlay
+    // Poll every 30 seconds (background refresh - no loading overlay)
+    const interval = setInterval(() => fetchData(false), 30000)
+    return () => clearInterval(interval)
+  }, [fetchData])
+
+  // Group tickets by status
+  const ticketsByStatus = COLUMNS.reduce((acc, col) => {
+    acc[col.status] = tickets.filter(t => t.status === col.status)
+    return acc
+  }, {} as Record<TicketStatus, Ticket[]>)
+
+  // Filter tickets by selected epic
+  const filteredTickets = selectedEpic
+    ? Object.entries(ticketsByStatus).reduce((acc, [status, tickets]) => {
+        acc[status as TicketStatus] = tickets.filter(t => t.epic_id === selectedEpic)
+        return acc
+      }, {} as Record<TicketStatus, Ticket[]>)
+    : ticketsByStatus
+
+  const handleTicketCreated = () => {
+    fetchData(false) // Background refresh after creation
+    setShowCreateTicket(false)
+  }
+
+  const handleEpicCreated = () => {
+    fetchData(false) // Background refresh after creation
+    setShowCreateEpic(false)
+  }
+
+  if (initialLoading) {
+    return (
+      <div className="flex items-center justify-center h-full" data-testid="kanban-loading">
+        <div className="text-gray-400">Loading kanban board...</div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex flex-col h-full bg-gray-900" data-testid="kanban-board">
+      {/* Header */}
+      <div className="flex items-center justify-between p-4 border-b border-gray-800">
+        <div className="flex items-center gap-4">
+          <h1 className="text-xl font-semibold text-white">Kanban Board</h1>
+
+          {/* Epic Filter */}
+          <div className="flex items-center gap-2">
+            <Folder className="w-4 h-4 text-gray-400" />
+            <select
+              value={selectedEpic || ''}
+              onChange={(e) => setSelectedEpic(e.target.value || null)}
+              className="bg-gray-800 text-white px-3 py-1.5 rounded border border-gray-700 text-sm"
+              data-testid="kanban-epic-filter"
+            >
+              <option value="">All Tickets</option>
+              {epics.map((epic) => (
+                <option key={epic.id} value={epic.id}>
+                  {epic.title}
+                </option>
+              ))}
+            </select>
+          </div>
+        </div>
+
+        {/* Actions */}
+        <div className="flex items-center gap-2">
+          <button
+            onClick={() => setShowCreateEpic(true)}
+            className="flex items-center gap-2 px-3 py-1.5 bg-purple-600 hover:bg-purple-700 text-white rounded text-sm"
+            data-testid="kanban-create-epic"
+          >
+            <Folder className="w-4 h-4" />
+            New Epic
+          </button>
+          <button
+            onClick={() => setShowCreateTicket(true)}
+            className="flex items-center gap-2 px-3 py-1.5 bg-blue-600 hover:bg-blue-700 text-white rounded text-sm"
+            data-testid="kanban-create-ticket"
+          >
+            <Plus className="w-4 h-4" />
+            New Ticket
+          </button>
+        </div>
+      </div>
+
+      {/* Board Columns */}
+      <div className="flex-1 flex gap-4 p-4 overflow-x-auto">
+        {COLUMNS.map((column) => (
+          <div
+            key={column.status}
+            className="flex-shrink-0 w-80 flex flex-col bg-gray-800 rounded-lg"
+            data-testid={`kanban-column-${column.status}`}
+          >
+            {/* Column Header */}
+            <div className="p-3 border-b border-gray-700">
+              <div className="flex items-center justify-between">
+                <h2 className="font-medium text-white">{column.title}</h2>
+                <span className="text-xs text-gray-400 bg-gray-700 px-2 py-1 rounded">
+                  {filteredTickets[column.status]?.length || 0}
+                </span>
+              </div>
+            </div>
+
+            {/* Ticket List */}
+            <div className="flex-1 p-2 space-y-2 overflow-y-auto">
+              {filteredTickets[column.status]?.map((ticket) => (
+                <TicketCard
+                  key={ticket.id}
+                  ticket={ticket}
+                  epics={epics}
+                  onUpdate={fetchData}
+                  backendUrl={backendUrl}
+                  projectRoot={projectRoot}
+                />
+              ))}
+            </div>
+          </div>
+        ))}
+      </div>
+
+      {/* Dialogs */}
+      {showCreateTicket && (
+        <CreateTicketDialog
+          isOpen={showCreateTicket}
+          onClose={() => setShowCreateTicket(false)}
+          onCreated={handleTicketCreated}
+          epics={epics}
+          projectId={projectId}
+          projectRoot={projectRoot}
+          backendUrl={backendUrl}
+        />
+      )}
+
+      {showCreateEpic && (
+        <CreateEpicDialog
+          isOpen={showCreateEpic}
+          onClose={() => setShowCreateEpic(false)}
+          onCreated={handleEpicCreated}
+          projectId={projectId}
+          backendUrl={backendUrl}
+        />
+      )}
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/components/PrerequisitesPanel.tsx b/ushadow/launcher/src/components/PrerequisitesPanel.tsx
index d701c38d..1f2133de 100644
--- a/ushadow/launcher/src/components/PrerequisitesPanel.tsx
+++ b/ushadow/launcher/src/components/PrerequisitesPanel.tsx
@@ -122,20 +122,24 @@ export function PrerequisitesPanel({
                   {prereqsInCategory.map(prereq => {
                     const status = getPrereqStatus(prereq.id)
                     const showStart = prereq.has_service && status.installed === true && status.running === false
+                    const isTailscale = prereq.id === 'tailscale'
+                    const tailscaleInstalled = isTailscale && status.installed
+
                     return (
-                      <PrereqItem
-                        key={prereq.id}
-                        label={prereq.display_name}
-                        installed={status.installed}
-                        running={status.running}
-                        optional={prereq.optional}
-                        showInstall={!status.installed}
-                        showStart={showStart}
-                        onInstall={() => onInstall(prereq.id)}
-                        onStart={prereq.id === 'docker' ? onStartDocker : undefined}
-                        isInstalling={isInstalling}
-                        installing={installingItem === prereq.id}
-                      />
+                      <div key={prereq.id}>
+                        <PrereqItem
+                          label={prereq.display_name}
+                          installed={status.installed}
+                          running={status.running}
+                          optional={prereq.optional}
+                          showInstall={!status.installed}
+                          showStart={showStart}
+                          onInstall={() => onInstall(prereq.id)}
+                          onStart={prereq.id === 'docker' ? onStartDocker : undefined}
+                          isInstalling={isInstalling}
+                          installing={installingItem === prereq.id}
+                        />
+                      </div>
                     )
                   })}
                 </div>
diff --git a/ushadow/launcher/src/components/ProjectConfigEditor.tsx b/ushadow/launcher/src/components/ProjectConfigEditor.tsx
new file mode 100644
index 00000000..47d26e27
--- /dev/null
+++ b/ushadow/launcher/src/components/ProjectConfigEditor.tsx
@@ -0,0 +1,486 @@
+import { useState, useEffect } from 'react'
+import { Save, X, FileSearch, ArrowRight, ArrowLeft, Check } from 'lucide-react'
+import { tauri, type DetectedEnvVar } from '../hooks/useTauri'
+import type { LauncherConfig } from '../hooks/useTauri'
+
+interface ProjectConfigEditorProps {
+  isOpen: boolean
+  projectRoot: string
+  onClose: () => void
+  onSave?: () => void
+}
+
+// Common infrastructure services
+const INFRASTRUCTURE_SERVICES = [
+  { id: 'postgres', name: 'PostgreSQL', defaultPort: 5432 },
+  { id: 'mysql', name: 'MySQL', defaultPort: 3306 },
+  { id: 'redis', name: 'Redis', defaultPort: 6379 },
+  { id: 'mongodb', name: 'MongoDB', defaultPort: 27017 },
+  { id: 'elasticsearch', name: 'Elasticsearch', defaultPort: 9200 },
+  { id: 'rabbitmq', name: 'RabbitMQ', defaultPort: 5672 },
+  { id: 'kafka', name: 'Kafka', defaultPort: 9092 },
+]
+
+export function ProjectConfigEditor({ isOpen, projectRoot, onClose, onSave }: ProjectConfigEditorProps) {
+  const [config, setConfig] = useState<Partial<LauncherConfig> | null>(null)
+  const [isLoading, setIsLoading] = useState(true)
+  const [isSaving, setIsSaving] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  // Infrastructure selection
+  const [selectedInfra, setSelectedInfra] = useState<string[]>([])
+
+  // All detected env vars
+  const [allEnvVars, setAllEnvVars] = useState<DetectedEnvVar[]>([])
+
+  // Port categorization
+  const [managedPorts, setManagedPorts] = useState<DetectedEnvVar[]>([])
+  const [sharedInfraPorts, setSharedInfraPorts] = useState<DetectedEnvVar[]>([])
+
+  // Other variables with append env name flags
+  const [otherVars, setOtherVars] = useState<DetectedEnvVar[]>([])
+  const [appendEnvName, setAppendEnvName] = useState<Record<string, boolean>>({})
+
+  useEffect(() => {
+    if (isOpen && projectRoot) {
+      loadConfig()
+      scanAllEnvVars()
+    }
+  }, [isOpen, projectRoot])
+
+  const loadConfig = async () => {
+    setIsLoading(true)
+    setError(null)
+    try {
+      const cfg = await tauri.loadProjectConfig(projectRoot)
+      setConfig(cfg)
+    } catch (err) {
+      console.warn('No existing config, creating new:', err)
+      // Create default config
+      setConfig({
+        project: {
+          name: projectRoot.split('/').pop() || 'project',
+          display_name: projectRoot.split('/').pop() || 'Project'
+        },
+        prerequisites: {
+          required: ['docker', 'git'],
+          optional: []
+        },
+        setup: {
+          command: './go.sh',
+          env_vars: ['PROJECT_ROOT', 'WORKTREE_PATH', 'PORT_OFFSET']
+        },
+        infrastructure: {
+          compose_file: 'docker-compose.yml',
+          project_name: `${projectRoot.split('/').pop()}-infra`,
+          profile: undefined
+        },
+        containers: {
+          naming_pattern: '{env_name}-{service}',
+          primary_service: 'backend',
+          health_endpoint: '/health',
+          tailscale_project_prefix: undefined
+        },
+        ports: {
+          allocation_strategy: 'offset',
+          base_port: 8000,
+          offset: {
+            min: 0,
+            max: 100,
+            step: 10
+          }
+        },
+        worktrees: {
+          default_parent: `../worktrees/${projectRoot.split('/').pop()}`,
+          branch_prefix: undefined
+        }
+      })
+    } finally {
+      setIsLoading(false)
+    }
+  }
+
+  const scanAllEnvVars = async () => {
+    try {
+      const vars = await tauri.scanAllEnvVars(projectRoot)
+      setAllEnvVars(vars)
+
+      // Separate into categories
+      const ports = vars.filter(v => v.is_port)
+      const nonPorts = vars.filter(v => !v.is_port)
+
+      // Initially put all ports in managed, database ports can be moved to shared-infra
+      setManagedPorts(ports.filter(v => !v.is_database_port))
+      setSharedInfraPorts(ports.filter(v => v.is_database_port))
+      setOtherVars(nonPorts)
+
+      // Initialize append env name checkboxes
+      const appendFlags: Record<string, boolean> = {}
+      nonPorts.forEach(v => {
+        appendFlags[v.name] = v.should_append_env_name
+      })
+      setAppendEnvName(appendFlags)
+    } catch (err) {
+      console.error('Failed to scan env vars:', err)
+      setError(`Failed to scan .env file: ${err}`)
+    }
+  }
+
+  const toggleInfraService = (serviceId: string) => {
+    setSelectedInfra(prev =>
+      prev.includes(serviceId)
+        ? prev.filter(id => id !== serviceId)
+        : [...prev, serviceId]
+    )
+  }
+
+  const movePortToManaged = (portVar: DetectedEnvVar) => {
+    setSharedInfraPorts(prev => prev.filter(p => p.name !== portVar.name))
+    setManagedPorts(prev => [...prev, portVar])
+  }
+
+  const movePortToSharedInfra = (portVar: DetectedEnvVar) => {
+    setManagedPorts(prev => prev.filter(p => p.name !== portVar.name))
+    setSharedInfraPorts(prev => [...prev, portVar])
+  }
+
+  const toggleAppendEnvName = (varName: string) => {
+    setAppendEnvName(prev => ({
+      ...prev,
+      [varName]: !prev[varName]
+    }))
+  }
+
+  const handleSave = async () => {
+    if (!config) return
+
+    setIsSaving(true)
+    setError(null)
+
+    try {
+      // TODO: Call Rust backend to save config
+      // await tauri.saveProjectConfig(projectRoot, config)
+
+      if (onSave) onSave()
+      onClose()
+    } catch (err) {
+      setError(`Failed to save config: ${err}`)
+    } finally {
+      setIsSaving(false)
+    }
+  }
+
+  if (!isOpen) return null
+
+  return (
+    <div className="fixed inset-0 bg-black/50 flex items-center justify-center z-50" data-testid="project-config-editor">
+      <div className="bg-surface-800 rounded-xl w-full max-w-6xl max-h-[90vh] overflow-y-auto mx-4 shadow-xl">
+        {/* Header */}
+        <div className="sticky top-0 bg-surface-800 border-b border-surface-700 p-6 flex items-center justify-between">
+          <div>
+            <h2 className="text-xl font-semibold">Project Configuration</h2>
+            <p className="text-sm text-text-muted mt-1">{projectRoot}</p>
+          </div>
+          <button
+            onClick={onClose}
+            className="p-2 rounded hover:bg-surface-700 transition-colors"
+            data-testid="close-config-editor"
+          >
+            <X className="w-5 h-5" />
+          </button>
+        </div>
+
+        {isLoading ? (
+          <div className="p-8 text-center text-text-muted">Loading configuration...</div>
+        ) : config ? (
+          <div className="p-6 space-y-6">
+            {/* Project Info */}
+            <section>
+              <h3 className="text-lg font-semibold mb-4">Project Information</h3>
+              <div className="grid grid-cols-2 gap-4">
+                <div>
+                  <label className="block text-sm text-text-secondary mb-2">Project Name</label>
+                  <input
+                    type="text"
+                    value={config.project?.name || ''}
+                    onChange={(e) => setConfig({
+                      ...config,
+                      project: { ...config.project!, name: e.target.value }
+                    })}
+                    className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none focus:ring-2 focus:ring-primary-500/50"
+                    data-testid="project-name-input"
+                  />
+                </div>
+                <div>
+                  <label className="block text-sm text-text-secondary mb-2">Display Name</label>
+                  <input
+                    type="text"
+                    value={config.project?.display_name || ''}
+                    onChange={(e) => setConfig({
+                      ...config,
+                      project: { ...config.project!, display_name: e.target.value }
+                    })}
+                    className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none focus:ring-2 focus:ring-primary-500/50"
+                    data-testid="project-display-name-input"
+                  />
+                </div>
+              </div>
+            </section>
+
+            {/* Environment Startup */}
+            <section>
+              <h3 className="text-lg font-semibold mb-4">Environment Startup</h3>
+              <div className="space-y-4">
+                <div>
+                  <label className="block text-sm text-text-secondary mb-2">
+                    Startup Command
+                    <span className="text-text-muted ml-2">(run when starting an environment)</span>
+                  </label>
+                  <input
+                    type="text"
+                    value={config.setup?.command || ''}
+                    onChange={(e) => setConfig({
+                      ...config,
+                      setup: { ...config.setup!, command: e.target.value }
+                    })}
+                    placeholder="./go.sh or docker compose up -d"
+                    className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none focus:ring-2 focus:ring-primary-500/50 font-mono text-sm"
+                    data-testid="startup-command-input"
+                  />
+                </div>
+              </div>
+            </section>
+
+            {/* Infrastructure Selection */}
+            <section>
+              <div className="flex items-center justify-between mb-4">
+                <h3 className="text-lg font-semibold">Shared Infrastructure</h3>
+                <button
+                  onClick={scanAllEnvVars}
+                  className="flex items-center gap-2 px-3 py-1.5 rounded bg-surface-700 hover:bg-surface-600 text-sm transition-colors"
+                  data-testid="scan-env-button"
+                >
+                  <FileSearch className="w-4 h-4" />
+                  Scan .env files
+                </button>
+              </div>
+              <p className="text-sm text-text-muted mb-4">
+                Select which infrastructure services are shared across environments (won't be offset)
+              </p>
+              <div className="grid grid-cols-3 gap-3">
+                {INFRASTRUCTURE_SERVICES.map(service => {
+                  const isSelected = selectedInfra.includes(service.id)
+                  return (
+                    <button
+                      key={service.id}
+                      onClick={() => toggleInfraService(service.id)}
+                      className={`
+                        flex items-center gap-3 p-3 rounded-lg border-2 transition-all
+                        ${isSelected
+                          ? 'border-primary-500 bg-primary-500/10'
+                          : 'border-surface-600 bg-surface-700/50 hover:border-surface-500'
+                        }
+                      `}
+                      data-testid={`infra-service-${service.id}`}
+                    >
+                      <div className={`
+                        w-5 h-5 rounded border-2 flex items-center justify-center
+                        ${isSelected ? 'bg-primary-500 border-primary-500' : 'border-surface-500'}
+                      `}>
+                        {isSelected && <Check className="w-3 h-3 text-white" />}
+                      </div>
+                      <div className="flex-1 text-left">
+                        <p className="font-medium text-sm">{service.name}</p>
+                        <p className="text-xs text-text-muted">:{service.defaultPort}</p>
+                      </div>
+                    </button>
+                  )
+                })}
+              </div>
+            </section>
+
+            {/* Port Management - Two Column Layout */}
+            <section>
+              <h3 className="text-lg font-semibold mb-4">Port Management</h3>
+              <p className="text-sm text-text-muted mb-4">
+                Drag ports between columns or click arrows. Managed ports will be offset for each environment.
+              </p>
+
+              <div className="grid grid-cols-2 gap-4">
+                {/* Managed Ports (Left) */}
+                <div className="bg-surface-700/30 rounded-lg p-4 border-2 border-green-500/30">
+                  <h4 className="font-medium mb-3 text-green-400">Managed Ports (Offset)</h4>
+                  <div className="space-y-2 min-h-[200px]">
+                    {managedPorts.length === 0 ? (
+                      <p className="text-sm text-text-muted text-center py-8">No managed ports</p>
+                    ) : (
+                      managedPorts.map((port, idx) => (
+                        <div
+                          key={port.name}
+                          className="flex items-center gap-2 p-2 bg-surface-700 rounded border border-surface-600"
+                          data-testid={`managed-port-${port.name}`}
+                        >
+                          <code className="flex-1 text-sm text-primary-400">{port.name}</code>
+                          <span className="text-xs text-text-muted">{port.default_value}</span>
+                          <button
+                            onClick={() => movePortToSharedInfra(port)}
+                            className="p-1 rounded hover:bg-surface-600 text-text-muted hover:text-primary-400"
+                            title="Move to shared infrastructure"
+                          >
+                            <ArrowRight className="w-4 h-4" />
+                          </button>
+                        </div>
+                      ))
+                    )}
+                  </div>
+                </div>
+
+                {/* Shared Infrastructure Ports (Right) */}
+                <div className="bg-surface-700/30 rounded-lg p-4 border-2 border-blue-500/30">
+                  <h4 className="font-medium mb-3 text-blue-400">Shared Infrastructure (No Offset)</h4>
+                  <div className="space-y-2 min-h-[200px]">
+                    {sharedInfraPorts.length === 0 ? (
+                      <p className="text-sm text-text-muted text-center py-8">No shared infrastructure ports</p>
+                    ) : (
+                      sharedInfraPorts.map((port, idx) => (
+                        <div
+                          key={port.name}
+                          className="flex items-center gap-2 p-2 bg-surface-700 rounded border border-surface-600"
+                          data-testid={`shared-port-${port.name}`}
+                        >
+                          <button
+                            onClick={() => movePortToManaged(port)}
+                            className="p-1 rounded hover:bg-surface-600 text-text-muted hover:text-primary-400"
+                            title="Move to managed"
+                          >
+                            <ArrowLeft className="w-4 h-4" />
+                          </button>
+                          <code className="flex-1 text-sm text-blue-400">{port.name}</code>
+                          <span className="text-xs text-text-muted">{port.default_value}</span>
+                        </div>
+                      ))
+                    )}
+                  </div>
+                </div>
+              </div>
+
+              {/* Port Offset Settings */}
+              {config.ports?.allocation_strategy === 'offset' && (
+                <div className="mt-4 grid grid-cols-3 gap-4 p-4 bg-surface-700/30 rounded-lg">
+                  <div>
+                    <label className="block text-sm text-text-secondary mb-2">Base Port</label>
+                    <input
+                      type="number"
+                      value={config.ports?.base_port || 8000}
+                      onChange={(e) => setConfig({
+                        ...config,
+                        ports: { ...config.ports!, base_port: parseInt(e.target.value) }
+                      })}
+                      className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none focus:ring-2 focus:ring-primary-500/50"
+                    />
+                  </div>
+                  <div>
+                    <label className="block text-sm text-text-secondary mb-2">Step</label>
+                    <input
+                      type="number"
+                      value={config.ports?.offset?.step || 10}
+                      onChange={(e) => setConfig({
+                        ...config,
+                        ports: {
+                          ...config.ports!,
+                          offset: { ...config.ports!.offset!, step: parseInt(e.target.value) }
+                        }
+                      })}
+                      className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none focus:ring-2 focus:ring-primary-500/50"
+                    />
+                  </div>
+                  <div>
+                    <label className="block text-sm text-text-secondary mb-2">Max Offset</label>
+                    <input
+                      type="number"
+                      value={config.ports?.offset?.max || 100}
+                      onChange={(e) => setConfig({
+                        ...config,
+                        ports: {
+                          ...config.ports!,
+                          offset: { ...config.ports!.offset!, max: parseInt(e.target.value) }
+                        }
+                      })}
+                      className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none focus:ring-2 focus:ring-primary-500/50"
+                    />
+                  </div>
+                </div>
+              )}
+            </section>
+
+            {/* Other Environment Variables */}
+            {otherVars.length > 0 && (
+              <section>
+                <h3 className="text-lg font-semibold mb-4">Other Environment Variables</h3>
+                <p className="text-sm text-text-muted mb-4">
+                  Check variables that should have the environment name appended (e.g., DB_NAME becomes DB_NAME_envname)
+                </p>
+                <div className="space-y-2">
+                  {otherVars.map((envVar) => (
+                    <div
+                      key={envVar.name}
+                      className="flex items-center gap-3 p-3 bg-surface-700/50 rounded-lg hover:bg-surface-700 transition-colors"
+                      data-testid={`env-var-${envVar.name}`}
+                    >
+                      <button
+                        onClick={() => toggleAppendEnvName(envVar.name)}
+                        className={`
+                          w-5 h-5 rounded border-2 flex items-center justify-center transition-colors
+                          ${appendEnvName[envVar.name]
+                            ? 'bg-primary-500 border-primary-500'
+                            : 'border-surface-500 hover:border-surface-400'
+                          }
+                        `}
+                        data-testid={`append-env-checkbox-${envVar.name}`}
+                      >
+                        {appendEnvName[envVar.name] && <Check className="w-3 h-3 text-white" />}
+                      </button>
+                      <code className="flex-1 text-sm text-text-primary">{envVar.name}</code>
+                      <span className="text-xs text-text-muted font-mono">{envVar.default_value}</span>
+                      {appendEnvName[envVar.name] && (
+                        <span className="text-xs bg-primary-500/20 text-primary-400 px-2 py-1 rounded">
+                          Append env name
+                        </span>
+                      )}
+                    </div>
+                  ))}
+                </div>
+              </section>
+            )}
+
+            {error && (
+              <div className="p-3 bg-red-500/20 border border-red-500/30 rounded-lg text-red-400 text-sm">
+                {error}
+              </div>
+            )}
+          </div>
+        ) : null}
+
+        {/* Footer */}
+        <div className="sticky bottom-0 bg-surface-800 border-t border-surface-700 p-6 flex gap-3 justify-end">
+          <button
+            onClick={onClose}
+            className="px-4 py-2 rounded-lg bg-surface-700 hover:bg-surface-600 transition-colors"
+            data-testid="cancel-config-button"
+          >
+            Cancel
+          </button>
+          <button
+            onClick={handleSave}
+            disabled={isSaving}
+            className="px-4 py-2 rounded-lg bg-primary-500 hover:bg-primary-600 disabled:opacity-50 transition-colors flex items-center gap-2"
+            data-testid="save-config-button"
+          >
+            <Save className="w-4 h-4" />
+            {isSaving ? 'Saving...' : 'Save Configuration'}
+          </button>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/components/ProjectManager.tsx b/ushadow/launcher/src/components/ProjectManager.tsx
new file mode 100644
index 00000000..19b256df
--- /dev/null
+++ b/ushadow/launcher/src/components/ProjectManager.tsx
@@ -0,0 +1,102 @@
+import { useState } from 'react'
+import { nanoid } from 'nanoid'
+import { ProjectsPanel } from './ProjectsPanel'
+import { ProjectSetupDialog } from './ProjectSetupDialog'
+import { StartupConfigPanel } from './StartupConfigPanel'
+import { useAppStore, type ProjectConfig } from '../store/appStore'
+import { tauri } from '../hooks/useTauri'
+
+export function ProjectManager() {
+  const { projects, activeProjectId, addProject, removeProject, setActiveProject } = useAppStore()
+  const [showSetupDialog, setShowSetupDialog] = useState(false)
+
+  const handleAddProject = () => {
+    setShowSetupDialog(true)
+  }
+
+  const handleSetupComplete = async (rootPath: string, worktreesPath: string) => {
+    try {
+      // Load the config to get project name and display name
+      const configPath = `${rootPath}/.launcher-config.yaml`
+
+      let projectName = 'unknown'
+      let displayName = 'Unknown Project'
+
+      try {
+        // Try to load config from the project root
+        const config = await tauri.loadProjectConfig(rootPath)
+        projectName = config.project.name
+        displayName = config.project.display_name
+      } catch (err) {
+        // Config doesn't exist or is invalid - fall back to folder name
+        console.warn('Failed to load config, using folder name:', err)
+        const folderName = rootPath.split('/').pop() || 'unknown'
+        projectName = folderName
+        displayName = folderName.charAt(0).toUpperCase() + folderName.slice(1)
+      }
+
+      const newProject: ProjectConfig = {
+        id: nanoid(),
+        name: projectName,
+        displayName,
+        rootPath,
+        worktreesPath,
+        configPath,
+        addedAt: Date.now(),
+      }
+
+      addProject(newProject)
+      setActiveProject(newProject.id)
+      setShowSetupDialog(false)
+    } catch (err) {
+      console.error('Failed to add project:', err)
+    }
+  }
+
+  const handleSelectProject = (projectId: string) => {
+    setActiveProject(projectId)
+  }
+
+  const handleRemoveProject = (projectId: string) => {
+    // Don't allow removing the active project
+    if (projectId === activeProjectId) {
+      return
+    }
+    removeProject(projectId)
+  }
+
+  // Get the active project for dialog defaults
+  const activeProject = projects.find(p => p.id === activeProjectId)
+  const defaultPath = activeProject?.rootPath || ''
+
+  return (
+    <div className="space-y-4">
+      <ProjectsPanel
+        projects={projects}
+        activeProjectId={activeProjectId}
+        onAddProject={handleAddProject}
+        onSelectProject={handleSelectProject}
+        onRemoveProject={handleRemoveProject}
+      />
+
+      {/* Show startup configuration for active project */}
+      {activeProject && (
+        <StartupConfigPanel
+          projectRoot={activeProject.rootPath}
+          onSave={(config) => {
+            console.log('Startup config saved:', config)
+            // TODO: Save to backend
+          }}
+        />
+      )}
+
+      <ProjectSetupDialog
+        isOpen={showSetupDialog}
+        projectName="project" // Generic name for multi-project mode
+        defaultPath={defaultPath}
+        onClose={() => setShowSetupDialog(false)}
+        onSetup={handleSetupComplete}
+      />
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/components/ProjectSetupDialog.tsx b/ushadow/launcher/src/components/ProjectSetupDialog.tsx
index 22ba4099..7cd28f3e 100644
--- a/ushadow/launcher/src/components/ProjectSetupDialog.tsx
+++ b/ushadow/launcher/src/components/ProjectSetupDialog.tsx
@@ -5,6 +5,7 @@ import { join } from '@tauri-apps/api/path'
 
 interface ProjectSetupDialogProps {
   isOpen: boolean
+  projectName?: string // e.g., "ushadow", "myproject" - defaults to "ushadow"
   defaultPath: string
   defaultWorktreesPath?: string
   onClose: () => void
@@ -18,6 +19,7 @@ interface ProjectStatus {
 
 export function ProjectSetupDialog({
   isOpen,
+  projectName = 'ushadow',
   defaultPath,
   defaultWorktreesPath,
   onClose,
@@ -28,8 +30,11 @@ export function ProjectSetupDialog({
   const [worktreesPath, setWorktreesPath] = useState<string | null>(null)
   const [projectStatus, setProjectStatus] = useState<ProjectStatus | null>(null)
 
-  const title = 'Configure Folders'
-  const description = 'Select a parent folder. The Ushadow project will be in ushadow/, and worktrees in worktrees/ushadow/.'
+  const isMultiProjectMode = projectName === 'project'
+  const title = isMultiProjectMode ? 'Add Project' : 'Configure Folders'
+  const description = isMultiProjectMode
+    ? 'Select the project folder. Worktrees will be created in ../worktrees/[projectname]/ relative to the project.'
+    : 'Select a parent folder. The Ushadow project will be in ushadow/, and worktrees in worktrees/ushadow/.'
 
   // Reset when dialog closes
   useEffect(() => {
@@ -41,28 +46,64 @@ export function ProjectSetupDialog({
   // Calculate the full install path and worktrees path using cross-platform path joining
   useEffect(() => {
     if (parentPath) {
-      Promise.all([
-        join(parentPath, 'ushadow'),
-        join(parentPath, 'worktrees', 'ushadow')
-      ]).then(async ([installPath, defaultWorktreesPath]) => {
-        setFullInstallPath(installPath)
-        setWorktreesPath(defaultWorktreesPath)
-
-        // Check if this path already has a ushadow repo
-        try {
-          const status = await invoke<ProjectStatus>('check_project_dir', { path: installPath })
-          setProjectStatus(status)
-        } catch (err) {
-          console.error('Failed to check project directory:', err)
-          setProjectStatus(null)
-        }
-      })
+      // For multi-project mode (projectName="project"), treat selected folder as the project root directly
+      // For single-project mode (projectName="ushadow"), create subdirectories
+      const isMultiProjectMode = projectName === 'project'
+
+      if (isMultiProjectMode) {
+        // Multi-project: selected folder IS the project root
+        // Worktrees go in ../worktrees/projectname (sibling to project)
+        const pathParts = parentPath.split(/[/\\]/)
+        const folderName = pathParts.pop() || 'project'
+        const grandParent = pathParts.join('/')
+
+        join(grandParent, 'worktrees', folderName).then(async (worktreesPath) => {
+          setFullInstallPath(parentPath)  // Use selected folder directly
+          setWorktreesPath(worktreesPath)  // ../worktrees/projectname
+
+          // For multi-project mode, just check if .git exists (don't require ushadow-specific files)
+          try {
+            const gitPath = await join(parentPath, '.git')
+            // Use a simple file system check instead of check_project_dir
+            const pathExists = await invoke('check_install_path', { path: gitPath })
+            setProjectStatus({
+              path: parentPath,
+              exists: true,
+              is_valid_repo: pathExists
+            })
+          } catch (err) {
+            console.error('Failed to check git directory:', err)
+            setProjectStatus({
+              path: parentPath,
+              exists: true,
+              is_valid_repo: false
+            })
+          }
+        })
+      } else {
+        // Single-project: create subdirectories under parent
+        Promise.all([
+          join(parentPath, projectName),
+          join(parentPath, 'worktrees', projectName)
+        ]).then(async ([installPath, defaultWorktreesPath]) => {
+          setFullInstallPath(installPath)
+          setWorktreesPath(defaultWorktreesPath)
+
+          try {
+            const status = await invoke<ProjectStatus>('check_project_dir', { path: installPath })
+            setProjectStatus(status)
+          } catch (err) {
+            console.error('Failed to check project directory:', err)
+            setProjectStatus(null)
+          }
+        })
+      }
     } else {
       setFullInstallPath(null)
       setWorktreesPath(null)
       setProjectStatus(null)
     }
-  }, [parentPath])
+  }, [parentPath, projectName])
 
   if (!isOpen) return null
 
@@ -71,7 +112,7 @@ export function ProjectSetupDialog({
       directory: true,
       multiple: false,
       defaultPath: parentPath || defaultPath || undefined,
-      title: 'Choose parent folder for Ushadow',
+      title: `Choose parent folder for ${projectName}`,
     })
 
     if (selected && typeof selected === 'string') {
@@ -85,8 +126,8 @@ export function ProjectSetupDialog({
     }
 
     // If paths aren't ready yet, compute them now
-    const pathToUse = fullInstallPath || (parentPath ? await join(parentPath, 'ushadow') : null)
-    const worktreesToUse = worktreesPath || (parentPath ? await join(parentPath, 'worktrees') : null)
+    const pathToUse = fullInstallPath || (parentPath ? await join(parentPath, projectName) : null)
+    const worktreesToUse = worktreesPath || (parentPath ? await join(parentPath, 'worktrees', projectName) : null)
 
     if (!pathToUse || !worktreesToUse) {
       return
@@ -126,11 +167,15 @@ export function ProjectSetupDialog({
             <div className="flex-1 text-left">
               {parentPath ? (
                 <>
-                  <p className="text-xs text-text-muted mb-1">Parent folder:</p>
+                  <p className="text-xs text-text-muted mb-1">
+                    {isMultiProjectMode ? 'Project folder:' : 'Parent folder:'}
+                  </p>
                   <p className="text-sm font-medium truncate">{parentPath}</p>
                 </>
               ) : (
-                <p className="text-sm text-text-secondary">Click to choose parent folder...</p>
+                <p className="text-sm text-text-secondary">
+                  {isMultiProjectMode ? 'Click to choose project folder...' : 'Click to choose parent folder...'}
+                </p>
               )}
             </div>
           </button>
@@ -146,17 +191,26 @@ export function ProjectSetupDialog({
                 <>
                   <div className="flex items-center gap-2 mb-1">
                     <CheckCircle className="w-4 h-4 text-green-400" />
-                    <p className="text-xs text-green-400">Existing Ushadow repository found:</p>
+                    <p className="text-xs text-green-400">
+                      {isMultiProjectMode ? 'Existing git repository found:' : `Existing ${projectName} repository found:`}
+                    </p>
                   </div>
                   <p className="text-sm font-mono text-green-300 break-all">{fullInstallPath}</p>
                   <p className="text-xs text-green-400/70 mt-2">Will link to this existing installation</p>
                 </>
               ) : (
                 <>
-                  <p className="text-xs text-primary-400 mb-1">Project folder:</p>
+                  <p className="text-xs text-primary-400 mb-1">
+                    {isMultiProjectMode ? 'Project root:' : 'Project folder:'}
+                  </p>
                   <p className="text-sm font-mono text-primary-300 break-all">{fullInstallPath}</p>
                   {projectStatus?.exists && !projectStatus?.is_valid_repo && (
-                    <p className="text-xs text-yellow-400 mt-2">Folder exists but is not a valid Ushadow repository</p>
+                    <p className="text-xs text-yellow-400 mt-2">
+                      {isMultiProjectMode
+                        ? 'Folder exists but is not a valid git repository'
+                        : `Folder exists but is not a valid ${projectName} repository`
+                      }
+                    </p>
                   )}
                 </>
               )}
diff --git a/ushadow/launcher/src/components/ProjectsPanel.tsx b/ushadow/launcher/src/components/ProjectsPanel.tsx
new file mode 100644
index 00000000..10399e07
--- /dev/null
+++ b/ushadow/launcher/src/components/ProjectsPanel.tsx
@@ -0,0 +1,124 @@
+import { useState } from 'react'
+import { Plus, FolderOpen, Trash2, Check } from 'lucide-react'
+import type { ProjectConfig } from '../store/appStore'
+
+interface ProjectsPanelProps {
+  projects: ProjectConfig[]
+  activeProjectId: string | null
+  onAddProject: () => void
+  onSelectProject: (projectId: string) => void
+  onRemoveProject: (projectId: string) => void
+}
+
+export function ProjectsPanel({
+  projects,
+  activeProjectId,
+  onAddProject,
+  onSelectProject,
+  onRemoveProject,
+}: ProjectsPanelProps) {
+  const [confirmDelete, setConfirmDelete] = useState<string | null>(null)
+
+  const handleRemoveClick = (projectId: string, e: React.MouseEvent) => {
+    e.stopPropagation()
+
+    if (confirmDelete === projectId) {
+      // Second click - confirm deletion
+      onRemoveProject(projectId)
+      setConfirmDelete(null)
+    } else {
+      // First click - show confirmation
+      setConfirmDelete(projectId)
+      // Reset after 3 seconds
+      setTimeout(() => setConfirmDelete(null), 3000)
+    }
+  }
+
+  return (
+    <div className="bg-surface-800 rounded-lg" data-testid="projects-panel">
+      {/* Header */}
+      <div className="flex items-center justify-between p-4 border-b border-surface-700">
+        <h3 className="font-medium text-text-primary">Projects</h3>
+        <button
+          onClick={onAddProject}
+          className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg bg-primary-600 hover:bg-primary-700 transition-colors text-sm"
+          title="Add project"
+          data-testid="add-project-button"
+        >
+          <Plus className="w-4 h-4" />
+          <span>Add Project</span>
+        </button>
+      </div>
+
+      {/* Projects List */}
+      <div className="p-2 space-y-1" data-testid="projects-list">
+        {projects.length === 0 ? (
+          <div className="text-center py-8 text-text-muted text-sm">
+            <FolderOpen className="w-8 h-8 mx-auto mb-2 opacity-50" />
+            <p>No projects configured</p>
+            <p className="text-xs mt-1">Click "Add Project" to get started</p>
+          </div>
+        ) : (
+          projects.map((project) => {
+            const isActive = project.id === activeProjectId
+            const isConfirmingDelete = confirmDelete === project.id
+
+            return (
+              <div
+                key={project.id}
+                onClick={() => onSelectProject(project.id)}
+                className={`
+                  flex items-center gap-3 px-3 py-2.5 rounded-lg cursor-pointer transition-colors
+                  ${isActive
+                    ? 'bg-primary-600/20 border border-primary-500/40'
+                    : 'hover:bg-surface-700/50 border border-transparent'
+                  }
+                `}
+                data-testid={`project-item-${project.id}`}
+              >
+                {/* Active Indicator */}
+                <div className="flex-shrink-0">
+                  {isActive ? (
+                    <div className="w-5 h-5 rounded-full bg-primary-500 flex items-center justify-center">
+                      <Check className="w-3 h-3 text-white" />
+                    </div>
+                  ) : (
+                    <div className="w-5 h-5 rounded-full border-2 border-surface-600" />
+                  )}
+                </div>
+
+                {/* Project Info */}
+                <div className="flex-1 min-w-0">
+                  <p className={`font-medium truncate ${isActive ? 'text-primary-300' : 'text-text-primary'}`}>
+                    {project.displayName}
+                  </p>
+                  <p className="text-xs text-text-muted truncate" title={project.rootPath}>
+                    {project.rootPath}
+                  </p>
+                </div>
+
+                {/* Remove Button */}
+                {!isActive && (
+                  <button
+                    onClick={(e) => handleRemoveClick(project.id, e)}
+                    className={`
+                      p-1.5 rounded transition-colors flex-shrink-0
+                      ${isConfirmingDelete
+                        ? 'bg-red-500/20 text-red-400 hover:bg-red-500/30'
+                        : 'text-text-muted hover:text-red-400 hover:bg-red-500/10'
+                      }
+                    `}
+                    title={isConfirmingDelete ? 'Click again to confirm' : 'Remove project'}
+                    data-testid={`remove-project-${project.id}`}
+                  >
+                    <Trash2 className="w-4 h-4" />
+                  </button>
+                )}
+              </div>
+            )
+          })
+        )}
+      </div>
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/components/SettingsDialog.tsx b/ushadow/launcher/src/components/SettingsDialog.tsx
index b9b40cbc..80da1484 100644
--- a/ushadow/launcher/src/components/SettingsDialog.tsx
+++ b/ushadow/launcher/src/components/SettingsDialog.tsx
@@ -1,6 +1,7 @@
 import { useState, useEffect } from 'react'
-import { X, Settings, Eye, EyeOff, Save } from 'lucide-react'
+import { X, Settings, Save, FolderGit2, Terminal, Trello } from 'lucide-react'
 import { tauri, type LauncherSettings } from '../hooks/useTauri'
+import { useAppStore } from '../store/appStore'
 
 interface SettingsDialogProps {
   isOpen: boolean
@@ -8,12 +9,18 @@ interface SettingsDialogProps {
 }
 
 export function SettingsDialog({ isOpen, onClose }: SettingsDialogProps) {
+  const { multiProjectMode, setMultiProjectMode, kanbanEnabled, setKanbanEnabled } = useAppStore()
   const [settings, setSettings] = useState<LauncherSettings>({
     default_admin_email: null,
     default_admin_password: null,
     default_admin_name: null,
+    coding_agent: {
+      agent_type: 'claude',
+      command: 'claude',
+      args: ['--dangerously-skip-permissions'],
+      auto_start: true,
+    },
   })
-  const [showPassword, setShowPassword] = useState(false)
   const [isSaving, setIsSaving] = useState(false)
   const [saveSuccess, setSaveSuccess] = useState(false)
   const [isLoading, setIsLoading] = useState(true)
@@ -56,7 +63,7 @@ export function SettingsDialog({ isOpen, onClose }: SettingsDialogProps) {
     }
   }
 
-  const isValid = settings.default_admin_email && settings.default_admin_password
+  const isValid = settings.coding_agent.command.trim().length > 0
 
   return (
     <div
@@ -85,66 +92,156 @@ export function SettingsDialog({ isOpen, onClose }: SettingsDialogProps) {
           </div>
         ) : (
           <>
-            {/* Description */}
-            <p className="text-sm text-text-secondary mb-6">
-              Configure default admin credentials that will be used for all new environments.
-              These credentials are stored locally and used to auto-create users.
-            </p>
+            {/* Coding Agent Section */}
+            <div className="mb-6">
+              <div className="flex items-center gap-2 mb-3">
+                <Terminal className="w-4 h-4 text-primary-400" />
+                <h3 className="text-sm font-medium">Coding Agent</h3>
+              </div>
+              <p className="text-xs text-text-muted mb-4">
+                Configure which coding agent CLI to use when working on tickets
+              </p>
+
+              {/* Agent Type */}
+              <div className="mb-3">
+                <label className="block text-xs text-text-secondary mb-1">
+                  Agent Type
+                </label>
+                <input
+                  type="text"
+                  value={settings.coding_agent.agent_type}
+                  onChange={(e) => setSettings({
+                    ...settings,
+                    coding_agent: { ...settings.coding_agent, agent_type: e.target.value }
+                  })}
+                  className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none text-sm focus:ring-2 focus:ring-primary-500/50"
+                  placeholder="claude"
+                  data-testid="settings-agent-type"
+                />
+              </div>
 
-            {/* Admin Name */}
-            <div className="mb-4">
-              <label className="block text-sm text-text-secondary mb-2">
-                Admin Name <span className="text-text-muted">(optional)</span>
-              </label>
-              <input
-                type="text"
-                value={settings.default_admin_name || ''}
-                onChange={(e) => setSettings({ ...settings, default_admin_name: e.target.value || null })}
-                className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none text-sm focus:ring-2 focus:ring-primary-500/50"
-                placeholder="Administrator"
-                data-testid="settings-admin-name"
-              />
+              {/* Command */}
+              <div className="mb-3">
+                <label className="block text-xs text-text-secondary mb-1">
+                  Command
+                </label>
+                <input
+                  type="text"
+                  value={settings.coding_agent.command}
+                  onChange={(e) => setSettings({
+                    ...settings,
+                    coding_agent: { ...settings.coding_agent, command: e.target.value }
+                  })}
+                  className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none text-sm focus:ring-2 focus:ring-primary-500/50"
+                  placeholder="claude"
+                  data-testid="settings-agent-command"
+                />
+              </div>
+
+              {/* Arguments */}
+              <div className="mb-3">
+                <label className="block text-xs text-text-secondary mb-1">
+                  Arguments (comma-separated)
+                </label>
+                <input
+                  type="text"
+                  value={settings.coding_agent.args.join(', ')}
+                  onChange={(e) => setSettings({
+                    ...settings,
+                    coding_agent: {
+                      ...settings.coding_agent,
+                      args: e.target.value.split(',').map(s => s.trim()).filter(Boolean)
+                    }
+                  })}
+                  className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none text-sm focus:ring-2 focus:ring-primary-500/50"
+                  placeholder="--dangerously-skip-permissions"
+                  data-testid="settings-agent-args"
+                />
+              </div>
+
+              {/* Auto-start Toggle */}
+              <div className="flex items-center justify-between">
+                <label className="text-xs text-text-secondary">
+                  Auto-start agent when ticket is assigned
+                </label>
+                <button
+                  onClick={() => setSettings({
+                    ...settings,
+                    coding_agent: { ...settings.coding_agent, auto_start: !settings.coding_agent.auto_start }
+                  })}
+                  className={`relative w-11 h-6 rounded-full transition-colors ${
+                    settings.coding_agent.auto_start ? 'bg-primary-500' : 'bg-surface-600'
+                  }`}
+                  data-testid="toggle-auto-start"
+                >
+                  <div
+                    className={`absolute top-1 w-4 h-4 bg-white rounded-full transition-transform ${
+                      settings.coding_agent.auto_start ? 'translate-x-6' : 'translate-x-1'
+                    }`}
+                  />
+                </button>
+              </div>
             </div>
 
-            {/* Admin Email */}
-            <div className="mb-4">
-              <label className="block text-sm text-text-secondary mb-2">
-                Admin Email
-              </label>
-              <input
-                type="email"
-                value={settings.default_admin_email || ''}
-                onChange={(e) => setSettings({ ...settings, default_admin_email: e.target.value || null })}
-                className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none text-sm focus:ring-2 focus:ring-primary-500/50"
-                placeholder="admin@example.com"
-                autoFocus
-                data-testid="settings-admin-email"
-              />
+            {/* Divider */}
+            <div className="my-6 border-t border-surface-700" />
+
+            {/* Multi-Project Mode Toggle */}
+            <div className="mb-6">
+              <div className="flex items-start justify-between mb-2">
+                <div className="flex items-center gap-2">
+                  <FolderGit2 className="w-4 h-4 text-primary-400" />
+                  <label className="text-sm font-medium">Multi-Project Mode</label>
+                  <span className="text-xs bg-primary-500/20 text-primary-400 px-2 py-0.5 rounded">
+                    Experimental
+                  </span>
+                </div>
+                <button
+                  onClick={() => setMultiProjectMode(!multiProjectMode)}
+                  className={`relative w-11 h-6 rounded-full transition-colors ${
+                    multiProjectMode ? 'bg-primary-500' : 'bg-surface-600'
+                  }`}
+                  data-testid="toggle-multi-project-mode"
+                >
+                  <div
+                    className={`absolute top-1 w-4 h-4 bg-white rounded-full transition-transform ${
+                      multiProjectMode ? 'translate-x-6' : 'translate-x-1'
+                    }`}
+                  />
+                </button>
+              </div>
+              <p className="text-xs text-text-muted">
+                Manage multiple codebases beyond ushadow. Each project can have its own configuration and worktrees.
+              </p>
             </div>
 
-            {/* Admin Password */}
+            {/* Kanban Board Toggle */}
             <div className="mb-6">
-              <label className="block text-sm text-text-secondary mb-2">
-                Admin Password
-              </label>
-              <div className="relative">
-                <input
-                  type={showPassword ? 'text' : 'password'}
-                  value={settings.default_admin_password || ''}
-                  onChange={(e) => setSettings({ ...settings, default_admin_password: e.target.value || null })}
-                  className="w-full bg-surface-700 rounded-lg px-3 py-2 pr-10 outline-none text-sm focus:ring-2 focus:ring-primary-500/50"
-                  placeholder="••••••••"
-                  data-testid="settings-admin-password"
-                />
+              <div className="flex items-start justify-between mb-2">
+                <div className="flex items-center gap-2">
+                  <Trello className="w-4 h-4 text-primary-400" />
+                  <label className="text-sm font-medium">Kanban Board</label>
+                  <span className="text-xs bg-primary-500/20 text-primary-400 px-2 py-0.5 rounded">
+                    Experimental
+                  </span>
+                </div>
                 <button
-                  type="button"
-                  onClick={() => setShowPassword(!showPassword)}
-                  className="absolute right-2 top-1/2 -translate-y-1/2 text-text-muted hover:text-text-primary"
-                  data-testid="toggle-password-visibility"
+                  onClick={() => setKanbanEnabled(!kanbanEnabled)}
+                  className={`relative w-11 h-6 rounded-full transition-colors ${
+                    kanbanEnabled ? 'bg-primary-500' : 'bg-surface-600'
+                  }`}
+                  data-testid="toggle-kanban-enabled"
                 >
-                  {showPassword ? <EyeOff className="w-5 h-5" /> : <Eye className="w-5 h-5" />}
+                  <div
+                    className={`absolute top-1 w-4 h-4 bg-white rounded-full transition-transform ${
+                      kanbanEnabled ? 'translate-x-6' : 'translate-x-1'
+                    }`}
+                  />
                 </button>
               </div>
+              <p className="text-xs text-text-muted">
+                Enable ticket tracking with a Kanban board. Create tickets, link them to worktrees, and manage development workflows.
+              </p>
             </div>
 
             {/* Success Message */}
@@ -184,7 +281,7 @@ export function SettingsDialog({ isOpen, onClose }: SettingsDialogProps) {
 
             {/* Helper text */}
             <p className="text-xs text-text-muted mt-4">
-              💡 These credentials will be used to automatically create an admin user when you create a new environment.
+              💡 The coding agent will be automatically started in the tmux window when you assign a ticket to an environment.
             </p>
           </>
         )}
diff --git a/ushadow/launcher/src/components/StartupConfigPanel.tsx b/ushadow/launcher/src/components/StartupConfigPanel.tsx
new file mode 100644
index 00000000..2868393b
--- /dev/null
+++ b/ushadow/launcher/src/components/StartupConfigPanel.tsx
@@ -0,0 +1,77 @@
+import { useState, useEffect } from 'react'
+import { Save } from 'lucide-react'
+
+interface StartupConfigPanelProps {
+  projectRoot: string
+  onSave?: (config: StartupConfig) => void
+}
+
+export interface StartupConfig {
+  command: string
+}
+
+export function StartupConfigPanel({ projectRoot, onSave }: StartupConfigPanelProps) {
+  const [command, setCommand] = useState('')
+  const [isSaved, setIsSaved] = useState(false)
+
+  // Load existing config if available
+  useEffect(() => {
+    // TODO: Load from backend
+    setCommand('./go.sh')
+  }, [projectRoot])
+
+  const handleSave = () => {
+    const config: StartupConfig = { command }
+
+    console.log('Saving startup config:', config)
+    if (onSave) onSave(config)
+
+    setIsSaved(true)
+    setTimeout(() => setIsSaved(false), 2000)
+  }
+
+  return (
+    <div className="bg-surface-800 rounded-lg p-6" data-testid="startup-config-panel">
+      <div className="flex items-center justify-between mb-4">
+        <h3 className="text-lg font-semibold">Environment Startup</h3>
+        <button
+          onClick={handleSave}
+          className={`
+            flex items-center gap-2 px-3 py-1.5 rounded-lg transition-all
+            ${isSaved
+              ? 'bg-green-500/20 text-green-400'
+              : 'bg-primary-500 hover:bg-primary-600 text-white'
+            }
+          `}
+          data-testid="save-startup-config"
+        >
+          <Save className="w-4 h-4" />
+          {isSaved ? 'Saved!' : 'Save'}
+        </button>
+      </div>
+
+      <div>
+        <label className="block text-sm text-text-secondary mb-2">
+          Command or script to start the environment
+        </label>
+        <textarea
+          value={command}
+          onChange={(e) => setCommand(e.target.value)}
+          placeholder={`./go.sh
+
+or paste bash code:
+
+#!/bin/bash
+OFFSET=\${PORT_OFFSET:-0}
+export BACKEND_PORT=$((8000 + OFFSET))
+docker compose up -d`}
+          className="w-full bg-surface-700 rounded-lg px-3 py-2 outline-none focus:ring-2 focus:ring-primary-500/50 font-mono text-sm h-48 resize-y"
+          data-testid="startup-command-input"
+        />
+        <p className="text-xs text-text-muted mt-2">
+          Available environment variables: PROJECT_ROOT, WORKTREE_PATH, PORT_OFFSET, ENV_NAME
+        </p>
+      </div>
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/components/TicketCard.tsx b/ushadow/launcher/src/components/TicketCard.tsx
new file mode 100644
index 00000000..76117574
--- /dev/null
+++ b/ushadow/launcher/src/components/TicketCard.tsx
@@ -0,0 +1,183 @@
+import { useState } from 'react'
+import { Tag, Folder, GitBranch, Terminal, Clock, AlertCircle } from 'lucide-react'
+import type { Ticket, Epic } from './KanbanBoard'
+import { TicketDetailDialog } from './TicketDetailDialog'
+import { EnvironmentBadge } from './EnvironmentBadge'
+
+interface TicketCardProps {
+  ticket: Ticket
+  epics: Epic[]
+  onUpdate: () => void
+  backendUrl: string
+  projectRoot: string
+}
+
+const PRIORITY_COLORS = {
+  low: 'bg-gray-600',
+  medium: 'bg-blue-600',
+  high: 'bg-orange-600',
+  urgent: 'bg-red-600',
+}
+
+const PRIORITY_LABELS = {
+  low: 'Low',
+  medium: 'Medium',
+  high: 'High',
+  urgent: 'Urgent',
+}
+
+export function TicketCard({ ticket, epics, onUpdate, backendUrl, projectRoot }: TicketCardProps) {
+  const [isDragging, setIsDragging] = useState(false)
+  const [showDetail, setShowDetail] = useState(false)
+
+  // Find epic for this ticket
+  const epic = ticket.epic_id ? epics.find(e => e.id === ticket.epic_id) : null
+
+  // Determine color: ticket color > epic color > generated color
+  const getCardColor = (): string => {
+    if (ticket.color) return ticket.color
+    if (epic?.color) return epic.color
+    // Generate color from ticket ID hash
+    const hash = ticket.id.split('').reduce((acc, char) => acc + char.charCodeAt(0), 0)
+    const hue = hash % 360
+    return `hsl(${hue}, 70%, 60%)`
+  }
+
+  const cardColor = getCardColor()
+
+  // Convert hex/hsl to rgb for border
+  const getBorderStyle = () => {
+    return {
+      borderLeft: `4px solid ${cardColor}`,
+    }
+  }
+
+  const handleDragStart = (e: React.DragEvent) => {
+    setIsDragging(true)
+    e.dataTransfer.effectAllowed = 'move'
+    e.dataTransfer.setData('text/plain', ticket.id)
+  }
+
+  const handleDragEnd = () => {
+    setIsDragging(false)
+  }
+
+  return (
+    <>
+      <div
+        draggable
+        onDragStart={handleDragStart}
+        onDragEnd={handleDragEnd}
+        onClick={() => setShowDetail(true)}
+        style={getBorderStyle()}
+        className={`
+          bg-gray-900 rounded p-3 cursor-pointer hover:bg-gray-850 transition-colors
+          ${isDragging ? 'opacity-50' : ''}
+        `}
+        data-testid={`ticket-card-${ticket.id}`}
+      >
+      {/* Header */}
+      <div className="flex items-start justify-between mb-2">
+        <h3 className="text-sm font-medium text-white flex-1 pr-2" data-testid="ticket-card-title">
+          {ticket.title}
+        </h3>
+        <span
+          className={`text-xs px-2 py-0.5 rounded text-white ${PRIORITY_COLORS[ticket.priority]}`}
+          data-testid="ticket-card-priority"
+        >
+          {PRIORITY_LABELS[ticket.priority]}
+        </span>
+      </div>
+
+      {/* Description */}
+      {ticket.description && (
+        <p className="text-xs text-gray-400 mb-2 line-clamp-2" data-testid="ticket-card-description">
+          {ticket.description}
+        </p>
+      )}
+
+      {/* Badges Row - Epic and Environment */}
+      {(epic || ticket.environment_name) && (
+        <div className="flex flex-wrap gap-2 mb-2">
+          {epic && (
+            <div
+              className="flex items-center gap-1.5 text-xs px-2 py-1 rounded"
+              style={{ backgroundColor: `${epic.color}20`, color: epic.color }}
+              data-testid="ticket-card-epic"
+            >
+              <Folder className="w-3 h-3" />
+              <span>{epic.title}</span>
+            </div>
+          )}
+
+          {ticket.environment_name && (
+            <EnvironmentBadge
+              name={ticket.environment_name}
+              variant="badge"
+              showIcon={true}
+              testId="ticket-card-environment"
+            />
+          )}
+        </div>
+      )}
+
+      {/* Tags */}
+      {ticket.tags.length > 0 && (
+        <div className="flex flex-wrap gap-1 mb-2" data-testid="ticket-card-tags">
+          {ticket.tags.map((tag, idx) => (
+            <span
+              key={idx}
+              className="flex items-center gap-1 text-xs px-2 py-0.5 bg-gray-800 text-gray-300 rounded"
+            >
+              <Tag className="w-3 h-3" />
+              {tag}
+            </span>
+          ))}
+        </div>
+      )}
+
+      {/* Footer Metadata */}
+      <div className="flex items-center gap-3 text-xs text-gray-500 pt-2 border-t border-gray-800">
+        {/* Branch */}
+        {ticket.branch_name && (
+          <div className="flex items-center gap-1" data-testid="ticket-card-branch">
+            <GitBranch className="w-3 h-3" />
+            <span className="truncate">{ticket.branch_name}</span>
+          </div>
+        )}
+
+        {/* Tmux Window */}
+        {ticket.tmux_window_name && (
+          <div
+            className="flex items-center gap-1 text-green-500"
+            title="Tmux window active"
+            data-testid="ticket-card-tmux"
+          >
+            <Terminal className="w-3 h-3" />
+            <span>Active</span>
+          </div>
+        )}
+
+        {/* ID */}
+        <div className="ml-auto text-gray-600" data-testid="ticket-card-id">
+          #{ticket.id.slice(-6)}
+        </div>
+      </div>
+    </div>
+
+      {/* Detail Dialog */}
+      <TicketDetailDialog
+        ticket={ticket}
+        epics={epics}
+        isOpen={showDetail}
+        onClose={() => setShowDetail(false)}
+        onUpdated={() => {
+          setShowDetail(false)
+          onUpdate()
+        }}
+        projectRoot={projectRoot}
+        backendUrl={backendUrl}
+      />
+    </>
+  )
+}
diff --git a/ushadow/launcher/src/components/TicketDetailDialog.tsx b/ushadow/launcher/src/components/TicketDetailDialog.tsx
new file mode 100644
index 00000000..cb1e669c
--- /dev/null
+++ b/ushadow/launcher/src/components/TicketDetailDialog.tsx
@@ -0,0 +1,790 @@
+import { useState, useEffect } from 'react'
+import {
+  X,
+  Save,
+  GitBranch,
+  Terminal,
+  Folder,
+  Tag,
+  Plus,
+  AlertCircle,
+  CheckCircle,
+} from 'lucide-react'
+import type { Ticket, Epic, UshadowEnvironment } from '../hooks/useTauri'
+import { EnvironmentBadge } from './EnvironmentBadge'
+
+interface TicketDetailDialogProps {
+  ticket: Ticket
+  epics: Epic[]
+  isOpen: boolean
+  onClose: () => void
+  onUpdated: () => void
+  projectRoot: string
+  backendUrl: string
+}
+
+const PRIORITY_OPTIONS = [
+  { value: 'low', label: 'Low', color: 'bg-gray-600' },
+  { value: 'medium', label: 'Medium', color: 'bg-blue-600' },
+  { value: 'high', label: 'High', color: 'bg-orange-600' },
+  { value: 'urgent', label: 'Urgent', color: 'bg-red-600' },
+]
+
+const STATUS_OPTIONS = [
+  { value: 'backlog', label: 'Backlog' },
+  { value: 'todo', label: 'To Do' },
+  { value: 'in_progress', label: 'In Progress' },
+  { value: 'in_review', label: 'In Review' },
+  { value: 'done', label: 'Done' },
+  { value: 'archived', label: 'Archived' },
+]
+
+export function TicketDetailDialog({
+  ticket,
+  epics,
+  isOpen,
+  onClose,
+  onUpdated,
+  projectRoot,
+  backendUrl,
+}: TicketDetailDialogProps) {
+  const [title, setTitle] = useState(ticket.title)
+  const [description, setDescription] = useState(ticket.description || '')
+  const [priority, setPriority] = useState(ticket.priority)
+  const [status, setStatus] = useState(ticket.status)
+  const [epicId, setEpicId] = useState(ticket.epic_id || '')
+  const [tagInput, setTagInput] = useState('')
+  const [tags, setTags] = useState<string[]>(ticket.tags)
+  const [saving, setSaving] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [environments, setEnvironments] = useState<UshadowEnvironment[]>([])
+  const [loadingEnvs, setLoadingEnvs] = useState(false)
+  const [creatingWorktree, setCreatingWorktree] = useState(false)
+  const [assigningEnv, setAssigningEnv] = useState(false)
+  const [successMessage, setSuccessMessage] = useState<string | null>(null)
+
+  // Load environments on mount
+  useEffect(() => {
+    if (isOpen) {
+      loadEnvironments()
+    }
+  }, [isOpen])
+
+  const loadEnvironments = async () => {
+    setLoadingEnvs(true)
+    try {
+      const { tauri } = await import('../hooks/useTauri')
+      const discovery = await tauri.discoverEnvironments()
+      setEnvironments(discovery.environments)
+    } catch (err) {
+      console.error('Failed to load environments:', err)
+    } finally {
+      setLoadingEnvs(false)
+    }
+  }
+
+  const handleSave = async () => {
+    setError(null)
+    setSaving(true)
+
+    try {
+      const { tauri } = await import('../hooks/useTauri')
+
+      await tauri.updateTicket(
+        ticket.id,
+        title !== ticket.title ? title : undefined,
+        description !== ticket.description ? description : undefined,
+        status !== ticket.status ? status : undefined,
+        priority !== ticket.priority ? priority : undefined,
+        epicId !== ticket.epic_id ? epicId || undefined : undefined,
+        JSON.stringify(tags) !== JSON.stringify(ticket.tags) ? tags : undefined,
+        undefined // order
+      )
+
+      setSuccessMessage('Ticket updated successfully')
+      setTimeout(() => setSuccessMessage(null), 3000)
+      onUpdated()
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to update ticket')
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const handleAddTag = () => {
+    if (tagInput.trim() && !tags.includes(tagInput.trim())) {
+      setTags([...tags, tagInput.trim()])
+      setTagInput('')
+    }
+  }
+
+  const handleRemoveTag = (tagToRemove: string) => {
+    setTags(tags.filter((t) => t !== tagToRemove))
+  }
+
+  const handleCreateWorktree = async () => {
+    setError(null)
+    setCreatingWorktree(true)
+
+    try {
+      const { tauri } = await import('../hooks/useTauri')
+
+      // Get epic for base branch if ticket has one
+      const epic = epicId ? epics.find((e) => e.id === epicId) : null
+
+      const request = {
+        ticketId: ticket.id,
+        ticketTitle: ticket.title,
+        projectRoot,
+        branchName: undefined, // Will be auto-generated
+        baseBranch: epic?.base_branch || 'main',
+        epicBranch: epic?.branch_name || undefined,
+      }
+
+      const result = await tauri.createTicketWorktree(request)
+
+      // Update ticket with worktree info
+      await tauri.updateTicket(
+        ticket.id,
+        undefined, // title
+        undefined, // description
+        'in_progress', // status - move to in progress when creating worktree
+        undefined, // priority
+        undefined, // epicId
+        undefined, // tags
+        undefined, // order
+        result.worktree_path, // worktreePath
+        result.branch_name, // branchName
+        result.tmux_window_name, // tmuxWindowName
+        result.tmux_session_name // tmuxSessionName
+      )
+
+      // Start coding agent in the tmux window
+      try {
+        await tauri.startCodingAgentForTicket(
+          ticket.id,
+          result.tmux_window_name,
+          result.tmux_session_name,
+          result.worktree_path
+        )
+      } catch (agentErr) {
+        console.error('[TicketDetail] Failed to start coding agent:', agentErr)
+        // Don't fail the whole operation if agent fails to start
+      }
+
+      setSuccessMessage(
+        `Worktree created at ${result.worktree_path} with tmux window ${result.tmux_window_name}`
+      )
+      setTimeout(() => setSuccessMessage(null), 5000)
+      onUpdated()
+      await loadEnvironments()
+    } catch (err) {
+      console.error('[TicketDetail] Error creating worktree:', err)
+      setError(err instanceof Error ? err.message : 'Failed to create worktree')
+    } finally {
+      setCreatingWorktree(false)
+    }
+  }
+
+  const handleAssignToEnvironment = async (env: UshadowEnvironment) => {
+    if (!env.path || !env.branch) {
+      console.error('[TicketDetail] Environment missing required fields:', { env })
+      setError('Environment missing path or branch information')
+      return
+    }
+
+    setError(null)
+    setAssigningEnv(true)
+
+    try {
+      const { tauri } = await import('../hooks/useTauri')
+
+      const result = await tauri.attachTicketToWorktree(ticket.id, env.path, env.branch)
+
+      // Update ticket with environment info
+      await tauri.updateTicket(
+        ticket.id,
+        undefined, // title
+        undefined, // description
+        'in_progress', // status - move to in progress when assigning
+        undefined, // priority
+        undefined, // epicId
+        undefined, // tags
+        undefined, // order
+        result.worktree_path, // worktreePath
+        result.branch_name, // branchName
+        result.tmux_window_name, // tmuxWindowName
+        result.tmux_session_name, // tmuxSessionName
+        env.name // environmentName - save the environment name!
+      )
+
+      // Start coding agent in the tmux window
+      try {
+        await tauri.startCodingAgentForTicket(
+          ticket.id,
+          result.tmux_window_name,
+          result.tmux_session_name,
+          result.worktree_path
+        )
+      } catch (agentErr) {
+        console.error('[TicketDetail] Failed to start coding agent:', agentErr)
+        // Don't fail the whole operation if agent fails to start
+      }
+
+      setSuccessMessage(`Ticket assigned to environment ${env.name}`)
+      setTimeout(() => setSuccessMessage(null), 3000)
+      onUpdated()
+    } catch (err) {
+      console.error('[TicketDetail] Error assigning to environment:', err)
+      setError(err instanceof Error ? err.message : 'Failed to assign to environment')
+    } finally {
+      setAssigningEnv(false)
+    }
+  }
+
+  if (!isOpen) return null
+
+  const selectedEpic = epicId ? epics.find((e) => e.id === epicId) : null
+  const hasAssignment = ticket.worktree_path || ticket.branch_name
+
+  return (
+    <div
+      className="fixed inset-0 flex items-center justify-center z-50 p-4"
+      style={{ backgroundColor: 'rgba(0, 0, 0, 0.6)' }}
+      onClick={onClose}
+      data-testid="ticket-detail-dialog"
+    >
+      <div
+        className="rounded-xl w-full max-w-4xl max-h-[90vh] overflow-y-auto"
+        style={{ backgroundColor: '#1a1a21', border: '1px solid #3d3d4a' }}
+        onClick={(e) => e.stopPropagation()}
+      >
+        {/* Header */}
+        <div
+          className="flex items-center justify-between p-6"
+          style={{ borderBottom: '1px solid #3d3d4a' }}
+        >
+          <h2 className="text-xl font-semibold" style={{ color: '#f4f4f5' }}>
+            Ticket Details
+          </h2>
+          <button
+            onClick={onClose}
+            className="transition-colors"
+            style={{ color: '#a1a1aa' }}
+            onMouseEnter={(e) => (e.currentTarget.style.color = '#f4f4f5')}
+            onMouseLeave={(e) => (e.currentTarget.style.color = '#a1a1aa')}
+            data-testid="ticket-detail-close"
+          >
+            <X className="w-5 h-5" />
+          </button>
+        </div>
+
+        <div className="p-6 space-y-6">
+          {/* Success Message */}
+          {successMessage && (
+            <div
+              className="rounded-lg p-4 flex items-start gap-3"
+              style={{
+                backgroundColor: 'rgba(74, 222, 128, 0.1)',
+                border: '1px solid rgba(74, 222, 128, 0.2)',
+              }}
+              data-testid="ticket-detail-success"
+            >
+              <CheckCircle className="w-5 h-5 mt-0.5 flex-shrink-0" style={{ color: '#4ade80' }} />
+              <div className="flex-1">
+                <p className="text-sm" style={{ color: '#a1a1aa' }}>
+                  {successMessage}
+                </p>
+              </div>
+            </div>
+          )}
+
+          {/* Error Message */}
+          {error && (
+            <div
+              className="rounded-lg p-4 flex items-start gap-3"
+              style={{
+                backgroundColor: 'rgba(248, 113, 113, 0.1)',
+                border: '1px solid rgba(248, 113, 113, 0.2)',
+              }}
+              data-testid="ticket-detail-error"
+            >
+              <AlertCircle className="w-5 h-5 mt-0.5 flex-shrink-0" style={{ color: '#f87171' }} />
+              <div className="flex-1">
+                <p className="text-sm" style={{ color: '#a1a1aa' }}>
+                  {error}
+                </p>
+              </div>
+            </div>
+          )}
+
+          {/* Two Column Layout */}
+          <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
+            {/* Left Column - Basic Info */}
+            <div className="space-y-4">
+              <h3 className="text-lg font-semibold" style={{ color: '#f4f4f5' }}>
+                Basic Information
+              </h3>
+
+              {/* Title */}
+              <div>
+                <label className="block text-sm font-medium mb-2" style={{ color: '#a1a1aa' }}>
+                  Title *
+                </label>
+                <input
+                  type="text"
+                  value={title}
+                  onChange={(e) => setTitle(e.target.value)}
+                  className="w-full px-4 py-2.5 rounded-lg transition-all focus:outline-none"
+                  style={{
+                    backgroundColor: '#252530',
+                    border: '1px solid #52525b',
+                    color: '#f4f4f5',
+                  }}
+                  onFocus={(e) => (e.currentTarget.style.border = '1px solid #4ade80')}
+                  onBlur={(e) => (e.currentTarget.style.border = '1px solid #52525b')}
+                  data-testid="ticket-detail-title"
+                />
+              </div>
+
+              {/* Description */}
+              <div>
+                <label className="block text-sm font-medium mb-2" style={{ color: '#a1a1aa' }}>
+                  Description
+                </label>
+                <textarea
+                  value={description}
+                  onChange={(e) => setDescription(e.target.value)}
+                  className="w-full px-4 py-2.5 rounded-lg h-32 transition-all focus:outline-none"
+                  style={{
+                    backgroundColor: '#252530',
+                    border: '1px solid #52525b',
+                    color: '#f4f4f5',
+                  }}
+                  onFocus={(e) => (e.currentTarget.style.border = '1px solid #4ade80')}
+                  onBlur={(e) => (e.currentTarget.style.border = '1px solid #52525b')}
+                  data-testid="ticket-detail-description"
+                />
+              </div>
+
+              {/* Priority */}
+              <div>
+                <label className="block text-sm font-medium mb-2" style={{ color: '#a1a1aa' }}>
+                  Priority
+                </label>
+                <select
+                  value={priority}
+                  onChange={(e) => setPriority(e.target.value as typeof priority)}
+                  className="w-full px-4 py-2.5 rounded-lg transition-all focus:outline-none"
+                  style={{
+                    backgroundColor: '#252530',
+                    border: '1px solid #52525b',
+                    color: '#f4f4f5',
+                  }}
+                  onFocus={(e) => (e.currentTarget.style.border = '1px solid #4ade80')}
+                  onBlur={(e) => (e.currentTarget.style.border = '1px solid #52525b')}
+                  data-testid="ticket-detail-priority"
+                >
+                  {PRIORITY_OPTIONS.map((opt) => (
+                    <option key={opt.value} value={opt.value}>
+                      {opt.label}
+                    </option>
+                  ))}
+                </select>
+              </div>
+
+              {/* Status */}
+              <div>
+                <label className="block text-sm font-medium mb-2" style={{ color: '#a1a1aa' }}>
+                  Status
+                </label>
+                <select
+                  value={status}
+                  onChange={(e) => setStatus(e.target.value as typeof status)}
+                  className="w-full px-4 py-2.5 rounded-lg transition-all focus:outline-none"
+                  style={{
+                    backgroundColor: '#252530',
+                    border: '1px solid #52525b',
+                    color: '#f4f4f5',
+                  }}
+                  onFocus={(e) => (e.currentTarget.style.border = '1px solid #4ade80')}
+                  onBlur={(e) => (e.currentTarget.style.border = '1px solid #52525b')}
+                  data-testid="ticket-detail-status"
+                >
+                  {STATUS_OPTIONS.map((opt) => (
+                    <option key={opt.value} value={opt.value}>
+                      {opt.label}
+                    </option>
+                  ))}
+                </select>
+              </div>
+
+              {/* Epic */}
+              <div>
+                <label className="block text-sm font-medium mb-2" style={{ color: '#a1a1aa' }}>
+                  Epic
+                </label>
+                <select
+                  value={epicId}
+                  onChange={(e) => setEpicId(e.target.value)}
+                  className="w-full px-4 py-2.5 rounded-lg transition-all focus:outline-none"
+                  style={{
+                    backgroundColor: '#252530',
+                    border: '1px solid #52525b',
+                    color: '#f4f4f5',
+                  }}
+                  onFocus={(e) => (e.currentTarget.style.border = '1px solid #4ade80')}
+                  onBlur={(e) => (e.currentTarget.style.border = '1px solid #52525b')}
+                  data-testid="ticket-detail-epic"
+                >
+                  <option value="">No Epic</option>
+                  {epics.map((epic) => (
+                    <option key={epic.id} value={epic.id}>
+                      {epic.title}
+                    </option>
+                  ))}
+                </select>
+                {selectedEpic && (
+                  <div
+                    className="mt-2 flex items-center gap-2 text-sm px-2 py-1 rounded"
+                    style={{ backgroundColor: `${selectedEpic.color}20`, color: selectedEpic.color }}
+                  >
+                    <Folder className="w-4 h-4" />
+                    <span>Base: {selectedEpic.base_branch}</span>
+                  </div>
+                )}
+              </div>
+
+              {/* Tags */}
+              <div>
+                <label className="block text-sm font-medium mb-2" style={{ color: '#a1a1aa' }}>
+                  Tags
+                </label>
+                <div className="flex gap-2 mb-2">
+                  <input
+                    type="text"
+                    value={tagInput}
+                    onChange={(e) => setTagInput(e.target.value)}
+                    onKeyPress={(e) => e.key === 'Enter' && handleAddTag()}
+                    className="flex-1 px-4 py-2.5 rounded-lg transition-all focus:outline-none"
+                    placeholder="Add tag"
+                    style={{
+                      backgroundColor: '#252530',
+                      border: '1px solid #52525b',
+                      color: '#f4f4f5',
+                    }}
+                    onFocus={(e) => (e.currentTarget.style.border = '1px solid #4ade80')}
+                    onBlur={(e) => (e.currentTarget.style.border = '1px solid #52525b')}
+                    data-testid="ticket-detail-tag-input"
+                  />
+                  <button
+                    onClick={handleAddTag}
+                    className="px-3 py-2.5 rounded-lg font-medium transition-all"
+                    style={{
+                      backgroundColor: 'transparent',
+                      border: '1px solid #52525b',
+                      color: '#f4f4f5',
+                    }}
+                    onMouseEnter={(e) => {
+                      e.currentTarget.style.backgroundColor = '#2d2d3a'
+                      e.currentTarget.style.borderColor = '#a1a1aa'
+                    }}
+                    onMouseLeave={(e) => {
+                      e.currentTarget.style.backgroundColor = 'transparent'
+                      e.currentTarget.style.borderColor = '#52525b'
+                    }}
+                    data-testid="ticket-detail-add-tag"
+                  >
+                    <Plus className="w-5 h-5" />
+                  </button>
+                </div>
+                <div className="flex flex-wrap gap-2">
+                  {tags.map((tag, idx) => (
+                    <span
+                      key={idx}
+                      className="inline-flex items-center gap-1.5 px-2.5 py-1 rounded-full text-xs font-medium"
+                      style={{
+                        backgroundColor: 'rgba(74, 222, 128, 0.15)',
+                        color: '#86efac',
+                      }}
+                      data-testid={`ticket-detail-tag-${tag}`}
+                    >
+                      <Tag className="w-3 h-3" />
+                      {tag}
+                      <button
+                        onClick={() => handleRemoveTag(tag)}
+                        className="ml-0.5 transition-colors"
+                        style={{ color: '#71717a' }}
+                        onMouseEnter={(e) => (e.currentTarget.style.color = '#f4f4f5')}
+                        onMouseLeave={(e) => (e.currentTarget.style.color = '#71717a')}
+                      >
+                        <X className="w-3 h-3" />
+                      </button>
+                    </span>
+                  ))}
+                </div>
+              </div>
+            </div>
+
+            {/* Right Column - Environment Assignment */}
+            <div className="space-y-4">
+              <h3 className="text-lg font-semibold" style={{ color: '#f4f4f5' }}>
+                Environment Assignment
+              </h3>
+
+              {/* Current Assignment */}
+              {hasAssignment ? (
+                <div
+                  className="p-4 rounded-lg"
+                  style={{
+                    backgroundColor: '#252530',
+                    border: '1px solid #3d3d4a',
+                  }}
+                >
+                  <div className="flex items-center justify-between mb-3">
+                    {ticket.environment_name && (
+                      <EnvironmentBadge
+                        name={ticket.environment_name}
+                        variant="label"
+                        showIcon={true}
+                        testId="ticket-detail-assigned-env"
+                      />
+                    )}
+                    <div className="flex items-center gap-1.5 px-2 py-1 rounded text-xs" style={{ backgroundColor: 'rgba(74, 222, 128, 0.2)', color: '#4ade80' }}>
+                      <CheckCircle className="w-3 h-3" />
+                      <span>Assigned</span>
+                    </div>
+                  </div>
+                  {ticket.branch_name && (
+                    <div className="flex items-center gap-2 text-sm mb-2" style={{ color: '#71717a' }}>
+                      <GitBranch className="w-3 h-3" />
+                      <span>{ticket.branch_name}</span>
+                    </div>
+                  )}
+                  {ticket.tmux_window_name && (
+                    <div className="flex items-center gap-2 text-xs" style={{ color: '#71717a' }}>
+                      <Terminal className="w-3 h-3" />
+                      <span>{ticket.tmux_window_name}</span>
+                    </div>
+                  )}
+                  {ticket.worktree_path && (
+                    <div className="text-xs truncate mt-2" style={{ color: '#52525b' }} title={ticket.worktree_path}>
+                      {ticket.worktree_path}
+                    </div>
+                  )}
+
+                  {/* Action Buttons */}
+                  {ticket.tmux_window_name && ticket.worktree_path && (
+                    <div className="flex gap-2 mt-4 pt-3" style={{ borderTop: '1px solid #3d3d4a' }}>
+                      <button
+                        onClick={async () => {
+                          const { tauri } = await import('../hooks/useTauri')
+                          await tauri.openTmuxInTerminal(ticket.tmux_window_name!, ticket.worktree_path!)
+                        }}
+                        className="flex-1 flex items-center justify-center gap-2 px-3 py-2 rounded-lg font-medium transition-all"
+                        style={{
+                          backgroundColor: '#252530',
+                          border: '1px solid #52525b',
+                          color: '#f4f4f5',
+                        }}
+                        onMouseEnter={(e) => {
+                          e.currentTarget.style.backgroundColor = '#2d2d3a'
+                          e.currentTarget.style.borderColor = '#a1a1aa'
+                        }}
+                        onMouseLeave={(e) => {
+                          e.currentTarget.style.backgroundColor = '#252530'
+                          e.currentTarget.style.borderColor = '#52525b'
+                        }}
+                        data-testid="ticket-detail-open-terminal"
+                      >
+                        <Terminal className="w-4 h-4" />
+                        Open Terminal
+                      </button>
+                      <button
+                        onClick={async () => {
+                          const { tauri } = await import('../hooks/useTauri')
+                          await tauri.openInVscode(ticket.worktree_path!)
+                        }}
+                        className="flex-1 flex items-center justify-center gap-2 px-3 py-2 rounded-lg font-medium transition-all"
+                        style={{
+                          backgroundColor: '#252530',
+                          border: '1px solid #52525b',
+                          color: '#f4f4f5',
+                        }}
+                        onMouseEnter={(e) => {
+                          e.currentTarget.style.backgroundColor = '#2d2d3a'
+                          e.currentTarget.style.borderColor = '#a1a1aa'
+                        }}
+                        onMouseLeave={(e) => {
+                          e.currentTarget.style.backgroundColor = '#252530'
+                          e.currentTarget.style.borderColor = '#52525b'
+                        }}
+                        data-testid="ticket-detail-open-vscode"
+                      >
+                        <svg className="w-4 h-4" viewBox="0 0 24 24" fill="currentColor">
+                          <path d="M23.15 2.587L18.21.21a1.494 1.494 0 0 0-1.705.29l-9.46 8.63-4.12-3.128a.999.999 0 0 0-1.276.057L.327 7.261A1 1 0 0 0 .326 8.74L3.899 12 .326 15.26a1 1 0 0 0 .001 1.479L1.65 17.94a.999.999 0 0 0 1.276.057l4.12-3.128 9.46 8.63a1.492 1.492 0 0 0 1.704.29l4.942-2.377A1.5 1.5 0 0 0 24 20.06V3.939a1.5 1.5 0 0 0-.85-1.352zm-5.146 14.861L10.826 12l7.178-5.448v10.896z"/>
+                        </svg>
+                        Open VSCode
+                      </button>
+                    </div>
+                  )}
+                </div>
+              ) : (
+                <div
+                  className="p-4 rounded-lg text-sm"
+                  style={{
+                    backgroundColor: '#252530',
+                    border: '1px solid #3d3d4a',
+                    color: '#71717a',
+                  }}
+                >
+                  Not assigned to any environment
+                </div>
+              )}
+
+              {/* Create New Worktree */}
+              <div>
+                <label className="block text-sm font-medium mb-2" style={{ color: '#a1a1aa' }}>
+                  {hasAssignment ? 'Or create new worktree:' : 'Create new worktree:'}
+                </label>
+                <button
+                  onClick={handleCreateWorktree}
+                  disabled={creatingWorktree}
+                  className="w-full flex items-center justify-center gap-2 px-4 py-2.5 font-medium rounded-lg transition-all"
+                  style={{
+                    backgroundColor: creatingWorktree ? 'rgba(168, 85, 247, 0.4)' : '#a855f7',
+                    color: creatingWorktree ? 'rgba(255, 255, 255, 0.5)' : '#ffffff',
+                    cursor: creatingWorktree ? 'not-allowed' : 'pointer',
+                  }}
+                  onMouseEnter={(e) => {
+                    if (!creatingWorktree) e.currentTarget.style.backgroundColor = '#c084fc'
+                  }}
+                  onMouseLeave={(e) => {
+                    if (!creatingWorktree) e.currentTarget.style.backgroundColor = '#a855f7'
+                  }}
+                  data-testid="ticket-detail-create-worktree"
+                >
+                  <GitBranch className="w-5 h-5" />
+                  {creatingWorktree ? 'Creating Worktree...' : 'Create New Worktree'}
+                </button>
+                <p className="text-xs mt-2" style={{ color: '#71717a' }}>
+                  Creates a new git worktree and tmux window for this ticket.
+                  {selectedEpic && selectedEpic.branch_name && ' Will use epic\'s shared branch.'}
+                </p>
+              </div>
+
+              {/* Assign to Existing Environment */}
+              <div>
+                <label className="block text-sm font-medium mb-2" style={{ color: '#a1a1aa' }}>
+                  {hasAssignment ? 'Reassign to different environment:' : 'Or assign to existing environment:'}
+                </label>
+                  {loadingEnvs ? (
+                    <div className="text-sm" style={{ color: '#71717a' }}>
+                      Loading environments...
+                    </div>
+                  ) : environments.length === 0 ? (
+                    <div className="text-sm" style={{ color: '#71717a' }}>
+                      No environments available
+                    </div>
+                  ) : (
+                    <div className="space-y-2 max-h-64 overflow-y-auto">
+                      {environments
+                        .filter((env) => env.is_worktree && env.path && env.branch)
+                        .map((env) => (
+                          <button
+                            key={env.name}
+                            onClick={() => handleAssignToEnvironment(env)}
+                            disabled={assigningEnv}
+                            className="w-full flex items-center justify-between p-3 rounded-lg text-left transition-all"
+                            style={{
+                              backgroundColor: '#252530',
+                              border: '1px solid #3d3d4a',
+                              opacity: assigningEnv ? 0.5 : 1,
+                            }}
+                            onMouseEnter={(e) => {
+                              if (!assigningEnv) e.currentTarget.style.backgroundColor = '#2d2d3a'
+                            }}
+                            onMouseLeave={(e) => {
+                              if (!assigningEnv) e.currentTarget.style.backgroundColor = '#252530'
+                            }}
+                            data-testid={`ticket-detail-assign-${env.name}`}
+                          >
+                            <div className="flex-1">
+                              <EnvironmentBadge
+                                name={env.name}
+                                variant="text"
+                                showIcon={false}
+                                className="text-base"
+                              />
+                              <div className="text-xs flex items-center gap-2 mt-1" style={{ color: '#a1a1aa' }}>
+                                <GitBranch className="w-3 h-3" />
+                                <span>{env.branch}</span>
+                              </div>
+                            </div>
+                            <div
+                              className="w-3 h-3 rounded-full"
+                              style={{ backgroundColor: env.running ? '#4ade80' : '#52525b' }}
+                            />
+                          </button>
+                        ))}
+                    </div>
+                  )}
+              </div>
+
+              {/* Metadata */}
+              <div className="pt-4 text-xs space-y-1" style={{ borderTop: '1px solid #3d3d4a', color: '#71717a' }}>
+                <div>ID: {ticket.id}</div>
+                <div>Created: {new Date(ticket.created_at).toLocaleString()}</div>
+                <div>Updated: {new Date(ticket.updated_at).toLocaleString()}</div>
+              </div>
+            </div>
+          </div>
+
+          {/* Actions */}
+          <div className="flex items-center justify-end gap-3 pt-4" style={{ borderTop: '1px solid #3d3d4a' }}>
+            <button
+              onClick={onClose}
+              className="px-6 py-2.5 font-medium rounded-lg transition-all"
+              style={{
+                backgroundColor: 'transparent',
+                border: '1px solid #52525b',
+                color: '#f4f4f5',
+              }}
+              onMouseEnter={(e) => {
+                e.currentTarget.style.backgroundColor = '#2d2d3a'
+                e.currentTarget.style.borderColor = '#a1a1aa'
+              }}
+              onMouseLeave={(e) => {
+                e.currentTarget.style.backgroundColor = 'transparent'
+                e.currentTarget.style.borderColor = '#52525b'
+              }}
+              data-testid="ticket-detail-cancel"
+            >
+              Cancel
+            </button>
+            <button
+              onClick={handleSave}
+              disabled={saving || !title.trim()}
+              className="flex items-center gap-2 px-6 py-2.5 font-medium rounded-lg transition-all"
+              style={{
+                backgroundColor: saving || !title.trim() ? 'rgba(74, 222, 128, 0.4)' : '#4ade80',
+                color: saving || !title.trim() ? 'rgba(15, 15, 19, 0.5)' : '#0f0f13',
+                cursor: saving || !title.trim() ? 'not-allowed' : 'pointer',
+              }}
+              onMouseEnter={(e) => {
+                if (!saving && title.trim()) e.currentTarget.style.backgroundColor = '#86efac'
+              }}
+              onMouseLeave={(e) => {
+                if (!saving && title.trim()) e.currentTarget.style.backgroundColor = '#4ade80'
+              }}
+              data-testid="ticket-detail-save"
+            >
+              <Save className="w-4 h-4" />
+              {saving ? 'Saving...' : 'Save Changes'}
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/ushadow/launcher/src/hooks/useClipboard.ts b/ushadow/launcher/src/hooks/useClipboard.ts
new file mode 100644
index 00000000..cf540089
--- /dev/null
+++ b/ushadow/launcher/src/hooks/useClipboard.ts
@@ -0,0 +1,43 @@
+import { writeText, readText } from '@tauri-apps/api/clipboard'
+
+/**
+ * Hook for clipboard operations using Tauri's native clipboard API.
+ *
+ * Uses Tauri's clipboard API which provides:
+ * - No browser permission prompts
+ * - Consistent behavior across platforms
+ * - Same code path as native keyboard shortcuts (Cmd+C, Ctrl+V, etc.)
+ */
+export function useClipboard() {
+  /**
+   * Write text to the clipboard
+   * @param text - The text to copy to clipboard
+   * @returns Promise that resolves when text is copied, or rejects on error
+   */
+  const copyToClipboard = async (text: string): Promise<void> => {
+    try {
+      await writeText(text)
+    } catch (err) {
+      console.error('Failed to copy to clipboard:', err)
+      throw err
+    }
+  }
+
+  /**
+   * Read text from the clipboard
+   * @returns Promise that resolves with clipboard text, or rejects on error
+   */
+  const readFromClipboard = async (): Promise<string | null> => {
+    try {
+      return await readText()
+    } catch (err) {
+      console.error('Failed to read from clipboard:', err)
+      throw err
+    }
+  }
+
+  return {
+    copyToClipboard,
+    readFromClipboard,
+  }
+}
diff --git a/ushadow/launcher/src/hooks/useTauri.ts b/ushadow/launcher/src/hooks/useTauri.ts
index 429b5416..dc6ab8c5 100644
--- a/ushadow/launcher/src/hooks/useTauri.ts
+++ b/ushadow/launcher/src/hooks/useTauri.ts
@@ -64,10 +64,18 @@ export interface Discovery {
 }
 
 // Launcher settings
+export interface CodingAgentConfig {
+  agent_type: string
+  command: string
+  args: string[]
+  auto_start: boolean
+}
+
 export interface LauncherSettings {
   default_admin_email: string | null
   default_admin_password: string | null
   default_admin_name: string | null
+  coding_agent: CodingAgentConfig
 }
 
 // Prerequisites configuration types
@@ -169,10 +177,19 @@ export const tauri = {
   // Utilities
   openBrowser: (url: string) => invoke<void>('open_browser', { url }),
 
+  // OAuth server
+  startOAuthServer: () => invoke<[number, string]>('start_oauth_server'),
+  waitForOAuthCallback: (port: number) => invoke<{success: boolean, code?: string, state?: string, error?: string}>('wait_for_oauth_callback', { port }),
+
+  // HTTP client (bypasses CORS restrictions)
+  httpRequest: (url: string, method: string, headers?: Record<string, string>, body?: string) =>
+    invoke<{status: number, body: string, headers: Record<string, string>}>('http_request', { url, method, headers, body }),
+
   // Worktree management
   listWorktrees: (mainRepo: string) => invoke<WorktreeInfo[]>('list_worktrees', { mainRepo }),
   listGitBranches: (mainRepo: string) => invoke<string[]>('list_git_branches', { mainRepo }),
   checkWorktreeExists: (mainRepo: string, branch: string) => invoke<WorktreeInfo | null>('check_worktree_exists', { mainRepo, branch }),
+  checkEnvironmentConflict: (mainRepo: string, envName: string) => invoke<EnvironmentConflict | null>('check_environment_conflict', { mainRepo, envName }),
   createWorktree: (mainRepo: string, worktreesDir: string, name: string, baseBranch?: string) =>
     invoke<WorktreeInfo>('create_worktree', { mainRepo, worktreesDir, name, baseBranch }),
   createWorktreeWithWorkmux: (mainRepo: string, name: string, baseBranch?: string, background?: boolean) =>
@@ -203,6 +220,117 @@ export const tauri = {
   saveLauncherSettings: (settings: LauncherSettings) => invoke<void>('save_launcher_settings', { settings }),
   writeCredentialsToWorktree: (worktreePath: string, adminEmail: string, adminPassword: string, adminName?: string) =>
     invoke<void>('write_credentials_to_worktree', { worktreePath, adminEmail, adminPassword, adminName }),
+
+  // Configuration management
+  loadProjectConfig: (projectRoot: string) => invoke<LauncherConfig>('load_project_config', { projectRoot }),
+  getCurrentConfig: () => invoke<LauncherConfig | null>('get_current_config'),
+  checkLauncherConfigExists: (projectRoot: string) => invoke<boolean>('check_launcher_config_exists', { projectRoot }),
+  validateConfigFile: (projectRoot: string) => invoke<string>('validate_config_file', { projectRoot }),
+
+  // Environment scanning
+  scanEnvFile: (projectRoot: string) => invoke<DetectedPort[]>('scan_env_file', { projectRoot }),
+  scanAllEnvVars: (projectRoot: string) => invoke<DetectedEnvVar[]>('scan_all_env_vars', { projectRoot }),
+
+  // Infrastructure discovery
+  getInfraServicesFromCompose: () => invoke<InfraService[]>('get_infra_services_from_compose'),
+
+  // Kanban ticket/epic management (local storage)
+  getTickets: (projectId?: string) => invoke<Ticket[]>('get_tickets', { projectId }),
+  getEpics: (projectId?: string) => invoke<Epic[]>('get_epics', { projectId }),
+  createTicket: (
+    title: string,
+    description: string | null,
+    priority: string,
+    epicId: string | null,
+    tags: string[],
+    environmentName: string | null,
+    projectId: string | null
+  ) => invoke<Ticket>('create_ticket', { title, description, priority, epicId, tags, environmentName, projectId }),
+  updateTicket: (
+    id: string,
+    title?: string,
+    description?: string,
+    status?: string,
+    priority?: string,
+    epicId?: string,
+    tags?: string[],
+    order?: number,
+    worktreePath?: string,
+    branchName?: string,
+    tmuxWindowName?: string,
+    tmuxSessionName?: string,
+    environmentName?: string
+  ) => invoke<Ticket>('update_ticket', { id, title, description, status, priority, epicId, tags, order, worktreePath, branchName, tmuxWindowName, tmuxSessionName, environmentName }),
+  deleteTicket: (id: string) => invoke<void>('delete_ticket', { id }),
+  createEpic: (
+    title: string,
+    description: string | null,
+    color: string,
+    baseBranch: string,
+    branchName: string | null,
+    projectId: string | null
+  ) => invoke<Epic>('create_epic', { title, description, color, baseBranch, branchName, projectId }),
+  updateEpic: (
+    id: string,
+    title?: string,
+    description?: string,
+    color?: string,
+    branchName?: string
+  ) => invoke<Epic>('update_epic', { id, title, description, color, branchName }),
+  deleteEpic: (id: string) => invoke<void>('delete_epic', { id }),
+
+  // Kanban ticket-worktree integration
+  createTicketWorktree: (request: {
+    ticketId: string
+    ticketTitle: string
+    projectRoot: string
+    branchName?: string
+    baseBranch?: string
+    epicBranch?: string
+  }) => invoke<{
+    worktree_path: string
+    branch_name: string
+    tmux_window_name: string
+    tmux_session_name: string
+  }>('create_ticket_worktree', { request }),
+  attachTicketToWorktree: (ticketId: string, worktreePath: string, branchName: string) =>
+    invoke<{
+      worktree_path: string
+      branch_name: string
+      tmux_window_name: string
+      tmux_session_name: string
+    }>('attach_ticket_to_worktree', { ticketId, worktreePath, branchName }),
+  startCodingAgentForTicket: (
+    ticketId: string,
+    tmuxWindowName: string,
+    tmuxSessionName: string,
+    worktreePath: string
+  ) => invoke<void>('start_coding_agent_for_ticket', { ticketId, tmuxWindowName, tmuxSessionName, worktreePath }),
+}
+
+// DetectedPort type (from env_scanner.rs)
+export interface DetectedPort {
+  name: string
+  default_value: string | null
+  base_port: number | null
+  is_database: boolean
+}
+
+// DetectedEnvVar type (from env_scanner.rs)
+export interface DetectedEnvVar {
+  name: string
+  default_value: string | null
+  is_port: boolean
+  is_database_port: boolean
+  should_append_env_name: boolean
+}
+
+// ComposeServiceDefinition type (from docker-compose parsing)
+export interface ComposeServiceDefinition {
+  id: string              // Service name from compose (e.g., "postgres", "redis")
+  display_name: string    // Human-readable name (e.g., "PostgreSQL", "Redis")
+  default_port: number | null // Primary exposed port
+  profiles: string[]      // Profiles this service belongs to
 }
 
 // WorktreeInfo type
@@ -243,4 +371,89 @@ export interface ClaudeStatus {
   last_output: string | null
 }
 
+// Environment conflict types
+export interface EnvironmentConflict {
+  name: string
+  current_branch: string
+  path: string
+  is_running: boolean
+}
+
+// LauncherConfig type (matches Rust struct)
+export interface LauncherConfig {
+  project: {
+    name: string
+    display_name: string
+  }
+  prerequisites: {
+    required: string[]
+    optional: string[]
+  }
+  setup: {
+    command: string
+    env_vars: string[]
+  }
+  infrastructure: {
+    compose_file: string
+    project_name: string
+    profile?: string
+  }
+  containers: {
+    naming_pattern: string
+    primary_service: string
+    health_endpoint: string
+    tailscale_project_prefix?: string
+  }
+  ports: {
+    allocation_strategy: string
+    base_port: number
+    offset: {
+      min: number
+      max: number
+      step: number
+    }
+  }
+  worktrees: {
+    default_parent: string
+    branch_prefix: string
+  }
+}
+
+// Kanban types (local storage)
+export type TicketStatus = 'backlog' | 'todo' | 'in_progress' | 'in_review' | 'done' | 'archived'
+export type TicketPriority = 'low' | 'medium' | 'high' | 'urgent'
+
+export interface Epic {
+  id: string
+  title: string
+  description?: string
+  color: string
+  branch_name?: string
+  base_branch: string
+  project_id?: string
+  created_at: string
+  updated_at: string
+}
+
+export interface Ticket {
+  id: string
+  title: string
+  description?: string
+  status: TicketStatus
+  priority: TicketPriority
+  epic_id?: string
+  tags: string[]
+  color?: string
+  tmux_window_name?: string
+  tmux_session_name?: string
+  branch_name?: string
+  worktree_path?: string
+  environment_name?: string
+  project_id?: string
+  assigned_to?: string
+  order: number
+  created_at: string
+  updated_at: string
+}
+
 export default tauri
diff --git a/ushadow/launcher/src/services/tokenManager.ts b/ushadow/launcher/src/services/tokenManager.ts
new file mode 100644
index 00000000..6499cf12
--- /dev/null
+++ b/ushadow/launcher/src/services/tokenManager.ts
@@ -0,0 +1,170 @@
+/**
+ * Token Manager for Launcher
+ *
+ * Manages OAuth tokens (Keycloak) in the launcher's localStorage.
+ * Tokens are shared across all environment iframes via postMessage API.
+ */
+
+const TOKEN_KEY = 'kc_access_token'
+const REFRESH_TOKEN_KEY = 'kc_refresh_token'
+const ID_TOKEN_KEY = 'kc_id_token'
+const EXPIRES_AT_KEY = 'kc_expires_at'
+const REFRESH_EXPIRES_AT_KEY = 'kc_refresh_expires_at'
+
+interface TokenResponse {
+  access_token: string
+  refresh_token?: string
+  id_token?: string
+  expires_in?: number
+  refresh_expires_in?: number
+  token_type?: string
+}
+
+interface DecodedToken {
+  exp: number
+  iat: number
+  sub: string
+  preferred_username?: string
+  email?: string
+  name?: string
+  [key: string]: any
+}
+
+export class TokenManager {
+  /**
+   * Store tokens in localStorage with expiry times
+   */
+  static storeTokens(tokens: TokenResponse): void {
+    const now = Math.floor(Date.now() / 1000)
+
+    if (tokens.access_token) {
+      localStorage.setItem(TOKEN_KEY, tokens.access_token)
+    }
+    if (tokens.refresh_token) {
+      localStorage.setItem(REFRESH_TOKEN_KEY, tokens.refresh_token)
+    }
+    if (tokens.id_token) {
+      localStorage.setItem(ID_TOKEN_KEY, tokens.id_token)
+    }
+
+    // Store expiry times
+    if (tokens.expires_in) {
+      const expiresAt = now + tokens.expires_in
+      localStorage.setItem(EXPIRES_AT_KEY, expiresAt.toString())
+      console.log('[TokenManager] Access token expires in:', tokens.expires_in, 'seconds')
+    }
+
+    if (tokens.refresh_expires_in) {
+      const refreshExpiresAt = now + tokens.refresh_expires_in
+      localStorage.setItem(REFRESH_EXPIRES_AT_KEY, refreshExpiresAt.toString())
+      console.log('[TokenManager] Refresh token expires in:', tokens.refresh_expires_in, 'seconds')
+    }
+  }
+
+  /**
+   * Get access token from storage
+   */
+  static getAccessToken(): string | null {
+    return localStorage.getItem(TOKEN_KEY)
+  }
+
+  /**
+   * Get refresh token from storage
+   */
+  static getRefreshToken(): string | null {
+    return localStorage.getItem(REFRESH_TOKEN_KEY)
+  }
+
+  /**
+   * Get ID token from storage
+   */
+  static getIdToken(): string | null {
+    return localStorage.getItem(ID_TOKEN_KEY)
+  }
+
+  /**
+   * Clear all tokens from storage
+   */
+  static clearTokens(): void {
+    localStorage.removeItem(TOKEN_KEY)
+    localStorage.removeItem(REFRESH_TOKEN_KEY)
+    localStorage.removeItem(ID_TOKEN_KEY)
+    localStorage.removeItem(EXPIRES_AT_KEY)
+    localStorage.removeItem(REFRESH_EXPIRES_AT_KEY)
+  }
+
+  /**
+   * Check if user is authenticated (has valid token)
+   */
+  static isAuthenticated(): boolean {
+    const token = this.getAccessToken()
+    if (!token) {
+      console.log('[TokenManager] No access token found')
+      return false
+    }
+
+    try {
+      const decoded = this.decodeToken(token)
+      const now = Math.floor(Date.now() / 1000)
+      const isValid = decoded.exp > now
+      const expiresIn = decoded.exp - now
+
+      console.log('[TokenManager] Token check:', {
+        isValid,
+        expiresIn: `${Math.floor(expiresIn / 60)}m ${expiresIn % 60}s`,
+        expiresAt: new Date(decoded.exp * 1000).toISOString(),
+      })
+
+      if (!isValid) {
+        console.warn('[TokenManager] ⚠️ Token EXPIRED! Clearing expired tokens...')
+        this.clearTokens()
+      }
+
+      return isValid
+    } catch (error) {
+      console.error('[TokenManager] Invalid token:', error)
+      this.clearTokens()
+      return false
+    }
+  }
+
+  /**
+   * Get user info from decoded token
+   */
+  static getUserInfo(): any | null {
+    const token = this.getAccessToken()
+    if (!token) return null
+
+    try {
+      return this.decodeToken(token)
+    } catch (error) {
+      console.error('[TokenManager] Failed to decode token:', error)
+      return null
+    }
+  }
+
+  /**
+   * Decode JWT token (simple base64 decode)
+   */
+  private static decodeToken(token: string): DecodedToken {
+    const parts = token.split('.')
+    if (parts.length !== 3) {
+      throw new Error('Invalid JWT format')
+    }
+
+    const payload = parts[1]
+    const decoded = JSON.parse(atob(payload))
+    return decoded as DecodedToken
+  }
+
+  /**
+   * Get all tokens as object (for sharing with iframes)
+   */
+  static getAllTokens(): { token: string | null; refreshToken: string | null; idToken: string | null } {
+    return {
+      token: this.getAccessToken(),
+      refreshToken: this.getRefreshToken(),
+      idToken: this.getIdToken(),
+    }
+  }
+}
diff --git a/ushadow/launcher/src/store/appStore.ts b/ushadow/launcher/src/store/appStore.ts
index 87ad3b27..f51ada88 100644
--- a/ushadow/launcher/src/store/appStore.ts
+++ b/ushadow/launcher/src/store/appStore.ts
@@ -1,7 +1,7 @@
 import { create } from 'zustand'
 import { persist } from 'zustand/middleware'
 
-export type AppMode = 'install' | 'infra' | 'environments'
+export type AppMode = 'install' | 'infra' | 'environments' | 'kanban'
 
 export interface SpoofedPrerequisites {
   git_installed: boolean | null  // null = use real value
@@ -12,10 +12,22 @@ export interface SpoofedPrerequisites {
   python_installed: boolean | null
 }
 
+export interface ProjectConfig {
+  id: string  // Unique identifier (timestamp or uuid)
+  name: string  // Project name from .launcher-config.yaml
+  displayName: string  // Human-readable name
+  rootPath: string  // Absolute path to project root
+  worktreesPath: string  // Absolute path to worktrees directory
+  configPath: string  // Path to .launcher-config.yaml
+  addedAt: number  // Timestamp when added
+}
+
 interface AppState {
   // Feature flags
   dryRunMode: boolean
   showDevTools: boolean
+  multiProjectMode: boolean  // Enable multi-project support
+  kanbanEnabled: boolean     // Enable Kanban board feature
 
   // UI state
   logExpanded: boolean
@@ -26,19 +38,31 @@ interface AppState {
   // Spoofed prerequisites (for testing)
   spoofedPrereqs: SpoofedPrerequisites
 
-  // Project settings
+  // Project settings (legacy - for backward compat when multiProjectMode=false)
   projectRoot: string
   worktreesDir: string
 
+  // Multi-project support
+  projects: ProjectConfig[]
+  activeProjectId: string | null
+
   // Actions
   setDryRunMode: (enabled: boolean) => void
   setShowDevTools: (enabled: boolean) => void
   setLogExpanded: (expanded: boolean) => void
+  setMultiProjectMode: (enabled: boolean) => void
+  setKanbanEnabled: (enabled: boolean) => void
   setAppMode: (mode: AppMode) => void
   setSpoofedPrereq: (key: keyof SpoofedPrerequisites, value: boolean | null) => void
   resetSpoofedPrereqs: () => void
   setProjectRoot: (path: string) => void
   setWorktreesDir: (path: string) => void
+
+  // Multi-project actions
+  addProject: (project: ProjectConfig) => void
+  removeProject: (projectId: string) => void
+  setActiveProject: (projectId: string) => void
+  updateProject: (projectId: string, updates: Partial<ProjectConfig>) => void
 }
 
 const defaultSpoofedPrereqs: SpoofedPrerequisites = {
@@ -57,15 +81,21 @@ export const useAppStore = create<AppState>()(
       dryRunMode: false,
       showDevTools: false,
       logExpanded: true,
+      multiProjectMode: false,
+      kanbanEnabled: false,
       appMode: 'install',
       spoofedPrereqs: defaultSpoofedPrereqs,
       projectRoot: '',
       worktreesDir: '',
+      projects: [],
+      activeProjectId: null,
 
       // Actions
       setDryRunMode: (enabled) => set({ dryRunMode: enabled }),
       setShowDevTools: (enabled) => set({ showDevTools: enabled }),
       setLogExpanded: (expanded) => set({ logExpanded: expanded }),
+      setMultiProjectMode: (enabled) => set({ multiProjectMode: enabled }),
+      setKanbanEnabled: (enabled) => set({ kanbanEnabled: enabled }),
       setAppMode: (mode) => set({ appMode: mode }),
       setSpoofedPrereq: (key, value) => set((state) => ({
         spoofedPrereqs: { ...state.spoofedPrereqs, [key]: value }
@@ -73,6 +103,22 @@ export const useAppStore = create<AppState>()(
       resetSpoofedPrereqs: () => set({ spoofedPrereqs: defaultSpoofedPrereqs }),
       setProjectRoot: (path) => set({ projectRoot: path }),
       setWorktreesDir: (path) => set({ worktreesDir: path }),
+
+      // Multi-project actions
+      addProject: (project) => set((state) => ({
+        projects: [...state.projects, project],
+        activeProjectId: project.id,
+      })),
+      removeProject: (projectId) => set((state) => ({
+        projects: state.projects.filter(p => p.id !== projectId),
+        activeProjectId: state.activeProjectId === projectId ? null : state.activeProjectId,
+      })),
+      setActiveProject: (projectId) => set({ activeProjectId: projectId }),
+      updateProject: (projectId, updates) => set((state) => ({
+        projects: state.projects.map(p =>
+          p.id === projectId ? { ...p, ...updates } : p
+        ),
+      })),
     }),
     {
       name: 'ushadow-launcher-settings',
diff --git a/ushadow/launcher/src/utils/pkce.ts b/ushadow/launcher/src/utils/pkce.ts
new file mode 100644
index 00000000..f2975476
--- /dev/null
+++ b/ushadow/launcher/src/utils/pkce.ts
@@ -0,0 +1,49 @@
+/**
+ * PKCE (Proof Key for Code Exchange) Utilities
+ *
+ * Implements OAuth 2.0 PKCE flow for secure authorization without client secrets.
+ * Used by the launcher's OAuth flow.
+ */
+
+/**
+ * Generate a random code verifier for PKCE
+ * @returns Base64 URL-encoded random string
+ */
+export function generateCodeVerifier(): string {
+  const array = new Uint8Array(32)
+  crypto.getRandomValues(array)
+  return base64UrlEncode(array)
+}
+
+/**
+ * Generate code challenge from verifier using SHA-256
+ * @param verifier - The code verifier
+ * @returns Base64 URL-encoded SHA-256 hash of verifier
+ */
+export async function generateCodeChallenge(verifier: string): Promise<string> {
+  const encoder = new TextEncoder()
+  const data = encoder.encode(verifier)
+  const hash = await crypto.subtle.digest('SHA-256', data)
+  return base64UrlEncode(new Uint8Array(hash))
+}
+
+/**
+ * Generate a random state parameter for CSRF protection
+ * @returns Random string
+ */
+export function generateState(): string {
+  return (
+    Math.random().toString(36).substring(2, 15) +
+    Math.random().toString(36).substring(2, 15)
+  )
+}
+
+/**
+ * Base64 URL encode (for PKCE)
+ * @param array - Byte array to encode
+ * @returns Base64 URL-encoded string
+ */
+function base64UrlEncode(array: Uint8Array): string {
+  const base64 = btoa(String.fromCharCode(...Array.from(array)))
+  return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
+}
diff --git a/ushadow/mobile/app/(tabs)/conversations.tsx b/ushadow/mobile/app/(tabs)/conversations.tsx
index bcff4d94..de6c2538 100644
--- a/ushadow/mobile/app/(tabs)/conversations.tsx
+++ b/ushadow/mobile/app/(tabs)/conversations.tsx
@@ -1,7 +1,8 @@
 /**
  * Conversations Tab - Ushadow Mobile
  *
- * Displays user's conversations from the Chronicle backend.
+ * Displays user's conversations from Chronicle and/or Mycelia backends.
+ * Supports single-source (Chronicle only) and dual-source modes via feature flag.
  * Shows transcripts, speaker segments, and conversation metadata.
  */
 
@@ -20,63 +21,73 @@ import {
 import { useFocusEffect } from '@react-navigation/native';
 import { Ionicons } from '@expo/vector-icons';
 import { theme, colors, spacing, borderRadius, fontSize } from '../theme';
-import { fetchConversations, Conversation, getChronicleAudioUrl } from '../services/chronicleApi';
+import { Conversation, getChronicleAudioUrl } from '../services/chronicleApi';
 import { isAuthenticated } from '../_utils/authStorage';
 import ConversationAudioPlayer from '../components/AudioPlayer';
+import { useFeatureFlag } from '../hooks/useFeatureFlags';
+import {
+  useChronicleConversations,
+  useMultiSourceConversations,
+  type ConversationSource,
+} from '../hooks/useConversations';
+
+// Type to add source info to conversations
+type ConversationWithSource = Conversation & { source?: ConversationSource };
 
 export default function ConversationsScreen() {
-  const [conversations, setConversations] = useState<Conversation[]>([]);
-  const [isLoading, setIsLoading] = useState(true);
-  const [isRefreshing, setIsRefreshing] = useState(false);
-  const [error, setError] = useState<string | null>(null);
   const [isLoggedIn, setIsLoggedIn] = useState(false);
   const [expandedId, setExpandedId] = useState<string | null>(null);
   const [expandedDetailedSummary, setExpandedDetailedSummary] = useState<Set<string>>(new Set());
 
-  const loadConversations = useCallback(async (showRefreshIndicator = false) => {
-    try {
-      if (showRefreshIndicator) {
-        setIsRefreshing(true);
-      }
-      setError(null);
+  // Check if dual-source mode is enabled
+  const isDualSourceEnabled = useFeatureFlag('mobile_dual_source_conversations');
 
-      const loggedIn = await isAuthenticated();
-      setIsLoggedIn(loggedIn);
+  // Determine which sources to enable
+  const enabledSources: ConversationSource[] = isDualSourceEnabled
+    ? ['chronicle', 'mycelia']
+    : ['chronicle'];
 
-      if (!loggedIn) {
-        setConversations([]);
-        return;
-      }
+  // Use the appropriate hook based on feature flag
+  const dualSourceData = useMultiSourceConversations(enabledSources, {
+    enabled: isDualSourceEnabled,
+    limit: 50,
+  });
 
-      const response = await fetchConversations(1, 50);
-      console.log(`[Conversations] Raw response:`, JSON.stringify(response, null, 2));
-      console.log(`[Conversations] First conversation:`, JSON.stringify(response.conversations[0], null, 2));
-      setConversations(response.conversations);
-      console.log(`[Conversations] Loaded ${response.conversations.length} conversations`);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : 'Failed to load conversations';
-      setError(message);
-      console.error('[Conversations] Error:', err);
-    } finally {
-      setIsLoading(false);
-      setIsRefreshing(false);
-    }
-  }, []);
+  const singleSourceData = useChronicleConversations({
+    enabled: !isDualSourceEnabled,
+    limit: 50,
+  });
+
+  // Select the active data source
+  const activeData = isDualSourceEnabled ? dualSourceData : singleSourceData;
+
+  // Get conversations and loading state
+  const conversations: ConversationWithSource[] = isDualSourceEnabled
+    ? dualSourceData.data
+    : singleSourceData.data.map((conv) => ({ ...conv, source: 'chronicle' as ConversationSource }));
 
+  const isLoading = activeData.loading;
+  const error = activeData.error;
+
+  // Check authentication status
   useEffect(() => {
-    loadConversations();
-  }, [loadConversations]);
+    const checkAuth = async () => {
+      const loggedIn = await isAuthenticated();
+      setIsLoggedIn(loggedIn);
+    };
+    checkAuth();
+  }, []);
 
   // Refresh when screen regains focus (e.g., after scanning QR code)
   useFocusEffect(
     useCallback(() => {
-      loadConversations();
-    }, [loadConversations])
+      activeData.refetch();
+    }, [activeData.refetch])
   );
 
   const handleRefresh = useCallback(() => {
-    loadConversations(true);
-  }, [loadConversations]);
+    activeData.refetch();
+  }, [activeData.refetch]);
 
   const toggleExpand = (id: string) => {
     setExpandedId(expandedId === id ? null : id);
@@ -125,7 +136,7 @@ export default function ConversationsScreen() {
     }
   };
 
-  const renderConversation = ({ item }: { item: Conversation }) => {
+  const renderConversation = ({ item }: { item: ConversationWithSource }) => {
     const itemId = item.id || item.conversation_id;
     const isExpanded = expandedId === itemId;
     const isDetailedExpanded = expandedDetailedSummary.has(itemId);
@@ -137,6 +148,14 @@ export default function ConversationsScreen() {
     // Determine status from has_memory or default
     const hasContent = item.has_memory || (item.memory_count && item.memory_count > 0);
 
+    // Get source badge info
+    const sourceBadge = item.source
+      ? {
+          label: item.source === 'chronicle' ? 'Chronicle' : 'Mycelia',
+          color: item.source === 'chronicle' ? colors.primary[400] : colors.accent[400],
+        }
+      : null;
+
     return (
       <TouchableOpacity
         style={styles.conversationCard}
@@ -148,6 +167,11 @@ export default function ConversationsScreen() {
           <View style={styles.cardHeaderLeft}>
             <View style={[styles.statusDot, { backgroundColor: hasContent ? colors.success.default : colors.primary[400] }]} />
             <Text style={styles.cardDate}>{formatDate(item.created_at)}</Text>
+            {isDualSourceEnabled && sourceBadge && (
+              <View style={[styles.sourceBadge, { backgroundColor: sourceBadge.color }]}>
+                <Text style={styles.sourceBadgeText}>{sourceBadge.label}</Text>
+              </View>
+            )}
           </View>
           <View style={styles.cardHeaderRight}>
             {item.segment_count !== undefined && (
@@ -289,7 +313,11 @@ export default function ConversationsScreen() {
       {isLoading ? (
         <View style={styles.loadingContainer}>
           <ActivityIndicator size="large" color={colors.primary[400]} />
-          <Text style={styles.loadingText}>Loading conversations...</Text>
+          <Text style={styles.loadingText}>
+            {isDualSourceEnabled
+              ? 'Loading conversations from Chronicle and Mycelia...'
+              : 'Loading conversations...'}
+          </Text>
         </View>
       ) : (
         <FlatList
@@ -300,7 +328,7 @@ export default function ConversationsScreen() {
           ListEmptyComponent={renderEmptyState}
           refreshControl={
             <RefreshControl
-              refreshing={isRefreshing}
+              refreshing={isLoading}
               onRefresh={handleRefresh}
               tintColor={colors.primary[400]}
               colors={[colors.primary[400]]}
@@ -510,4 +538,17 @@ const styles = StyleSheet.create({
     textAlign: 'center',
     paddingHorizontal: spacing.xl,
   },
+  sourceBadge: {
+    paddingHorizontal: spacing.sm,
+    paddingVertical: 2,
+    borderRadius: borderRadius.sm,
+    marginLeft: spacing.sm,
+  },
+  sourceBadgeText: {
+    fontSize: 10,
+    color: '#FFFFFF',
+    fontWeight: '600',
+    textTransform: 'uppercase',
+    letterSpacing: 0.5,
+  },
 });
diff --git a/ushadow/mobile/app/_layout.tsx b/ushadow/mobile/app/_layout.tsx
index c40d84c3..7f6ad6df 100644
--- a/ushadow/mobile/app/_layout.tsx
+++ b/ushadow/mobile/app/_layout.tsx
@@ -3,27 +3,31 @@
  *
  * Sets up the navigation and global providers.
  * Uses tab-based navigation with Home, Conversations, and Memories.
+ * Provides feature flags, Bluetooth, and OMI connection contexts.
  */
 
 import { Stack } from 'expo-router';
 import { StatusBar } from 'expo-status-bar';
 import { theme } from './theme';
 import { BluetoothProvider, OmiConnectionProvider } from './contexts';
+import { FeatureFlagProvider } from './contexts/FeatureFlagContext';
 
 export default function RootLayout() {
   return (
-    <BluetoothProvider>
-      <OmiConnectionProvider>
-        <StatusBar style="light" />
-        <Stack
-          screenOptions={{
-            headerShown: false,
-            contentStyle: { backgroundColor: theme.background },
-          }}
-        >
-          <Stack.Screen name="(tabs)" options={{ headerShown: false }} />
-        </Stack>
-      </OmiConnectionProvider>
-    </BluetoothProvider>
+    <FeatureFlagProvider>
+      <BluetoothProvider>
+        <OmiConnectionProvider>
+          <StatusBar style="light" />
+          <Stack
+            screenOptions={{
+              headerShown: false,
+              contentStyle: { backgroundColor: theme.background },
+            }}
+          >
+            <Stack.Screen name="(tabs)" options={{ headerShown: false }} />
+          </Stack>
+        </OmiConnectionProvider>
+      </BluetoothProvider>
+    </FeatureFlagProvider>
   );
 }
diff --git a/ushadow/mobile/app/components/ConnectionLogViewer.tsx b/ushadow/mobile/app/components/ConnectionLogViewer.tsx
index e7128e64..f47da43e 100644
--- a/ushadow/mobile/app/components/ConnectionLogViewer.tsx
+++ b/ushadow/mobile/app/components/ConnectionLogViewer.tsx
@@ -219,6 +219,7 @@ export const ConnectionLogViewer: React.FC<ConnectionLogViewerProps> = ({
       ? `${Math.floor(item.durationSeconds / 60)}m ${item.durationSeconds % 60}s`
       : 'In progress';
     const startTime = new Date(item.startTime).toLocaleString();
+    const endTime = item.endTime ? new Date(item.endTime).toLocaleString() : null;
     const hasError = !!item.error;
 
     // Format end reason
@@ -244,7 +245,7 @@ export const ConnectionLogViewer: React.FC<ConnectionLogViewerProps> = ({
             <Text style={styles.sessionSource}>
               {item.source.type === 'phone' ? 'Phone Microphone' : `OMI Device (${item.source.deviceName})`}
             </Text>
-            <Text style={styles.sessionTime}>{startTime}</Text>
+            <Text style={styles.sessionTime}>Started: {startTime}</Text>
           </View>
           {hasError && (
             <Ionicons name="alert-circle" size={20} color={colors.error.default} />
@@ -255,6 +256,12 @@ export const ConnectionLogViewer: React.FC<ConnectionLogViewerProps> = ({
             <Text style={styles.sessionDetailLabel}>Duration:</Text>
             <Text style={styles.sessionDetailValue}>{duration}</Text>
           </View>
+          {endTime && (
+            <View style={styles.sessionDetailRow}>
+              <Text style={styles.sessionDetailLabel}>Ended:</Text>
+              <Text style={styles.sessionDetailValue}>{endTime}</Text>
+            </View>
+          )}
           <View style={styles.sessionDetailRow}>
             <Text style={styles.sessionDetailLabel}>Codec:</Text>
             <Text style={styles.sessionDetailValue}>{item.codec.toUpperCase()}</Text>
@@ -267,7 +274,7 @@ export const ConnectionLogViewer: React.FC<ConnectionLogViewerProps> = ({
           </View>
           {item.endTime && (
             <View style={styles.sessionDetailRow}>
-              <Text style={styles.sessionDetailLabel}>Ended:</Text>
+              <Text style={styles.sessionDetailLabel}>Reason:</Text>
               <Text style={[styles.sessionDetailValue, hasError && { color: colors.error.default }]}>
                 {endReasonText}
               </Text>
diff --git a/ushadow/mobile/app/components/LeaderDiscovery.tsx b/ushadow/mobile/app/components/LeaderDiscovery.tsx
index cdf3c2d7..37d9993b 100644
--- a/ushadow/mobile/app/components/LeaderDiscovery.tsx
+++ b/ushadow/mobile/app/components/LeaderDiscovery.tsx
@@ -19,6 +19,7 @@ import {
 import { useTailscaleDiscovery, SavedServerConfig } from '../hooks/useTailscaleDiscovery';
 import QRScanner, { UshadowConnectionData } from './QRScanner';
 import { colors, theme, spacing, borderRadius, fontSize } from '../theme';
+import { useFeatureFlagContext } from '../contexts/FeatureFlagContext';
 
 interface LeaderDiscoveryProps {
   onLeaderFound?: (apiUrl: string, streamUrl: string, authToken?: string, chronicleApiUrl?: string, hostname?: string) => void;
@@ -44,6 +45,9 @@ export const LeaderDiscovery: React.FC<LeaderDiscoveryProps> = ({
     setError,
   } = useTailscaleDiscovery();
 
+  // Feature flags - refresh after QR scan to get UNode-specific flags
+  const { refreshFlags } = useFeatureFlagContext();
+
   const [showScanner, setShowScanner] = useState(false);
   const [showManual, setShowManual] = useState(false);
   const [endpoint, setEndpoint] = useState('');
@@ -55,8 +59,19 @@ export const LeaderDiscovery: React.FC<LeaderDiscoveryProps> = ({
     // This now saves the server AND attempts to connect
     const result = await connectFromQR(data);
     if (result.success && result.leader && onLeaderFound) {
-      // Don't pass auth token - user will login with Keycloak instead
-      onLeaderFound(result.leader.apiUrl, result.leader.streamUrl, undefined, result.leader.chronicleApiUrl, result.leader.hostname);
+      console.log('[LeaderDiscovery] Successfully connected to UNode, refreshing feature flags...');
+
+      // Refresh feature flags from the newly connected UNode
+      try {
+        await refreshFlags();
+        console.log('[LeaderDiscovery] Feature flags refreshed successfully');
+      } catch (err) {
+        console.error('[LeaderDiscovery] Failed to refresh feature flags:', err);
+        // Don't fail the connection if feature flags fail to load
+      }
+
+      // Pass auth token from QR code if available (v3+)
+      onLeaderFound(result.leader.apiUrl, result.leader.streamUrl, data.auth_token, result.leader.chronicleApiUrl);
     }
   };
 
diff --git a/ushadow/mobile/app/components/OmiDeviceCard.tsx b/ushadow/mobile/app/components/OmiDeviceCard.tsx
index ba1308f2..3bb55cc1 100644
--- a/ushadow/mobile/app/components/OmiDeviceCard.tsx
+++ b/ushadow/mobile/app/components/OmiDeviceCard.tsx
@@ -343,8 +343,8 @@ export const OmiDeviceCard: React.FC<OmiDeviceCardProps> = ({
         const wsUrl = buildOmiWebSocketUrl();
         console.log('[OmiDeviceCard] Starting OMI audio streaming to:', wsUrl);
 
-        // Start WebSocket connection
-        await audioStreamer.startStreaming(wsUrl);
+        // Start WebSocket connection (OMI uses Opus codec)
+        await audioStreamer.startStreaming(wsUrl, 'streaming', 'opus');
 
         // Start OMI audio listener
         await startAudioListener(async (audioBytes: Uint8Array) => {
diff --git a/ushadow/mobile/app/hooks/useAudioManager.ts b/ushadow/mobile/app/hooks/useAudioManager.ts
index 396bd478..c0d582b2 100644
--- a/ushadow/mobile/app/hooks/useAudioManager.ts
+++ b/ushadow/mobile/app/hooks/useAudioManager.ts
@@ -213,8 +213,8 @@ export const useAudioManager = ({
 
       const finalWebSocketUrl = buildWebSocketUrl(webSocketUrl);
 
-      // Start custom WebSocket streaming first
-      await audioStreamer.startStreaming(finalWebSocketUrl);
+      // Start custom WebSocket streaming first (OMI uses Opus codec)
+      await audioStreamer.startStreaming(finalWebSocketUrl, 'streaming', 'opus');
 
       // Initialize previous state
       previousWsReadyStateRef.current = audioStreamer.getWebSocketReadyState();
@@ -281,8 +281,8 @@ export const useAudioManager = ({
         endpoint: '/ws_pcm',
       });
 
-      // Start WebSocket streaming first
-      await audioStreamer.startStreaming(finalWebSocketUrl);
+      // Start WebSocket streaming first (Phone microphone uses PCM codec)
+      await audioStreamer.startStreaming(finalWebSocketUrl, 'streaming', 'pcm');
 
       // Start phone audio recording
       await phoneAudioRecorder.startRecording(async (pcmBuffer: Uint8Array) => {
diff --git a/ushadow/mobile/app/hooks/useAudioStreamer.ts b/ushadow/mobile/app/hooks/useAudioStreamer.ts
index 77ecfbfb..bfce625c 100644
--- a/ushadow/mobile/app/hooks/useAudioStreamer.ts
+++ b/ushadow/mobile/app/hooks/useAudioStreamer.ts
@@ -226,7 +226,7 @@ export const useAudioStreamer = (options?: UseAudioStreamerOptions): UseAudioStr
 
     reconnectTimeoutRef.current = setTimeout(() => {
       if (!manuallyStoppedRef.current) {
-        startStreaming(currentUrlRef.current, currentModeRef.current)
+        startStreaming(currentUrlRef.current, currentModeRef.current, currentCodecRef.current)
           .then(() => {
             // Connection successful, reset retry state
             setStateSafe(setIsRetrying, false);
@@ -253,11 +253,20 @@ export const useAudioStreamer = (options?: UseAudioStreamerOptions): UseAudioStr
       return Promise.reject(new Error(errorMsg));
     }
 
-    currentUrlRef.current = trimmed;
     currentModeRef.current = mode;
     currentCodecRef.current = codec;
     manuallyStoppedRef.current = false;
 
+    // Add codec parameter to URL if not already present
+    let finalUrl = trimmed;
+    if (!finalUrl.includes('codec=')) {
+      const separator = finalUrl.includes('?') ? '&' : '?';
+      finalUrl = `${finalUrl}${separator}codec=${codec}`;
+      console.log(`[AudioStreamer] Added codec parameter: ${codec}`);
+    }
+
+    currentUrlRef.current = finalUrl;
+
     // Network gate
     const netState = await NetInfo.fetch();
     if (!netState.isConnected || !netState.isInternetReachable) {
@@ -266,9 +275,9 @@ export const useAudioStreamer = (options?: UseAudioStreamerOptions): UseAudioStr
       return Promise.reject(new Error(errorMsg));
     }
 
-    console.log(`[AudioStreamer] Initializing WebSocket: ${trimmed}`);
+    console.log(`[AudioStreamer] Initializing WebSocket: ${finalUrl}`);
     console.log(`[AudioStreamer] Network state:`, netState);
-    onLog?.('connecting', 'Initializing WebSocket connection', trimmed);
+    onLog?.('connecting', 'Initializing WebSocket connection', finalUrl);
     if (websocketRef.current) await stopStreaming();
 
     setStateSafe(setIsConnecting, true);
@@ -277,7 +286,7 @@ export const useAudioStreamer = (options?: UseAudioStreamerOptions): UseAudioStr
     return new Promise<void>((resolve, reject) => {
       try {
         console.log(`[AudioStreamer] Creating WebSocket connection...`);
-        const ws = new WebSocket(trimmed);
+        const ws = new WebSocket(finalUrl);
         console.log(`[AudioStreamer] WebSocket object created, waiting for connection...`);
 
         ws.onopen = async () => {
diff --git a/ushadow/mobile/app/hooks/useMultiDestinationStreamer.ts b/ushadow/mobile/app/hooks/useMultiDestinationStreamer.ts
index 144e103e..915b534d 100644
--- a/ushadow/mobile/app/hooks/useMultiDestinationStreamer.ts
+++ b/ushadow/mobile/app/hooks/useMultiDestinationStreamer.ts
@@ -23,7 +23,8 @@ export interface UseMultiDestinationStreamer {
   isStreaming: boolean;
   startMultiStreaming: (
     config: MultiDestinationConfig,
-    streamMode?: 'batch' | 'streaming'
+    streamMode?: 'batch' | 'streaming',
+    codec?: 'pcm' | 'opus'
   ) => Promise<void>;
   stopMultiStreaming: () => void;
   sendAudioToAll: (audioBytes: Uint8Array) => void;
@@ -39,7 +40,8 @@ export const useDirectMultiCast = (): UseMultiDestinationStreamer => {
 
   const startMultiStreaming = useCallback(async (
     config: MultiDestinationConfig,
-    streamMode: 'batch' | 'streaming' = 'streaming'
+    streamMode: 'batch' | 'streaming' = 'streaming',
+    codec: 'pcm' | 'opus' = 'pcm'
   ) => {
     // Create streamer for each destination
     const newStreamers: Record<string, any> = {};
@@ -90,7 +92,8 @@ export const useRelayStreamer = (): UseMultiDestinationStreamer => {
 
   const startMultiStreaming = useCallback(async (
     config: MultiDestinationConfig,
-    streamMode: 'batch' | 'streaming' = 'streaming'
+    streamMode: 'batch' | 'streaming' = 'streaming',
+    codec: 'pcm' | 'opus' = 'pcm'
   ) => {
     if (config.mode !== 'relay' || !config.relayUrl) {
       throw new Error('Relay mode requires relayUrl');
@@ -107,8 +110,8 @@ export const useRelayStreamer = (): UseMultiDestinationStreamer => {
 
     console.log('[RelayStreamer] Connecting to relay:', relayWsUrl);
 
-    // Connect to relay server
-    await relayStreamer.startStreaming(relayWsUrl, streamMode);
+    // Connect to relay server with specified codec
+    await relayStreamer.startStreaming(relayWsUrl, streamMode, codec);
 
     // Initialize status for all destinations
     const status: Record<string, { isStreaming: boolean; error: string | null }> = {};
@@ -147,14 +150,15 @@ export const useMultiDestinationStreamer = (): UseMultiDestinationStreamer => {
 
   const startMultiStreaming = useCallback(async (
     config: MultiDestinationConfig,
-    streamMode: 'batch' | 'streaming' = 'streaming'
+    streamMode: 'batch' | 'streaming' = 'streaming',
+    codec: 'pcm' | 'opus' = 'pcm'
   ) => {
     setCurrentMode(config.mode);
 
     if (config.mode === 'relay') {
-      return relayStreamer.startMultiStreaming(config, streamMode);
+      return relayStreamer.startMultiStreaming(config, streamMode, codec);
     } else {
-      return directStreamer.startMultiStreaming(config, streamMode);
+      return directStreamer.startMultiStreaming(config, streamMode, codec);
     }
   }, [relayStreamer, directStreamer]);
 
diff --git a/vibe-kanban b/vibe-kanban
new file mode 160000
index 00000000..d54a4620
--- /dev/null
+++ b/vibe-kanban
@@ -0,0 +1 @@
+Subproject commit d54a46209b99f7dab298e3adb607efc4e63116c7