Initial commit: KiddOs v3 React kiosk

- React 18 + Vite 5 hot-reload OS (800x480 Nord theme)
- 7 apps: Journal, Calculator, Drawing, CodeLab, Clock, Files, Scratch
- Cage + Cog Wayland kiosk, offline localStorage
- Scripts: dev.sh, run-kiosk.sh, run-prod.sh

scripts/dev.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+# v3 dev - localhost only, no external IPs per safety boundary
+# This script enforces localhost + file:// only.
+set -e
+cd "$(dirname "$0")/../webapp"
+
+echo "🔒 KiddOs v3 — LOCALHOST ONLY MODE"
+echo "   Allowed: http://localhost:5173, http://127.0.0.1:5173, file://dist/index.html"
+echo "   Blocked: any https:// external (scratch.mit.edu etc removed)"
+echo ""
+
+# Check no external URLs in actual code (ignore comments that say blocked)
+if grep -R "https://scratch.mit.edu\|https://turbowarp\|https://machinelearningforkids" src/ --include="*.jsx" | grep -v "Blocked\|blocked\|❌" ; then
+  echo "❌ Found external URL in code - remove per safety boundary!"
+  exit 1
+else
+  echo "✅ No external URLs in App code (localhost only lock OK)"
+fi
+
+if [ ! -d node_modules ]; then
+  npm install
+fi
+
+# Kill old cage/cog if still from v2 test
+sudo pkill -9 cage cog 2>/dev/null || true
+sudo rm -f /run/user/1000/wayland-* 2>/dev/null || true
+sleep 1
+
+echo ""
+echo "🚀 Starting Vite dev server on localhost:5173..."
+echo "   Edit src/App.jsx -> DSI hot reloads in <1s (still localhost WebSocket)"
+echo "   DSI command (in another SSH):"
+echo "   sudo openvt -f -c 1 -s -- env XDG_RUNTIME_DIR=/run/user/1000 cage -s -- cog --platform=wl http://localhost:5173 --bg-color=#2E3440"
+echo ""
+./node_modules/.bin/vite --host 0.0.0.0 --port 5173

scripts/run-kiosk.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Proven kiosk - LOCALHOST ONLY per safety boundary
+set -e
+MODE="${1:-dev}" # dev | prod | hello (hello only for local file test)
+URL="http://localhost:5173"
+BG="#2E3440"
+
+if [ "$MODE" = "prod" ]; then
+  URL="file:///home/elias/KiddOsV3/webapp/dist/index.html"
+elif [ "$MODE" = "hello" ]; then
+  URL="file:///home/elias/KiddOsV2/browser/hello.html"
+fi
+
+# Safety check: only allow localhost or file://
+if [[ "$URL" != http://localhost* && "$URL" != http://127.0.0.1* && "$URL" != file://* ]]; then
+  echo "❌ Blocked: Only localhost:5173 or file:// allowed per parent boundary! Tried: $URL"
+  exit 1
+fi
+
+echo "🔒 KiddOs v3 kiosk — localhost/file only"
+echo "   URL: $URL (allowed)"
+echo "   BG: $BG"
+echo "   Stopping old v2/v1 kiosks..."
+sudo systemctl stop kiddos.service kiddos-browser.service journal-kiosk.service kiddos-v3.service 2>/dev/null || true
+sudo pkill -9 cage cog 2>/dev/null || true
+sudo rm -f /run/user/1000/wayland-* 2>/dev/null || true
+sleep 1
+
+if [ "$MODE" = "dev" ]; then
+  if ! curl -s --connect-timeout 2 http://localhost:5173/ | grep -q "KiddOs" ; then
+    echo "⚠️  Vite dev server not running on :5173!"
+    echo "   Start in another SSH: cd ~/KiddOsV3/webapp && npm run dev"
+    echo "   Falling back to prod file://"
+    URL="file:///home/elias/KiddOsV3/webapp/dist/index.html"
+  fi
+fi
+
+echo "   Starting: cage -s -- cog --platform=wl $URL"
+sudo openvt -f -c 1 -s -- env XDG_RUNTIME_DIR=/run/user/1000 cage -s -- cog --platform=wl "$URL" --bg-color="$BG"

scripts/run-prod.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Dev helper: run both vite + quick test
+set -e
+cd "$(dirname "$0")/../webapp"
+echo "Checking vite build..."
+npm run build
+echo "Build ok -> dist/"
+echo ""
+echo "Preview static build on http://localhost:4173 to test without HMR"
+npm run preview -- --host 0.0.0.0 --port 4173 &
+PREVIEW_PID=$!
+echo "Preview PID $PREVIEW_PID"
+sleep 2
+echo ""
+echo "Try kiosk with prod file:"
+echo "cage -s -- cog --platform=wl file://$PWD/dist/index.html --bg-color=#2E3440"
+echo ""
+echo "Press Ctrl+C to stop preview"
+wait $PREVIEW_PID