chore: version packages

fix(terminal): preserve IME punctuation input

CHANGELOG.md

@@ -1,5 +1,69 @@
 # aicodeman
 
+## 1.20.1
+
+### Patch Changes
+
+- Terminal input and scrollback fixes (PRs #327, #331):
+  - IME punctuation preserved (#327): keyCode 229 / `Process` key events are now delegated to xterm's CompositionHelper instead of being suppressed, so an active Chinese IME committing numbers and full-width punctuation (，。！？ and friends) reaches the terminal correctly. The CJK input field sends the browser's committed text instead of guessing from `KeyboardEvent.key`, and the redundant Android orphan-input fallback is removed so xterm is the single input owner.
+  - Shell history replay bounded (#331): selecting a Shell session loads a bounded 1 MiB tail instead of replaying the entire multi-megabyte tmux scrollback on xterm's main thread; full history stays available via the explicit "Load full history" action. tmux history limits now apply correctly on both legacy tmux (global default set in the same command queue before pane creation) and tmux 3.7+ (per-pane targeting that never resizes or trims unrelated live panes). Also adds `Server-Timing` and `[TERMINAL-PERF]` timing stages for terminal loads, fixes `scrollToLastNonEmptyLine` double-counting scrollback rows, and keeps live output ordered behind snapshot replays.
+
+  ### Thanks
+  - @dignfei for both fixes: the IME punctuation root-cause fix (#327) and the bounded shell history replay with the tmux history-limit correctness work (#331).
+
+## 1.20.0
+
+### Minor Changes
+
+- Response viewer for OpenCode, Gemini, Antigravity and Pi sessions (#326). External CLIs render their own TUIs, so the viewer used to come up empty for them; a new transcript parser (`response-viewer-transcript.ts`) reconstructs the conversation from the pane text instead, and the `?context=full` view now tags every block with a role so prompts render as "You" and agent output as the assistant. The divider normalizer was rewritten as a linear scan after review found catastrophic backtracking on agent-controlled input (minutes of stall on a long dash run), with an equivalence corpus pinning the old accept set.
+
+  CLIs installed via nvm or Homebrew are now found when Codeman runs as a service (#329). A shared resolver falls back to a login-shell probe when the direct PATH lookup misses, so systemd and LaunchAgent installs no longer report every CLI as missing. Review hardening on top: a failed resolution is negative-cached with doubling backoff instead of re-spawning a login shell on every request, all probes pass `killSignal: 'SIGKILL'` (interactive bash shrugs off SIGTERM, and a blocking `.bash_profile` could have hung the server indefinitely), the resolvers are inert under vitest again so test suites cannot execute binaries found on the dev box, and the improved not-found guidance is wired into both the session-create errors and the per-CLI status endpoints.
+
+  `GET /api/system/repo-status` reports branch, upstream, ahead/behind and remote reachability for git-clone installs (#328). Review hardening: the git network calls moved off the synchronous path onto a single-flight 45s cache (one slow remote could previously freeze the whole server for up to a minute per request), remote URLs and git stderr are credential-redacted before they leave the server, the spawns use the same non-interactive git env as the clone path, and a local-branch upstream no longer parses into garbage.
+
+  Auto Copy for the terminal (#325, opt-in, per-device): a finished selection (mouse drag, double or triple click, or a phone long-press) lands on the clipboard by itself, so select-then-copy becomes select. Alongside it, hand-encoded tap reports are now gated on the server-observed `cliMouseTracking` state, so a pane that has fallen back to a plain shell no longer receives `[<0;88;20M` junk on tap.
+
+  The Ralph loop no longer stops polling after two ticks (#330): the reschedule guard read a stale timer handle that the timer callback never cleared, so the loop silently died while its status stayed `running`. The handle is now nulled as the callback's first statement, and a regression test pins the bug.
+
+  The red "needs you" tab alert clears when a dialog is answered in the terminal instead of surviving until the end of the turn: the post-hook re-capture could erase the parsed dialog options that the staleness sweep relies on (`applyCapture` is now add-only for options), and a delayed staleness pass now runs while a page is open. The unreachable `copyTerminal()` was removed, closing out #322.
+
+  ### Thanks
+  - @aakhter contributed the external-CLI response viewer (#326), the repo-status endpoint (#328), the login-shell CLI resolution (#329) and the Ralph reschedule fix (#330)
+  - @rounakdatta reported the mobile copy gap (#322) closed out in this release
+
+## 1.19.7
+
+### Patch Changes
+
+- Mobile catches up: links open from a tap, terminal text can be selected and copied, long prompts stay visible while you type. Plus Files panel search, a bundled Nerd Font symbols fallback, and a per-device terminal font setting.
+  - **Terminal and chat links work on phones** (#321): tapping a URL or file path in terminal output now opens it (new tab, file preview, or log viewer), resolved through the same provider desktop hover uses, so tap and click can never disagree about what is a link. Dialog rows and the composer keep their existing meaning. Response-viewer links open in a new tab with `rel="noopener noreferrer"` instead of navigating the dashboard away. Wrapped links open whole: the logical-line reconstruction now stitches hard wraps through the indent their continuation carries, which also fixes desktop hover-click truncating wrapped URLs.
+  - **Terminal text can be copied on touch devices** (#321): long-press selects the token under the finger, drag or tap the other end to extend, and a small bar offers Copy, Line (the whole logical line, wraps included) and dismiss. Copy works on plain-HTTP installs too. Three guards keep the keyboard down and the selection alive through the browser's own long-press handling.
+  - **A long prompt stays visible on phones** (#321): the local-echo overlay grows upward once it would run past the last visible row (a prompt taller than the screen keeps its tail, where the cursor is), and the keyboard-driven padding shrink can no longer reclaim the space the fixed toolbar and accessory bar stand in.
+  - **Files panel search** (#324): `GET /api/sessions/:id/files?q=...` answers a flat match list (name or path substring, `*`/`?` globs), recursing past non-matching directories with its own match cap on top of the existing bounds; without `q` the response is byte-identical to before. Glob queries are matched without regex so a pathological pattern cannot stall the server.
+  - **Nerd Font prompt glyphs out of the box, custom terminal font** (#320): a bundled icons-only Symbols Nerd Font Mono fallback renders powerlevel10k/starship/oh-my-posh glyphs on every device with no font install, and App Settings gains a per-device terminal font family that is prepended to the built-in stack.
+
+  ### Thanks
+
+  Three contributor PRs in one release: thanks to @rounakdatta (#321), @aakhter (#324) and @comzine (#320).
+
+- 8a54b33: Clear every production-reachable npm advisory, and fix a service-worker caching regression the upgrade exposed.
+
+  `npm audit` reported 20 advisories, but 16 were devDependencies-only (Remotion, Puppeteer, postcss, the eslint/tsx toolchain) and never reached anyone installing the package. Four reached production and are now resolved:
+  - **`@fastify/static` 9.1.3 to 10.1.3** — GHSA-8pvw-jcv7-9cmj, authorization bypass via non-canonical URL paths. The advisory covers `<=10.1.1`, so the entire 9.x line is affected and the fix only exists on 10.x.
+  - **`find-my-way` 9.6.0 to 9.8.0** — GHSA-c96f-x56v-gq3h (HTTP/2 DDoS). Not exploitable here since Codeman does not enable HTTP/2, fixed anyway.
+  - **`fast-uri` 3.1.2 to 3.1.5** — GHSA-v2hh-gcrm-f6hx, host confusion via a literal backslash authority delimiter.
+  - **`brace-expansion` to 5.0.9 / 1.1.18** — GHSA-3jxr-9vmj-r5cp, exponential-time expansion DoS.
+
+  The last three were transitive and only needed a lockfile re-resolve; no `overrides` were added.
+
+  The `@fastify/static` major changes the `setHeaders` callback's first argument from a Node `ServerResponse` to a `FastifyReply`, which required two fixes:
+  - `res.setHeader()` became `reply.header()`. A v9-style body throws `TypeError: res.setHeader is not a function` from inside the plugin on every static request.
+  - **That change also flips precedence, silently.** The callback used to write to the raw response and be overwritten by the route's staged reply headers; it now writes to the reply and wins instead. That handed `/sw.js` a year of `immutable` in place of the `no-cache, no-store` its route sets, which would pin a service worker on every client with no server-side way to recover. A route that already set `Cache-Control` now keeps it.
+
+  `ws` also appears in `npm audit` but production is already on 8.21.0, outside the vulnerable range; the only affected copy is bundled under `@remotion/renderer` and is dev-only.
+
+  Adds `test/static-cache-headers.test.ts`, which drives a real server and covers the caching contract that had no test at all, and moves the floors in `test/dependency-security.test.ts` up to the patched versions.
+
 ## 1.19.6
 
 ### Patch Changes

docs/architecture-invariants.md

@@ -92,13 +92,15 @@ Implementation detail extracted from `CLAUDE.md` so that file stays small enough
 
 ### Full-scrollback replay
 
-**Full-scrollback replay** (COD-164/#148, reworked for #205): `GET /api/sessions/:id/terminal?full=1` returns the ENTIRE tmux scrollback (capture-pane `-e -S -<lines>` bounded by the configured history limit, explicit `maxBuffer` from the terminal-history config, early byte-cap before normalization, CRLF-normalized for shell panes). On success the capture is returned ALONE (`source='mux-full-history'` — it supersedes the byte buffer; no duplication). The first load OF EACH SESSION per page load requests `full=1` (`_fullHistoryLoaded` Set in app.js — the old one-shot `_initialFullBufferLoad` flag was consumed by whichever tab auto-selected, leaving every other tab one frame of history); later switches keep the cheap `?tail=` visible-frame path. On top of that, scrolling up while already at the TOP of the buffer re-pulls `full=1` on demand (`_maybeRefetchFullHistory`, 4s per-session cooldown, in-flight + tab-switch guards, viewport position held across the replay). The re-pull exists because xterm's buffer is only a WINDOW onto tmux's history and two things shrink it: tmux coalesces bursty output into pane REPAINTS that overwrite rows instead of emitting linefeeds (measured: a 60-line burst added 1 row of browser scrollback and destroyed 34), and a tab switch replays only the visible frame. tmux's own history is intact throughout — the browser just has to ask for it again. On-demand rather than automatic because at a 100k history limit the capture can be megabytes. ⚠️ **The re-pull must never DOWNGRADE the buffer** (#205 round 2): the same reasoning that makes it a win for a shell pane makes it destructive for a repaint-mode CLI pane, where tmux keeps no history of its own (`history_size≈0` measured for a Claude pane) and the capture is roughly ONE frame while xterm may hold hundreds of rows of replayed frames — `_resetTerminalForReplay()` + rewrite then deletes history mid-scroll ("goes back a bit, repeats blocks, gets worse the further up I go"; measured A/B on a live pane: 341 rows → 42 with the guard off). `_replayWouldShrinkBuffer()` (terminal-ui.js) estimates the capture's rendered rows — escape sequences stripped, `capture-pane -J` re-wrapping accounted for — and the pull is skipped when that is more than one screen short of `buffer.active.length`. The one-screen tolerance matters: both sides are estimates (the buffer length counts trailing blank rows), so only a clear downgrade is refused. A refused session joins `_fullHistoryRepullUseless`, raising its cooldown from 4s to 60s so a hollow pane stops re-fetching megabytes on every scroll-up. Tests: `test/tmux-capture-full-history.test.ts`, `test/tmux-scrollback-eol.test.ts`, `test/terminal-scroll-routing.test.ts`.
+**Full-scrollback replay** (COD-164/#148, reworked for #205): `GET /api/sessions/:id/terminal?full=1` returns the ENTIRE tmux scrollback (capture-pane `-e -S -<lines>` bounded by the configured history limit, explicit `maxBuffer` from the terminal-history config, early byte-cap before normalization, CRLF-normalized for shell panes). On success the capture is returned ALONE (`source='mux-full-history'` — it supersedes the byte buffer; no duplication). The first load of each non-shell TUI session per page requests `full=1` (`_fullHistoryLoaded` Set in app.js — the old one-shot `_initialFullBufferLoad` flag was consumed by whichever tab auto-selected, leaving every other TUI tab one frame of history). Shell sessions instead load a bounded 1 MiB `?tail=` window on every selection: a 100k-line shell capture can be tens of MiB, and automatically parsing it makes tab-switch latency scale with the entire session. Shell full history is therefore explicit-button-only; reaching the top during an ordinary wheel/touch gesture must not reset xterm and replay the multi-megabyte capture on its main thread. Other modes may still re-pull `full=1` at the TOP, and pressing **Load full history** forces the request for any recoverably truncated session (`_maybeRefetchFullHistory`, 4s per-session gesture cooldown, in-flight + tab-switch guards, viewport position held across the replay); Shell full pulls are not retained in the tab cache, so the next switch stays bounded. Chunked replay enqueues 32 KiB pieces across safe yields, appends an xterm parse marker, then releases the live-output gate; output arriving after that release stays ordered behind the snapshot, while the marker callback supplies accurate parse timing without extending the pre-existing queued-event discard window. The route exposes capture/prepare totals in `Server-Timing`, while `[TERMINAL-PERF]` separates TTFB, body/JSON, reset+parse and total time for both selection and on-demand full pulls; parse completion is not a browser compositor/GPU paint measurement. The re-pull exists because xterm's buffer is only a WINDOW onto tmux's history and two things shrink it: tmux coalesces bursty output into pane REPAINTS that overwrite rows instead of emitting linefeeds (measured: a 60-line burst added 1 row of browser scrollback and destroyed 34), and a tab switch replays only the visible frame. tmux's own history is intact throughout — the browser just has to ask for it again. On-demand rather than automatic because at a 100k history limit the capture can be megabytes. ⚠️ **The re-pull must never DOWNGRADE the buffer** (#205 round 2): the same reasoning that makes it a win for a shell pane makes it destructive for a repaint-mode CLI pane, where tmux keeps no history of its own (`history_size≈0` measured for a Claude pane) and the capture is roughly ONE frame while xterm may hold hundreds of rows of replayed frames — `_resetTerminalForReplay()` + rewrite then deletes history mid-scroll ("goes back a bit, repeats blocks, gets worse the further up I go"; measured A/B on a live pane: 341 rows → 42 with the guard off). `_replayWouldShrinkBuffer()` (terminal-ui.js) estimates the capture's rendered rows — escape sequences stripped, `capture-pane -J` re-wrapping accounted for — and the pull is skipped when that is more than one screen short of `buffer.active.length`. The one-screen tolerance matters: both sides are estimates (the buffer length counts trailing blank rows), so only a clear downgrade is refused. A refused session joins `_fullHistoryRepullUseless`, raising its cooldown from 4s to 60s so a hollow pane stops re-fetching megabytes on every scroll-up. Tests: `test/tmux-capture-full-history.test.ts`, `test/tmux-scrollback-eol.test.ts`, `test/terminal-scroll-routing.test.ts`.
 
 ### Terminal scrollback: strip flavors and wheel/touch forwarding
 
-**Two strip flavors, one carry** (#205, `session.ts:_handleTerminalOutput`): the FULL strip (`isAltScreenStripMode` = codex/claude/gemini) removes alt-screen toggles, `3J`, and mouse-tracking DECSETs. Every other mode (shell/opencode/antigravity/pi) gets the NARROW strip (`isMuxAltScreenOnlyStripMode`) — alt-screen toggles ONLY — and only when tmux-backed (`useMux`). Rationale: the tmux CLIENT emits `smcup` as its first bytes at attach, before any program runs, parking xterm in the scrollback-less alternate buffer for the whole session (touch scrolling no-ops; xterm's own wheel handler converts the wheel to Up/Down arrows = readline history cycling — both #205 symptoms). tmux never forwards a pane program's alt-screen toggles to its client (it repaints instead; measured — vim/less inside a pane emit zero to the client), so the only thing the narrow strip ever removes is tmux's own smcup. It keeps `3J` (a user's `clear` is a deliberate scrollback wipe) and the mouse DECSETs (tmux passes those through even with `mouse off`; stripping them would break htop/vim mouse support). ⚠️ The `useMux` gate is load-bearing: `startShell()`/`startInteractive()` fall back to a DIRECT PTY when mux creation fails, and there the inner program's own `?1049h` really does reach xterm — stripping it would break vim/less/htop for real. The replay path (`session-routes.ts`, via `session.usesMux`) applies the same narrow branch; the frontend `_sessionUsesServerMouseStrip()` mirror stays claude/codex/gemini because only the FULL strip touches mouse DECSETs. The chunk-boundary carry (`_altScreenSeqCarry`) runs for both flavors. Tests: `test/claude-scrollback-strip.test.ts`.
+**Two strip flavors, one carry** (#205, `session.ts:_handleTerminalOutput`): the FULL strip (`isAltScreenStripMode` = codex/claude/gemini) removes alt-screen toggles, `3J`, and mouse-tracking DECSETs. Every other mode (shell/opencode/antigravity/pi) gets the NARROW strip (`isMuxAltScreenOnlyStripMode`) — alt-screen toggles ONLY — and only when tmux-backed (`useMux`). Rationale: the tmux CLIENT emits `smcup` as its first bytes at attach, before any program runs, parking xterm in the scrollback-less alternate buffer for the whole session (touch scrolling no-ops; xterm's own wheel handler converts the wheel to Up/Down arrows = readline history cycling — both #205 symptoms). tmux never forwards a pane program's alt-screen toggles to its client (it repaints instead; measured — vim/less inside a pane emit zero to the client), so the only thing the narrow strip ever removes is tmux's own smcup. It keeps `3J` (a user's `clear` is a deliberate scrollback wipe) and the mouse DECSETs (tmux passes those through even with `mouse off`; stripping them would break htop/vim mouse support). ⚠️ The `useMux` gate is load-bearing: `startShell()`/`startInteractive()` fall back to a DIRECT PTY when mux creation fails, and there the inner program's own `?1049h` really does reach xterm — stripping it would break vim/less/htop for real. The replay path (`session-routes.ts`, via `session.usesMux`) applies the same narrow branch; the frontend mirror (`_shouldReportMouseToCli()`) stays claude/codex/gemini because only the FULL strip touches mouse DECSETs. The chunk-boundary carry (`_altScreenSeqCarry`) runs for both flavors. Tests: `test/claude-scrollback-strip.test.ts`.
 
-**Only claude ≥ 2.1.187 forwards the wheel; every other mode scrolls local scrollback** (#227 follow-up, `terminal-ui.js:_shouldForwardWheelToApp`). Codex was in the forward list until a reporter hit a completely dead wheel in codex tabs while the scrollbar drag worked. Measured against codex-cli 0.147.0 in a bare tmux: it never enables mouse tracking (`mouse_any_flag=0`) and SGR wheel reports fed to its PTY change nothing on screen, because it runs an INLINE viewport (`alternate_on=0`) and pushes its transcript into the terminal's own scrollback (tmux `history_size` grows) instead of paging in-app. So for codex, local scrollback IS the transcript and forwarding swallowed every tick. ⚠️ "The TUI is a strip mode" is NOT evidence that it consumes wheel reports — verify with a real `\x1b[<64;c;rM` write into a live pane before adding a mode here. Hand-encoded SGR TAPS stay enabled for codex (`_sessionUsesServerMouseStrip`); measured, they are no-ops that insert nothing, so click-to-position is simply unavailable there rather than harmful.
+⚠️ **What the full strip removes, it must REMEMBER.** Stripping the mouse DECSETs means xterm's `modes.mouseTrackingMode` is permanently `'none'` for those modes, so the browser hand-encodes click reports to compensate (`_sendSyntheticSgrTap`). With no state to consult it did that on EVERY click, which delivered mouse reports to programs that never asked for them: the same pane runs a plain shell whenever the CLI has exited or a `shell` was started inside a claude-mode session, and a shell prints the report as literal text (`[<0;88;20M`), garbling the next line typed. `_recordStrippedMouseMode()` therefore records each stripped sequence as it goes and publishes `cliMouseTracking` through `toState()`, and `_shouldReportMouseToCli()` requires it. ⚠️ Only the TRACKING modes count (1000/1001/1002/1003): 1005/1006 select an ENCODING and 1007 is alt-scroll, and counting those would put the stray reports straight back. ⚠️ The change broadcasts IMMEDIATELY rather than through `broadcastSessionStateDebounced`, because the flag flips when a dialog opens and the user can click that dialog inside the 500ms debounce window. Measured on a live claude 2.x: the CLI holds a tracking mode on continuously (so clicks keep being reported exactly as before), while a bash prompt in the same stripped mode reports nothing. Fails toward silence: after a server restart the flag is false until the CLI re-emits, which tmux does at client attach.
+
+**Only claude ≥ 2.1.187 forwards the wheel; every other mode scrolls local scrollback** (#227 follow-up, `terminal-ui.js:_shouldForwardWheelToApp`). Codex was in the forward list until a reporter hit a completely dead wheel in codex tabs while the scrollbar drag worked. Measured against codex-cli 0.147.0 in a bare tmux: it never enables mouse tracking (`mouse_any_flag=0`) and SGR wheel reports fed to its PTY change nothing on screen, because it runs an INLINE viewport (`alternate_on=0`) and pushes its transcript into the terminal's own scrollback (tmux `history_size` grows) instead of paging in-app. So for codex, local scrollback IS the transcript and forwarding swallowed every tick. ⚠️ "The TUI is a strip mode" is NOT evidence that it consumes wheel reports — verify with a real `\x1b[<64;c;rM` write into a live pane before adding a mode here. Hand-encoded SGR TAPS are gated by `_shouldReportMouseToCli()` (strip mode AND the server-observed `cliMouseTracking` flag, recorded by `_recordStrippedMouseMode` in session.ts as it strips): codex never enables mouse tracking, so since #325 no tap report is sent there at all — click-to-position was already a measured no-op in codex, and a pane that has fallen back to a shell no longer receives `[<0;88;20M` junk.
 
 **Wheel/touch forwarding is NOT gated on viewport-at-bottom** (#205, `terminal-ui.js:_shouldForwardWheelToApp`): for sessions verified to scroll their own transcript on SGR wheel reports (claude ≥ 2.1.187 — version via the local/docker/remote `--version` probes), the plain wheel AND touch drags forward as coalesced SGR reports (`_forwardScrollToApp` → `_sendSyntheticSgrWheel`, 40ms batches, 5-tick cap, 512-byte queue bound). It used to gate on the viewport being at the bottom so both scrollbacks stayed reachable, but a repaint-mode CLI keeps NO terminal scrollback of its own — xterm's buffer holds only replayed repaint frames, so local scrolling drags the CLI's pinned prompt box up the screen over stale frames; and `scrollToLastNonEmptyLine()` routinely parked the viewport off-bottom, silently pinning the wheel to local. Forwarding now snaps the viewport home first (SGR coordinates address the LIVE screen — a report computed from a scrolled-up viewport would hit-test the wrong row). Local scrollback remains on Shift+wheel and the `terminalWheelLocalScrollback` opt-out (both also cover touch via the shared gate; touch has no Shift, so the setting is its only local pin). `_wheelScrollLines()` normalizes `deltaMode` (Firefox fires LINE deltas ≈3/notch — read as pixels that rounded to 0 and fell to the ±1 fallback, ~4× too slow; PAGE deltas scale by `terminal.rows`) while keeping the #154 Shift-axis trap (macOS trackpads put Shift+scroll magnitude on deltaX). Tests: `test/terminal-touch-tap.test.ts`.
 
@@ -258,6 +260,22 @@ Invariants:
 
 Copy goes through `_copyText()` (Clipboard API, then hidden-textarea + `execCommand`), not raw `navigator.clipboard`, because `install.sh`'s LAN option serves plain HTTP where `navigator.clipboard` is undefined; the fallback steals focus, so the terminal is refocused afterwards. Related: xterm registers its own `copy` listener on the terminal element gated on `hasSelection()`, which is why right-click → Copy has always worked. Selection itself is unavailable on touch devices by design (`user-select: none` on the terminal subtree), and in `shell`/`opencode`/`antigravity` tabs the TUI owns the mouse, so selecting there needs Shift+drag. Tests: `test/terminal-copy-selection.test.ts` (gate + wiring invariants), `test/terminal-copy-shortcut.test.ts` (browser, real key presses).
 
+### Auto Copy (copy-on-select)
+
+**Auto Copy** (`autoCopySelection`, per-device, default OFF) puts a finished terminal selection on the clipboard without a keystroke. It is a thin layer over the smart-copy machinery above and shares `_copyText()` with it, but the two paths differ in every decision that matters:
+
+- **It fires at the END of a gesture, never on selection change.** `onSelectionChange` runs for every cell a drag crosses, so copying there would be one clipboard write per mouse move. The callback only ARMS `_autoCopyPending`; the flush is a document-level `mouseup` listener installed once in `initTerminal`, plus explicit calls from the touch selection path.
+- **The flush is synchronous inside the handler.** Both clipboard paths need user activation: Firefox gates `navigator.clipboard.writeText` on it, and `document.execCommand('copy')` (the plain-HTTP fallback that `install.sh`'s LAN option lands on) has to run in the gesture's own task. Deferring to a timer or waiting for `onSelectionChange` loses it, and the failure is browser-specific and invisible in Chrome.
+- **The listener is on `document`, not the terminal container**, because a drag that ends outside the terminal (sweeping up past the header) delivers its mouseup to the document. Unrelated mouseups elsewhere on the page are filtered by the decision helper, not by the listener's target.
+- **Touch has its own entry point.** `_endTouchSelectionGesture()` and `_selectTouchSelectionLine()` call the flush directly, because the touch path `preventDefault()`s its touchend (that is what stops the compat mouse pair from stealing the selection back), so no mouseup ever reaches the document there. Without those two calls the toggle is simply dead on a phone.
+- **It must NOT do what `copyTerminalSelection()` does.** That one clears the selection (so a second `Ctrl+C` is an interrupt) and focuses the terminal. Clearing would make text vanish from under the cursor that just highlighted it, and focusing opens the on-screen keyboard over it on a phone. Focus is instead RESTORED to whatever held it before the copy, which only matters for the `execCommand` fallback (it focuses a temp textarea on the way through); the Clipboard API path never moves focus at all.
+
+`decideAutoCopy()` (constants.js, pure) holds the guards: setting off, blank or whitespace-only text (what a drag across empty cells produces), and a `AUTO_COPY_MAX_CHARS` (1M) cap. ⚠️ The cap is not decoration: a drag off the top of the viewport autoscrolls, so one gesture can sweep the whole 50k-line scrollback. Past it the copy is REFUSED rather than truncated, with a toast pointing at `Ctrl+C`, which still copies everything through the explicit path.
+
+⚠️ **Two dedupe rules, and both earn their place.** A genuine selection change (`pending`) always copies, so re-selecting the same text after copying something else in between still works. Otherwise only text differing from the last auto-copy does, which is what stops an unrelated mouseup from re-copying a stale selection AND what makes the first copy of a drag work at all: xterm fires `onSelectionChange` from its own document `mouseup` handler, and listener order between the two is registration order, not something this code controls. Gating on `pending` alone silently drops that first copy.
+
+Feedback is silent on success except ONCE per page load (a feature that works by doing nothing visible cannot otherwise be told from a dead toggle); failures and refusals toast, throttled to 10s so a permanently blocked clipboard cannot paint a toast on every drag. The setting is per-device on both counts required by the settings rule: it is in `displayKeys` AND absent from the `.strict()` `SettingsUpdateSchema` (clipboard access differs by device and by origin, and the plain-HTTP LAN install has no `navigator.clipboard` at all). Tests: `test/terminal-auto-copy.test.ts`.
+
 ### Settings surface: App Settings, Session Options, Add Case
 
 **One visual language, three modals.** `#appSettingsModal`, `#sessionOptionsModal` and `#createCaseModal` share the `set-*` surface (left rail, sections of grouped row cards, label + description on the left, control pinned right) through a single `:is(#appSettingsModal, #sessionOptionsModal, #createCaseModal)` scope in `styles.css`. An `:is()` list takes the specificity of its **most specific argument**, and all three arguments are ids, so every rule kept exactly the weight it had when the block was `#appSettingsModal`-only: nothing downstream shifted in the cascade. That property is what let the surface absorb Session Options and then Add Case in two separate commits without a cascade audit each time.
@@ -359,7 +377,7 @@ Anatomy: `.set-shell` → `.set-shell-head` (title + `.set-head-actions`) + `.se
 
 ### Buffers, uploads, and terminal history
 
-Target: 20 sessions, 50 agent windows at 60fps. Limits in `src/config/`: terminal 32MB (see below), text 1MB, messages 1000, max agents 500, max sessions 50, max SSE clients 100. **Terminal history** (`src/config/terminal-history.ts`, COD-80): tmux history-limit 100k lines, PTY buffer 32MB max / 24MB trim (env `CODEMAN_MAX_TERMINAL_BUFFER`/`CODEMAN_TRIM_TERMINAL_TO`; the env-derived trim is clamped ≤75% of max — trim ≥ max would disable `BufferAccumulator` trimming entirely = unbounded memory); browser xterm scrollback stays a separate hardcoded 50k (`DEFAULT_SCROLLBACK` in constants.js — 100k/tab is a mobile-memory hazard). Settings keys `terminalScrollbackLines`/`terminalBufferMaxBytes`/`terminalBufferTrimBytes` are schema-validated but inert (only `tmuxHistoryLimit` is wired live); `buffer-limits.ts` re-exports the defaults. Text/message limits are env-overridable too (`CODEMAN_MAX_TEXT_OUTPUT`/`CODEMAN_TRIM_TEXT_TO`/`CODEMAN_MAX_MESSAGES`). **Image upload** (`image-input.js` / `config/buffer-limits.ts`): up to `_maxBatchImages` 20 images/batch (bounded concurrency 3), per-file `MAX_PASTE_IMAGE_BYTES` 50MB (env `CODEMAN_MAX_PASTE_IMAGE_BYTES`); the mobile camera-roll picker auto-downscales to fit before upload. **HEIC paste uploads** (#151): converted server-side to JPEG in a `worker_threads` worker (`web/heic-jpeg-worker.ts`, resourceLimits + 30s timeout) gated by `runWithConversionLimit()`; detection is magic-byte based (covers Android/MIUI HEIFs mislabeled as JPEG); headers declaring > 64MP are rejected 415 BEFORE decode (decompression-bomb guard). Deps: `heic-decode` + `jpeg-js`. Use `LRUMap` for bounded caches, `StaleExpirationMap` for TTL cleanup. Anti-flicker pipeline: `docs/terminal-anti-flicker.md`.
+Target: 20 sessions, 50 agent windows at 60fps. Limits in `src/config/`: terminal 32MB (see below), text 1MB, messages 1000, max agents 500, max sessions 50, max SSE clients 100. **Terminal history** (`src/config/terminal-history.ts`, COD-80): tmux history-limit 100k lines, PTY buffer 32MB max / 24MB trim (env `CODEMAN_MAX_TERMINAL_BUFFER`/`CODEMAN_TRIM_TERMINAL_TO`; the env-derived trim is clamped ≤75% of max — trim ≥ max would disable `BufferAccumulator` trimming entirely = unbounded memory); browser xterm scrollback stays a separate hardcoded 50k (`DEFAULT_SCROLLBACK` in constants.js — 100k/tab is a mobile-memory hazard). tmux <3.7 allocates history at pane creation, so `createSession()` sets the global default in the same command queue immediately before `new-session`; tmux 3.7+ instead creates the session and targets only that pane, because changing the global option can resize and trim unrelated live panes. A settings change resizes tracked panes only on 3.7+ and otherwise affects future panes; no version can recover lines already evicted. Settings keys `terminalScrollbackLines`/`terminalBufferMaxBytes`/`terminalBufferTrimBytes` are schema-validated but inert (only `tmuxHistoryLimit` is wired); `buffer-limits.ts` re-exports the defaults. Text/message limits are env-overridable too (`CODEMAN_MAX_TEXT_OUTPUT`/`CODEMAN_TRIM_TEXT_TO`/`CODEMAN_MAX_MESSAGES`). **Image upload** (`image-input.js` / `config/buffer-limits.ts`): up to `_maxBatchImages` 20 images/batch (bounded concurrency 3), per-file `MAX_PASTE_IMAGE_BYTES` 50MB (env `CODEMAN_MAX_PASTE_IMAGE_BYTES`); the mobile camera-roll picker auto-downscales to fit before upload. **HEIC paste uploads** (#151): converted server-side to JPEG in a `worker_threads` worker (`web/heic-jpeg-worker.ts`, resourceLimits + 30s timeout) gated by `runWithConversionLimit()`; detection is magic-byte based (covers Android/MIUI HEIFs mislabeled as JPEG); headers declaring > 64MP are rejected 415 BEFORE decode (decompression-bomb guard). Deps: `heic-decode` + `jpeg-js`. Use `LRUMap` for bounded caches, `StaleExpirationMap` for TTL cleanup. Anti-flicker pipeline: `docs/terminal-anti-flicker.md`.
 
 ## Local packages and build artifacts
 

docs/wiki/Mobile-Guide.md

@@ -88,6 +88,22 @@ looks exactly like a dead button.
 On phones this button replaces the desktop's **Run Shell** control; starting a shell moved
 into the Run dropdown.
 
+## Tapping, links and copying
+
+- **Tap a link** in terminal output and it opens in a new tab. Same for a link in an agent's
+  answer in the response viewer — it opens a tab rather than navigating the dashboard away,
+  which on a phone would unload the whole session view.
+- **Tap a file path** an agent printed and the file-preview overlay opens; a log path opens the
+  log viewer. Works in scrolled-up transcript too.
+- A tap on the prose *beside* a link still places the cursor as usual, and a tap on a dialog's
+  numbered choice still answers the dialog even when the row contains a path — the dialog wins,
+  because on a phone it is the only interaction that matters.
+- **Long-press to select text**, then drag, or tap the other end to extend the selection — no
+  hairline handles to grab. A small bar offers **Copy**, **Line** (the whole logical line,
+  wrapped rows included) and dismiss. Copy works on plain-HTTP installs too, where the browser
+  clipboard API is unavailable.
+- A swipe is never mistaken for a long-press, and the keyboard stays down while you select.
+
 ## Scrolling and the keyboard
 
 - The terminal and toolbar shift up when the keyboard opens, tracked through the browser's
@@ -97,6 +113,10 @@ into the Run dropdown.
   keeps focus so you can place the caret.
 - A scroll is never mistaken for a tap: travel is measured from the start of the gesture, and
   multi-touch never counts.
+- **A long prompt stays visible.** Once what you are typing wraps past the last visible row it
+  grows upward over the transcript instead of sliding under the keyboard, so the end of the
+  sentence — where the cursor is — is always on screen. A prompt taller than the visible strip
+  shows its tail.
 
 ## Voice
 

docs/wiki/Settings-Reference.md

@@ -45,6 +45,7 @@ supervised by systemd or launchd; npm installs report as non-updatable. See
 | CJK Input                     | Off                  | IME composition through a dedicated text field.                        |
 | Extended Keyboard Bar         | Per device           | Which accessory bar phones get. Shell sessions override it while they are active. |
 | Wheel Scrolls Local History   | Off                  | Keeps the wheel on the local buffer instead of forwarding it to the CLI. |
+| Auto Copy Selection           | Off                  | Copies highlighted terminal text to the clipboard the moment you finish selecting it. Ctrl+C still copies on demand. |
 | WebGL Renderer                | On                   | With a GPU-stall watchdog that falls back to DOM rendering.            |
 | Gesture Control               | Off                  | Camera hand tracking. Also needs `CODEMAN_GESTURE=1` on the server.    |
 

docs/wiki/The-Dashboard.md

@@ -133,8 +133,10 @@ TUIs render correctly.
 
 Worth knowing:
 
-- **Scrollback.** The first time you open a session, Codeman pulls the entire tmux
-  scrollback, not just the recent tail. Scrolling to the very top pulls again on demand.
+- **Scrollback.** Agent/TUI sessions pull their entire tmux scrollback on first open.
+  Shell sessions open from a bounded recent tail so a large transcript cannot stall tab
+  switching; press **Load full history** to pull the rest explicitly. Ordinary Shell scrolling
+  stays within the bounded browser buffer so dragging upward remains responsive.
 - **Wheel and touch scrolling** are forwarded into Claude's own transcript on recent Claude
   versions, so the wheel scrolls the conversation rather than the terminal. `Shift+Wheel` is
   always local scrollback. Other CLIs scroll locally.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "aicodeman",
-  "version": "1.19.6",
+  "version": "1.20.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "aicodeman",
-      "version": "1.19.6",
+      "version": "1.20.1",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [
@@ -17,7 +17,7 @@
         "@fastify/compress": "^8.3.1",
         "@fastify/cookie": "^11.0.2",
         "@fastify/multipart": "^10.0.0",
-        "@fastify/static": "^9.1.3",
+        "@fastify/static": "^10.1.3",
         "@fastify/websocket": "^11.2.0",
         "@xterm/addon-fit": "^0.11.0",
         "@xterm/addon-serialize": "^0.14.0",
@@ -1454,9 +1454,9 @@
       }
     },
     "node_modules/@fastify/static": {
-      "version": "9.1.3",
-      "resolved": "https://registry.npmjs.org/@fastify/static/-/static-9.1.3.tgz",
-      "integrity": "sha512-aXrYtsiryLhRxRNaxNqsn7FUISeb7rB9q4eHUPIot5aeQBLNahnz1m6thzm7JWC1poSGXS9XrX8DvuMivp2hkQ==",
+      "version": "10.1.3",
+      "resolved": "https://registry.npmjs.org/@fastify/static/-/static-10.1.3.tgz",
+      "integrity": "sha512-W6jqajYS974XjPjB5hQWoxPM8NKM4+p8YmQT6G5IbCa4uhdWSVadZUv75siy1wEA/3ty8RYdpBydfWeu9AqAqQ==",
       "funding": [
         {
           "type": "github",
@@ -1470,13 +1470,30 @@
       "license": "MIT",
       "dependencies": {
         "@fastify/accept-negotiator": "^2.0.0",
+        "@fastify/error": "^4.0.0",
         "@fastify/send": "^4.0.0",
-        "content-disposition": "^1.0.1",
-        "fastify-plugin": "^5.0.0",
+        "content-disposition": "^2.0.1",
+        "fastify-plugin": "^6.0.0",
         "fastq": "^1.17.1",
         "glob": "^13.0.0"
       }
     },
+    "node_modules/@fastify/static/node_modules/fastify-plugin": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
+      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@fastify/websocket": {
       "version": "11.2.0",
       "resolved": "https://registry.npmjs.org/@fastify/websocket/-/websocket-11.2.0.tgz",
@@ -4136,16 +4153,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
@@ -5078,9 +5095,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
-      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5431,9 +5448,9 @@
       }
     },
     "node_modules/content-disposition": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
-      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
+      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -6552,9 +6569,9 @@
       }
     },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "funding": [
         {
           "type": "github",
@@ -6661,9 +6678,9 @@
       }
     },
     "node_modules/find-my-way": {
-      "version": "9.6.0",
-      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.6.0.tgz",
-      "integrity": "sha512-Zf4Xve4RymLl7NgaavNebZ01joJ8MfVerOG43wy7SHLO+r+K0C6d/SE0BiR7AV5V1VOCFlOP7ecdo+I4qmiHrQ==",
+      "version": "9.8.0",
+      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.8.0.tgz",
+      "integrity": "sha512-JtyUgATO7qxRp2zKhrmWof74Mqxc1ikbwpwMY97p8ipuTj2QtreA4gK2JNAF6SOqqHnYYkwMUvsgQVi2AJxIyw==",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -6905,15 +6922,15 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/glob/node_modules/minimatch": {
@@ -12344,7 +12361,7 @@
       }
     },
     "packages/xterm-zerolag-input": {
-      "version": "0.3.0",
+      "version": "0.3.1",
       "license": "MIT",
       "devDependencies": {
         "@xterm/headless": "^6.0.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "aicodeman",
-  "version": "1.19.6",
+  "version": "1.20.1",
   "description": "Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence",
   "type": "module",
   "main": "dist/index.js",
@@ -85,7 +85,7 @@
     "@fastify/compress": "^8.3.1",
     "@fastify/cookie": "^11.0.2",
     "@fastify/multipart": "^10.0.0",
-    "@fastify/static": "^9.1.3",
+    "@fastify/static": "^10.1.3",
     "@fastify/websocket": "^11.2.0",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/addon-serialize": "^0.14.0",

packages/xterm-zerolag-input/CHANGELOG.md

@@ -1,5 +1,20 @@
 # xterm-zerolag-input
 
+## 0.3.1
+
+### Patch Changes
+
+- Mobile catches up: links open from a tap, terminal text can be selected and copied, long prompts stay visible while you type. Plus Files panel search, a bundled Nerd Font symbols fallback, and a per-device terminal font setting.
+  - **Terminal and chat links work on phones** (#321): tapping a URL or file path in terminal output now opens it (new tab, file preview, or log viewer), resolved through the same provider desktop hover uses, so tap and click can never disagree about what is a link. Dialog rows and the composer keep their existing meaning. Response-viewer links open in a new tab with `rel="noopener noreferrer"` instead of navigating the dashboard away. Wrapped links open whole: the logical-line reconstruction now stitches hard wraps through the indent their continuation carries, which also fixes desktop hover-click truncating wrapped URLs.
+  - **Terminal text can be copied on touch devices** (#321): long-press selects the token under the finger, drag or tap the other end to extend, and a small bar offers Copy, Line (the whole logical line, wraps included) and dismiss. Copy works on plain-HTTP installs too. Three guards keep the keyboard down and the selection alive through the browser's own long-press handling.
+  - **A long prompt stays visible on phones** (#321): the local-echo overlay grows upward once it would run past the last visible row (a prompt taller than the screen keeps its tail, where the cursor is), and the keyboard-driven padding shrink can no longer reclaim the space the fixed toolbar and accessory bar stand in.
+  - **Files panel search** (#324): `GET /api/sessions/:id/files?q=...` answers a flat match list (name or path substring, `*`/`?` globs), recursing past non-matching directories with its own match cap on top of the existing bounds; without `q` the response is byte-identical to before. Glob queries are matched without regex so a pathological pattern cannot stall the server.
+  - **Nerd Font prompt glyphs out of the box, custom terminal font** (#320): a bundled icons-only Symbols Nerd Font Mono fallback renders powerlevel10k/starship/oh-my-posh glyphs on every device with no font install, and App Settings gains a per-device terminal font family that is prepended to the built-in stack.
+
+  ### Thanks
+
+  Three contributor PRs in one release: thanks to @rounakdatta (#321), @aakhter (#324) and @comzine (#320).
+
 ## 0.3.0
 
 ### Minor Changes

packages/xterm-zerolag-input/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xterm-zerolag-input",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Instant keystroke feedback overlay for xterm.js: Mosh-inspired local echo that removes perceived input latency over SSH, tunnels and other high-RTT connections",
   "type": "module",
   "main": "dist/index.cjs",

packages/xterm-zerolag-input/src/overlay-renderer.ts

@@ -65,38 +65,71 @@ export function renderOverlay(container: HTMLDivElement, params: RenderParams):
     charTop,
     charHeight,
     promptRow,
+    totalRows,
     font,
     showCursor,
     cursorColor,
     terminal,
   } = params;
 
-  // Position container at prompt row.
+  // ── Keep what is being typed ON SCREEN ────────────────────────────
+  //
+  // The overlay lays its wrapped lines out DOWNWARD from the prompt row, and
+  // nothing past the last terminal row is visible. On a phone the strip left
+  // above the on-screen keyboard is only a handful of rows, so a prompt long
+  // enough to wrap ran off the bottom and the user was typing blind — the tail
+  // of their own sentence, the part they are actually looking at, hidden behind
+  // the keyboard.
+  //
+  // So the composer grows UPWARD once it reaches the last row, exactly as a real
+  // terminal's does: every line div is opaque (see makeLine), so the lines cover
+  // transcript rows above instead of vanishing under the keyboard below, and the
+  // newest text stays where the eye is. A prompt taller than the whole viewport
+  // keeps its TAIL for the same reason.
+  //
+  // `startCol` indents only the line that begins at the prompt marker, so it is
+  // dropped along with that line when the tail is all that fits.
+  const rows = totalRows && totalRows > 0 ? totalRows : terminal?.rows;
+  let visibleLines = lines;
+  let keepsPromptLine = true;
+  let topRow = promptRow;
+  if (rows && rows > 0) {
+    if (lines.length > rows) {
+      visibleLines = lines.slice(lines.length - rows);
+      keepsPromptLine = false;
+      topRow = 0;
+    } else if (promptRow + lines.length > rows) {
+      topRow = rows - lines.length;
+    }
+  }
+  topRow = Math.max(0, topRow);
+
   container.style.left = '0px';
-  container.style.top = promptRow * cellH + 'px';
+  container.style.top = topRow * cellH + 'px';
 
   // Clear and rebuild (typically 1-3 line divs, negligible cost)
   container.innerHTML = '';
   const fullWidthPx = totalCols * cellW;
 
-  for (let i = 0; i < lines.length; i++) {
-    const leftPx = i === 0 ? startCol * cellW : 0;
-    const widthPx = i === 0 ? fullWidthPx - leftPx : fullWidthPx;
+  for (let i = 0; i < visibleLines.length; i++) {
+    const indents = i === 0 && keepsPromptLine;
+    const leftPx = indents ? startCol * cellW : 0;
+    const widthPx = indents ? fullWidthPx - leftPx : fullWidthPx;
     const topPx = i * cellH;
-    const lineEl = makeLine(lines[i], leftPx, topPx, widthPx, cellH, cellW, charTop, charHeight, font, terminal);
+    const lineEl = makeLine(visibleLines[i], leftPx, topPx, widthPx, cellH, cellW, charTop, charHeight, font, terminal);
     container.appendChild(lineEl);
   }
 
   // Block cursor at end of last line (use visual width for CJK support)
   if (showCursor) {
-    const lastLine = lines[lines.length - 1];
-    const lastLineLeft = lines.length === 1 ? startCol : 0;
+    const lastLine = visibleLines[visibleLines.length - 1];
+    const lastLineLeft = visibleLines.length === 1 && keepsPromptLine ? startCol : 0;
     const cursorCol = lastLineLeft + stringCellWidth(terminal, lastLine);
     if (cursorCol < totalCols) {
       const cursor = document.createElement('span');
       cursor.style.cssText = 'position:absolute;display:inline-block';
       cursor.style.left = cursorCol * cellW + 'px';
-      cursor.style.top = (lines.length - 1) * cellH + 'px';
+      cursor.style.top = (visibleLines.length - 1) * cellH + 'px';
       cursor.style.width = cellW + 'px';
       cursor.style.height = cellH + 'px';
       cursor.style.backgroundColor = cursorColor;

packages/xterm-zerolag-input/src/types.ts

@@ -172,6 +172,13 @@ export interface RenderParams {
   /** Height of the character rendering area (px). */
   charHeight: number;
   promptRow: number;
+  /**
+   * Visible terminal rows. When given, the overlay is kept ON SCREEN: it grows
+   * upward instead of running off the bottom edge, and a wrapped prompt taller
+   * than the viewport keeps its tail. Omit to lay out straight down from
+   * `promptRow` (the historical behaviour).
+   */
+  totalRows?: number;
   font: FontStyle;
   showCursor: boolean;
   cursorColor: string;

packages/xterm-zerolag-input/src/zerolag-input-addon.ts

@@ -565,7 +565,10 @@ export class ZerolagInputAddon implements XtermAddon {
 
       // Skip redundant re-renders — include text content to detect
       // same-length changes (e.g., setFlushed with different text)
-      const renderKey = `${displayText}:${startCol}:${activePrompt.row}:${activePrompt.col}:${totalCols}:${this._flushedOffset}`;
+      // `rows` is part of the key: the layout is clamped to the visible rows
+      // (see renderOverlay), so a keyboard opening — which changes rows without
+      // changing the text — must not be skipped as a redundant render.
+      const renderKey = `${displayText}:${startCol}:${activePrompt.row}:${activePrompt.col}:${totalCols}:${this._terminal.rows}:${this._flushedOffset}`;
       if (renderKey === this._lastRenderKey && this._overlay.style.display !== 'none') return;
       this._lastRenderKey = renderKey;
 
@@ -612,6 +615,7 @@ export class ZerolagInputAddon implements XtermAddon {
         charTop,
         charHeight,
         promptRow: activePrompt.row,
+        totalRows: this._terminal.rows,
         font: this._font,
         showCursor: this._options.showCursor,
         cursorColor,

packages/xterm-zerolag-input/test/overlay-renderer.test.ts

@@ -418,3 +418,88 @@ describe('stringCellWidth', () => {
     expect(stringCellWidth(null, '')).toBe(0);
   });
 });
+
+describe('renderOverlay — staying on screen (totalRows)', () => {
+  // A phone with the keyboard up leaves only a handful of terminal rows. The
+  // overlay lays its wrapped lines out downward from the prompt row, so a long
+  // prompt used to run off the bottom edge and the user typed blind, with the
+  // tail of their own sentence behind the keyboard. With totalRows known, the
+  // composer grows UPWARD instead — the line divs are opaque, so they cover
+  // transcript above rather than disappearing below.
+  const linesOf = (n: number) => Array.from({ length: n }, (_, i) => `line${i}`);
+  const lineDivs = (container: HTMLDivElement) =>
+    Array.from(container.children).filter((el) => el.tagName === 'DIV') as HTMLDivElement[];
+
+  it('lifts the block so its last line lands on the last visible row', () => {
+    const container = document.createElement('div');
+    renderOverlay(container, makeParams({ lines: linesOf(5), promptRow: 10, totalRows: 12, cellH: 17 }));
+
+    // 10 + 5 would end on row 14 of a 12-row screen; the block starts at 7 instead.
+    expect(container.style.top).toBe(7 * 17 + 'px');
+    expect(lineDivs(container)).toHaveLength(5);
+  });
+
+  it('leaves the prompt row alone when the block already fits', () => {
+    const container = document.createElement('div');
+    renderOverlay(container, makeParams({ lines: linesOf(3), promptRow: 5, totalRows: 24, cellH: 17 }));
+
+    expect(container.style.top).toBe(5 * 17 + 'px');
+  });
+
+  it('keeps the TAIL when the prompt is taller than the whole viewport', () => {
+    // The end is where the cursor is, and where the user is looking.
+    const container = document.createElement('div');
+    renderOverlay(container, makeParams({ lines: linesOf(6), promptRow: 2, totalRows: 3, cellH: 20 }));
+
+    const divs = lineDivs(container);
+    expect(container.style.top).toBe('0px');
+    expect(divs).toHaveLength(3);
+    expect(divs.map((d) => d.textContent)).toEqual(['line3', 'line4', 'line5']);
+  });
+
+  it('drops the prompt indent once the prompt line is no longer shown', () => {
+    // startCol indents only the line that begins at the prompt marker.
+    const container = document.createElement('div');
+    renderOverlay(
+      container,
+      makeParams({ lines: linesOf(6), promptRow: 2, totalRows: 3, startCol: 5, cellW: 10, totalCols: 80 })
+    );
+
+    const first = lineDivs(container)[0];
+    expect(first.style.left).toBe('0px');
+    expect(first.style.width).toBe(80 * 10 + 'px');
+  });
+
+  it('rides the cursor on the last VISIBLE line', () => {
+    const container = document.createElement('div');
+    renderOverlay(
+      container,
+      makeParams({ lines: ['aaa', 'bbb', 'ccc', 'ddd'], promptRow: 9, totalRows: 3, cellH: 20, cellW: 10, startCol: 4 })
+    );
+
+    const cursor = Array.from(container.children).find((el) => el.tagName === 'SPAN') as HTMLSpanElement;
+    // Tail is the last 3 lines, so the cursor sits on row 2 (0-based) of the block…
+    expect(cursor.style.top).toBe(2 * 20 + 'px');
+    // …at column 3, NOT startCol + 3: the indented prompt line is not shown.
+    expect(cursor.style.left).toBe(3 * 10 + 'px');
+  });
+
+  it('lays out straight down when totalRows is absent (unchanged behaviour)', () => {
+    const container = document.createElement('div');
+    renderOverlay(container, makeParams({ lines: linesOf(9), promptRow: 20, cellH: 17 }));
+
+    expect(container.style.top).toBe(20 * 17 + 'px');
+    expect(lineDivs(container)).toHaveLength(9);
+  });
+
+  it('falls back to the terminal row count when totalRows is not passed', () => {
+    // The addon passes totalRows, but a stale bundle / third-party caller may not.
+    const container = document.createElement('div');
+    renderOverlay(
+      container,
+      makeParams({ lines: linesOf(4), promptRow: 8, cellH: 17, terminal: { rows: 10, cols: 80 } as never })
+    );
+
+    expect(container.style.top).toBe(6 * 17 + 'px');
+  });
+});

src/config/terminal-history.ts

@@ -8,7 +8,8 @@
  * src/web/public/constants.js and deliberately stays at 50k — 100k xterm lines per tab
  * is a mobile-memory hazard — so DEFAULT_TERMINAL_SCROLLBACK_LINES stays 50,000 to match.
  * The terminalScrollbackLines/terminalBufferMaxBytes/terminalBufferTrimBytes settings keys
- * remain schema-validated but inert (a follow-up wires them); only tmuxHistoryLimit is live.
+ * remain schema-validated but inert (a follow-up wires them); only tmuxHistoryLimit is wired.
+ * tmux <3.7 applies it to new panes; tmux 3.7+ can also resize live panes.
  * All values remain env- and settings-overridable and bounds-clamped via
  * resolveTerminalHistoryConfig().
  */

src/git-clone.ts

@@ -479,14 +479,23 @@ export function gitNonInteractiveEnv(base: NodeJS.ProcessEnv = process.env): Nod
 
 // ─── Pure: output handling ───────────────────────────────────────────────────
 
+/**
+ * Redact any `scheme://user:secret@host` credential pair embedded in text — a
+ * remote URL stored with an inline token, or git stderr echoing such a URL
+ * back. Shared by the clone error path (`sanitizeGitOutput`) and the
+ * repository-status card fields (`web/repo-status.ts`).
+ */
+export function redactGitCredentials(text: string): string {
+  return text.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^/@\s]*:[^/@\s]*@/g, '$1***:***@');
+}
+
 /**
  * Make git's stderr safe to show in the browser: strip ANSI/control bytes,
  * redact any `scheme://user:secret@host` that a credential helper echoed back,
  * and keep only the tail (the last lines are the ones that say why it failed).
  */
 export function sanitizeGitOutput(text: string, maxBytes = MAX_STDERR_BYTES): string {
-  const redacted = text
-    .replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^/@\s]*:[^/@\s]*@/g, '$1***:***@')
+  const redacted = redactGitCredentials(text)
     // eslint-disable-next-line no-control-regex -- deliberate: strip C0/C1 and DEL.
     .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g, '')
     .trim();

src/mux-interface.ts

@@ -84,7 +84,7 @@ export interface CreateSessionOptions {
   envOverrides?: Record<string, string>;
   /** Claude CLI effort level, injected as a `--settings` soft default (overridable via /effort in-session) */
   effort?: EffortLevel;
-  /** tmux history-limit (scrollback lines) to set for this session. */
+  /** tmux history-limit (scrollback lines) allocated when this session is created. */
   historyLimit?: number;
   /** Remote execution metadata for local tmux sessions wrapping SSH */
   remote?: SessionRemote;
@@ -116,7 +116,7 @@ export interface RespawnPaneOptions {
   envOverrides?: Record<string, string>;
   /** Claude CLI effort level (preserved across respawns, injected via `--settings`) */
   effort?: EffortLevel;
-  /** tmux history-limit (scrollback lines) to set for this session after respawn. */
+  /** Original tmux history-limit retained for config parity; respawn cannot resize the existing pane. */
   historyLimit?: number;
   /** Remote execution metadata for local tmux sessions wrapping SSH */
   remote?: SessionRemote;
@@ -216,7 +216,7 @@ export interface TerminalMultiplexer extends EventEmitter {
   /** Update Ralph enabled state for a session */
   updateRalphEnabled(sessionId: string, enabled: boolean): void;
 
-  /** Apply a tmux history-limit to all tracked sessions. */
+  /** Apply history-limit to live panes where tmux supports it, otherwise to future panes. */
   setHistoryLimit(limit: number): Promise<void>;
 
   // ========== Discovery ==========

src/ralph-loop.ts

@@ -281,7 +281,14 @@ export class RalphLoop extends EventEmitter {
         // Guard: only reschedule if still running AND no timer is pending
         // (prevents race where stop() clears timer between our check and setTimeout)
         if (this._status === 'running' && this.loopTimer === null) {
-          this.loopTimer = setTimeout(() => this.runLoop(), this.pollIntervalMs);
+          // Null the handle when the timer fires, BEFORE re-entering runLoop —
+          // otherwise the `loopTimer === null` guard above stays false on the
+          // next pass and the loop stops rescheduling after 2 ticks.
+          // Mirrors the orchestrator-loop reschedule pattern.
+          this.loopTimer = setTimeout(() => {
+            this.loopTimer = null;
+            this.runLoop();
+          }, this.pollIntervalMs);
         }
       });
   }

src/session.ts

@@ -415,6 +415,15 @@ export class Session extends EventEmitter {
   // sequences split across PTY chunks can't slip past the alt-screen/scrollback
   // strip (see _handleTerminalOutput / isAltScreenStripMode)
   private _altScreenSeqCarry: string = '';
+
+  /**
+   * Mouse-tracking DECSET modes the CLI currently has ON, as observed while
+   * STRIPPING them out of the stream below. Kept as a set rather than a boolean
+   * because a TUI may enable 1002 and later disable 1000 (a mode it never
+   * enabled); tracking is on while any of them is.
+   */
+  private _cliMouseModes = new Set<number>();
+  private _cliMouseTracking = false;
   private resolvePromise: ((value: { result: string; cost: number }) => void) | null = null;
   private rejectPromise: ((reason: Error) => void) | null = null;
   private _promptResolved: boolean = false; // Guard against race conditions in runPrompt
@@ -510,7 +519,7 @@ export class Session extends EventEmitter {
   // the CLAUDE_CODE_EFFORT_LEVEL env var, which would hard-lock the session.
   private _effort: EffortLevel | undefined;
 
-  // tmux history-limit (scrollback lines) applied to this session's pane.
+  // tmux history-limit (scrollback lines) allocated when this session's pane is created.
   private readonly _tmuxHistoryLimit: number;
 
   // Remote execution metadata, present when this session runs over SSH through local tmux.
@@ -600,7 +609,7 @@ export class Session extends EventEmitter {
       envOverrides?: Record<string, string>;
       /** Claude CLI effort level (soft default via --settings, switchable in-session via /effort) */
       effort?: EffortLevel;
-      /** tmux history-limit (scrollback lines) for this session's pane. */
+      /** tmux history-limit (scrollback lines) allocated when this session's pane is created. */
       tmuxHistoryLimit?: number;
       /** Restored per-session attachment history. May include server-private external paths. */
       attachmentHistory?: SessionAttachmentHistoryItem[];
@@ -1285,6 +1294,7 @@ export class Session extends EventEmitter {
       niceValue: this._niceConfig.niceValue,
       color: this._color,
       flickerFilterEnabled: this._flickerFilterEnabled,
+      cliMouseTracking: this._cliMouseTracking || undefined,
       cliVersion: this._cliVersion || undefined,
       cliModel: this._cliModel || undefined,
       cliAccountType: this._cliAccountType || undefined,
@@ -1546,6 +1556,46 @@ export class Session extends EventEmitter {
     };
   }
 
+  /**
+   * Remember whether the CLI currently wants to be told about mouse clicks.
+   *
+   * The strip in {@link _handleTerminalOutput} is the ONLY place these sequences
+   * exist. After it, neither the browser nor xterm can ever learn that the CLI
+   * asked for mouse tracking, so `terminal.modes.mouseTrackingMode` is
+   * permanently 'none' for a stripped mode. The browser hand-encodes SGR reports
+   * to compensate (`_sendSyntheticSgrTap` in terminal-ui.js), and with no state
+   * to consult it had to do that on EVERY click, delivering mouse reports to a
+   * CLI that never asked for them. Publishing this through `toState()` is what
+   * lets the browser report a click only when the CLI is listening.
+   *
+   * Only the TRACKING modes count. 1005/1006 select an encoding and 1007 is
+   * alt-scroll; a CLI that picks SGR encoding without turning a tracking mode on
+   * is not asking about clicks, and counting those would put the stray reports
+   * straight back.
+   *
+   * This must stay in lockstep with the strip regex that calls it: a sequence
+   * removed from the stream but not recorded here is one the browser can neither
+   * see nor be told about.
+   */
+  private _recordStrippedMouseMode(seq: string): void {
+    // eslint-disable-next-line no-control-regex
+    const match = /\x1b\[\?(\d+)([hl])$/.exec(seq);
+    if (!match) return;
+    const mode = Number(match[1]);
+    if (mode !== 1000 && mode !== 1001 && mode !== 1002 && mode !== 1003) return;
+    if (match[2] === 'h') this._cliMouseModes.add(mode);
+    else this._cliMouseModes.delete(mode);
+    this._syncCliMouseTracking();
+  }
+
+  /** Emit only on a real transition: a TUI re-emitting its enable on every repaint costs nothing. */
+  private _syncCliMouseTracking(): void {
+    const active = this._cliMouseModes.size > 0;
+    if (active === this._cliMouseTracking) return;
+    this._cliMouseTracking = active;
+    this.emit('mouseTrackingChanged', active);
+  }
+
   private _handleTerminalOutput(data: string): void {
     // Codex AND Claude Code emit sequences that wipe xterm.js scrollback, plus
     // mouse-tracking enables that hijack the scroll wheel so the user can't reach
@@ -1598,7 +1648,10 @@ export class Session extends EventEmitter {
           // eslint-disable-next-line no-control-regex
           .replace(/\x1b\[3J/g, '')
           // eslint-disable-next-line no-control-regex
-          .replace(/\x1b\[\?(?:1000|1001|1002|1003|1005|1006|1007)[hl]/g, '');
+          .replace(/\x1b\[\?(?:1000|1001|1002|1003|1005|1006|1007)[hl]/g, (seq) => {
+            this._recordStrippedMouseMode(seq);
+            return '';
+          });
       }
     }
 
@@ -2525,6 +2578,11 @@ export class Session extends EventEmitter {
     this._messages = [];
     this._lineBuffer = '';
     this._altScreenSeqCarry = '';
+    // A restarted pane starts with no mouse mode: the new program has not asked
+    // for one yet, and carrying the old CLI's state over would report clicks
+    // into a program that never enabled tracking.
+    this._cliMouseModes.clear();
+    this._syncCliMouseTracking();
     this._markActivity(true);
   }
 

src/tmux-manager.ts

@@ -75,11 +75,17 @@ import {
   SAFE_PATH_PATTERN,
   findClaudeDir,
   getClaudeCliVersion,
+  getClaudeNotFoundMessage,
   resolveOpenCodeDir,
+  getOpenCodeNotFoundMessage,
   resolveCodexDir,
+  getCodexNotFoundMessage,
   resolveGeminiDir,
+  getGeminiNotFoundMessage,
   resolveAntigravityDir,
+  getAntigravityNotFoundMessage,
   resolvePiDir,
+  getPiNotFoundMessage,
   resolveLocalShell,
   loginShellArgs,
 } from './utils/index.js';
@@ -1562,6 +1568,8 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
   private reconnectGuard: Set<string> = new Set();
 
   private trueColorConfigured = false;
+  /** tmux 3.7+ can resize pane history after creation; older releases cannot. */
+  private liveHistoryResizeSupported: boolean | null = null;
 
   constructor() {
     super();
@@ -1580,6 +1588,26 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
     return tmuxCommand(this.tmuxSocket);
   }
 
+  private supportsLiveHistoryResize(): boolean {
+    if (this.liveHistoryResizeSupported !== null) return this.liveHistoryResizeSupported;
+
+    try {
+      const output = execSync(`${this.tmux()} -V`, {
+        encoding: 'utf8',
+        timeout: EXEC_TIMEOUT_MS,
+        stdio: ['ignore', 'pipe', 'ignore'],
+      });
+      const match = output.match(/(?:^|\D)(\d+)\.(\d+)/);
+      const major = match ? Number(match[1]) : 0;
+      const minor = match ? Number(match[2]) : 0;
+      this.liveHistoryResizeSupported = major > 3 || (major === 3 && minor >= 7);
+    } catch {
+      // Unknown versions take the legacy path required by tmux <3.7.
+      this.liveHistoryResizeSupported = false;
+    }
+    return this.liveHistoryResizeSupported;
+  }
+
   // Load saved sessions from disk (NEVER called in test mode)
   private loadSessions(): void {
     if (IS_TEST_MODE) return;
@@ -1853,29 +1881,28 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
       return session;
     }
 
-    // Resolve CLI binary directory based on mode
+    // Resolve CLI binary directory based on mode. The not-found messages come
+    // from the resolvers (formatCliNotFoundMessage) so the error names WHERE it
+    // looked — server PATH, login shell, checked directories — instead of just
+    // asserting the CLI is missing (the classic systemd/launchd PATH trap).
     const { pathExport, dir: cliDir } = this.buildPathExport(mode);
     if (mode === 'claude' && !cliDir) {
-      throw new Error('Claude CLI not found. Install it with: curl -fsSL https://claude.ai/install.sh | bash');
+      throw new Error(getClaudeNotFoundMessage());
     }
     if (mode === 'opencode' && !cliDir) {
-      throw new Error('OpenCode CLI not found. Install with: curl -fsSL https://opencode.ai/install | bash');
+      throw new Error(getOpenCodeNotFoundMessage());
     }
     if (mode === 'codex' && !cliDir) {
-      throw new Error('Codex CLI not found. Install with: npm install -g @openai/codex');
+      throw new Error(getCodexNotFoundMessage());
     }
     if (mode === 'gemini' && !cliDir) {
-      throw new Error('Gemini CLI not found. Install with: npm install -g @google/gemini-cli');
+      throw new Error(getGeminiNotFoundMessage());
     }
     if (mode === 'antigravity' && !cliDir) {
-      throw new Error(
-        'Antigravity CLI not found. Install with: curl -fsSL https://antigravity.google/cli/install.sh | bash'
-      );
+      throw new Error(getAntigravityNotFoundMessage());
     }
     if (mode === 'pi' && !cliDir) {
-      throw new Error(
-        'Pi CLI not found. Install with: npm install -g --ignore-scripts @earendil-works/pi-coding-agent'
-      );
+      throw new Error(getPiNotFoundMessage());
     }
 
     const envExportsStr = this.buildEnvExports(sessionId, muxName, mode).join(' && ');
@@ -1921,7 +1948,16 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
       // launched in TMUX_LAUNCH_CWD (/tmp) rather than the real workingDir: a FUSE/rclone
       // mount that isn't ready yet makes `getcwd` fail and breaks the spawn (see #110). The
       // pane cd's into workingDir below via respawn-pane.
-      execSync(`${this.tmux()} new-session -ds "${muxName}" -c ${TMUX_LAUNCH_CWD}`, {
+      // tmux <3.7 allocates history only at pane creation, so its global default
+      // must be set immediately BEFORE new-session. tmux 3.7+ can resize a pane
+      // after creation; target only the new session there because changing the
+      // global option can resize (and when lowered, trim) unrelated live panes.
+      const safeHistoryLimit =
+        Number.isSafeInteger(historyLimit) && historyLimit > 0 ? Math.trunc(historyLimit) : DEFAULT_TMUX_HISTORY_LIMIT;
+      const createSessionCommand = this.supportsLiveHistoryResize()
+        ? `${this.tmux()} new-session -ds "${muxName}" -c ${TMUX_LAUNCH_CWD} \\; set-option -t "${muxName}" history-limit ${safeHistoryLimit}`
+        : `${this.tmux()} set-option -g history-limit ${safeHistoryLimit} \\; new-session -ds "${muxName}" -c ${TMUX_LAUNCH_CWD} \\; set-option -t "${muxName}" history-limit ${safeHistoryLimit}`;
+      execSync(createSessionCommand, {
         cwd: TMUX_LAUNCH_CWD,
         timeout: EXEC_TIMEOUT_MS,
         stdio: 'ignore',
@@ -1986,16 +2022,6 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
           .catch(() => {
             /* Already set globally as fallback */
           }),
-        // Raise tmux scrollback from its 2000-line default so re-attach preserves
-        // more context. Intentionally exceeds the xterm-side DEFAULT_SCROLLBACK (50k
-        // in constants.js), which stays lower to protect browser/mobile memory.
-        execAsync(`${this.tmux()} set-option -t "${muxName}" history-limit ${historyLimit}`, {
-          timeout: EXEC_TIMEOUT_MS,
-        })
-          .then(() => {})
-          .catch(() => {
-            /* Non-critical — falls back to tmux default */
-          }),
       ];
 
       // Enable 24-bit true color passthrough — server-wide, set once per lifetime
@@ -2119,7 +2145,6 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
       resumeSessionId,
       envOverrides,
       effort,
-      historyLimit = DEFAULT_TMUX_HISTORY_LIMIT,
       remote,
       docker,
       name,
@@ -2130,16 +2155,6 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
 
     if (!isValidMuxName(muxName) || !isValidPath(workingDir)) return null;
 
-    // Re-apply the configured tmux history-limit after respawn (kept in sync
-    // with the live setting via setHistoryLimit()).
-    if (!IS_TEST_MODE) {
-      await execAsync(`${this.tmux()} set-option -t ${shellescape(muxName)} history-limit ${historyLimit}`, {
-        timeout: EXEC_TIMEOUT_MS,
-      }).catch(() => {
-        /* Non-critical — keeps existing tmux history-limit */
-      });
-    }
-
     // Resolve CLI binary directory based on mode
     const { pathExport } = this.buildPathExport(mode);
 
@@ -2998,9 +3013,9 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
   }
 
   /**
-   * Apply a tmux history-limit to all tracked sessions (e.g. when the user
-   * changes the terminal-history setting). Invalid limits fall back to the
-   * default. Best-effort per session.
+   * Apply a tmux history limit. tmux 3.7+ safely targets tracked live sessions;
+   * older releases can only change the global default for future panes. Invalid
+   * limits fall back to the default.
    */
   async setHistoryLimit(limit: number): Promise<void> {
     const safeLimit = Number.isSafeInteger(limit) && limit > 0 ? Math.trunc(limit) : DEFAULT_TMUX_HISTORY_LIMIT;
@@ -3009,12 +3024,22 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
       return;
     }
 
-    const updates = Array.from(this.sessions.values()).map((session) =>
-      execAsync(`${this.tmux()} set-option -t ${shellescape(session.muxName)} history-limit ${safeLimit}`, {
-        timeout: EXEC_TIMEOUT_MS,
-      })
-    );
-    await Promise.allSettled(updates);
+    if (this.supportsLiveHistoryResize()) {
+      const updates = Array.from(this.sessions.values()).map((session) =>
+        execAsync(`${this.tmux()} set-option -t ${shellescape(session.muxName)} history-limit ${safeLimit}`, {
+          timeout: EXEC_TIMEOUT_MS,
+        })
+      );
+      await Promise.allSettled(updates);
+      return;
+    }
+
+    await execAsync(`${this.tmux()} set-option -g history-limit ${safeLimit}`, {
+      timeout: EXEC_TIMEOUT_MS,
+    }).catch(() => {
+      // No tmux server yet is fine: legacy createSession sets the same default
+      // immediately before it creates the first pane.
+    });
   }
 
   /**

src/types/session.ts

@@ -500,6 +500,14 @@ export interface SessionState {
   color?: SessionColor;
   /** Flicker filter enabled (buffers output after screen clears) */
   flickerFilterEnabled?: boolean;
+  /**
+   * True while the CLI in the pane has a mouse-tracking DECSET on, as observed
+   * by the server on its way out of the stream (those sequences are stripped for
+   * claude/codex/gemini, so the browser can never see them itself). The browser
+   * hand-encodes a click report ONLY when this is true; without it, every click
+   * sent mouse reports to a CLI that never asked for them.
+   */
+  cliMouseTracking?: boolean;
   /** Claude Code CLI version (parsed from terminal, e.g., "2.1.27") */
   cliVersion?: string;
   /** Claude model in use (parsed from terminal, e.g., "Opus 4.5") */

src/types/update.ts

@@ -98,3 +98,52 @@ export interface UpdateCheckResult {
   source: 'github-api' | 'git-ls-remote' | 'none';
   error?: string;
 }
+
+/**
+ * Role of a remote in the repository-status view.
+ * - `tracking`: the current branch's `@{upstream}` remote (where `git pull` goes).
+ * - `upstream`: the canonical project (a remote named `origin`/`upstream` that is
+ *   not the tracking remote).
+ * - `other`: anything else explicitly requested via `CODEMAN_UPDATE_REMOTES`.
+ */
+export type RepoRemoteRole = 'tracking' | 'upstream' | 'other';
+
+/** A single incoming commit — present on the remote ref but not in local HEAD. */
+export interface RepoIncomingCommit {
+  /** Abbreviated SHA. */
+  sha: string;
+  /** Commit subject (first line). */
+  subject: string;
+}
+
+/** Ahead/behind + incoming summary for local HEAD vs one remote's compare ref. */
+export interface RepoRemoteStatus {
+  /** Remote name, e.g. `origin`, `bitbucket`. */
+  name: string;
+  /** Remote URL (best-effort; empty if unresolved). */
+  url: string;
+  role: RepoRemoteRole;
+  /** Ref HEAD is compared against, e.g. `origin/master`, `bitbucket/local`. */
+  compareRef: string;
+  /** Commits in local HEAD not on the remote ref (local-only / unpushed). */
+  ahead: number;
+  /** Commits on the remote ref not in local HEAD (incoming). */
+  behind: number;
+  /** Up to N most recent incoming commits (newest first). */
+  incoming: RepoIncomingCommit[];
+  /** Set when this remote could not be fetched/compared. */
+  error?: string;
+}
+
+/** Result of the repository-status check across the configured remotes. */
+export interface RepositoryStatusResult {
+  /** epoch ms of the check. */
+  checkedAt: number;
+  /** False when this is not a git install (then `remotes` is empty + `error` set). */
+  isGit: boolean;
+  /** Current running version, for display. */
+  currentVersion: string;
+  remotes: RepoRemoteStatus[];
+  /** Top-level error (e.g. not a git install, or no remotes resolved). */
+  error?: string;
+}

src/utils/antigravity-cli-resolver.ts

@@ -7,22 +7,37 @@
  * @module utils/antigravity-cli-resolver
  */
 
-import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js';
+import {
+  createCliExecutableResolver,
+  formatCliNotFoundMessage,
+  type CliResolverHost,
+} from './cli-executable-resolver.js';
 
 /** Common directories where the Antigravity CLI binary may be installed */
 const ANTIGRAVITY_SEARCH_DIRS = [
   join(homedir(), '.local', 'bin'),
   join(homedir(), '.antigravity', 'bin'),
   '/usr/local/bin',
+  join(homedir(), '.bun', 'bin'),
+  join(homedir(), '.npm-global', 'bin'),
   join(homedir(), 'bin'),
 ];
 
-/** Cached directory containing the agy binary (empty string = searched but not found) */
-let _antigravityDir: string | null = null;
+const ANTIGRAVITY_NOT_FOUND =
+  'Antigravity CLI not found. Install with: curl -fsSL https://antigravity.google/cli/install.sh | bash';
+
+function createAntigravityResolver(host?: CliResolverHost, now?: () => number) {
+  return createCliExecutableResolver({ binary: 'agy', searchDirs: ANTIGRAVITY_SEARCH_DIRS, now }, host);
+}
+
+/** Creates an isolated Antigravity wrapper around an injected resolver host and clock. */
+export function createAntigravityResolverForTest(host: CliResolverHost, now?: () => number) {
+  return createAntigravityResolver(host, now);
+}
+
+const antigravityResolver = createAntigravityResolver();
 
 /**
  * Finds the directory containing the `agy` binary.
@@ -31,30 +46,7 @@ let _antigravityDir: string | null = null;
  * @returns Directory path, or null if not found
  */
 export function resolveAntigravityDir(): string | null {
-  if (_antigravityDir !== null) return _antigravityDir || null;
-
-  try {
-    const result = execSync('which agy', {
-      encoding: 'utf-8',
-      timeout: EXEC_TIMEOUT_MS,
-    }).trim();
-    if (result && existsSync(result)) {
-      _antigravityDir = dirname(result);
-      return _antigravityDir;
-    }
-  } catch {
-    // agy not in PATH, will check common locations
-  }
-
-  for (const dir of ANTIGRAVITY_SEARCH_DIRS) {
-    if (existsSync(join(dir, 'agy'))) {
-      _antigravityDir = dir;
-      return _antigravityDir;
-    }
-  }
-
-  _antigravityDir = '';
-  return null;
+  return antigravityResolver.resolve()?.directory ?? null;
 }
 
 /**
@@ -63,3 +55,7 @@ export function resolveAntigravityDir(): string | null {
 export function isAntigravityAvailable(): boolean {
   return resolveAntigravityDir() !== null;
 }
+
+export function getAntigravityNotFoundMessage(): string {
+  return formatCliNotFoundMessage(ANTIGRAVITY_NOT_FOUND, antigravityResolver.diagnostics());
+}

src/utils/claude-cli-resolver.ts

@@ -8,11 +8,11 @@
  * @module utils/claude-cli-resolver
  */
 
-import { execSync, execFileSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { delimiter, dirname, join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { delimiter, join } from 'node:path';
 import { homedir } from 'node:os';
 import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js';
+import { createCliExecutableResolver, formatCliNotFoundMessage } from './cli-executable-resolver.js';
 
 /** Common directories where the Claude CLI binary may be installed */
 const CLAUDE_SEARCH_DIRS = [
@@ -23,8 +23,8 @@ const CLAUDE_SEARCH_DIRS = [
   join(homedir(), 'bin'),
 ];
 
-/** Cached directory containing the claude binary (empty string = searched but not found) */
-let _claudeDir: string | null = null;
+const claudeResolver = createCliExecutableResolver({ binary: 'claude', searchDirs: CLAUDE_SEARCH_DIRS });
+const CLAUDE_NOT_FOUND = 'Claude CLI not found. Install it with: curl -fsSL https://claude.ai/install.sh | bash';
 
 /**
  * Returns true if the Claude CLI binary can be located (via `which` or one of
@@ -43,29 +43,11 @@ export function isClaudeAvailable(): boolean {
  * @returns Directory path, or null if not found
  */
 export function findClaudeDir(): string | null {
-  if (_claudeDir !== null) return _claudeDir || null;
+  return claudeResolver.resolve()?.directory ?? null;
+}
 
-  // Try `which` first (respects current PATH)
-  try {
-    const result = execSync('which claude', { encoding: 'utf-8', timeout: EXEC_TIMEOUT_MS }).trim();
-    if (result && existsSync(result)) {
-      _claudeDir = dirname(result);
-      return _claudeDir;
-    }
-  } catch {
-    // Claude not in PATH, will check common locations
-  }
-
-  // Fallback: check common installation directories
-  for (const dir of CLAUDE_SEARCH_DIRS) {
-    if (existsSync(join(dir, 'claude'))) {
-      _claudeDir = dir;
-      return _claudeDir;
-    }
-  }
-
-  _claudeDir = ''; // mark as searched, not found
-  return null;
+export function getClaudeNotFoundMessage(): string {
+  return formatCliNotFoundMessage(CLAUDE_NOT_FOUND, claudeResolver.diagnostics());
 }
 
 /**
@@ -99,7 +81,9 @@ export function getAugmentedPath(): string {
   const currentPath = process.env.PATH || '';
   const claudeDir = findClaudeDir();
 
-  if (claudeDir && !currentPath.split(delimiter).includes(claudeDir)) {
+  if (!claudeDir) return currentPath;
+
+  if (!currentPath.split(delimiter).includes(claudeDir)) {
     _augmentedPath = `${claudeDir}${delimiter}${currentPath}`;
     return _augmentedPath;
   }
@@ -193,6 +177,9 @@ function probeClaudeCliVersion(): string | null {
     encoding: 'utf-8',
     timeout: EXEC_TIMEOUT_MS,
     env: { ...process.env, PATH: getAugmentedPath() },
+    // execFileSync's timeout only SENDS the signal and then keeps waiting; a
+    // child that ignores SIGTERM would block the server thread permanently.
+    killSignal: 'SIGKILL',
   });
   const match = out.match(/(\d+\.\d+\.\d+)/);
   return match ? match[1] : null;

src/utils/cli-executable-resolver.ts

@@ -0,0 +1,301 @@
+/**
+ * @fileoverview Shared CLI executable resolution for the per-CLI resolvers.
+ *
+ * One lookup chain behind all six *-cli-resolver modules (claude, opencode,
+ * codex, gemini, antigravity, pi): the server process PATH first, then the
+ * CLI's common install directories in order, then — last, because it is the
+ * only step that spawns anything — an interactive login shell, which is what
+ * finds nvm/Homebrew/user-npm installs when Codeman runs as a systemd/launchd
+ * service with a minimal PATH (launchd hands a job `/usr/bin:/bin:/usr/sbin:/sbin`).
+ *
+ * Caching is asymmetric, same shape as `resolveClaudeCliVersion` in
+ * claude-cli-resolver.ts: a successful resolution is cached for the process
+ * lifetime, a MISS is negative-cached and retried only after a doubling backoff
+ * (`cliResolveRetryDelayMs`). The callers are request-facing (the per-CLI
+ * status endpoints in system-routes.ts, the availability gates in
+ * session-routes.ts, and tmux-manager's spawn path), and the login-shell probe
+ * is a SYNCHRONOUS spawn bounded by `EXEC_TIMEOUT_MS` — without the negative
+ * cache, a missing CLI re-ran the whole chain and stalled the event loop for up
+ * to 5s on every request, forever.
+ *
+ * Test hermeticity: under vitest (`process.env.VITEST`) the production host
+ * short-circuits — IO primitives that were not injected become inert stubs, so
+ * a suite can never scan the machine's PATH or spawn login shells (the same
+ * rule as `IS_TEST_MODE` in tmux-manager and the VITEST gate in
+ * `getClaudeCliVersion`). Tests opt back in through the injection hooks
+ * (`runCommand`/`isExecutableFile` fakes do no real IO by construction) or, for
+ * fixtures that need the real filesystem predicate against their own temp
+ * files, via `allowRealIoUnderVitest`.
+ *
+ * @module utils/cli-executable-resolver
+ */
+
+import { execFileSync } from 'node:child_process';
+import { accessSync, constants, statSync } from 'node:fs';
+import { basename, delimiter, dirname, isAbsolute, join } from 'node:path';
+import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js';
+import { loginShellArgs, resolveLocalShell } from './shell-resolver.js';
+
+const SAFE_BINARY_NAME = /^[a-z0-9][a-z0-9._-]*$/i;
+const LOGIN_SHELL_BEGIN_MARKER = '__CODEMAN_CLI_RESOLVE_BEGIN__';
+const LOGIN_SHELL_END_MARKER = '__CODEMAN_CLI_RESOLVE_END__';
+/** Maximum rendered length of each bounded diagnostic field, excluding its label. */
+const DIAGNOSTIC_FIELD_MAX_LENGTH = 1024;
+
+/** First retry window after a full-chain resolution miss. */
+const RESOLVE_RETRY_BASE_MS = 60_000;
+/**
+ * Ceiling for the doubling backoff. Deliberately shorter than the 15min cap on
+ * the claude version probe: that one is cosmetic, while this gates the Run
+ * flow, and "installing a CLI while the server is running is picked up without
+ * a restart" should stay true within minutes.
+ */
+const RESOLVE_RETRY_MAX_MS = 5 * 60_000;
+
+/**
+ * How long to wait before re-running the resolution chain after `failures`
+ * consecutive misses: 1min, 2min, 4min… capped at 5min. Mirrors
+ * `claudeVersionRetryDelayMs` in claude-cli-resolver.ts. Exported for tests.
+ */
+export function cliResolveRetryDelayMs(failures: number): number {
+  if (failures <= 0) return 0;
+  return Math.min(RESOLVE_RETRY_BASE_MS * 2 ** (failures - 1), RESOLVE_RETRY_MAX_MS);
+}
+
+export type CliResolutionSource = 'process-path' | 'common-directory' | 'login-shell';
+
+export interface CliResolutionDiagnostics {
+  binary: string;
+  processPath: string;
+  shellPath: string;
+  shellArgs: string[];
+  searchDirs: string[];
+}
+
+export interface CliResolverHost {
+  processPath: string;
+  shellPath: string;
+  shellArgs: string[];
+  findOnProcessPath(binary: string): string | null;
+  findInLoginShell(binary: string): string | null;
+  exists(path: string): boolean;
+}
+
+export interface CandidateValidation<T> {
+  accepted: boolean;
+  metadata?: T;
+}
+
+export interface CliResolution<T = undefined> {
+  binaryPath: string;
+  directory: string;
+  source: CliResolutionSource;
+  metadata?: T;
+}
+
+export interface CliExecutableResolver<T = undefined> {
+  resolve(): CliResolution<T> | null;
+  diagnostics(): CliResolutionDiagnostics;
+}
+
+export interface CliResolverCommandOptions {
+  encoding: 'utf8';
+  timeout: number;
+  stdio: ['ignore', 'pipe', 'ignore'];
+  killSignal: 'SIGKILL';
+}
+
+export type CliResolverCommandRunner = (file: string, args: string[], options: CliResolverCommandOptions) => string;
+
+export interface ProductionCliResolverHostOptions {
+  processPath?: string;
+  shellPath?: string;
+  shellArgs?: string[];
+  runCommand?: CliResolverCommandRunner;
+  isExecutableFile?: (path: string) => boolean;
+  /**
+   * Test-only escape hatch: keep the REAL IO primitives even under vitest.
+   * For tests that exercise `isExecutableRegularFile` against their own temp
+   * fixtures. Such a test must still inject `runCommand` if it can reach the
+   * login-shell step, or it would spawn a real interactive shell.
+   */
+  allowRealIoUnderVitest?: boolean;
+}
+
+function isExecutableRegularFile(path: string): boolean {
+  try {
+    if (!statSync(path).isFile()) return false;
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function parseLoginShellResult(output: string, binary: string): string | null {
+  const lines = output.split(/\r?\n/).map((line) => line.trim());
+  const begin = lines.indexOf(LOGIN_SHELL_BEGIN_MARKER);
+  if (begin === -1) return null;
+  const end = lines.indexOf(LOGIN_SHELL_END_MARKER, begin + 1);
+  if (end === -1) return null;
+
+  for (const candidate of lines.slice(begin + 1, end)) {
+    if (isAbsolute(candidate) && basename(candidate) === binary) return candidate;
+  }
+  return null;
+}
+
+function loginShellCommand(binary: string): string {
+  return [
+    `printf '%s\\n' '${LOGIN_SHELL_BEGIN_MARKER}'`,
+    `command -v -- ${binary}`,
+    `printf '%s\\n' '${LOGIN_SHELL_END_MARKER}'`,
+  ].join('; ');
+}
+
+export function createProductionCliResolverHost(options: ProductionCliResolverHostOptions = {}): CliResolverHost {
+  const shellPath = options.shellPath ?? resolveLocalShell();
+  const shellArgs = options.shellArgs ?? loginShellArgs(shellPath).trim().split(/\s+/).filter(Boolean);
+  const processPath = options.processPath ?? process.env.PATH ?? '';
+  // Hermeticity gate (see @fileoverview): under vitest, any IO primitive the
+  // caller did not inject is replaced by an inert stub. The suites must never
+  // depend on — or execute — whatever happens to be installed on the machine
+  // running them, and route tests hitting the per-CLI status endpoints would
+  // otherwise scan the real PATH and spawn real login shells on CI.
+  const inert = Boolean(process.env.VITEST) && options.allowRealIoUnderVitest !== true;
+  const isExecutableFile = options.isExecutableFile ?? (inert ? () => false : isExecutableRegularFile);
+  const runCommand: CliResolverCommandRunner =
+    options.runCommand ?? (inert ? () => '' : (file, args, commandOptions) => execFileSync(file, args, commandOptions));
+  const run = (file: string, args: string[]): string => {
+    try {
+      return runCommand(file, args, {
+        encoding: 'utf8',
+        timeout: EXEC_TIMEOUT_MS,
+        stdio: ['ignore', 'pipe', 'ignore'],
+        // SIGKILL is load-bearing: execFileSync's `timeout` only SENDS the kill
+        // signal and then keeps waiting for the child to exit. Interactive bash
+        // ignores SIGTERM (the default), so a login shell stuck in a blocking
+        // .bash_profile would survive the timeout and block the server forever.
+        killSignal: 'SIGKILL',
+      });
+    } catch {
+      return '';
+    }
+  };
+
+  return {
+    processPath,
+    shellPath,
+    shellArgs: [...shellArgs],
+    findOnProcessPath: (binary) => {
+      if (!SAFE_BINARY_NAME.test(binary)) return null;
+      for (const directory of processPath.split(delimiter).filter(Boolean)) {
+        const candidate = join(directory, binary);
+        if (isAbsolute(candidate) && isExecutableFile(candidate)) return candidate;
+      }
+      return null;
+    },
+    findInLoginShell: (binary) => {
+      if (!SAFE_BINARY_NAME.test(binary)) return null;
+      const candidate = parseLoginShellResult(run(shellPath, [...shellArgs, '-c', loginShellCommand(binary)]), binary);
+      return candidate && isExecutableFile(candidate) ? candidate : null;
+    },
+    exists: isExecutableFile,
+  };
+}
+
+export function createCliExecutableResolver<T = undefined>(
+  options: {
+    binary: string;
+    searchDirs: string[];
+    validateCandidate?: (path: string) => CandidateValidation<T>;
+    /** Clock injection for tests driving the failure backoff. Defaults to `Date.now`. */
+    now?: () => number;
+  },
+  host: CliResolverHost = createProductionCliResolverHost()
+): CliExecutableResolver<T> {
+  if (!SAFE_BINARY_NAME.test(options.binary)) {
+    throw new Error(`Unsafe CLI binary name: ${options.binary}`);
+  }
+
+  const now = options.now ?? Date.now;
+  /** Successful resolution, cached for the process lifetime. */
+  let cached: CliResolution<T> | null = null;
+  /** Consecutive full-chain misses (drives the retry backoff). */
+  let failures = 0;
+  /** Timestamp of the most recent miss. */
+  let lastFailureAt = 0;
+  const accept = (path: string | null, source: CliResolutionSource): CliResolution<T> | null => {
+    if (!path || !isAbsolute(path) || !host.exists(path)) return null;
+    const validation = options.validateCandidate?.(path) ?? ({ accepted: true } as CandidateValidation<T>);
+    if (!validation.accepted) return null;
+    return {
+      binaryPath: path,
+      directory: dirname(path),
+      source,
+      metadata: validation.metadata,
+    };
+  };
+
+  return {
+    resolve() {
+      if (cached) return cached;
+      // Negative cache: a miss is remembered and the chain — whose login-shell
+      // tail is a synchronous 5s-bounded spawn — is not re-run until the
+      // backoff elapses. Without this, every status poll and Run click against
+      // a missing CLI froze the event loop for the full probe, forever.
+      if (failures > 0 && now() - lastFailureAt < cliResolveRetryDelayMs(failures)) return null;
+
+      cached = accept(host.findOnProcessPath(options.binary), 'process-path');
+      if (!cached) {
+        for (const dir of options.searchDirs) {
+          cached = accept(join(dir, options.binary), 'common-directory');
+          if (cached) break;
+        }
+      }
+      if (!cached) {
+        cached = accept(host.findInLoginShell(options.binary), 'login-shell');
+      }
+
+      if (cached) {
+        failures = 0;
+        lastFailureAt = 0;
+        return cached;
+      }
+      failures += 1;
+      lastFailureAt = now();
+      return null;
+    },
+    diagnostics: () => ({
+      binary: options.binary,
+      processPath: host.processPath,
+      shellPath: host.shellPath,
+      shellArgs: [...host.shellArgs],
+      searchDirs: [...options.searchDirs],
+    }),
+  };
+}
+
+function sanitizeDiagnosticField(value: string, emptyMarker: string): string {
+  const flattened = Array.from(value, (character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    const isControl = codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+    return isControl || codePoint === 0x2028 || codePoint === 0x2029 ? ' ' : character;
+  })
+    .join('')
+    .replace(/ +/g, ' ')
+    .trim();
+  if (!flattened) return emptyMarker;
+  if (flattened.length <= DIAGNOSTIC_FIELD_MAX_LENGTH) return flattened;
+  return `${flattened.slice(0, DIAGNOSTIC_FIELD_MAX_LENGTH - 1)}…`;
+}
+
+export function formatCliNotFoundMessage(base: string, diagnostics: CliResolutionDiagnostics): string {
+  const processPath = sanitizeDiagnosticField(diagnostics.processPath, '(empty)');
+  const shell = sanitizeDiagnosticField(
+    [diagnostics.shellPath, ...diagnostics.shellArgs].filter(Boolean).join(' '),
+    '(none)'
+  );
+  const dirs = sanitizeDiagnosticField(diagnostics.searchDirs.join(', '), '(none)');
+  return `${base}\nServer PATH: ${processPath}\nLogin shell: ${shell}\nChecked directories: ${dirs}`;
+}

src/utils/codex-cli-resolver.ts

@@ -7,11 +7,9 @@
  * @module utils/codex-cli-resolver
  */
 
-import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js';
+import { createCliExecutableResolver, formatCliNotFoundMessage } from './cli-executable-resolver.js';
 
 /** Common directories where the Codex CLI binary may be installed */
 const CODEX_SEARCH_DIRS = [
@@ -23,8 +21,8 @@ const CODEX_SEARCH_DIRS = [
   join(homedir(), 'bin'), // User bin
 ];
 
-/** Cached directory containing the codex binary (empty string = searched but not found) */
-let _codexDir: string | null = null;
+const codexResolver = createCliExecutableResolver({ binary: 'codex', searchDirs: CODEX_SEARCH_DIRS });
+const CODEX_NOT_FOUND = 'Codex CLI not found. Install with: npm install -g @openai/codex';
 
 /**
  * Finds the directory containing the `codex` binary.
@@ -34,31 +32,7 @@ let _codexDir: string | null = null;
  * @returns Directory path, or null if not found
  */
 export function resolveCodexDir(): string | null {
-  if (_codexDir !== null) return _codexDir || null;
-
-  // Try `which` first (respects current PATH)
-  try {
-    const result = execSync('which codex', {
-      encoding: 'utf-8',
-      timeout: EXEC_TIMEOUT_MS,
-    }).trim();
-    if (result && existsSync(result)) {
-      _codexDir = dirname(result);
-      return _codexDir;
-    }
-  } catch {
-    // Codex not in PATH, will check common locations
-  }
-
-  for (const dir of CODEX_SEARCH_DIRS) {
-    if (existsSync(join(dir, 'codex'))) {
-      _codexDir = dir;
-      return _codexDir;
-    }
-  }
-
-  _codexDir = ''; // mark as searched, not found
-  return null;
+  return codexResolver.resolve()?.directory ?? null;
 }
 
 /**
@@ -67,3 +41,7 @@ export function resolveCodexDir(): string | null {
 export function isCodexAvailable(): boolean {
   return resolveCodexDir() !== null;
 }
+
+export function getCodexNotFoundMessage(): string {
+  return formatCliNotFoundMessage(CODEX_NOT_FOUND, codexResolver.diagnostics());
+}

src/utils/file-query.ts

@@ -0,0 +1,93 @@
+/**
+ * @fileoverview Pure file-name/path query matcher for the Files panel search
+ * (COD-236). Compiles a user query string into a reusable predicate so the
+ * server-side file walk can prune to matching entries instead of streaming the
+ * whole tree.
+ *
+ * Semantics:
+ * - Empty / whitespace-only query → `compileFileQuery` returns `null` (the
+ *   caller treats this as "no search", falling back to the full tree). A query
+ *   longer than `MAX_QUERY_LENGTH` compiles to `null` too: no honest filename
+ *   search is that long, and the glob walk below is O(text · pattern).
+ * - A query containing a glob metachar (`*` or `?`) matches anchored and
+ *   case-insensitively, `*` spanning any run (slashes included) and `?` exactly
+ *   one character; every other character matches literally.
+ * - Otherwise the query is a plain case-insensitive substring.
+ * - When the query contains a `/` it matches against the relative path; else it
+ *   matches against the bare entry name.
+ *
+ * ⚠️ Globs are matched by `globMatch` below, never by compiling the query into
+ * a RegExp: `*a*a*a…` translated to `^.*a.*a.*a…$` is a classic backtracking
+ * blowup, evaluated synchronously against every walked path — a pathological
+ * query could freeze the event loop for the whole server (the same reason
+ * `search-service.ts` is regex-free). The two-pointer wildcard walk is
+ * O(text · pattern) worst case, with both operands short by construction.
+ *
+ * No fs / IO — safe to unit-test directly.
+ */
+
+export type FileQueryMatcher = (name: string, relativePath: string) => boolean;
+
+// Longer than any honest file search; bounds the O(text · pattern) glob walk.
+const MAX_QUERY_LENGTH = 256;
+
+/**
+ * Anchored glob match, linear-space two-pointer walk (no RegExp — see the
+ * fileoverview). `pattern` must already be lowercased; `text` is lowercased
+ * here so one compiled matcher serves many entries.
+ */
+function globMatch(pattern: string, rawText: string): boolean {
+  const text = rawText.toLowerCase();
+  let p = 0;
+  let t = 0;
+  let starP = -1;
+  let starT = -1;
+  while (t < text.length) {
+    const pc = p < pattern.length ? pattern[p] : '';
+    if (pc === '?' || pc === text[t]) {
+      p++;
+      t++;
+    } else if (pc === '*') {
+      // Remember the star; try matching zero characters first, and on a later
+      // mismatch re-expand it one character at a time from here.
+      starP = p++;
+      starT = t;
+    } else if (starP !== -1) {
+      p = starP + 1;
+      t = ++starT;
+    } else {
+      return false;
+    }
+  }
+  while (p < pattern.length && pattern[p] === '*') p++;
+  return p === pattern.length;
+}
+
+/**
+ * Compile a query string into a matcher predicate, or `null` when the query is
+ * empty/whitespace or overlong (caller treats null as "no search").
+ */
+export function compileFileQuery(query: string): FileQueryMatcher | null {
+  const trimmed = query.trim();
+  if (trimmed === '' || trimmed.length > MAX_QUERY_LENGTH) return null;
+
+  const matchesPath = trimmed.includes('/');
+  const isGlob = trimmed.includes('*') || trimmed.includes('?');
+
+  if (isGlob) {
+    const pattern = trimmed.toLowerCase();
+    return (name, relativePath) => globMatch(pattern, matchesPath ? relativePath : name);
+  }
+
+  const needle = trimmed.toLowerCase();
+  return (name, relativePath) => (matchesPath ? relativePath : name).toLowerCase().includes(needle);
+}
+
+/**
+ * Convenience: compile the query and apply it in one call. Returns false when
+ * the query compiles to null (empty).
+ */
+export function matchFileQuery(query: string, name: string, relativePath: string): boolean {
+  const matcher = compileFileQuery(query);
+  return matcher ? matcher(name, relativePath) : false;
+}

src/utils/gemini-cli-resolver.ts

@@ -7,11 +7,9 @@
  * @module utils/gemini-cli-resolver
  */
 
-import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js';
+import { createCliExecutableResolver, formatCliNotFoundMessage } from './cli-executable-resolver.js';
 
 /** Common directories where the Gemini CLI binary may be installed */
 const GEMINI_SEARCH_DIRS = [
@@ -23,8 +21,8 @@ const GEMINI_SEARCH_DIRS = [
   join(homedir(), 'bin'),
 ];
 
-/** Cached directory containing the gemini binary (empty string = searched but not found) */
-let _geminiDir: string | null = null;
+const geminiResolver = createCliExecutableResolver({ binary: 'gemini', searchDirs: GEMINI_SEARCH_DIRS });
+const GEMINI_NOT_FOUND = 'Gemini CLI not found. Install with: npm install -g @google/gemini-cli';
 
 /**
  * Finds the directory containing the `gemini` binary.
@@ -33,30 +31,7 @@ let _geminiDir: string | null = null;
  * @returns Directory path, or null if not found
  */
 export function resolveGeminiDir(): string | null {
-  if (_geminiDir !== null) return _geminiDir || null;
-
-  try {
-    const result = execSync('which gemini', {
-      encoding: 'utf-8',
-      timeout: EXEC_TIMEOUT_MS,
-    }).trim();
-    if (result && existsSync(result)) {
-      _geminiDir = dirname(result);
-      return _geminiDir;
-    }
-  } catch {
-    // Gemini not in PATH, will check common locations
-  }
-
-  for (const dir of GEMINI_SEARCH_DIRS) {
-    if (existsSync(join(dir, 'gemini'))) {
-      _geminiDir = dir;
-      return _geminiDir;
-    }
-  }
-
-  _geminiDir = '';
-  return null;
+  return geminiResolver.resolve()?.directory ?? null;
 }
 
 /**
@@ -65,3 +40,7 @@ export function resolveGeminiDir(): string | null {
 export function isGeminiAvailable(): boolean {
   return resolveGeminiDir() !== null;
 }
+
+export function getGeminiNotFoundMessage(): string {
+  return formatCliNotFoundMessage(GEMINI_NOT_FOUND, geminiResolver.diagnostics());
+}

src/utils/index.ts

@@ -28,10 +28,22 @@ export { stringSimilarity, fuzzyPhraseMatch, todoContentHash } from './string-si
 export { assertNever } from './type-safety.js';
 export { wrapWithNice } from './nice-wrapper.js';
 export { resolveLocalShell, loginShellArgs } from './shell-resolver.js';
-export { findClaudeDir, getAugmentedPath, getClaudeCliVersion, getClaudeBinaryPath } from './claude-cli-resolver.js';
+export {
+  findClaudeDir,
+  getAugmentedPath,
+  getClaudeCliVersion,
+  getClaudeBinaryPath,
+  getClaudeNotFoundMessage,
+} from './claude-cli-resolver.js';
 export { spawnPtyWithHelperRepair } from './node-pty-repair.js';
-export { resolveOpenCodeDir } from './opencode-cli-resolver.js';
-export { resolveCodexDir, isCodexAvailable } from './codex-cli-resolver.js';
-export { resolveGeminiDir, isGeminiAvailable } from './gemini-cli-resolver.js';
-export { resolveAntigravityDir, isAntigravityAvailable } from './antigravity-cli-resolver.js';
-export { resolvePiDir, isPiAvailable, getPiCliVersion } from './pi-cli-resolver.js';
+export { resolveOpenCodeDir, getOpenCodeNotFoundMessage } from './opencode-cli-resolver.js';
+export { resolveCodexDir, isCodexAvailable, getCodexNotFoundMessage } from './codex-cli-resolver.js';
+export { resolveGeminiDir, isGeminiAvailable, getGeminiNotFoundMessage } from './gemini-cli-resolver.js';
+export {
+  resolveAntigravityDir,
+  isAntigravityAvailable,
+  getAntigravityNotFoundMessage,
+} from './antigravity-cli-resolver.js';
+export { resolvePiDir, isPiAvailable, getPiCliVersion, getPiNotFoundMessage } from './pi-cli-resolver.js';
+export { compileFileQuery, matchFileQuery } from './file-query.js';
+export type { FileQueryMatcher } from './file-query.js';

src/utils/opencode-cli-resolver.ts

@@ -7,11 +7,9 @@
  * @module utils/opencode-cli-resolver
  */
 
-import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js';
+import { createCliExecutableResolver, formatCliNotFoundMessage } from './cli-executable-resolver.js';
 
 /** Common directories where the OpenCode CLI binary may be installed */
 const OPENCODE_SEARCH_DIRS = [
@@ -24,8 +22,8 @@ const OPENCODE_SEARCH_DIRS = [
   join(homedir(), 'bin'), // User bin
 ];
 
-/** Cached directory containing the opencode binary (empty string = searched but not found) */
-let _openCodeDir: string | null = null;
+const openCodeResolver = createCliExecutableResolver({ binary: 'opencode', searchDirs: OPENCODE_SEARCH_DIRS });
+const OPENCODE_NOT_FOUND = 'OpenCode CLI not found. Install with: curl -fsSL https://opencode.ai/install | bash';
 
 /**
  * Finds the directory containing the `opencode` binary.
@@ -35,32 +33,7 @@ let _openCodeDir: string | null = null;
  * @returns Directory path, or null if not found
  */
 export function resolveOpenCodeDir(): string | null {
-  if (_openCodeDir !== null) return _openCodeDir || null;
-
-  // Try `which` first (respects current PATH)
-  try {
-    const result = execSync('which opencode', {
-      encoding: 'utf-8',
-      timeout: EXEC_TIMEOUT_MS,
-    }).trim();
-    if (result && existsSync(result)) {
-      _openCodeDir = dirname(result);
-      return _openCodeDir;
-    }
-  } catch {
-    // OpenCode not in PATH, will check common locations
-  }
-
-  // Fallback: check common installation directories
-  for (const dir of OPENCODE_SEARCH_DIRS) {
-    if (existsSync(join(dir, 'opencode'))) {
-      _openCodeDir = dir;
-      return _openCodeDir;
-    }
-  }
-
-  _openCodeDir = ''; // mark as searched, not found
-  return null;
+  return openCodeResolver.resolve()?.directory ?? null;
 }
 
 /**
@@ -69,3 +42,7 @@ export function resolveOpenCodeDir(): string | null {
 export function isOpenCodeAvailable(): boolean {
   return resolveOpenCodeDir() !== null;
 }
+
+export function getOpenCodeNotFoundMessage(): string {
+  return formatCliNotFoundMessage(OPENCODE_NOT_FOUND, openCodeResolver.diagnostics());
+}

src/utils/pi-cli-resolver.ts

@@ -15,11 +15,15 @@
  * @module utils/pi-cli-resolver
  */
 
-import { execFileSync, execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js';
+import {
+  createCliExecutableResolver,
+  formatCliNotFoundMessage,
+  type CliResolverHost,
+} from './cli-executable-resolver.js';
 
 /** Common directories where the Pi CLI binary may be installed */
 const PI_SEARCH_DIRS = [
@@ -45,10 +49,7 @@ const PI_SEARCH_DIRS = [
  */
 export const PI_VERSION_REGEX = /(?:^|\s)(\d+\.\d+\.\d+)/;
 
-/** Cached directory containing the pi binary (empty string = searched but not found) */
-let _piDir: string | null = null;
-/** Cached version string reported by the resolved binary (empty string = probed, unusable) */
-let _piVersion: string | null = null;
+const PI_NOT_FOUND = 'Pi CLI not found. Install with: npm install -g --ignore-scripts @earendil-works/pi-coding-agent';
 
 /**
  * Run `pi --version` on a candidate path and return the trimmed version when it
@@ -57,7 +58,12 @@ let _piVersion: string | null = null;
  * (which is how an unrelated `pi` on PATH gets rejected).
  *
  * Never runs under vitest: the suites must stay hermetic and must not depend on
- * whether the dev box happens to have pi installed.
+ * whether the dev box happens to have pi installed — and since `pi` is a short
+ * GENERIC name, this probe would EXECUTE whatever binary of that name the
+ * machine carries. The shared resolver host is already inert under vitest, so
+ * this gate is defense in depth for any opted-in host that still carries the
+ * default probe; tests drive resolution via `createPiResolverForTest`, whose
+ * injected probe bypasses it. Pinned by test/pi-cli-resolver.test.ts.
  */
 function probePiVersion(binPath: string): string | null {
   if (process.env.VITEST) return null;
@@ -66,6 +72,9 @@ function probePiVersion(binPath: string): string | null {
       encoding: 'utf-8',
       timeout: EXEC_TIMEOUT_MS,
       stdio: ['ignore', 'pipe', 'ignore'],
+      // A stuck or hostile `pi` that ignores SIGTERM would survive the timeout
+      // and block the server (execFileSync keeps waiting after the signal).
+      killSignal: 'SIGKILL',
     }).trim();
     // Upstream prints a bare version today; tolerate a `pi 0.84.1` style prefix too.
     const candidate = PI_VERSION_REGEX.exec(out)?.[1];
@@ -77,6 +86,34 @@ function probePiVersion(binPath: string): string | null {
   return null;
 }
 
+type PiVersionProbe = (binPath: string) => string | null;
+
+function createPiResolver(host?: CliResolverHost, versionProbe: PiVersionProbe = probePiVersion, now?: () => number) {
+  return createCliExecutableResolver<string>(
+    {
+      binary: 'pi',
+      searchDirs: PI_SEARCH_DIRS,
+      validateCandidate: (binPath) => {
+        const version = versionProbe(binPath);
+        return version ? { accepted: true, metadata: version } : { accepted: false };
+      },
+      now,
+    },
+    host
+  );
+}
+
+/**
+ * Creates an isolated Pi wrapper around an injected host, version probe and
+ * clock. Omitting `versionProbe` keeps the ambient (VITEST-gated) probe, which
+ * is exactly what the hermeticity test exercises.
+ */
+export function createPiResolverForTest(host: CliResolverHost, versionProbe?: PiVersionProbe, now?: () => number) {
+  return createPiResolver(host, versionProbe ?? probePiVersion, now);
+}
+
+const piResolver = createPiResolver();
+
 /**
  * Finds the directory containing a verified `pi` binary.
  * Checks `which pi` first, then falls back to common install locations. Every
@@ -86,46 +123,7 @@ function probePiVersion(binPath: string): string | null {
  * @returns Directory path, or null if not found
  */
 export function resolvePiDir(): string | null {
-  if (_piDir !== null) return _piDir || null;
-
-  const accept = (binPath: string): string | null => {
-    // Under vitest the probe never runs, so existence alone decides (keeps the
-    // suites hermetic and matches how the sibling resolvers behave there).
-    if (process.env.VITEST) {
-      _piDir = dirname(binPath);
-      _piVersion = '';
-      return _piDir;
-    }
-    const version = probePiVersion(binPath);
-    if (!version) return null;
-    _piDir = dirname(binPath);
-    _piVersion = version;
-    return _piDir;
-  };
-
-  try {
-    const result = execSync('which pi', {
-      encoding: 'utf-8',
-      timeout: EXEC_TIMEOUT_MS,
-    }).trim();
-    if (result && existsSync(result)) {
-      const dir = accept(result);
-      if (dir) return dir;
-    }
-  } catch {
-    // pi not in PATH, will check common locations
-  }
-
-  for (const dir of PI_SEARCH_DIRS) {
-    const binPath = join(dir, 'pi');
-    if (!existsSync(binPath)) continue;
-    const accepted = accept(binPath);
-    if (accepted) return accepted;
-  }
-
-  _piDir = '';
-  _piVersion = '';
-  return null;
+  return piResolver.resolve()?.directory ?? null;
 }
 
 /**
@@ -135,12 +133,14 @@ export function isPiAvailable(): boolean {
   return resolvePiDir() !== null;
 }
 
+export function getPiNotFoundMessage(): string {
+  return formatCliNotFoundMessage(PI_NOT_FOUND, piResolver.diagnostics());
+}
+
 /**
- * Version reported by the resolved `pi` binary, or null when pi is unavailable
- * (or when the probe was skipped, i.e. under vitest). Surfaced through
- * `GET /api/pi/status` so a misresolution is diagnosable from the UI.
+ * Version reported by the resolved `pi` binary, or null when pi is unavailable.
+ * Surfaced through `GET /api/pi/status` so a misresolution is diagnosable from the UI.
  */
 export function getPiCliVersion(): string | null {
-  resolvePiDir();
-  return _piVersion || null;
+  return piResolver.resolve()?.metadata ?? null;
 }

src/web/approval-inbox.ts

@@ -22,14 +22,14 @@
  * - Acknowledgement (`acknowledge()`, idle items only) is NOT resolution: the
  *   item stays pending, it just stops arming the tab alert on every client.
  *
- * @dependencies utils (stripAnsi)
+ * @dependencies utils (stripAnsi, CLAUDE_WORKING_LINE_PATTERN)
  * @consumedby web/routes/hook-event-routes (notePrompt/resolve), web/routes/approval-routes,
  *   web/session-listener-wiring (working/exit resolution), web/server (emit callbacks + stop)
  *
  * @module web/approval-inbox
  */
 
-import { stripAnsi } from '../utils/index.js';
+import { stripAnsi, CLAUDE_WORKING_LINE_PATTERN } from '../utils/index.js';
 
 // ─── Types ───────────────────────────────────────────────────────────────────
 
@@ -106,6 +106,12 @@ const ITEM_TTL_MS = 12 * 60 * 60 * 1000;
  * single delayed re-capture picks up the frame the immediate capture missed.
  */
 const RECAPTURE_DELAY_MS = 600;
+/**
+ * Delayed staleness pass for the late-hook case (see notePrompt). Comfortably
+ * clear of RECAPTURE_DELAY_MS so a dialog Ink has not painted yet is never
+ * mistaken for one that is gone.
+ */
+const STALE_CHECK_DELAY_MS = 3000;
 /** Context kept per item: enough for a dialog plus a few lines above it. */
 const MAX_CONTEXT_CHARS = 4000;
 const MAX_CONTEXT_LINES = 30;
@@ -195,7 +201,8 @@ export function parseDialogOptions(context: string | undefined): ApprovalOption[
 export class ApprovalInbox {
   /** Keyed by sessionId; the one-active-item-per-session invariant lives here. */
   private items = new Map<string, ApprovalItem>();
-  private recaptureTimers = new Map<string, ReturnType<typeof setTimeout>>();
+  /** Post-capture timers per item id (re-capture + the delayed staleness check). */
+  private itemTimers = new Map<string, ReturnType<typeof setTimeout>[]>();
   /** Capture callbacks kept for answer-time re-verification; dropped on remove. */
   private captures = new Map<string, () => string | null>();
   private seq = 0;
@@ -229,31 +236,55 @@ export class ApprovalInbox {
     if (args.capture) this.captures.set(args.sessionId, args.capture);
     this.onPending?.(item);
     if (args.capture && !this.stopped) {
-      const timer = setTimeout(() => {
-        this.recaptureTimers.delete(item.id);
-        // Only update the item if it is still the live one for the session.
-        if (this.items.get(args.sessionId)?.id !== item.id) return;
+      // Pass 1 (600ms): enrich the card with the painted frame.
+      this.scheduleForItem(item, RECAPTURE_DELAY_MS, () => {
         this.applyCapture(item, args.capture);
         this.onUpdated?.(item);
-      }, RECAPTURE_DELAY_MS);
-      this.recaptureTimers.set(item.id, timer);
+      });
+      // Pass 2: the late-hook staleness check. Claude Code fires the
+      // Notification behind the dialog, so a prompt answered before the hook
+      // lands creates an item for a dialog that is ALREADY gone: nothing ever
+      // parsed, so the "options vanished" test can never fire, `stop` may have
+      // gone by already, and the red alert then outlived reloads until the 12h
+      // TTL. This pass re-reads the pane and resolves when the frame proves no
+      // dialog is up. Deliberately LATER than the re-capture, whose whole
+      // reason for existing is that Ink may not have painted the dialog yet:
+      // resolving inside that window could clear the alert for a dialog that
+      // was about to appear.
+      this.scheduleForItem(item, STALE_CHECK_DELAY_MS, () => {
+        this.verifyStillAnswerable(item.id);
+      });
     }
     return item;
   }
 
   /**
    * Answer-time guard: re-capture the pane and check the dialog is still on
-   * screen before keystrokes are sent at it. Only conclusive when the ORIGINAL
-   * frame parsed options: if a fresh capture then parses none, the dialog is
-   * gone (answered in the terminal moments ago), so the item resolves and the
-   * answer must be refused, because the digit would land in whatever now has
-   * focus. Unparseable-from-the-start items stay answerable (approve/deny
-   * only), same risk the terminal user already carries.
+   * screen before keystrokes are sent at it. If the dialog is gone (answered in
+   * the terminal moments ago) the item resolves and the answer is refused,
+   * because the digit would land in whatever now has focus.
+   *
+   * A fresh frame that parses NO options is conclusive in two cases, and only
+   * those; anything else stays answerable, so an unreadable capture keeps the
+   * alert rather than losing a live dialog:
+   *
+   * 1. The item HAD parsed options. They cannot vanish while the dialog is up.
+   * 2. The frame shows Claude actively running a turn. A modal dialog BLOCKS
+   *    the turn, so a working line and a dialog cannot coexist — measured on
+   *    v2.1.237: a live-dialog frame carries neither the `… (13s` timer nor
+   *    even the `esc to interrupt` footer, which the dialog replaces with
+   *    `Enter to select · ↑/↓ to navigate · Esc to cancel`.
+   *
+   * Case 2 is what closes the late-hook hole. Claude Code fires the
+   * Notification behind the dialog, so a prompt answered before the hook lands
+   * produces an item whose FIRST capture already has no dialog in it — never
+   * parsed, so case 1 can never fire, and the red alert then outlived even
+   * `stop` (which had already fired) and survived reloads until the 12h TTL.
    */
   verifyStillAnswerable(id: string): boolean {
     const item = this.getById(id);
     if (!item) return false;
-    if (item.kind === 'idle' || !item.options) return true;
+    if (item.kind === 'idle') return true;
     const capture = this.captures.get(item.sessionId);
     if (!capture) return true;
     let raw: string | null = null;
@@ -266,14 +297,39 @@ export class ApprovalInbox {
     if (!context) return true;
     const options = parseDialogOptions(context);
     if (!options) {
-      this.remove(item, 'resolved_in_terminal');
-      return false;
+      if (item.options || CLAUDE_WORKING_LINE_PATTERN.test(context)) {
+        this.remove(item, 'resolved_in_terminal');
+        return false;
+      }
+      return true; // never parsed and the pane is not visibly working: unreadable, not gone
     }
     item.context = context;
     item.options = options;
     return true;
   }
 
+  /**
+   * "This session's pane started moving again": re-verify its pending DIALOG
+   * item against the screen and resolve it if the dialog is gone.
+   *
+   * The staleness check itself lived only in `GET /api/approvals`, which
+   * nothing calls while a page is open (`seedApprovals()` runs on init and
+   * reconnect), so a dialog answered in the terminal kept its red tab alert for
+   * the whole rest of the turn. The `working` signal is exactly the moment an
+   * answer lands, and routing it through `verifyStillAnswerable` is what makes
+   * it safe to act on for a permission/question item: `working` is heuristic
+   * and can flap, but it only decides WHEN to look — the pane decides the
+   * outcome, and an unreadable capture keeps the alert.
+   *
+   * Cheap by construction: a Map miss unless a dialog item is actually pending,
+   * and the item is gone after the first successful resolve.
+   */
+  resolveIfDialogGone(sessionId: string): void {
+    const item = this.getForSession(sessionId);
+    if (!item || item.kind === 'idle') return;
+    this.verifyStillAnswerable(item.id);
+  }
+
   /** Pending item for a session, TTL-checked. */
   getForSession(sessionId: string): ApprovalItem | undefined {
     const item = this.items.get(sessionId);
@@ -359,12 +415,27 @@ export class ApprovalInbox {
   /** Clear all timers (shutdown/tests). Items become inert; no events fire after this. */
   stop(): void {
     this.stopped = true;
-    for (const timer of this.recaptureTimers.values()) clearTimeout(timer);
-    this.recaptureTimers.clear();
+    for (const timers of this.itemTimers.values()) for (const timer of timers) clearTimeout(timer);
+    this.itemTimers.clear();
     this.items.clear();
     this.captures.clear();
   }
 
+  /**
+   * Run `fn` after `delayMs` if the item is still the live one for its session,
+   * tracking the timer so `remove()`/`stop()` can cancel it.
+   */
+  private scheduleForItem(item: ApprovalItem, delayMs: number, fn: () => void): void {
+    const timer = setTimeout(() => {
+      const timers = this.itemTimers.get(item.id)?.filter((t) => t !== timer) ?? [];
+      if (timers.length > 0) this.itemTimers.set(item.id, timers);
+      else this.itemTimers.delete(item.id);
+      if (this.items.get(item.sessionId)?.id !== item.id) return;
+      fn();
+    }, delayMs);
+    this.itemTimers.set(item.id, [...(this.itemTimers.get(item.id) ?? []), timer]);
+  }
+
   private applyCapture(item: ApprovalItem, capture?: () => string | null): void {
     if (!capture) return;
     let raw: string | null = null;
@@ -377,17 +448,30 @@ export class ApprovalInbox {
     if (!context) return;
     item.context = context;
     // Idle prompts are not dialogs; never offer digit answers for them.
-    if (item.kind !== 'idle') item.options = parseDialogOptions(context);
+    if (item.kind === 'idle') return;
+    const options = parseDialogOptions(context);
+    // ⚠️ ADD-ONLY: a re-capture that parses NOTHING must never erase options a
+    // previous capture found. Claude Code delays the Notification hook behind
+    // the dialog (measured 6s here, up to ~30s), so the 600ms re-capture very
+    // often lands AFTER the user has already answered in the terminal, on a
+    // frame with no dialog in it. Clearing the field there was the whole bug:
+    // `verifyStillAnswerable` reads a MISSING `options` as "never parsed" and
+    // keeps such an item answerable by design, so a cleared field made the item
+    // permanently unsweepable — the red "needs you" alert then survived every
+    // `GET /api/approvals` and every page reload and only went away on `stop`
+    // (owner report 2026-08-20: a confirmed question left a tab flowing red for
+    // ~8 minutes while the turn ran on), and the stale card still accepted an
+    // answer, typing a bare `1` into a composer with no dialog under it.
+    // Keeping the parse means a later capture is CONCLUSIVE: options present +
+    // fresh frame without them == answered in the terminal.
+    if (options) item.options = options;
   }
 
   private remove(item: ApprovalItem, resolution: ApprovalResolution): void {
     this.items.delete(item.sessionId);
     this.captures.delete(item.sessionId);
-    const timer = this.recaptureTimers.get(item.id);
-    if (timer) {
-      clearTimeout(timer);
-      this.recaptureTimers.delete(item.id);
-    }
+    for (const timer of this.itemTimers.get(item.id) ?? []) clearTimeout(timer);
+    this.itemTimers.delete(item.id);
     if (!this.stopped) {
       this.onResolved?.({ id: item.id, sessionId: item.sessionId, kind: item.kind, resolution });
     }

src/web/public/app.js

@@ -536,10 +536,10 @@ class CodemanApp {
     this._initGeneration = 0;     // dedup concurrent handleInit calls
     this._initFallbackTimer = null; // fallback timer if SSE init doesn't arrive
     this._selectGeneration = 0;   // cancel stale selectSession loads
-    // Sessions whose full tmux scrollback has already been replayed this page load
-    // (COD-47). Tracked PER SESSION rather than as a single "first load" flag: the
-    // flag was consumed by whichever session auto-selected at page load, so every
-    // OTHER tab started life with one visible frame of history (issue #205).
+    // Non-shell sessions whose full tmux scrollback has already been replayed this
+    // page load (COD-47). Shells deliberately start from a bounded tail because
+    // their scrollback can be very large; full history stays available on demand.
+    // Tracked PER SESSION rather than as a single "first load" flag (issue #205).
     this._fullHistoryLoaded = new Set();
     // Cooldown per session for the scroll-to-top "load more history" re-pull.
     this._fullHistoryRepullAt = new Map(); // Map<sessionId, timestamp>
@@ -2053,6 +2053,28 @@ class CodemanApp {
           wrap.appendChild(actions);
           wrap.appendChild(pre);
         });
+        // Links open in a NEW tab.
+        //
+        // marked emits a bare `<a href>` and the sanitizer's allowlist has no
+        // `target`, so a tap in the chat NAVIGATED THE APP AWAY: on a phone that
+        // unloads the whole dashboard — SSE, terminal buffers, unsent composer
+        // text — and the OS back gesture reloads it from scratch, which is what
+        // "links don't open" reads as on mobile, with no middle-click or
+        // open-in-new-tab affordance to work around it.
+        //
+        // This pass runs AFTER sanitizing, so it is the only source of these two
+        // attributes: whatever an agent wrote is already gone, and `rel` is set on
+        // the same element in the same breath, so no page Codeman opens ever gets
+        // a `window.opener` handle back (reverse tabnabbing).
+        //
+        // A fragment link stays in-page, and mailto:/tel: are handed to the OS —
+        // giving those a target just strands an empty tab.
+        tmpl.content.querySelectorAll('a[href]').forEach((a) => {
+          const href = a.getAttribute('href') || '';
+          if (!href || href.startsWith('#') || /^(?:mailto|tel):/i.test(href)) return;
+          a.setAttribute('target', '_blank');
+          a.setAttribute('rel', 'noopener noreferrer');
+        });
         return tmpl.innerHTML;
       } catch { /* fall through */ }
     }
@@ -5246,6 +5268,22 @@ class CodemanApp {
     this.terminal.write('\x1b[3J\x1b[H\x1b[2J');
   }
 
+  _recordTerminalLoadTiming(timing) {
+    this._lastTerminalLoadTiming = timing;
+    console.info('[TERMINAL-PERF]', timing);
+    const resetAndParseMs =
+      (timing.cacheResetAndParseMs || 0) +
+      (timing.freshResetAndParseMs || 0) +
+      (timing.resetAndParseMs || 0);
+    const totalMs = timing.selectDoneMs ?? timing.totalMs ?? timing.selectToReplayCompleteMs ?? 0;
+    _crashDiag.log(
+      `TERMINAL_LOAD: ${timing.trigger} ${timing.full ? 'full' : 'tail'} ${timing.chars} chars ` +
+      `ttfb=${timing.ttfbMs.toFixed(0)}ms body+json=${timing.bodyAndJsonMs.toFixed(0)}ms ` +
+      `reset+parse=${resetAndParseMs.toFixed(0)}ms total=${totalMs.toFixed(0)}ms ` +
+      `server="${timing.serverTiming}"${timing.refused ? ' refused-downgrade' : ''}`
+    );
+  }
+
   /**
    * "Load more history": re-pull the whole tmux scrollback when the user scrolls up
    * while already at the top of what the browser has.
@@ -5274,6 +5312,11 @@ class CodemanApp {
     const sessionId = this.activeSessionId;
     if (!sessionId || this._fullHistoryRepullInFlight || this._isLoadingBuffer) return;
     if (this.detachedSessions?.has(sessionId)) return;
+    const session = this.sessions.get(sessionId);
+    // A shell's full capture can be many megabytes. Replaying it from an
+    // ordinary scroll gesture blocks xterm's main thread, so keep that cost
+    // behind the explicit "Load full history" button.
+    if (!force && session?.mode === 'shell') return;
     const now = Date.now();
     // Momentum scrolling fires this dozens of times per flick, and a burst of new
     // output is the normal reason to want a re-pull, so cooldown rather than latch.
@@ -5285,13 +5328,32 @@ class CodemanApp {
     this._fullHistoryRepullAt.set(sessionId, now);
     this._fullHistoryRepullInFlight = true;
     try {
+      const requestStartedAt = performance.now();
       const res = await fetch(`/api/sessions/${sessionId}/terminal?full=1`);
+      const headersReceivedAt = performance.now();
       const payload = (await res.json())?.data ?? {};
+      const bodyParsedAt = performance.now();
       const buffer = payload.terminalBuffer;
+      const timing = {
+        trigger: force ? 'full-history-button' : 'full-history-scroll',
+        mode: session?.mode || 'unknown',
+        full: true,
+        source: payload.source || 'unknown',
+        chars: buffer?.length || 0,
+        ttfbMs: headersReceivedAt - requestStartedAt,
+        bodyAndJsonMs: bodyParsedAt - headersReceivedAt,
+        resetAndParseMs: 0,
+        totalMs: 0,
+        serverTiming: res.headers?.get?.('server-timing') || '',
+        refused: false,
+      };
       // Bail on a tab switch mid-fetch: writing here would paint another session's
       // history into the terminal the user is now looking at.
       if (!buffer || this.activeSessionId !== sessionId) return;
       if (this._replayWouldShrinkBuffer(buffer)) {
+        timing.refused = true;
+        timing.totalMs = performance.now() - requestStartedAt;
+        this._recordTerminalLoadTiming(timing);
         (this._fullHistoryRepullUseless ||= new Set()).add(sessionId);
         this._logScrollRouting?.('repull-refused-downgrade');
         // The browser already holds more than tmux can give back, so there is
@@ -5302,17 +5364,32 @@ class CodemanApp {
       this._setHistoryTruncation(sessionId, payload);
       this._fullHistoryRepullUseless?.delete(sessionId);
       const rowsBefore = this.terminal.buffer.active.length;
+      const replayStartedAt = performance.now();
       this._resetTerminalForReplay();
-      await this.chunkedTerminalWrite(buffer, TERMINAL_CHUNK_SIZE, sessionId);
-      if (this.activeSessionId !== sessionId) return;
-      this.terminalBufferCache.set(sessionId, buffer);
+      const {
+        parsedAt,
+        bufferLength: parsedBufferLength,
+        completed,
+      } = await this.chunkedTerminalWrite(buffer, TERMINAL_CHUNK_SIZE, sessionId);
+      timing.resetAndParseMs = parsedAt - replayStartedAt;
+      if (!completed || this.activeSessionId !== sessionId) return;
+      // Keep shell tab restores bounded too. A user-triggered full-history pull
+      // may be tens of MB; caching it would replay that whole payload again on
+      // the next tab switch before the normal 1MB tail fetch replaces it.
+      if (this.sessions.get(sessionId)?.mode !== 'shell') {
+        this.terminalBufferCache.set(sessionId, buffer);
+      } else {
+        this.terminalBufferCache.delete(sessionId);
+      }
       // Hold the user's place. The replay is a superset that grew the buffer
       // UPWARD, so what used to be row 0 (what they were looking at) is now `delta`
       // rows down; scrolling there reveals the recovered history above it instead
       // of teleporting them to the bottom the way a normal buffer load does.
-      const delta = this.terminal.buffer.active.length - rowsBefore;
+      const delta = parsedBufferLength - rowsBefore;
       if (delta > 0) this.terminal.scrollToLine(delta);
       else this.terminal.scrollToTop();
+      timing.totalMs = performance.now() - requestStartedAt;
+      this._recordTerminalLoadTiming(timing);
     } catch {
       // Transient (offline, 5xx) — the next scroll-up past the cooldown retries.
     } finally {
@@ -5592,6 +5669,7 @@ class CodemanApp {
     // COD-144: track whether the load painted nothing (empty fetch + no cache).
     // For that just-created-session case we flush (not discard) queued SSE events.
     let bufferWasEmpty = false;
+    let cacheResetAndParseMs = 0;
     try {
       // Fit terminal to container BEFORE writing any buffer data.
       // If the browser was resized while viewing another session, the terminal
@@ -5669,23 +5747,30 @@ class CodemanApp {
       // blank and rewrites with fresh data. Skip the cache and write the fresh
       // buffer once for a single clean transition.
       const cachedBuffer = this.terminalBufferCache.get(sessionId);
-      let clearedForBusy = false;
-      if (cachedBuffer && !sessionIsBusy && !restoredSnapshot) {
+      let clearedBeforeFresh = false;
+      if (cachedBuffer && !sessionIsBusy && !restoredSnapshot && session?.mode !== 'shell') {
         _crashDiag.log(`CACHE_WRITE: ${(cachedBuffer.length/1024).toFixed(0)}KB`);
         this._setTerminalLoadState(sessionId, selectGen, 'replaying');
+        const cacheReplayStartedAt = performance.now();
         this._resetTerminalForReplay();
-        await this.chunkedTerminalWrite(cachedBuffer, TERMINAL_CHUNK_SIZE, bufferLoadOwner);
+        const { parsedAt: cacheParsedAt } = await this.chunkedTerminalWrite(
+          cachedBuffer,
+          TERMINAL_CHUNK_SIZE,
+          bufferLoadOwner
+        );
+        cacheResetAndParseMs = cacheParsedAt - cacheReplayStartedAt;
         if (this._isStaleSelect(selectGen)) {
           this._clearTerminalLoadState(sessionId, selectGen);
           return;
         }
         this.terminal.scrollToBottom();
         _crashDiag.log('CACHE_DONE');
-      } else if (sessionIsBusy) {
-        // Clear stale content immediately — fresh buffer is being fetched
+      } else if (sessionIsBusy || session?.mode === 'shell') {
+        // Busy sessions have stale caches. Shell sessions deliberately skip even
+        // an idle cache so a changed 1MB tail cannot cause two back-to-back parses.
         this._resetTerminalForReplay();
-        clearedForBusy = true;
-        _crashDiag.log('CACHE_SKIP_BUSY');
+        clearedBeforeFresh = true;
+        _crashDiag.log(session?.mode === 'shell' ? 'CACHE_SKIP_SHELL' : 'CACHE_SKIP_BUSY');
       }
 
       // Give TUI sessions a short chance to redraw after resize before the
@@ -5703,26 +5788,29 @@ class CodemanApp {
 
       this._setTerminalLoadState(sessionId, selectGen, 'fetching');
       _crashDiag.log('FETCH_START');
-      // The first load OF EACH SESSION this page load requests the full tmux
-      // scrollback (?full=1, COD-47) so history that scrolled off the server's byte
-      // buffer comes back. Later switches to an already-replayed session keep the
-      // fast ?tail= frame path, which is why this is a Set and not a flag: the flag
-      // version gave the full replay to the auto-selected tab and one frame of
-      // history to every other one (issue #205).
-      const useFullHistory = !this._fullHistoryLoaded.has(sessionId);
+      // TUI sessions still get one canonical full replay per page (COD-47/#205).
+      // A shell can retain hundreds of thousands of plain scrollback lines, so
+      // automatically replaying all of them makes tab selection scale with the
+      // entire session. Load its bounded 1MB tail first; the existing truncation
+      // banner action fetches ?full=1 when the user explicitly asks for it.
+      const useFullHistory = session?.mode !== 'shell' && !this._fullHistoryLoaded.has(sessionId);
       if (useFullHistory) this._fullHistoryLoaded.add(sessionId);
+      const fetchStartedAt = performance.now();
       const res = await fetch(
         useFullHistory
           ? `/api/sessions/${sessionId}/terminal?full=1`
           : `/api/sessions/${sessionId}/terminal?tail=${TERMINAL_TAIL_SIZE}`
       );
+      const headersReceivedAt = performance.now();
       if (this._isStaleSelect(selectGen)) {
         this._clearTerminalLoadState(sessionId, selectGen);
         return;
       }
       const data = (await res.json())?.data ?? {};
+      const bodyParsedAt = performance.now();
       _crashDiag.log(`FETCH_DONE: ${data.terminalBuffer ? (data.terminalBuffer.length/1024).toFixed(0) + 'KB' : 'empty'} truncated=${data.truncated}`);
 
+      let freshResetAndParseMs = 0;
       if (data.terminalBuffer) {
         // Skip rewrite if fresh buffer matches cache — avoids visible clear+rewrite flash.
         // On slow connections (mobile 5G), the gap between clear() and chunkedWrite() is
@@ -5731,10 +5819,11 @@ class CodemanApp {
         // something other than the cache, so the fetched buffer must be
         // replayed even when it byte-matches the cache.
         const needsRewrite =
-          restoredSnapshot || clearedForBusy || data.terminalBuffer !== cachedBuffer;
+          restoredSnapshot || clearedBeforeFresh || data.terminalBuffer !== cachedBuffer;
         if (needsRewrite) {
           _crashDiag.log(`REWRITE: ${(data.terminalBuffer.length/1024).toFixed(0)}KB`);
           this._setTerminalLoadState(sessionId, selectGen, 'replaying');
+          const replayStartedAt = performance.now();
           this._resetTerminalForReplay();
           // Truncation is reported OUT OF BAND (#258). This used to write a grey
           // "... earlier output truncated ..." line into the
@@ -5742,7 +5831,12 @@ class CodemanApp {
           // cannot be actioned, and is indistinguishable from real CLI output.
           this._setHistoryTruncation(sessionId, data);
           // Use chunked write for large buffers to avoid UI jank
-          await this.chunkedTerminalWrite(data.terminalBuffer, TERMINAL_CHUNK_SIZE, bufferLoadOwner);
+          const { parsedAt: freshParsedAt } = await this.chunkedTerminalWrite(
+            data.terminalBuffer,
+            TERMINAL_CHUNK_SIZE,
+            bufferLoadOwner
+          );
+          freshResetAndParseMs = freshParsedAt - replayStartedAt;
           if (this._isStaleSelect(selectGen)) {
             this._clearTerminalLoadState(sessionId, selectGen);
             return;
@@ -5751,22 +5845,42 @@ class CodemanApp {
           this.terminal.scrollToBottom();
         }
 
-        // Update cache (cap at 20 entries)
-        this.terminalBufferCache.set(sessionId, data.terminalBuffer);
-        if (this.terminalBufferCache.size > 20) {
-          // Evict oldest entry (first key in Map iteration order)
-          const oldest = this.terminalBufferCache.keys().next().value;
-          this.terminalBufferCache.delete(oldest);
+        // Shell selection always uses a fresh bounded tail, so retaining its
+        // payload only wastes memory and can evict useful TUI caches.
+        if (session?.mode === 'shell') {
+          this.terminalBufferCache.delete(sessionId);
+        } else {
+          // Update cache (cap at 20 entries)
+          this.terminalBufferCache.set(sessionId, data.terminalBuffer);
+          if (this.terminalBufferCache.size > 20) {
+            // Evict oldest entry (first key in Map iteration order)
+            const oldest = this.terminalBufferCache.keys().next().value;
+            this.terminalBufferCache.delete(oldest);
+          }
         }
-      } else if (!cachedBuffer) {
-        // No fresh buffer and no cache — clear any stale content
-        this._resetTerminalForReplay();
+      } else if (!cachedBuffer || clearedBeforeFresh) {
+        // Nothing was painted. If this path was not already cleared above,
+        // clear stale content now; either way queued live output must be flushed.
+        if (!clearedBeforeFresh) this._resetTerminalForReplay();
         bufferWasEmpty = true;
       }
 
+      const terminalLoadTiming = {
+        trigger: 'session-select',
+        mode: session?.mode || 'unknown',
+        full: useFullHistory,
+        source: data.source || 'unknown',
+        chars: data.terminalBuffer?.length || 0,
+        ttfbMs: headersReceivedAt - fetchStartedAt,
+        bodyAndJsonMs: bodyParsedAt - headersReceivedAt,
+        cacheResetAndParseMs,
+        freshResetAndParseMs,
+        selectToReplayCompleteMs: performance.now() - _selStart,
+        serverTiming: res.headers?.get?.('server-timing') || '',
+      };
       // Buffer load complete — unblock live SSE writes. chunkedTerminalWrite calls
-      // _finishBufferLoad internally (discarding queued events to prevent duplicate
-      // content); if we skipped the write (cache hit or empty), call it here.
+      // _finishBufferLoad after ordering the fetched snapshot in xterm; if we skipped
+      // the write (cache hit or empty), call it here.
       // COD-144: when the load painted nothing, FLUSH the queued events instead of
       // discarding — a new session's prompt arrives only as a queued SSE event.
       if (this._isLoadingBuffer) {
@@ -5895,9 +6009,12 @@ class CodemanApp {
       if (typeof KeyboardHandler !== 'undefined' && KeyboardHandler.keyboardVisible) {
         KeyboardHandler.onKeyboardShow();
       }
+      const selectDoneMs = performance.now() - _selStart;
+      terminalLoadTiming.selectDoneMs = selectDoneMs;
+      this._recordTerminalLoadTiming(terminalLoadTiming);
       this._clearTerminalLoadState(sessionId, selectGen);
-      _crashDiag.log(`SELECT_DONE: ${(performance.now() - _selStart).toFixed(0)}ms`);
-      console.log(`[CRASH-DIAG] selectSession DONE: ${sessionId.slice(0,8)} in ${(performance.now() - _selStart).toFixed(0)}ms`);
+      _crashDiag.log(`SELECT_DONE: ${selectDoneMs.toFixed(0)}ms`);
+      console.log(`[CRASH-DIAG] selectSession DONE: ${sessionId.slice(0,8)} in ${selectDoneMs.toFixed(0)}ms`);
     } catch (err) {
       if (this._isLoadingBuffer) this._finishBufferLoad(bufferLoadOwner);
       this._restoringFlushedState = false;

src/web/public/constants.js

@@ -527,6 +527,90 @@ function sortSessionsByActivity(rows) {
   return (Array.isArray(rows) ? rows.slice() : []).sort(compareSessionActivity);
 }
 
+// Terminal font stack — the single source for every xterm surface (the main
+// terminal in terminal-ui.js, the log-viewer terminal in panels-ui.js).
+// "Symbols Nerd Font Mono" is a bundled icons-only webfont (fonts/ +
+// @font-face in styles.css): browsers fall back PER GLYPH, so Nerd Font
+// prompt icons (powerline segments, folder/git glyphs from p10k, starship,
+// oh-my-posh) render even though the text fonts carry no private-use-area
+// symbols — while all readable text keeps coming from the text fonts.
+const TERMINAL_FONT_DEFAULT_STACK =
+  '"Fira Code", "Cascadia Code", "JetBrains Mono", "SF Mono", Monaco, "Symbols Nerd Font Mono", monospace';
+
+/**
+ * Resolve the xterm fontFamily from the per-device `terminalFontFamily`
+ * setting. A user-set family (or comma-separated list) is PREPENDED to the
+ * built-in stack, never a replacement — the symbols fallback and a final
+ * `monospace` must survive whatever the user types. Blank input yields the
+ * default. Unquoted names that need quoting for CSS (spaces, digits leading,
+ * etc.) are quoted; embedded quotes are stripped rather than escaped, since
+ * a font name cannot contain them anyway.
+ */
+function resolveTerminalFontFamily(custom) {
+  const raw = typeof custom === 'string' ? custom.trim() : '';
+  if (!raw) return TERMINAL_FONT_DEFAULT_STACK;
+  const families = raw
+    .split(',')
+    .map((f) => f.trim().replace(/^["']|["']$/g, '').replace(/["']/g, '').trim())
+    .filter(Boolean)
+    // Drop generic families the user may append — the default stack already
+    // ends in `monospace`, and a duplicate earlier entry would shadow the
+    // symbols fallback behind it.
+    .filter((f) => !/^(monospace|serif|sans-serif|system-ui)$/i.test(f))
+    .map((f) => (/^[A-Za-z][A-Za-z0-9-]*$/.test(f) ? f : `"${f}"`));
+  if (!families.length) return TERMINAL_FONT_DEFAULT_STACK;
+  return `${families.join(', ')}, ${TERMINAL_FONT_DEFAULT_STACK}`;
+}
+
+// ---------------------------------------------------------------------------
+// Auto Copy (copy-on-select). Pure decision, so every guard below is testable
+// without a terminal, a clipboard, or a browser.
+// ---------------------------------------------------------------------------
+
+/**
+ * Upper bound on an AUTO-copied selection.
+ *
+ * A drag that runs off the top of the viewport autoscrolls, so one gesture can
+ * sweep the entire 50k-line scrollback (millions of characters), and writing
+ * that to the clipboard on every mouseup is a real hazard on a phone. Past the
+ * cap the copy is REFUSED rather than truncated (half a selection on the
+ * clipboard is worse than none) and the user is told to press Ctrl+C, which
+ * still copies the whole thing through the explicit path.
+ */
+const AUTO_COPY_MAX_CHARS = 1_000_000;
+
+/**
+ * What an auto-copy attempt should do at the end of a selection gesture.
+ *
+ * `pending` is set by xterm's onSelectionChange and cleared on every flush;
+ * `lastCopied` is the text this surface auto-copied last. Either one alone is
+ * wrong, which is why both are here:
+ *
+ *  - onSelectionChange does not reliably fire BEFORE the mouseup that ends the
+ *    drag (xterm fires it from its own document-level mouseup handler, and
+ *    listener order between the two is registration order, not something this
+ *    code controls). Gating on `pending` alone would silently drop the first
+ *    copy of a drag-selection.
+ *  - Gating on `text !== lastCopied` alone drops a deliberate re-selection of
+ *    the same text after the user copied something else in between, and it
+ *    would let any unrelated mouseup on the page re-copy a stale selection.
+ *
+ * So: a genuine selection change (`pending`) always copies, and otherwise only
+ * text that differs from the last auto-copy does.
+ *
+ * @param {{enabled?: boolean, text?: string, lastCopied?: string, pending?: boolean}} params
+ * @returns {'copy'|'skip'|'too-large'}
+ */
+function decideAutoCopy({ enabled, text, lastCopied, pending } = {}) {
+  if (!enabled) return 'skip';
+  // Whitespace-only is what a drag across blank cells produces; putting a wall
+  // of spaces on the clipboard is never what the gesture meant.
+  if (typeof text !== 'string' || !text.trim()) return 'skip';
+  if (!pending && text === lastCopied) return 'skip';
+  if (text.length > AUTO_COPY_MAX_CHARS) return 'too-large';
+  return 'copy';
+}
+
 if (typeof window !== 'undefined') {
   window.WEBGL_FALLBACK = WEBGL_FALLBACK;
   window.evaluateWebGLLongTaskTrip = evaluateWebGLLongTaskTrip;
@@ -560,6 +644,14 @@ if (typeof window !== 'undefined') {
     compare: compareSessionActivity,
     sort: sortSessionsByActivity,
   };
+  window.CodemanAutoCopy = {
+    decide: decideAutoCopy,
+    MAX_CHARS: AUTO_COPY_MAX_CHARS,
+  };
+  window.CodemanTerminalFont = {
+    DEFAULT_STACK: TERMINAL_FONT_DEFAULT_STACK,
+    resolve: resolveTerminalFontFamily,
+  };
 }
 
 // Scheduler API — prioritize terminal writes over background UI updates.
@@ -1035,7 +1127,112 @@ function previewsInFileViewer(filePath) {
   return FILE_PREVIEW_EXTENSIONS.has(ext);
 }
 
+
+/**
+ * The LOGICAL line a terminal row belongs to — the rows it spans, its text as one
+ * string, and a two-way map between that string and terminal cells.
+ *
+ * One definition, two consumers: the link provider matches its patterns over this
+ * text (`registerFilePathLinkProvider`) and touch selection measures words and
+ * whole lines with it (`_touchSelectionLogicalLine`). They MUST agree — a link that
+ * spans a wrap and a "Line" that stops at the screen edge is the same bug twice.
+ *
+ * Two kinds of continuation, and handling only the first is not enough:
+ *
+ *   1. **Soft wrap** — the emulator ran out of columns and flags the next row
+ *      `isWrapped`. It inserts nothing, so the row's text is joined verbatim.
+ *   2. **Hard wrap** — the program wrapped the text itself and emitted a real
+ *      newline, so nothing is flagged. A row that fills the last column is taken
+ *      as continuing into the next; that is the only trace a hard wrap leaves.
+ *
+ * ⚠️ A hard-wrapped continuation may carry the program's own INDENT, and joining
+ * that verbatim puts whitespace in the middle of the token being stitched. That is
+ * why an agent's numbered list —
+ *
+ *     1. https://github.com/users/someone/packages/container/p
+ *        ackage/thing
+ *
+ * — opened only `…/container/p`: the URL pattern stops at the space the indent
+ * contributed. So the leading whitespace of a HARD continuation is dropped, and
+ * `colStart` on that segment records how much, keeping the cell mapping exact. A
+ * soft continuation keeps its leading whitespace, since the terminal never adds
+ * any and it is therefore real content.
+ *
+ * ⚠️ Only the final row is trimmed. Continuation rows are read UNTRIMMED so each
+ * contributes exactly `cols` cells; trimming one would shift every later offset.
+ *
+ * The row span is bounded by `maxRows` (12 by default): this runs on every hover,
+ * and a screenful of full-width output would otherwise re-scan the viewport each
+ * time.
+ *
+ * @param {{getLine: (row: number) => any, length: number}} buffer xterm buffer.
+ * @param {number} row 0-based ABSOLUTE buffer row to expand around.
+ * @param {number} cols Terminal width.
+ * @param {number} [maxRows] Row-span bound.
+ * @returns {{startRow: number, endRow: number, text: string,
+ *            offsetToCell: (offset: number) => {row: number, col: number},
+ *            cellToOffset: (row: number, col: number) => number} | null}
+ *          0-based rows and columns throughout; null when the row does not exist.
+ */
+function terminalLogicalLine(buffer, row, cols, maxRows) {
+  if (!buffer || typeof buffer.getLine !== 'function') return null;
+  const width = Math.max(1, cols || 1);
+  const bound = Math.max(1, maxRows || 12);
+  const lineAt = (r) => (r >= 0 ? buffer.getLine(r) : undefined);
+  if (!lineAt(row)) return null;
+
+  const continuesPrevious = (r) => {
+    if (r <= 0) return false;
+    if (lineAt(r)?.isWrapped) return true;
+    const prev = lineAt(r - 1);
+    return !!prev && (prev.translateToString(true) || '').length >= width;
+  };
+
+  let startRow = row;
+  while (startRow > 0 && row - startRow < bound && continuesPrevious(startRow)) startRow--;
+  let endRow = row;
+  const length = Number.isFinite(buffer.length) ? buffer.length : endRow + 1;
+  while (endRow + 1 < length && endRow - startRow < bound && continuesPrevious(endRow + 1)) endRow++;
+
+  const segments = [];
+  let text = '';
+  for (let r = startRow; r <= endRow; r++) {
+    const line = lineAt(r);
+    if (!line) break;
+    let rowText = line.translateToString(r === endRow) || '';
+    let colStart = 0;
+    if (r > startRow && !line.isWrapped) {
+      const indent = rowText.length - rowText.replace(/^\s+/, '').length;
+      colStart = indent;
+      rowText = rowText.slice(indent);
+    }
+    segments.push({ row: r, textStart: text.length, colStart, length: rowText.length });
+    text += rowText;
+  }
+
+  const offsetToCell = (offset) => {
+    for (let i = segments.length - 1; i >= 0; i--) {
+      const seg = segments[i];
+      if (offset >= seg.textStart || i === 0) {
+        return { row: seg.row, col: seg.colStart + (offset - seg.textStart) };
+      }
+    }
+    return { row: startRow, col: offset };
+  };
+
+  const cellToOffset = (targetRow, targetCol) => {
+    for (const seg of segments) {
+      if (seg.row !== targetRow) continue;
+      return seg.textStart + Math.max(0, targetCol - seg.colStart);
+    }
+    return -1;
+  };
+
+  return { startRow, endRow, text, offsetToCell, cellToOffset };
+}
+
 if (typeof window !== 'undefined') {
   window.CodemanHistoryFormat = { formatHistoryBytes, computeHistoryTruncationNotice, computeRewriteScrollLine };
   window.CodemanFilePaths = { absoluteFilePathPattern, previewsInFileViewer, FILE_PREVIEW_EXTENSIONS };
+  window.CodemanTerminalLines = { terminalLogicalLine };
 }

src/web/public/fonts/LICENSE-nerd-fonts.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Ryan L McIntyre
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/web/public/i18n.js

@@ -326,11 +326,20 @@
 
     // Input settings
     Input: '输入',
+    Font: '字体',
+    'Terminal font': '终端字体',
+    'Prepended to the built-in stack, so fallbacks (including bundled Nerd Font symbols) keep working. Must be installed on this device. Leave empty for the default.':
+      '置于内置字体栈之前，回退字体（包括内置的 Nerd Font 图标）仍然生效。需已安装在本设备上。留空使用默认值。',
     'Local Echo': '本地回显',
     'CJK Input': '中日韩输入',
     'Extended Keyboard Bar': '扩展键盘栏',
     'Gesture Control (beta)': '手势控制（测试版）',
     'Wheel Scrolls Local History': '滚轮滚动本地历史',
+    'Auto Copy Selection': '自动复制选中内容',
+    'Selection & clipboard': '选中与剪贴板',
+    'Auto Copy: selection copied': '自动复制：已复制选中内容',
+    'Auto Copy failed: the browser blocked clipboard access': '自动复制失败：浏览器阻止了剪贴板访问',
+    'Selection too large to copy automatically. Press Ctrl+C.': '选中内容过大，无法自动复制。请按 Ctrl+C。',
     'Instant typing feedback with local echo': '通过本地回显即时显示输入',
     'Dedicated IME input field for CJK languages': '为中日韩语言提供专用输入法文本框',
     'Extra keys: Tab, Esc, arrows, Ctrl+O': '附加按键：Tab、Esc、方向键、Ctrl+O',
@@ -500,6 +509,11 @@
     'Respawn Blocked': '重生已阻止',
     'Task Complete': '任务完成',
     'Copied to clipboard': '已复制到剪贴板',
+    // Terminal touch-selection bar (long-press to select). The bar is a sibling of
+    // `.xterm`, not a descendant, so SKIP_SELECTOR does not cover it and these apply.
+    Copy: '复制',
+    Line: '整行',
+    'Clear selection': '清除选择',
     'Failed to copy': '复制失败',
     'Checking…': '正在检查…',
     'Starting…': '正在启动…',

src/web/public/index.html

@@ -24,6 +24,9 @@
   <!-- Preload critical resources — lets browser discover these during HTML parse
        instead of waiting until <script> tags at bottom-of-body are reached. -->
   <link rel="preload" href="vendor/xterm.min.js" as="script">
+  <!-- Symbols font before the terminal first paints — a late-loading icon font
+       leaves tofu in xterm's glyph atlas until something forces a re-render. -->
+  <link rel="preload" href="fonts/symbols-nerd-font-mono.woff2" as="font" type="font/woff2" crossorigin>
   <link rel="preload" href="constants.js" as="script">
   <link rel="preload" href="app.js" as="script">
   <!-- Self-hosted xterm.js — eliminates CDN DNS/TLS latency (~100ms).
@@ -1624,6 +1627,32 @@
                 </div>
               </div>
 
+              <div class="set-group">
+                <div class="set-group-head"><h4>Selection &amp; clipboard</h4><span class="set-scope">device</span></div>
+                <div class="set-group-body">
+                  <div class="set-row" data-search="auto copy selection clipboard highlight copy on select mouse">
+                    <div class="set-row-text">
+                      <span class="set-row-label">Auto Copy Selection</span>
+                      <span class="set-row-desc">Put highlighted terminal text on the clipboard as soon as you finish selecting it, with mouse, double-click or long-press. Ctrl+C still copies on demand, and nothing outside the terminal is copied.</span>
+                    </div>
+                    <label class="switch switch-sm"><input type="checkbox" id="appSettingsAutoCopySelection"><span class="slider"></span></label>
+                  </div>
+                </div>
+              </div>
+
+              <div class="set-group">
+                <div class="set-group-head"><h4>Font</h4><span class="set-scope">device</span></div>
+                <div class="set-group-body">
+                  <div class="set-row has-field" data-search="terminal font family nerd custom typeface">
+                    <div class="set-row-text">
+                      <span class="set-row-label">Terminal font</span>
+                      <span class="set-row-desc">Prepended to the built-in stack, so fallbacks (including bundled Nerd Font symbols) keep working. Must be installed on this device. Leave empty for the default.</span>
+                    </div>
+                    <input type="text" id="appSettingsTerminalFont" class="set-input" placeholder='e.g. JetBrainsMono Nerd Font'>
+                  </div>
+                </div>
+              </div>
+
               <div class="set-group">
                 <div class="set-group-head"><h4>Scrolling &amp; rendering</h4></div>
                 <div class="set-group-body">

src/web/public/input-cjk.js

@@ -27,8 +27,8 @@
  *
  * Solution: outside composition, flush is DEBOUNCED (200ms). The entire
  * delete→reinsert cycle collapses into one flush of the final textarea value.
- * Keyboard typing of single printable characters still goes through the
- * keydown handler (immediate, no debounce).
+ * Physical-keyboard commits are flushed immediately after the input event
+ * exposes the final browser/IME text; keydown never guesses that text.
  *
  * ## Phantom character for Android backspace
  *
@@ -56,8 +56,7 @@ const CjkInput = (() => {
   let _compositionFlushTimer = null;
   let _dictationActive = false;
   let _dictationDecayTimer = null;
-  let _keydownSentAt = 0;
-  let _keydownSentText = '';
+  let _printableKeydownAt = null;
   const _listeners = {};
 
   const PHANTOM = '​';
@@ -197,6 +196,7 @@ const CjkInput = (() => {
 
       _send = send;
       _composing = false;
+      _printableKeydownAt = null;
       _flushTimer = null;
       _textarea = document.getElementById('cjkInput');
       if (!_textarea) return this;
@@ -234,6 +234,7 @@ const CjkInput = (() => {
       };
       _listeners.blur = () => {
         _t(`blur composing=${_composing} ${_vdesc(_textarea.value)}`);
+        _printableKeydownAt = null;
         // Keep cjkActive while CJK input is visible — iOS dictation and system
         // UI may steal focus temporarily, and clearing the flag during that
         // window lets xterm's onData process duplicated input.
@@ -253,6 +254,7 @@ const CjkInput = (() => {
       _listeners.compositionstart = () => {
         _t(`compstart ${_vdesc(_textarea.value)}`);
         _composing = true;
+        _printableKeydownAt = null;
         _cancelDebouncedFlush();
         // Leave textarea.value untouched — programmatic changes during
         // compositionstart cancel the IME composition on iOS Safari.
@@ -277,6 +279,7 @@ const CjkInput = (() => {
       // ── Keydown: special keys work REGARDLESS of composition state ──
       _listeners.keydown = (e) => {
         _t(`keydown ${_kdesc(e.key)} kc=${e.keyCode} ic=${e.isComposing} c=${_composing}`);
+        _printableKeydownAt = null;
         if (e.key === 'Enter') {
           e.preventDefault();
           _composing = false;
@@ -325,16 +328,11 @@ const CjkInput = (() => {
           return;
         }
 
-        // Single printable character: send immediately to PTY.
-        // Third-party IMEs on iOS may ignore preventDefault, so the char
-        // still enters the textarea and fires an input event — _keydownSentAt
-        // tells the input handler to skip that echo.
+        // A printable KeyboardEvent.key is the physical key, not necessarily
+        // the committed text. Let the browser/IME produce the input event so
+        // full-width punctuation and other layout transforms are preserved.
         if (e.key.length === 1 && !e.ctrlKey && !e.altKey && !e.metaKey && _isEffectivelyEmpty()) {
-          e.preventDefault();
-          _send(e.key);
-          _keydownSentAt = performance.now();
-          _keydownSentText = e.key;
-          _resetToPhantom();
+          _printableKeydownAt = performance.now();
           return;
         }
       };
@@ -343,6 +341,8 @@ const CjkInput = (() => {
       // ── Input event: primary path for virtual keyboards + dictation ──
       _listeners.input = (e) => {
         _t(`input ${e.inputType || '?'} ic=${e.isComposing} c=${_composing} ${_vdesc(_textarea.value)}`);
+        const printableKeydownAt = _printableKeydownAt;
+        _printableKeydownAt = null;
         // ── Stuck-composition recovery ──
         // Some IMEs (WeChat/Sogou keyboards) fire compositionstart without a
         // matching compositionend. A stale _composing=true blocks every flush
@@ -388,18 +388,18 @@ const CjkInput = (() => {
 
         if (_composing) return;
 
-        // Keydown handler already sent this character — clear the textarea
-        // echo that the IME inserted despite preventDefault. Content-checked:
-        // only a value matching the sent char is an echo. Anything else (e.g.
-        // an IME committing CJK text right after a keydown-sent char) is real
-        // input and must flow through to the debounced flush, not be dropped.
-        if (performance.now() - _keydownSentAt < 100) {
-          const cur = _strip(_textarea.value);
-          if (cur === '' || cur === _keydownSentText) {
-            _t('echo-drop');
-            _resetToPhantom();
-            return;
-          }
+        // A recent physical printable key makes this insertText a keyboard
+        // commit, so keep the old zero-latency path. Send the textarea's final
+        // Unicode value, never KeyboardEvent.key, because the IME may have
+        // transformed punctuation or the active layout may differ.
+        if (
+          e.inputType === 'insertText' &&
+          printableKeydownAt !== null &&
+          performance.now() - printableKeydownAt < 100
+        ) {
+          _cancelDebouncedFlush();
+          _flush();
+          return;
         }
 
         // Outside composition: keyboard typing or voice dictation.
@@ -425,6 +425,7 @@ const CjkInput = (() => {
       clearTimeout(_compositionFlushTimer);
       _compositionFlushTimer = null;
       _composing = false;
+      _printableKeydownAt = null;
       _resetToPhantom();
     },
 
@@ -446,6 +447,7 @@ const CjkInput = (() => {
       }
       window.cjkActive = false;
       _composing = false;
+      _printableKeydownAt = null;
       for (const key of Object.keys(_listeners)) delete _listeners[key];
       _initialized = false;
     },

src/web/public/mobile-handlers.js

@@ -573,6 +573,42 @@ const KeyboardHandler = {
    * space below the last row. After fitAddon.fit(), measure the gap and
    * reduce padding by that amount so the terminal sits flush against the bars.
    */
+  /**
+   * Combined height of the fixed bars that overlay the terminal's bottom edge.
+   *
+   * On phones the toolbar and the accessory bar are `position: fixed`, so they
+   * occupy no layout space of their own — `main`'s padding-bottom is the only
+   * thing reserving room for them, and any pixel taken out of it is a pixel of
+   * terminal painted underneath them.
+   */
+  _fixedBottomBarsHeight() {
+    let px = 0;
+    for (const selector of ['.toolbar', '.keyboard-accessory-bar', '#cjkInput.cjk-input-visible']) {
+      const el = document.querySelector(selector);
+      if (!el) continue;
+      const style = window.getComputedStyle?.(el);
+      if (style && (style.display === 'none' || style.visibility === 'hidden')) continue;
+      px += el.offsetHeight || 0;
+    }
+    return px;
+  },
+
+  /**
+   * Reclaim sub-row slack at the bottom of the terminal — but never the space the
+   * fixed bars stand in.
+   *
+   * Shrinking the padding by the whole slack pulled the terminal's bottom edge
+   * DOWN under those bars, and the row the following re-fit then gained was
+   * painted behind them: on a long wrapped prompt the last line was clipped by
+   * the accessory bar, i.e. the bottom half of the text being typed. The floor is
+   * now the bars' MEASURED height, so a device where the hard-coded 84px
+   * over-reserves still reclaims the difference, while one that genuinely needs
+   * it keeps every pixel.
+   *
+   * ⚠️ The floor can only ever prevent a shrink, never cause a grow
+   * (`Math.min(currentPadding, …)`): a measured height LARGER than the current
+   * padding makes this a no-op rather than silently resizing the terminal.
+   */
   _shrinkPaddingToFit() {
     try {
       const container = document.getElementById('terminalContainer');
@@ -583,7 +619,8 @@ const KeyboardHandler = {
       const gap = container.clientHeight - app.terminal.rows * cellH;
       if (gap > 0 && gap < cellH) {
         const currentPadding = parseInt(main.style.paddingBottom) || 0;
-        main.style.paddingBottom = Math.max(0, currentPadding - gap) + 'px';
+        const floor = Math.min(currentPadding, this._fixedBottomBarsHeight());
+        main.style.paddingBottom = Math.max(floor, currentPadding - gap) + 'px';
         if (app.fitAddon)
           try {
             app.fitAddon.fit();

src/web/public/panels-ui.js

@@ -2279,7 +2279,7 @@ Object.assign(CodemanApp.prototype, {
       const terminal = new Terminal({
         theme: { ...window.codemanCurrentXtermTheme() },
         minimumContrastRatio: window.codemanCurrentSkinIsLight() ? 4.5 : 1,
-        fontFamily: '"Fira Code", "Cascadia Code", "JetBrains Mono", "SF Mono", Monaco, monospace',
+        fontFamily: window.CodemanTerminalFont.resolve(this.loadAppSettingsFromStorage?.().terminalFontFamily),
         fontSize: 12,
         lineHeight: 1.2,
         cursorBlink: true,

src/web/public/settings-ui.js

@@ -41,8 +41,17 @@ Object.assign(CodemanApp.prototype, {
   _onHookElicitationComplete(data) {
     // Question answered in the terminal: clear the action alert without
     // waiting for `stop` (the turn may keep running for a long time).
+    // ⚠️ BOTH action kinds, matching the server's APPROVAL_RESOLVING_EVENTS,
+    // which resolves a session's pending item whatever its kind. An
+    // AskUserQuestion dialog arrives as `permission_prompt` (only MCP
+    // elicitation is `elicitation_dialog`), so clearing just the elicitation
+    // entry left the red alert armed on exactly the dialog these events are
+    // most often about. Normally the server's `approval:resolved` broadcast
+    // clears it too; this is the path that still works when the store holds no
+    // item for the session (restart, superseded).
     if (data.sessionId) {
       this.clearPendingHooks(data.sessionId, 'elicitation_dialog');
+      this.clearPendingHooks(data.sessionId, 'permission_prompt');
     }
   },
 
@@ -381,6 +390,11 @@ Object.assign(CodemanApp.prototype, {
     document.getElementById('appSettingsTunnelEnabled').checked = settings.tunnelEnabled ?? false;
     this.loadTunnelStatus();
     document.getElementById('appSettingsLocalEcho').checked = settings.localEchoEnabled ?? MobileDetection.isTouchDevice();
+    // Auto Copy (copy-on-select): per-device, default OFF everywhere. It quietly
+    // overwrites the system clipboard on a gesture the user may have meant only as
+    // a way to read, so it is opt-in rather than a default anyone has to discover.
+    document.getElementById('appSettingsAutoCopySelection').checked = settings.autoCopySelection === true;
+    document.getElementById('appSettingsTerminalFont').value = settings.terminalFontFamily || '';
     document.getElementById('appSettingsTerminalWheelLocal').checked =
       settings.terminalWheelLocalScrollback ?? defaults.terminalWheelLocalScrollback ?? false;
     document.getElementById('appSettingsCjkInput').checked = settings.cjkInputEnabled ?? defaults.cjkInputEnabled ?? false;
@@ -2006,6 +2020,8 @@ Object.assign(CodemanApp.prototype, {
       imageWatcherEnabled: document.getElementById('appSettingsImageWatcherEnabled').checked,
       tunnelEnabled: document.getElementById('appSettingsTunnelEnabled').checked,
       localEchoEnabled: document.getElementById('appSettingsLocalEcho').checked,
+      autoCopySelection: document.getElementById('appSettingsAutoCopySelection').checked,
+      terminalFontFamily: document.getElementById('appSettingsTerminalFont').value.trim(),
       terminalWheelLocalScrollback: document.getElementById('appSettingsTerminalWheelLocal').checked,
       cjkInputEnabled: document.getElementById('appSettingsCjkInput').checked,
       webglRendererEnabled: document.getElementById('appSettingsWebglRenderer').checked,
@@ -2052,6 +2068,7 @@ Object.assign(CodemanApp.prototype, {
     // Save to localStorage
     this.saveAppSettingsToStorage(settings);
     this._updateLocalEchoState();
+    this.applyTerminalFontFamily?.(settings.terminalFontFamily);
 
     // A real OFF→ON flip of the WebGL toggle retires the GPU-stall auto-fallback
     // marker so the next reload actually re-tries WebGL. Only the transition
@@ -2200,6 +2217,14 @@ Object.assign(CodemanApp.prototype, {
       showFileViewerButton: _fvb,
       webglRendererEnabled: _wgl,
       terminalWheelLocalScrollback: _twls,
+      // Copy-on-select. Per-device (clipboard access differs by device and by
+      // origin: the plain-HTTP LAN install has no navigator.clipboard at all)
+      // and absent from SettingsUpdateSchema (.strict()), so sending it would
+      // 400 the whole settings PUT.
+      autoCopySelection: _acs,
+      // Per-device by nature (the font must exist on the device) and absent
+      // from SettingsUpdateSchema (.strict()) — sending it would 400 the PUT.
+      terminalFontFamily: _tff,
       // Per-device header/toolbar button toggles — client-only, and absent from
       // SettingsUpdateSchema (.strict()), so sending them would 400 the PUT.
       showSessionButton: _ssb,
@@ -2874,8 +2899,10 @@ Object.assign(CodemanApp.prototype, {
           'showMonitor', 'showProjectInsights', 'showFileBrowser', 'showSubagents',
           'subagentActiveTabOnly', 'tabTwoRows', 'sessionListLayout', 'localEchoEnabled', 'cjkInputEnabled', 'extendedKeyboardBar',
           'skin', 'showPlanUsageLimits', 'showAttachmentsButton', 'showFileViewerButton', 'webglRendererEnabled',
+          'terminalFontFamily',
           'language',
           'terminalWheelLocalScrollback',
+          'autoCopySelection',
           'showSessionButton', 'showAwayDigestButton', 'showCronButton',
           'showTabDetachButton',
           'mobileOverviewEnabled',

src/web/public/styles.css

@@ -16,6 +16,19 @@
   font-weight: 400 700;
   src: url('fonts/jetbrains-mono-variable.woff2') format('woff2');
 }
+/* Icons-only per-glyph fallback for the terminal (Symbols Nerd Font Mono, MIT,
+   fonts/LICENSE-nerd-fonts.txt). Sits BEHIND the text fonts in the xterm stack
+   (constants.js: TERMINAL_FONT_DEFAULT_STACK), so it only ever supplies the
+   private-use-area glyphs shell prompts draw (powerline, p10k/starship folder
+   and git icons) — text rendering is untouched. `block` display, not `swap`:
+   there is no fallback that CAN render these glyphs, so swapping in tofu first
+   would poison xterm's glyph atlas until the next re-render. */
+@font-face {
+  font-family: 'Symbols Nerd Font Mono';
+  font-style: normal;
+  font-display: block;
+  src: url('fonts/symbols-nerd-font-mono.woff2') format('woff2');
+}
 
 :root {
   /* Dark is the safe fallback. Light skins override this so native selects,
@@ -3395,6 +3408,57 @@ body.touch-device .terminal-container .xterm .xterm-helper-textarea {
   -webkit-touch-callout: none !important;
 }
 
+/* Touch text-selection bar (long-press → select → Copy).
+   Lives in styles.css, NOT mobile.css: the gesture is touch-driven, not
+   width-driven, and mobile.css is media-gated to ≤1023px — a touch tablet in
+   landscape would get the gesture with no bar to copy from.
+   Built in JS (index.html is read once at server start, so markup added there
+   would need a restart to appear). z-index 900 sits above terminal content and
+   the local-echo overlay (7) and deliberately BELOW floating agent windows
+   (1000), so it can never cover their controls. */
+.term-select-bar {
+  position: absolute;
+  z-index: 900;
+  display: none;
+  gap: 2px;
+  padding: 3px;
+  background: var(--bg-card);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  box-shadow: 0 4px 14px rgba(0, 0, 0, 0.45);
+}
+
+.term-select-bar.visible {
+  display: flex;
+}
+
+.term-select-btn {
+  min-height: 38px;
+  min-width: 46px;
+  padding: 0 0.7rem;
+  border: none;
+  border-radius: 6px;
+  background: transparent;
+  color: var(--text);
+  font-family: inherit;
+  font-size: 0.82rem;
+  font-weight: 600;
+  cursor: pointer;
+  /* The bar is the one place in the terminal subtree a tap must land on a
+     control rather than a cell, so it opts out of the gesture styles above. */
+  touch-action: manipulation;
+}
+
+.term-select-btn:active {
+  background: var(--bg-hover);
+}
+
+.term-select-btn--close {
+  min-width: 38px;
+  padding: 0;
+  color: var(--text-muted);
+}
+
 /* Welcome Overlay */
 .welcome-overlay {
   position: absolute;

src/web/repo-status.ts

@@ -0,0 +1,397 @@
+/**
+ * @fileoverview Repository-status check (App Settings → Updates → "Repository
+ * status").
+ *
+ * INFORMATIONAL companion to the release-tag self-updater (`self-update.ts`).
+ * Where the updater answers "is there a newer published release tag, and do you
+ * want to `git checkout` it", this module answers "where does my local checkout
+ * sit relative to the upstream project AND my own fork" — by commit ahead/behind
+ * count plus a short list of the incoming commits.
+ *
+ * This needs the actual commits locally, so it does a READ-ONLY `git fetch` of
+ * the compared ref per remote (updates only remote-tracking refs under `.git`,
+ * never the working tree), then `git rev-list`/`git log`. Works uniformly for
+ * GitHub and non-GitHub remotes (e.g. Bitbucket) — no release tags required.
+ *
+ * Remote selection (generalizable): by default the union of `origin` and the
+ * current branch's `@{upstream}` tracking remote, deduped. Override with the
+ * `CODEMAN_UPDATE_REMOTES` env var (comma-separated remote names) for any other
+ * layout (e.g. the common `origin`=fork / `upstream`=canonical convention).
+ *
+ * Split PURE helpers (parsing + remote-set/role/compare-ref decisions, unit
+ * tested) from the IO wrapper `getRepositoryStatus()` (touches git).
+ *
+ * PERFORMANCE: every git invocation is ASYNC (`execFile`), never `execFileSync`
+ * — the fetch path can spend `2 × FETCH_TIMEOUT_MS` per remote on the network,
+ * and a synchronous version froze the whole event loop (SSE, PTY streaming) for
+ * up to a minute per request. The computation is additionally single-flight
+ * with a short TTL cache: concurrent requests share one in-flight promise, and
+ * a fresh-enough result is served without spawning git at all.
+ *
+ * SECURITY: remote URLs (and git stderr echoing them) can embed
+ * `scheme://user:token@host` credentials, so every `url`/`error` field is
+ * passed through `redactGitCredentials()` (shared with `git-clone.ts`) before
+ * it reaches a client.
+ *
+ * @module web/repo-status
+ */
+
+import { execFile } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { promisify } from 'node:util';
+import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js';
+import { gitNonInteractiveEnv, redactGitCredentials } from '../git-clone.js';
+import { getInstallInfo } from './self-update.js';
+import type { RepoIncomingCommit, RepoRemoteRole, RepoRemoteStatus, RepositoryStatusResult } from '../types/update.js';
+
+const require = createRequire(import.meta.url);
+const { version: APP_VERSION } = require('../../package.json') as { version: string };
+const execFileAsync = promisify(execFile);
+
+/** Network/git timeout for the fetch path (longer than EXEC_TIMEOUT_MS — hits network). */
+const FETCH_TIMEOUT_MS = 15_000;
+/** Max incoming commit subjects to list per remote. */
+const MAX_INCOMING = 10;
+/** Fresh-enough window for a cached status — repeated UI polls reuse it instead of re-running git. */
+const STATUS_CACHE_TTL_MS = 45_000;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// PURE helpers (unit tested, no IO)
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Parse `git rev-list --left-right --count HEAD...<ref>` output.
+ * Git prints two tab-separated counts: LEFT (commits in HEAD not in ref → ahead)
+ * and RIGHT (commits in ref not in HEAD → behind). Returns null on malformed input.
+ */
+export function parseAheadBehind(out: string): { ahead: number; behind: number } | null {
+  const m = out.trim().match(/^(\d+)\s+(\d+)$/);
+  if (!m) return null;
+  return { ahead: parseInt(m[1], 10), behind: parseInt(m[2], 10) };
+}
+
+/**
+ * Parse `git log --oneline` output into commits. Each non-empty line is
+ * `<sha> <subject>`; the first whitespace-delimited token is the SHA.
+ */
+export function parseLogLines(out: string): RepoIncomingCommit[] {
+  const commits: RepoIncomingCommit[] = [];
+  for (const line of out.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf(' ');
+    if (idx === -1) {
+      commits.push({ sha: trimmed, subject: '' });
+    } else {
+      commits.push({ sha: trimmed.slice(0, idx), subject: trimmed.slice(idx + 1).trim() });
+    }
+  }
+  return commits;
+}
+
+/**
+ * Extract the default branch name from `git ls-remote --symref <remote> HEAD`
+ * output (a line like `ref: refs/heads/master\tHEAD`). Returns null if absent.
+ *
+ * SECURITY: this parses UNTRUSTED remote output, and the result flows into a
+ * later `git fetch <remote> <branch>` positional. The capture is constrained to
+ * start with an alphanumeric (no leading `-`) so a hostile remote can't return
+ * `ref: refs/heads/--upload-pack=<cmd>\tHEAD` and smuggle an argv flag (RCE) —
+ * see `isSafeGitPositional` for the defense-in-depth re-check at the call site.
+ */
+export function parseSymrefDefaultBranch(out: string): string | null {
+  const m = out.match(/^ref:\s+refs\/heads\/([A-Za-z0-9_./][A-Za-z0-9_./+-]*)\s+HEAD$/m);
+  return m ? m[1] : null;
+}
+
+/**
+ * Reject a value that would be unsafe as a git positional argument (remote name
+ * or branch). A leading `-` lets untrusted ls-remote/symref output or a stray
+ * `CODEMAN_UPDATE_REMOTES` entry inject an option (e.g. `--upload-pack=<cmd>`)
+ * into a subsequent `git fetch`. Empty values are rejected too.
+ */
+export function isSafeGitPositional(value: string | null | undefined): value is string {
+  return typeof value === 'string' && value.length > 0 && !value.startsWith('-');
+}
+
+/** Split a comma-separated env value into trimmed, non-empty names. */
+export function parseRemotesEnv(value: string | null | undefined): string[] {
+  if (!value) return [];
+  return value
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+/**
+ * Decide which remote NAMES the status view covers, in display order.
+ *
+ * - If `envRemotes` is non-empty, use exactly those that actually exist (order
+ *   preserved). This is the full-control escape hatch.
+ * - Otherwise the union of `origin` (if it exists) and the tracking remote (if
+ *   any), deduped. The tracking remote is listed first when it isn't `origin`,
+ *   so "your fork" leads and "upstream" follows.
+ */
+export function resolveRemoteSet(opts: {
+  existingRemotes: string[];
+  trackingRemote: string | null;
+  envRemotes: string[];
+}): string[] {
+  const exists = new Set(opts.existingRemotes);
+  if (opts.envRemotes.length > 0) {
+    return dedupe(opts.envRemotes.filter((n) => exists.has(n)));
+  }
+  const out: string[] = [];
+  if (opts.trackingRemote && exists.has(opts.trackingRemote) && opts.trackingRemote !== 'origin') {
+    out.push(opts.trackingRemote);
+  }
+  if (exists.has('origin')) out.push('origin');
+  if (opts.trackingRemote && exists.has(opts.trackingRemote)) out.push(opts.trackingRemote);
+  return dedupe(out);
+}
+
+/** Classify a remote's role relative to the tracking remote. */
+export function roleForRemote(name: string, trackingRemote: string | null): RepoRemoteRole {
+  if (trackingRemote && name === trackingRemote) return 'tracking';
+  if (name === 'origin' || name === 'upstream') return 'upstream';
+  return 'other';
+}
+
+function dedupe(names: string[]): string[] {
+  return [...new Set(names)];
+}
+
+/**
+ * Extract the remote name from an `@{upstream}` short ref like `origin/master`.
+ *
+ * A ref with NO slash is a LOCAL-branch upstream (`git branch -u otherbranch`):
+ * `rev-parse --abbrev-ref @{upstream}` prints just the branch name, and there
+ * is no remote in it — the old `slice(0, indexOf('/'))` became `slice(0, -1)`
+ * there and yielded garbage like `maste`. Returns null for that case (treated
+ * as "no tracking remote"), and for empty/degenerate refs.
+ */
+export function parseTrackingRemote(trackingRef: string | null | undefined): string | null {
+  if (!trackingRef) return null;
+  const idx = trackingRef.indexOf('/');
+  if (idx <= 0) return null;
+  return trackingRef.slice(0, idx);
+}
+
+/**
+ * Redact embedded `scheme://user:secret@host` credentials from the fields of
+ * one remote's status that can carry them: the remote URL itself, and the
+ * error string (which may include git stderr echoing that URL back).
+ */
+export function redactRemoteStatus(status: RepoRemoteStatus): RepoRemoteStatus {
+  const out: RepoRemoteStatus = { ...status, url: redactGitCredentials(status.url) };
+  if (out.error !== undefined) out.error = redactGitCredentials(out.error);
+  return out;
+}
+
+/**
+ * Single-flight TTL cache around an async compute: concurrent callers await
+ * the SAME in-flight promise, and a result younger than `ttlMs` is returned
+ * without recomputing. A rejected compute is never cached, so the next call
+ * retries. `now` is injectable for deterministic TTL tests.
+ */
+export function createSingleFlightCache<T>(
+  ttlMs: number,
+  compute: () => Promise<T>
+): { get(now?: number): Promise<T> } {
+  let cachedAt = 0;
+  let cachedValue: T | undefined;
+  let hasValue = false;
+  let inFlight: Promise<T> | null = null;
+  return {
+    get(now = Date.now()): Promise<T> {
+      if (hasValue && now - cachedAt < ttlMs) return Promise.resolve(cachedValue as T);
+      if (inFlight) return inFlight;
+      inFlight = compute().then(
+        (value) => {
+          cachedValue = value;
+          hasValue = true;
+          cachedAt = Date.now();
+          inFlight = null;
+          return value;
+        },
+        (err: unknown) => {
+          inFlight = null;
+          throw err;
+        }
+      );
+      return inFlight;
+    },
+  };
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// IO wrapper
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface GitResult {
+  ok: boolean;
+  stdout: string;
+  stderr: string;
+}
+
+/**
+ * Run git non-interactively (no credential or SSH prompts — a missing key/cred
+ * fails fast instead of hanging; env via the shared `gitNonInteractiveEnv()`,
+ * which also closes the askpass/GCM/DISPLAY prompt paths). ASYNC on purpose:
+ * the fetch path hits the network for up to `FETCH_TIMEOUT_MS`, and a sync
+ * spawn would block the event loop for the whole wait.
+ */
+async function runGit(args: string[], cwd: string, timeout = EXEC_TIMEOUT_MS): Promise<GitResult> {
+  try {
+    const { stdout } = await execFileAsync('git', args, {
+      cwd,
+      encoding: 'utf-8',
+      timeout,
+      env: gitNonInteractiveEnv(),
+    });
+    return { ok: true, stdout: stdout.trim(), stderr: '' };
+  } catch (err: unknown) {
+    const e = err as { stdout?: Buffer | string; stderr?: Buffer | string };
+    return {
+      ok: false,
+      stdout: e.stdout ? String(e.stdout).trim() : '',
+      stderr: e.stderr ? String(e.stderr).trim() : '',
+    };
+  }
+}
+
+/** First line of stderr, trimmed — a compact human-readable failure reason. */
+function firstLine(s: string): string {
+  return (
+    s
+      .split('\n')
+      .find((l) => l.trim())
+      ?.trim() ?? 'git command failed'
+  );
+}
+
+/** Compute ahead/behind + incoming commits for one already-selected remote. */
+async function statusForRemote(
+  dir: string,
+  name: string,
+  trackingRemote: string,
+  trackingRef: string | null
+): Promise<RepoRemoteStatus> {
+  const role = roleForRemote(name, trackingRemote);
+  const url = (await runGit(['remote', 'get-url', name], dir)).stdout || '';
+  const base: RepoRemoteStatus = { name, url, role, compareRef: '', ahead: 0, behind: 0, incoming: [] };
+
+  // SECURITY: the remote name reaches git as a positional; reject a `-` prefix
+  // (e.g. a stray CODEMAN_UPDATE_REMOTES entry) before it can act as a flag.
+  if (!isSafeGitPositional(name)) {
+    return { ...base, error: `Refusing unsafe remote name "${name}".` };
+  }
+
+  // Resolve the compare ref + the remote branch to fetch.
+  let branch: string | null;
+  if (role === 'tracking' && trackingRef) {
+    // e.g. trackingRef = "bitbucket/local" → branch = "local"
+    branch = trackingRef.slice(name.length + 1) || null;
+  } else {
+    const symref = await runGit(['ls-remote', '--symref', name, 'HEAD'], dir, FETCH_TIMEOUT_MS);
+    branch = symref.ok ? parseSymrefDefaultBranch(symref.stdout) : null;
+    if (!branch && !symref.ok) {
+      return { ...base, error: `Could not reach ${name}: ${firstLine(symref.stderr)}` };
+    }
+    branch = branch ?? 'master';
+  }
+  if (!branch) return { ...base, error: `Could not resolve a branch on ${name}.` };
+  // SECURITY: defense-in-depth — `branch` may come from untrusted symref output
+  // or a tracking-ref slice; never let a `-`-prefixed value reach `git fetch`.
+  if (!isSafeGitPositional(branch)) {
+    return { ...base, error: `Refusing unsafe branch name "${branch}" from ${name}.` };
+  }
+  const compareRef = `${name}/${branch}`;
+
+  // Read-only fetch of just that ref so the local rev-list/log can see it.
+  // `--` ends option parsing so neither `name` nor `branch` can be read as a flag.
+  const fetched = await runGit(['fetch', '--no-tags', name, '--', branch], dir, FETCH_TIMEOUT_MS);
+  if (!fetched.ok) {
+    return { ...base, compareRef, error: `Could not fetch ${compareRef}: ${firstLine(fetched.stderr)}` };
+  }
+
+  const counts = await runGit(['rev-list', '--left-right', '--count', `HEAD...${compareRef}`], dir);
+  if (!counts.ok) {
+    return { ...base, compareRef, error: `Could not compare against ${compareRef}: ${firstLine(counts.stderr)}` };
+  }
+  const ab = parseAheadBehind(counts.stdout);
+  if (!ab) return { ...base, compareRef, error: `Unexpected git output comparing ${compareRef}.` };
+
+  const log = await runGit(['log', '--oneline', '-n', String(MAX_INCOMING), `HEAD..${compareRef}`], dir);
+  const incoming = log.ok ? parseLogLines(log.stdout) : [];
+
+  return { ...base, compareRef, ahead: ab.ahead, behind: ab.behind, incoming };
+}
+
+/** The uncached computation behind `getRepositoryStatus()`. */
+async function computeRepositoryStatus(): Promise<RepositoryStatusResult> {
+  const checkedAt = Date.now();
+  const info = getInstallInfo();
+  const base: RepositoryStatusResult = {
+    checkedAt,
+    isGit: info.installKind === 'git',
+    currentVersion: info.currentVersion || APP_VERSION,
+    remotes: [],
+  };
+  if (info.installKind !== 'git') {
+    return { ...base, error: 'Not a git install — repository status is unavailable.' };
+  }
+
+  const dir = info.installDir;
+
+  // Tracking ref of the current branch, e.g. "bitbucket/local" (empty if none).
+  const trackingRef =
+    (await runGit(['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}'], dir)).stdout || null;
+  const trackingRemote = parseTrackingRemote(trackingRef);
+  // A local-branch upstream (no slash) carries no remote — drop the ref too, so
+  // nothing downstream can mistake a bare branch name for a remote-tracking ref.
+  const remoteTrackingRef = trackingRemote ? trackingRef : null;
+
+  const remotesOut = await runGit(['remote'], dir);
+  const existingRemotes = remotesOut.ok
+    ? remotesOut.stdout
+        .split('\n')
+        .map((s) => s.trim())
+        .filter(Boolean)
+    : [];
+
+  const selected = resolveRemoteSet({
+    existingRemotes,
+    trackingRemote,
+    envRemotes: parseRemotesEnv(process.env.CODEMAN_UPDATE_REMOTES),
+  });
+
+  if (selected.length === 0) {
+    return { ...base, error: 'No comparable remotes found (set CODEMAN_UPDATE_REMOTES to choose).' };
+  }
+
+  // Sequential on purpose: concurrent `git fetch` in one repo can contend on
+  // ref locks, and the event loop no longer cares how long this takes.
+  const remotes: RepoRemoteStatus[] = [];
+  for (const name of selected) {
+    // SECURITY: redact `scheme://user:token@host` credentials from the URL and
+    // any error string (git stderr echoes the URL back) before they leave the server.
+    remotes.push(redactRemoteStatus(await statusForRemote(dir, name, trackingRemote ?? '', remoteTrackingRef)));
+  }
+  return { ...base, remotes };
+}
+
+const statusCache = createSingleFlightCache(STATUS_CACHE_TTL_MS, computeRepositoryStatus);
+
+/**
+ * Inspect how the local checkout sits relative to the configured remotes.
+ * Each remote is fetched + compared independently; a single unreachable remote
+ * surfaces as that card's `error` and never fails the whole call.
+ *
+ * Single-flight + TTL-cached: concurrent requests share one in-flight
+ * computation, and a result younger than `STATUS_CACHE_TTL_MS` is served
+ * without spawning git.
+ */
+export function getRepositoryStatus(): Promise<RepositoryStatusResult> {
+  return statusCache.get();
+}

src/web/response-viewer-transcript.ts

@@ -0,0 +1,361 @@
+export type ResponseViewerTranscriptKind = 'prompt' | 'response' | 'status' | 'tool';
+
+export interface ResponseViewerTranscriptBlock {
+  kind: ResponseViewerTranscriptKind;
+  label: 'Prompt' | 'Response' | 'Status' | 'Tool';
+  /** What the frontend renders by: 'user' gets the "You" badge, everything else the agent badge. */
+  role: 'user' | 'assistant';
+  text: string;
+}
+
+// Keep in lockstep with isExternalCliMode() in src/session.ts. Importing it here
+// would drag node-pty and the whole session layer into this pure module, so the
+// list is duplicated and test/response-viewer-transcript.test.ts pins the parity.
+const EXTERNAL_CLI_MODES = new Set(['codex', 'gemini', 'opencode', 'antigravity', 'pi']);
+
+function isPromptLine(line: string): boolean {
+  return /^\s*›\s*/.test(line);
+}
+
+function isDividerDashChar(ch: string): boolean {
+  return ch === '─' || ch === '-';
+}
+
+function isWhitespaceChar(ch: string): boolean {
+  return /\s/.test(ch);
+}
+
+// Linear-time equivalent of the old /^[─-]+\s*(.+?)\s*[─-]{3,}$/. The lazy
+// middle of that pattern backtracked catastrophically on a long dash run that
+// does NOT end in 3+ dashes (measured >2min at 8,000 chars) — and pane text is
+// agent-controlled with buffers up to 32MB, so this ran on hostile input. Same
+// accept set and same captured content, computed with counters; equivalence is
+// pinned char-for-char against the old regex by the brute-force corpus test in
+// test/response-viewer-transcript.test.ts.
+function normalizeDividerStatusLine(line: string): string | null {
+  const s = line.trim();
+  const n = s.length;
+  // Minimum match: 1 leading dash + 1 content char + 3 trailing dashes.
+  if (n < 5) return null;
+
+  let lead = 0;
+  while (lead < n && isDividerDashChar(s.charAt(lead))) lead += 1;
+  if (lead === 0) return null;
+
+  let trail = 0;
+  while (trail < n && isDividerDashChar(s.charAt(n - 1 - trail))) trail += 1;
+  if (trail < 3) return null;
+
+  // The regex was greedy on the leading run but gave dashes back until at least
+  // one content char plus the 3-dash tail fit (an all-dash line matched with a
+  // single leftover dash as its "content"), so the content window starts at the
+  // end of the leading run, clamped to leave 4 chars.
+  const contentStart = Math.min(lead, n - 4);
+  let ws = 0;
+  while (contentStart + ws < n - 4 && isWhitespaceChar(s.charAt(contentStart + ws))) ws += 1;
+  const from = contentStart + ws;
+
+  // The lazy middle stopped at the first position from which "optional
+  // whitespace, then dashes to end-of-line" matches: the start of the
+  // whitespace padding in front of the trailing dash run (never before the
+  // first content char).
+  const tailStart = n - trail;
+  let padded = tailStart;
+  while (padded > 0 && isWhitespaceChar(s.charAt(padded - 1))) padded -= 1;
+  const end = Math.max(from + 1, padded);
+
+  return s.slice(from, end).trim() || null;
+}
+
+function isDividerOnlyLine(line: string): boolean {
+  return /^[\s─-]{8,}$/.test(line.trim());
+}
+
+// COD-227: unambiguous Codex tool-call markers. These only ever appear as internal
+// activity, never as ordinary assistant prose, so they are always a Tool block.
+function isToolActivityMarker(line: string): boolean {
+  return /^\s*[•*-]\s+(Calling|Called)\b/.test(line.trim());
+}
+
+// COD-227: action verbs that ALSO occur in ordinary assistant prose (e.g.
+// "• Created COD-226: …"). These are a Tool header only when corroborated by a
+// box-drawing result tree on the next non-blank line (see the caller); the verb
+// alone is not sufficient.
+function isToolVerbBullet(line: string): boolean {
+  return /^\s*[•*-]\s+(Explored|Viewed|Read|Edited|Updated|Created|Deleted|Ran|Searched|Opened|Listed|Found|Applied|Patched|Used|Wrote|Executed|Modified|Analyzed|Compared|Fetched|Installed)\b/.test(
+    line.trim()
+  );
+}
+
+// A genuine Codex tool block renders its result as a box-drawing tree (└ │ ├).
+function isBoxDrawingLine(line: string): boolean {
+  return /^[│├└]/.test(line.trim());
+}
+
+// Look past blank lines from `fromIndex + 1` for the next non-blank line and report
+// whether it is a box-drawing tool-result line — the signal that a verb bullet is a
+// real tool block rather than assistant prose that happens to start with a verb.
+function nextNonBlankIsBoxDrawing(lines: string[], fromIndex: number): boolean {
+  for (let j = fromIndex + 1; j < lines.length; j += 1) {
+    const trimmed = (lines[j] || '').trim();
+    if (!trimmed) continue;
+    return isBoxDrawingLine(trimmed);
+  }
+  return false;
+}
+
+function isToolContinuationLine(line: string, currentKind: ResponseViewerTranscriptKind | null): boolean {
+  if (currentKind !== 'tool') return false;
+  const trimmed = line.trimEnd();
+  if (!trimmed) return true;
+  return /^\s*[│├└]/.test(trimmed) || /^\s{2,}\S/.test(line);
+}
+
+function isStatusLine(line: string, mode: string): boolean {
+  if (!EXTERNAL_CLI_MODES.has(mode)) return false;
+  const trimmed = line.trim();
+  if (!trimmed) return false;
+  if (normalizeDividerStatusLine(trimmed)) return true;
+  if (/^(model|directory):\s+/i.test(trimmed)) return true;
+  if (/\bContext\b.*\bleft\b/i.test(trimmed)) return true;
+  if (/\b\/model to change\b/i.test(trimmed)) return true;
+  if (/\bReady\b/i.test(trimmed) && /·/.test(trimmed)) return true;
+  if (/^(gpt|o\d|claude|gemini)\b/i.test(trimmed) && /·/.test(trimmed)) return true;
+  if (/^Tip:/i.test(trimmed)) return true;
+  if (/^\s*[•*-]\s+(Working|Thinking|Loading|Starting\b|Waiting\b)/i.test(trimmed)) return true;
+  return false;
+}
+
+function isStandaloneMarkdownLine(line: string): boolean {
+  const trimmed = line.trim();
+  if (!trimmed) return false;
+  if (/^#{1,6}\s/.test(trimmed)) return true;
+  if (/^>\s/.test(trimmed)) return true;
+  if (/^(```|~~~)/.test(trimmed)) return true;
+  if (/^[-*+]\s/.test(trimmed)) return true;
+  if (/^\d+[.)]\s/.test(trimmed)) return true;
+  if (/^\|/.test(trimmed)) return true;
+  if (/^\s{4,}\S/.test(line)) return true;
+  return false;
+}
+
+function shouldJoinWrappedLine(previous: string, next: string): boolean {
+  const prev = previous.trimEnd();
+  const curr = next.trim();
+  if (!prev || !curr) return false;
+  if (/[.!?]$/.test(prev)) return false;
+  if (/[:;]$/.test(prev)) return false;
+  if (isStandaloneMarkdownLine(curr)) return false;
+  if (/^[a-z(]/.test(curr)) return true;
+  if (prev.length >= 72 && /^[A-Za-z0-9"'(]/.test(curr)) return true;
+  return false;
+}
+
+function normalizeWrappedText(lines: string[]): string {
+  const out: string[] = [];
+  let paragraph = '';
+
+  const flushParagraph = () => {
+    if (!paragraph) return;
+    out.push(paragraph);
+    paragraph = '';
+  };
+
+  for (const rawLine of lines) {
+    const line = rawLine.trimEnd();
+    const trimmed = line.trim();
+    if (!trimmed) {
+      flushParagraph();
+      if (out[out.length - 1] !== '') out.push('');
+      continue;
+    }
+    if (isStandaloneMarkdownLine(line)) {
+      flushParagraph();
+      out.push(trimmed);
+      continue;
+    }
+    if (!paragraph) {
+      paragraph = trimmed;
+      continue;
+    }
+    if (shouldJoinWrappedLine(paragraph, trimmed)) {
+      paragraph += ` ${trimmed}`;
+      continue;
+    }
+    flushParagraph();
+    paragraph = trimmed;
+  }
+
+  flushParagraph();
+  return out
+    .join('\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim();
+}
+
+function cleanTerminalTranscript(buffer: string): string {
+  // Stripping ANSI/OSC/DCS escape sequences and stray C0/C1 control bytes
+  // legitimately requires control characters in these patterns.
+  /* eslint-disable no-control-regex */
+  return String(buffer || '')
+    .replace(/\x1b\[[\x30-\x3F]*[\x20-\x2F]*[\x40-\x7E]/g, '')
+    .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '')
+    .replace(/\x1b[PX^_][^\x1b]*\x1b\\/g, '')
+    .replace(/\x1b[NO()][A-Z0-9]?/g, '')
+    .replace(/\x1b[>=<78cDEHM]/g, '')
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
+    .replace(/\r\n/g, '\n')
+    .replace(/\r/g, '\n')
+    .replace(/[ \t]+$/gm, '')
+    .trim();
+  /* eslint-enable no-control-regex */
+}
+
+function trimLeadingStartup(lines: string[]): string[] {
+  let index = 0;
+  while (index < lines.length) {
+    const line = lines[index] || '';
+    const trimmed = line.trim();
+    if (!trimmed) {
+      index += 1;
+      continue;
+    }
+    if (/^[╭╰│─].*[╮╯│]?$/.test(trimmed)) {
+      index += 1;
+      continue;
+    }
+    if (/^>_\s*OpenAI Codex/i.test(trimmed)) {
+      index += 1;
+      continue;
+    }
+    if (/^(model|directory):\s+/i.test(trimmed)) {
+      index += 1;
+      continue;
+    }
+    break;
+  }
+  return lines.slice(index);
+}
+
+function pushBlock(
+  blocks: ResponseViewerTranscriptBlock[],
+  kind: ResponseViewerTranscriptKind | null,
+  lines: string[]
+): void {
+  if (!kind || lines.length === 0) return;
+  const normalizedLines =
+    kind === 'status'
+      ? lines.map((line) => normalizeDividerStatusLine(line) || line.trim()).filter((line) => line.length > 0)
+      : lines;
+  const text =
+    kind === 'tool' || kind === 'status'
+      ? normalizedLines
+          .join('\n')
+          .replace(/\n{3,}/g, '\n\n')
+          .trim()
+      : normalizeWrappedText(normalizedLines);
+  if (!text) return;
+  const label = (kind.charAt(0).toUpperCase() + kind.slice(1)) as ResponseViewerTranscriptBlock['label'];
+  // The frontend's loadFullContext() renders via msg.role — a block without it
+  // lost the "You" badge on prompts and rendered every block as the agent.
+  blocks.push({ kind, label, role: kind === 'prompt' ? 'user' : 'assistant', text });
+}
+
+export function isExternalCliTranscriptMode(mode: string | null | undefined): boolean {
+  return EXTERNAL_CLI_MODES.has(String(mode || ''));
+}
+
+export function parseExternalCliTranscript(
+  buffer: string,
+  mode: string | null | undefined
+): ResponseViewerTranscriptBlock[] {
+  const resolvedMode = String(mode || '');
+  if (!isExternalCliTranscriptMode(resolvedMode)) return [];
+
+  const cleaned = cleanTerminalTranscript(buffer);
+  if (!cleaned) return [];
+
+  const lines = trimLeadingStartup(cleaned.split('\n'));
+  const blocks: ResponseViewerTranscriptBlock[] = [];
+  let currentKind: ResponseViewerTranscriptKind | null = null;
+  let currentLines: string[] = [];
+
+  const flush = () => {
+    pushBlock(blocks, currentKind, currentLines);
+    currentKind = null;
+    currentLines = [];
+  };
+
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i] ?? '';
+    // COD-226: within a prompt, the 2-space Codex gutter is authoritative. Blank
+    // lines and gutter-indented (2+ leading spaces) continuation lines stay in the
+    // Prompt block ahead of every structural detector below, so multiline prompts —
+    // including bullets, indented dividers, and literal › lines — are not
+    // misclassified as responses. Only a non-blank, non-gutter line ends the prompt
+    // and falls through (a column-0 › then opens a NEW prompt).
+    if (currentKind === 'prompt') {
+      if (!line.trim()) {
+        currentLines.push('');
+        continue;
+      }
+      if (/^ {2,}\S/.test(line)) {
+        currentLines.push(line);
+        continue;
+      }
+    }
+
+    if (isDividerOnlyLine(line)) {
+      flush();
+      continue;
+    }
+
+    if (isPromptLine(line)) {
+      flush();
+      currentKind = 'prompt';
+      currentLines = [line.replace(/^\s*›\s*/, '').trim()];
+      continue;
+    }
+
+    // COD-227: • Calling / • Called are always tool markers; the other action verbs
+    // are a tool header only when a box-drawing result tree follows on the next
+    // non-blank line — otherwise the verb bullet is ordinary assistant prose.
+    if (isToolActivityMarker(line) || (isToolVerbBullet(line) && nextNonBlankIsBoxDrawing(lines, i))) {
+      if (currentKind !== 'tool') flush();
+      currentKind = 'tool';
+      currentLines.push(line.trimEnd());
+      continue;
+    }
+
+    if (isToolContinuationLine(line, currentKind)) {
+      currentLines.push(line.trimEnd());
+      continue;
+    }
+
+    if (isStatusLine(line, resolvedMode)) {
+      if (currentKind !== 'status') flush();
+      currentKind = 'status';
+      currentLines.push(line.trim());
+      continue;
+    }
+
+    if (!line.trim()) {
+      currentLines.push('');
+      continue;
+    }
+
+    if (currentKind !== 'response') flush();
+    currentKind = 'response';
+    currentLines.push(line);
+  }
+
+  flush();
+  return blocks.filter((block) => block.text.trim().length > 0);
+}
+
+export function getLastTranscriptResponse(blocks: ResponseViewerTranscriptBlock[]): string {
+  for (let i = blocks.length - 1; i >= 0; i -= 1) {
+    if (blocks[i]?.kind === 'response') return blocks[i].text;
+  }
+  return '';
+}

src/web/routes/file-routes.ts

@@ -21,6 +21,7 @@ import type {
   FileWriteData,
 } from '../../types.js';
 import { ApiErrorCode, createErrorResponse, getErrorMessage } from '../../types.js';
+import { compileFileQuery } from '../../utils/file-query.js';
 import { fileStreamManager } from '../../file-stream-manager.js';
 import {
   AUDIO_ATTACHMENT_EXTENSIONS,
@@ -937,12 +938,15 @@ export function registerFileRoutes(app: FastifyInstance, ctx: SessionPort & Even
   // File tree listing
   app.get('/api/sessions/:id/files', async (req) => {
     const { id } = req.params as { id: string };
-    const { depth, showHidden } = req.query as { depth?: string; showHidden?: string };
+    const { depth, showHidden, q } = req.query as { depth?: string; showHidden?: string; q?: string };
     const session = findSessionOrFail(ctx, id, req);
 
     const maxDepth = Math.min(parseInt(depth || '5', 10), 10);
     const includeHidden = showHidden === 'true';
     const workingDir = session.workingDir;
+    // null for an empty/whitespace query, which is what keeps the default
+    // tree response byte-identical when no search is requested.
+    const matcher = compileFileQuery(q ?? '');
 
     // Default excludes - large/generated directories
     const excludeDirs = new Set([
@@ -976,6 +980,92 @@ export function registerFileRoutes(app: FastifyInstance, ctx: SessionPort & Even
     let truncated = false;
     const maxFiles = 5000;
 
+    // ===== Search mode =====
+    // A query turns this endpoint into a FLAT match list rather than a nested
+    // tree. It recurses past non-matching directories on purpose — the whole
+    // point of searching is to reach a file whose ancestors do not match — so
+    // it is bounded independently by maxMatches on top of the shared maxFiles
+    // and maxDepth caps, and reports `truncated` when it stops early.
+    if (matcher) {
+      const matches: FileTreeNode[] = [];
+      const maxMatches = 1000;
+
+      const searchDirectory = async (dirPath: string, currentDepth: number): Promise<void> => {
+        if (currentDepth > maxDepth || totalFiles + totalDirectories > maxFiles || matches.length >= maxMatches) {
+          truncated = true;
+          return;
+        }
+
+        let entries: import('node:fs').Dirent[];
+        try {
+          entries = await fs.readdir(dirPath, { withFileTypes: true });
+        } catch {
+          // Can't read directory (permission denied, etc.)
+          return;
+        }
+        entries.sort((a, b) => {
+          if (a.isDirectory() && !b.isDirectory()) return -1;
+          if (!a.isDirectory() && b.isDirectory()) return 1;
+          return a.name.localeCompare(b.name);
+        });
+
+        for (const entry of entries) {
+          if (totalFiles + totalDirectories > maxFiles || matches.length >= maxMatches) {
+            truncated = true;
+            break;
+          }
+          if (!includeHidden && entry.name.startsWith('.')) continue;
+          if (entry.isDirectory() && excludeDirs.has(entry.name)) continue;
+
+          const fullPath = join(dirPath, entry.name);
+          const relativePath = relative(workingDir, fullPath);
+
+          if (entry.isDirectory()) {
+            totalDirectories++;
+            if (matcher(entry.name, relativePath)) {
+              matches.push({ name: entry.name, path: relativePath, type: 'directory' });
+            }
+            // Always recurse, even when this directory does not match.
+            await searchDirectory(fullPath, currentDepth + 1);
+          } else {
+            totalFiles++;
+            if (matcher(entry.name, relativePath)) {
+              let size: number | undefined;
+              try {
+                size = (await fs.stat(fullPath)).size;
+              } catch {
+                // Skip size if we can't stat the match.
+              }
+              matches.push({
+                name: entry.name,
+                path: relativePath,
+                type: 'file',
+                size,
+                extension: entry.name.includes('.') ? entry.name.split('.').pop()?.toLowerCase() : undefined,
+              });
+            }
+          }
+        }
+      };
+
+      await searchDirectory(workingDir, 1);
+
+      return {
+        success: true,
+        data: {
+          root: workingDir,
+          tree: [],
+          matches,
+          totalFiles,
+          totalDirectories,
+          truncated,
+          matchCount: matches.length,
+          query: (q ?? '').trim(),
+          mode: 'search' as const,
+        },
+      };
+    }
+
     const scanDirectory = async (dirPath: string, currentDepth: number): Promise<FileTreeNode[]> => {
       if (currentDepth > maxDepth || totalFiles + totalDirectories > maxFiles) {
         truncated = true;

src/web/routes/session-routes.ts

@@ -12,6 +12,7 @@ import { existsSync, statSync, mkdirSync, writeFileSync } from 'node:fs';
 import { execFile } from 'node:child_process';
 import fs from 'node:fs/promises';
 import { randomBytes } from 'node:crypto';
+import { performance } from 'node:perf_hooks';
 import {
   ApiErrorCode,
   createErrorResponse,
@@ -131,6 +132,11 @@ import {
   toSessionDocker,
 } from '../../docker-hosts.js';
 import { LRUMap } from '../../utils/lru-map.js';
+import {
+  getLastTranscriptResponse,
+  isExternalCliTranscriptMode,
+  parseExternalCliTranscript,
+} from '../response-viewer-transcript.js';
 
 // Path to linked-cases registry (same file used by case-routes resolveCasePath)
 const LINKED_CASES_FILE = dataPath('linked-cases.json');
@@ -797,54 +803,42 @@ export function registerSessionRoutes(
       }
     }
 
-    // Check OpenCode availability if requested
+    // Check OpenCode availability if requested. The error text comes from the
+    // resolver (formatCliNotFoundMessage) so it names where resolution looked —
+    // server PATH, login shell, common directories — same for the modes below.
     if (body.mode === 'opencode') {
-      const { isOpenCodeAvailable } = await import('../../utils/opencode-cli-resolver.js');
+      const { isOpenCodeAvailable, getOpenCodeNotFoundMessage } = await import('../../utils/opencode-cli-resolver.js');
       if (!isOpenCodeAvailable()) {
-        return createErrorResponse(
-          ApiErrorCode.OPERATION_FAILED,
-          'OpenCode CLI not found. Install with: curl -fsSL https://opencode.ai/install | bash'
-        );
+        return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getOpenCodeNotFoundMessage());
       }
     }
 
     // Check Codex availability if requested
     if (body.mode === 'codex') {
-      const { isCodexAvailable } = await import('../../utils/codex-cli-resolver.js');
+      const { isCodexAvailable, getCodexNotFoundMessage } = await import('../../utils/codex-cli-resolver.js');
       if (!isCodexAvailable()) {
-        return createErrorResponse(
-          ApiErrorCode.OPERATION_FAILED,
-          'Codex CLI not found. Install with: npm install -g @openai/codex'
-        );
+        return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getCodexNotFoundMessage());
       }
     }
 
     // Check Gemini availability if requested
     if (body.mode === 'gemini') {
-      const { isGeminiAvailable } = await import('../../utils/gemini-cli-resolver.js');
+      const { isGeminiAvailable, getGeminiNotFoundMessage } = await import('../../utils/gemini-cli-resolver.js');
       if (!isGeminiAvailable()) {
-        return createErrorResponse(
-          ApiErrorCode.OPERATION_FAILED,
-          'Gemini CLI not found. Install with: npm install -g @google/gemini-cli'
-        );
+        return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getGeminiNotFoundMessage());
       }
     }
     if (body.mode === 'antigravity') {
-      const { isAntigravityAvailable } = await import('../../utils/antigravity-cli-resolver.js');
+      const { isAntigravityAvailable, getAntigravityNotFoundMessage } =
+        await import('../../utils/antigravity-cli-resolver.js');
       if (!isAntigravityAvailable()) {
-        return createErrorResponse(
-          ApiErrorCode.OPERATION_FAILED,
-          'Antigravity CLI not found. Install with: curl -fsSL https://antigravity.google/cli/install.sh | bash'
-        );
+        return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getAntigravityNotFoundMessage());
       }
     }
     if (body.mode === 'pi') {
-      const { isPiAvailable } = await import('../../utils/pi-cli-resolver.js');
+      const { isPiAvailable, getPiNotFoundMessage } = await import('../../utils/pi-cli-resolver.js');
       if (!isPiAvailable()) {
-        return createErrorResponse(
-          ApiErrorCode.OPERATION_FAILED,
-          'Pi CLI not found. Install with: npm install -g --ignore-scripts @earendil-works/pi-coding-agent'
-        );
+        return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getPiNotFoundMessage());
       }
     }
 
@@ -1898,6 +1892,22 @@ export function registerSessionRoutes(
       return await readCodexLastResponse(session, codexQuery.context === 'full');
     }
 
+    // OpenCode / Gemini / Antigravity / Pi render their own TUIs and write no
+    // Claude transcript, so the scan below finds nothing and the response viewer
+    // renders permanently empty for them. Segment the terminal buffer instead —
+    // the pane IS the transcript for these CLIs. Codex is already handled above,
+    // where a real rollout file is the better source.
+    if (isExternalCliTranscriptMode(session.mode)) {
+      const externalQuery = req.query as { context?: string };
+      const blocks = parseExternalCliTranscript(session.terminalBuffer, session.mode);
+      return {
+        text: getLastTranscriptResponse(blocks),
+        timestamp: '',
+        hasContext: blocks.length > 0,
+        messages: externalQuery.context === 'full' ? blocks : undefined,
+      };
+    }
+
     // Scan ~/.claude/projects/*/ for the transcript file
     const projectsDir = join(process.env.HOME || '/tmp', '.claude', 'projects');
 
@@ -2270,18 +2280,17 @@ export function registerSessionRoutes(
 
   // Query params:
   //   tail=<bytes> - Only return last N bytes (faster initial load)
-  //   full=1       - Full page reload: replay the entire tmux scrollback (COD-47)
-  app.get('/api/sessions/:id/terminal', async (req) => {
+  //   full=1       - Explicitly request the entire tmux scrollback (COD-47)
+  app.get('/api/sessions/:id/terminal', async (req, reply) => {
+    const routeStartedAt = performance.now();
     const { id } = req.params as { id: string };
     const query = req.query as { tail?: string; full?: string };
     const session = findSessionOrFail(ctx, id, req);
 
-    // `full=1` is the EXPLICIT full-reload signal (COD-47): the browser reloaded
-    // the page and wants the whole scroll history back, so we capture the ENTIRE
-    // tmux scrollback and the user gets back history that scrolled off Codeman's
-    // byte buffer. Requests WITHOUT it — tab switches (`tail=`) and the legacy
-    // no-param callers (response-viewer fallback, clearTerminal refresh) — keep
-    // the fast visible-frame capture.
+    // `full=1` is the EXPLICIT full-history signal (COD-47): capture the ENTIRE
+    // tmux scrollback so history beyond the server byte buffer can be recovered.
+    // Requests WITHOUT it — shell selection/tab switches (`tail=`) and legacy
+    // no-param callers — keep the fast visible-frame capture.
     const tailBytes = query.tail ? parseInt(query.tail, 10) : 0;
     const isFullReload = query.full === '1' || query.full === 'true';
     const { tmuxHistoryLimit, terminalBufferMaxBytes } = await ctx.getTerminalHistoryConfig();
@@ -2294,6 +2303,7 @@ export function registerSessionRoutes(
     // overlap. `captureActivePaneBuffer` is a no-op ('') under test mode and
     // returns null when unavailable, in which case we fall back to history.
     const muxName = session.muxName;
+    const captureStartedAt = performance.now();
     const liveMuxBuffer =
       muxName && typeof ctx.mux.captureActivePaneBuffer === 'function'
         ? ctx.mux.captureActivePaneBuffer(
@@ -2303,6 +2313,7 @@ export function registerSessionRoutes(
               : undefined
           )
         : null;
+    const captureFinishedAt = performance.now();
     const hasLiveMuxBuffer = liveMuxBuffer !== null && liveMuxBuffer.length > 0;
     const source: 'history' | 'mux-visible' | 'mux-full-history' = hasLiveMuxBuffer
       ? isFullReload
@@ -2406,6 +2417,14 @@ export function registerSessionRoutes(
     // Remove Ctrl+L and leading whitespace (cheap on tailed subset)
     cleanBuffer = cleanBuffer.replace(CTRL_L_PATTERN, '').replace(LEADING_WHITESPACE_PATTERN, '');
 
+    const finishedAt = performance.now();
+    reply.header(
+      'Server-Timing',
+      `capture;dur=${(captureFinishedAt - captureStartedAt).toFixed(1)}, ` +
+        `prepare;dur=${(finishedAt - captureFinishedAt).toFixed(1)}, ` +
+        `total;dur=${(finishedAt - routeStartedAt).toFixed(1)}`
+    );
+
     return {
       terminalBuffer: cleanBuffer,
       status: session.status,
@@ -2806,58 +2825,46 @@ export function registerSessionRoutes(
         dockerResumeId = dockerCase.lastClaudeSessionId;
       }
     } else {
-      // Check OpenCode availability if requested
+      // Check OpenCode availability if requested. Error text comes from the
+      // resolver so it carries the resolution diagnostics; same for the modes below.
       if (mode === 'opencode') {
-        const { isOpenCodeAvailable } = await import('../../utils/opencode-cli-resolver.js');
+        const { isOpenCodeAvailable, getOpenCodeNotFoundMessage } =
+          await import('../../utils/opencode-cli-resolver.js');
         if (!isOpenCodeAvailable()) {
-          return createErrorResponse(
-            ApiErrorCode.OPERATION_FAILED,
-            'OpenCode CLI not found. Install with: curl -fsSL https://opencode.ai/install | bash'
-          );
+          return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getOpenCodeNotFoundMessage());
         }
       }
 
       // Check Codex availability if requested
       if (mode === 'codex') {
-        const { isCodexAvailable } = await import('../../utils/codex-cli-resolver.js');
+        const { isCodexAvailable, getCodexNotFoundMessage } = await import('../../utils/codex-cli-resolver.js');
         if (!isCodexAvailable()) {
-          return createErrorResponse(
-            ApiErrorCode.OPERATION_FAILED,
-            'Codex CLI not found. Install with: npm install -g @openai/codex'
-          );
+          return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getCodexNotFoundMessage());
         }
       }
 
       // Check Gemini availability if requested
       if (mode === 'gemini') {
-        const { isGeminiAvailable } = await import('../../utils/gemini-cli-resolver.js');
+        const { isGeminiAvailable, getGeminiNotFoundMessage } = await import('../../utils/gemini-cli-resolver.js');
         if (!isGeminiAvailable()) {
-          return createErrorResponse(
-            ApiErrorCode.OPERATION_FAILED,
-            'Gemini CLI not found. Install with: npm install -g @google/gemini-cli'
-          );
+          return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getGeminiNotFoundMessage());
         }
       }
 
       // Check Antigravity availability if requested
       if (mode === 'antigravity') {
-        const { isAntigravityAvailable } = await import('../../utils/antigravity-cli-resolver.js');
+        const { isAntigravityAvailable, getAntigravityNotFoundMessage } =
+          await import('../../utils/antigravity-cli-resolver.js');
         if (!isAntigravityAvailable()) {
-          return createErrorResponse(
-            ApiErrorCode.OPERATION_FAILED,
-            'Antigravity CLI not found. Install with: curl -fsSL https://antigravity.google/cli/install.sh | bash'
-          );
+          return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getAntigravityNotFoundMessage());
         }
       }
 
       // Check Pi availability if requested
       if (mode === 'pi') {
-        const { isPiAvailable } = await import('../../utils/pi-cli-resolver.js');
+        const { isPiAvailable, getPiNotFoundMessage } = await import('../../utils/pi-cli-resolver.js');
         if (!isPiAvailable()) {
-          return createErrorResponse(
-            ApiErrorCode.OPERATION_FAILED,
-            'Pi CLI not found. Install with: npm install -g --ignore-scripts @earendil-works/pi-coding-agent'
-          );
+          return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getPiNotFoundMessage());
         }
       }
 

src/web/routes/system-routes.ts

@@ -48,6 +48,7 @@ import {
 } from '../route-helpers.js';
 import { SseEvent } from '../sse-events.js';
 import { getInstallInfo, checkForUpdate, startUpdate, getUpdateStatusForApi } from '../self-update.js';
+import { getRepositoryStatus } from '../repo-status.js';
 import type { SessionPort, EventPort, ConfigPort, InfraPort, AuthPort } from '../ports/index.js';
 import { AUTH_COOKIE_NAME } from '../middleware/auth.js';
 import { QR_AUTH_FAILURE_MAX } from '../../config/tunnel-config.js';
@@ -354,6 +355,11 @@ export function registerSystemRoutes(
   // Poll target for update progress — survives the restart the update triggers.
   app.get('/api/system/update/status', async () => getUpdateStatusForApi());
 
+  // Informational companion to the release-tag updater above: what this CHECKOUT
+  // looks like against its own remotes (ahead/behind, incoming commits), which a
+  // release tag cannot answer for a git install tracking a branch.
+  app.get('/api/system/repo-status', async () => getRepositoryStatus());
+
   // Kick off a detached update to the latest release. Returns immediately; the
   // browser then polls /api/system/update/status across the service restart.
   app.post('/api/system/update', async (_req, reply) => {
@@ -722,7 +728,8 @@ export function registerSystemRoutes(
       const merged = { ...existing, ...settingsToStore };
       await fs.writeFile(SETTINGS_PATH, JSON.stringify(merged, null, 2));
 
-      // Apply a changed tmux history-limit to all live sessions immediately.
+      // tmux 3.7+ resizes tracked panes; older versions apply this to new panes.
+      // Already-evicted history cannot be recovered on either version.
       if (settings.tmuxHistoryLimit !== undefined) {
         await ctx.mux.setHistoryLimit(resolveTerminalHistoryConfig(merged).tmuxHistoryLimit);
       }

src/web/server.ts

@@ -781,19 +781,31 @@ export class WebServer extends EventEmitter {
 
     // Serve static files — content-hashed assets (e.g. app.a3f8c2e1.js) are immutable, cache aggressively.
     // HTML must revalidate every time so browsers pick up new hashed filenames after deploys.
-    // cacheControl disabled so setHeaders has full control (fastify-static's reply.headers() overwrites setHeaders otherwise).
+    // cacheControl disabled so setHeaders owns Cache-Control for plain static assets.
     // preCompressed: serve pre-built .br/.gz files (from build step) to avoid per-request CPU compression
     await this.app.register(fastifyStatic, {
       root: join(__dirname, 'public'),
       prefix: '/',
       cacheControl: false,
       preCompressed: true,
-      setHeaders: (res, path) => {
+      // ⚠️ @fastify/static v10 changed this callback's first argument from a Node
+      // `ServerResponse` to a `FastifyReply`, so it is `reply.header()` here and
+      // NOT `res.setHeader()`. A v9-style body throws TypeError on every static
+      // request, which is every page load. See the v10.0.0 release notes.
+      setHeaders: (reply, path) => {
+        // ⚠️ That same change ALSO flipped precedence, and silently. Under v9 this
+        // callback wrote to the raw response and Fastify's staged reply headers then
+        // overwrote it, so a route that set its own Cache-Control before .sendFile()
+        // won. Under v10 the callback writes to the reply itself and now wins instead,
+        // which handed `/sw.js` a year of `immutable` in place of the `no-cache,
+        // no-store` its route asks for — a service worker that can never update.
+        // So: a route that already decided keeps its answer.
+        if (reply.getHeader('Cache-Control') !== undefined) return;
         // Use .includes() not .endsWith() — preCompressed serves .html.br/.html.gz
         if (path.includes('.html')) {
-          res.setHeader('Cache-Control', 'no-cache');
+          reply.header('Cache-Control', 'no-cache');
         } else {
-          res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+          reply.header('Cache-Control', 'public, max-age=31536000, immutable');
         }
       },
     });

src/web/session-listener-wiring.ts

@@ -52,6 +52,7 @@ export interface SessionListenerRefs {
   limitResumeCancelled: (data: { reason: string }) => void;
   respawnBreakerTripped: (data: { count: number }) => void;
   cliInfoUpdated: (data: { version?: string; model?: string; accountType?: string; latestVersion?: string }) => void;
+  mouseTrackingChanged: (active: boolean) => void;
   ralphLoopUpdate: (state: RalphTrackerState) => void;
   ralphTodoUpdate: (todos: RalphTodoItem[]) => void;
   ralphCompletionDetected: (phrase: string) => void;
@@ -219,10 +220,18 @@ export function createSessionListeners(session: Session, deps: SessionListenerDe
       // An idle-prompt inbox item means "composer is waiting"; any working
       // transition means input arrived, so the item is moot. ONLY the idle
       // kind: `working` is heuristic and can flap mid-turn, so clearing a
-      // pending permission/question dialog on it would false-clear real
-      // approvals (those resolve via stop / elicitation hooks / answer-time
-      // re-capture instead).
+      // pending permission/question dialog on the signal ALONE would
+      // false-clear real approvals.
       approvalInbox.resolveForSession(session.id, 'resolved_in_terminal', ['idle']);
+      // A permission/question dialog gets the pane-VERIFIED variant instead:
+      // the signal only decides when to look, `verifyStillAnswerable` re-reads
+      // the screen and resolves only when the dialog is really gone. Without
+      // this, answering a dialog in the terminal left its red "needs you" alert
+      // armed for the rest of the turn, because the only other staleness check
+      // lives in `GET /api/approvals` and nothing calls that while a page is
+      // open. `stop` was the first thing to clear it, which on a long turn is
+      // minutes away.
+      approvalInbox.resolveIfDialogGone(session.id);
       deps.broadcast(SseEvent.SessionWorking, { id: session.id });
       // Full state ride-along: the home screens sort the running group on
       // lastSubmitAt, and without this the browser keeps the stamp it loaded
@@ -342,6 +351,20 @@ export function createSessionListeners(session: Session, deps: SessionListenerDe
       deps.broadcastSessionStateDebounced(session.id);
     },
 
+    /**
+     * The CLI turned mouse tracking on or off (observed while stripping the
+     * DECSETs out of the stream). Rides the full session state so the browser
+     * learns it through the session object it already merges, with no new SSE
+     * event to keep in sync across the two registries.
+     *
+     * Broadcast IMMEDIATELY, not debounced: this flips when a dialog opens, and
+     * a user can click that dialog inside the 500ms debounce window, which is
+     * exactly the click that has to be reported.
+     */
+    mouseTrackingChanged: () => {
+      deps.broadcast(SseEvent.SessionUpdated, { session: deps.getSessionStateWithRespawn(session) });
+    },
+
     // ─── Ralph Tracking Events ──────────────────────────────
 
     /** Broadcasts `session:ralphLoopUpdate` — Ralph tracker loop state changed (iteration, phase) */
@@ -453,6 +476,7 @@ export function attachSessionListeners(session: Session, refs: SessionListenerRe
   session.on('limitResumeCancelled', refs.limitResumeCancelled);
   session.on('respawnBreakerTripped', refs.respawnBreakerTripped);
   session.on('cliInfoUpdated', refs.cliInfoUpdated);
+  session.on('mouseTrackingChanged', refs.mouseTrackingChanged);
   session.on('ralphLoopUpdate', refs.ralphLoopUpdate);
   session.on('ralphTodoUpdate', refs.ralphTodoUpdate);
   session.on('ralphCompletionDetected', refs.ralphCompletionDetected);
@@ -487,6 +511,7 @@ export function detachSessionListeners(session: Session, refs: SessionListenerRe
   session.off('limitResumeCancelled', refs.limitResumeCancelled);
   session.off('respawnBreakerTripped', refs.respawnBreakerTripped);
   session.off('cliInfoUpdated', refs.cliInfoUpdated);
+  session.off('mouseTrackingChanged', refs.mouseTrackingChanged);
   session.off('ralphLoopUpdate', refs.ralphLoopUpdate);
   session.off('ralphTodoUpdate', refs.ralphTodoUpdate);
   session.off('ralphCompletionDetected', refs.ralphCompletionDetected);

test/antigravity-cli-resolver.test.ts

@@ -0,0 +1,121 @@
+/**
+ * @fileoverview Tests for the Antigravity CLI resolver wrapper.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { createAntigravityResolverForTest, isAntigravityAvailable } from '../src/utils/antigravity-cli-resolver.js';
+import {
+  cliResolveRetryDelayMs,
+  type CliResolution,
+  type CliResolverHost,
+} from '../src/utils/cli-executable-resolver.js';
+
+const availabilityResolution = vi.hoisted(() => ({ current: null as CliResolution | null }));
+
+vi.mock('../src/utils/cli-executable-resolver.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../src/utils/cli-executable-resolver.js')>();
+  return {
+    ...actual,
+    createCliExecutableResolver: (options: { binary: string; searchDirs: string[] }, host?: CliResolverHost) =>
+      host
+        ? actual.createCliExecutableResolver(options, host)
+        : {
+            resolve: () => availabilityResolution.current,
+            diagnostics: () => ({
+              binary: options.binary,
+              processPath: '/service/bin',
+              shellPath: '/bin/zsh',
+              shellArgs: ['-l'],
+              searchDirs: [...options.searchDirs],
+            }),
+          },
+  };
+});
+
+function createHost(
+  options: {
+    processPathResult?: string | null;
+    loginShellResults?: Array<string | null>;
+    existingPaths?: string[];
+  } = {}
+): CliResolverHost {
+  const loginShellResults = [...(options.loginShellResults ?? [])];
+  const existingPaths = new Set(options.existingPaths ?? []);
+  return {
+    processPath: '/service/bin',
+    shellPath: '/bin/zsh',
+    shellArgs: ['-l'],
+    findOnProcessPath: () => options.processPathResult ?? null,
+    findInLoginShell: () => loginShellResults.shift() ?? null,
+    exists: (path) => existingPaths.has(path),
+  };
+}
+
+describe('Antigravity CLI resolver', () => {
+  beforeEach(() => {
+    availabilityResolution.current = null;
+  });
+
+  it('resolves agy from the service PATH', () => {
+    const binaryPath = '/service/bin/agy';
+    const resolver = createAntigravityResolverForTest(
+      createHost({ processPathResult: binaryPath, existingPaths: [binaryPath] })
+    );
+
+    expect(resolver.resolve()?.directory).toBe('/service/bin');
+  });
+
+  it('falls back to a common install directory', () => {
+    const binaryPath = join(homedir(), '.local', 'bin', 'agy');
+    const resolver = createAntigravityResolverForTest(createHost({ existingPaths: [binaryPath] }));
+
+    expect(resolver.resolve()?.directory).toBe(join(homedir(), '.local', 'bin'));
+  });
+
+  it('resolves agy found only by the login shell', () => {
+    const binaryPath = '/login-shell/bin/agy';
+    const resolver = createAntigravityResolverForTest(
+      createHost({ loginShellResults: [binaryPath], existingPaths: [binaryPath] })
+    );
+
+    expect(resolver.resolve()?.directory).toBe('/login-shell/bin');
+  });
+
+  it('returns null when agy is unavailable', () => {
+    const resolver = createAntigravityResolverForTest(createHost());
+
+    expect(resolver.resolve()).toBeNull();
+  });
+
+  it('retries a failed lookup after the backoff and caches the first successful login-shell discovery', () => {
+    const binaryPath = '/late-login-shell/bin/agy';
+    let now = 0;
+    const resolver = createAntigravityResolverForTest(
+      createHost({ loginShellResults: [null, binaryPath], existingPaths: [binaryPath] }),
+      () => now
+    );
+
+    expect(resolver.resolve()).toBeNull();
+    // A miss is negative-cached: within the backoff window nothing re-runs the
+    // chain (its login-shell tail is a synchronous bounded spawn in production).
+    expect(resolver.resolve()).toBeNull();
+    now = cliResolveRetryDelayMs(1);
+    expect(resolver.resolve()?.binaryPath).toBe(binaryPath);
+    expect(resolver.resolve()?.binaryPath).toBe(binaryPath);
+  });
+
+  it('reports the public wrapper as available when agy resolves', () => {
+    availabilityResolution.current = {
+      binaryPath: '/service/bin/agy',
+      directory: '/service/bin',
+      source: 'process-path',
+    };
+
+    expect(isAntigravityAvailable()).toBe(true);
+  });
+
+  it('reports the public wrapper as unavailable when agy does not resolve', () => {
+    expect(isAntigravityAvailable()).toBe(false);
+  });
+});

test/approval-inbox.test.ts

@@ -40,6 +40,39 @@ const ASK_USER_QUESTION_FRAME = [
   'Enter to select · ↑/↓ to navigate · Esc to cancel',
 ].join('\n');
 
+// Both frames captured off a live Claude Code v2.1.237 pane. They are the
+// discriminator behind the late-hook resolution: a modal dialog BLOCKS the
+// turn, so a working line and a dialog cannot coexist. Note the dialog frame
+// carries no `esc to interrupt` footer either — the dialog replaces it.
+const LIVE_DIALOG_FRAME = [
+  '● Bash(sleep 12; echo "slept 12s")',
+  '  ⎿  slept 12s',
+  '────────────────────────────────────────',
+  ' ☐ Proceed',
+  '',
+  'Proceed?',
+  '',
+  '❯ 1. Yes',
+  '     Go ahead and proceed.',
+  '  2. No',
+  '     Do not proceed.',
+  '  3. Type something.',
+  '────────────────────────────────────────',
+  '  4. Chat about this',
+  '',
+  'Enter to select · ↑/↓ to navigate · Esc to cancel',
+].join('\n');
+
+const WORKING_FRAME = [
+  '● Bash(sleep 25)',
+  '  ⎿  Tip: Use git worktrees to run multiple Claude sessions in parallel.',
+  '✢ Clauding… (13s · ↓ 1.4k tokens)',
+  '────────────────────────────────────────',
+  '❯',
+  '────────────────────────────────────────',
+  '  ⏵⏵ bypass permissions on (shift+tab to cycle) · esc to interrupt · ← for agents',
+].join('\n');
+
 function collect(inbox: ApprovalInbox) {
   const pending: ApprovalItem[] = [];
   const updated: ApprovalItem[] = [];
@@ -333,6 +366,186 @@ describe('ApprovalInbox', () => {
     });
   });
 
+  describe('answered-in-the-terminal staleness', () => {
+    // Claude Code delays the Notification hook behind the dialog (measured 6s
+    // on v2.1.237, documented up to ~30s), so the 600ms re-capture routinely
+    // lands on a frame the user has ALREADY answered. Erasing `options` there
+    // made the item permanently unsweepable, because a missing `options` is how
+    // "we never could read this dialog" is expressed, and such items stay
+    // answerable on purpose. The red tab alert then survived every
+    // `GET /api/approvals` and every reload, clearing only on `stop`.
+    it('a re-capture taken after the answer does not erase parsed options', () => {
+      const { updated } = collect(inbox);
+      let frame = ASK_USER_QUESTION_FRAME;
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'permission',
+        capture: () => frame,
+      });
+      expect(item.options).toHaveLength(5);
+
+      // Answered in the terminal before the re-capture fires.
+      frame = "● User answered Claude's questions:\n  ⎿  · Which color do you prefer? → Red\n\n✶ Cooking… (6s)";
+      vi.advanceTimersByTime(600);
+
+      expect(updated).toHaveLength(1);
+      expect(inbox.getById(item.id)?.context).toContain('User answered');
+      expect(inbox.getById(item.id)?.options).toHaveLength(5);
+      // ...which keeps the staleness check conclusive instead of inconclusive.
+      expect(inbox.verifyStillAnswerable(item.id)).toBe(false);
+      expect(inbox.getById(item.id)).toBeUndefined();
+    });
+
+    it('resolveIfDialogGone resolves a dialog answered in the terminal', () => {
+      const { resolved } = collect(inbox);
+      let frame = PERMISSION_FRAME;
+      const item = inbox.notePrompt({ sessionId: 's1', sessionName: 'w1', kind: 'permission', capture: () => frame });
+      frame = 'the dialog is gone, claude is typing';
+
+      inbox.resolveIfDialogGone('s1');
+
+      expect(inbox.getById(item.id)).toBeUndefined();
+      expect(resolved.at(-1)).toMatchObject({ id: item.id, resolution: 'resolved_in_terminal' });
+    });
+
+    it('resolveIfDialogGone keeps a dialog that is still on screen', () => {
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'permission',
+        capture: () => PERMISSION_FRAME,
+      });
+      inbox.resolveIfDialogGone('s1');
+      expect(inbox.getById(item.id)).toBeDefined();
+    });
+
+    it('resolveIfDialogGone never touches an idle item (that is the working signal job)', () => {
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'idle',
+        capture: () => 'composer is empty',
+      });
+      inbox.resolveIfDialogGone('s1');
+      expect(inbox.getById(item.id)).toBeDefined();
+    });
+
+    // The late-hook hole: Claude Code fires the Notification behind the dialog,
+    // so a prompt answered before the hook lands produces an item whose FIRST
+    // capture already has no dialog in it. Nothing ever parsed, so "options
+    // vanished" can never fire, and `stop` had already gone by too — the red
+    // alert then survived reloads until the 12h TTL.
+    it('resolves an item that never parsed options once the pane is visibly working', () => {
+      const { resolved } = collect(inbox);
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'permission',
+        capture: () => WORKING_FRAME,
+      });
+      expect(item.options).toBeUndefined();
+
+      expect(inbox.verifyStillAnswerable(item.id)).toBe(false);
+      expect(inbox.getById(item.id)).toBeUndefined();
+      expect(resolved.at(-1)).toMatchObject({ id: item.id, resolution: 'resolved_in_terminal' });
+    });
+
+    it('keeps an unreadable dialog answerable when the pane is NOT visibly working', () => {
+      // The conservative rule this fix must not loosen: no options and no proof
+      // the turn is running means "we cannot read it", not "it is gone".
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'permission',
+        capture: () => 'some dialog shape we cannot parse',
+      });
+      expect(item.options).toBeUndefined();
+      expect(inbox.verifyStillAnswerable(item.id)).toBe(true);
+      expect(inbox.getById(item.id)).toBeDefined();
+    });
+
+    it('a real live-dialog frame carries no working line, so it is never false-resolved', () => {
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'permission',
+        capture: () => LIVE_DIALOG_FRAME,
+      });
+      expect(item.options).toHaveLength(4);
+      expect(inbox.verifyStillAnswerable(item.id)).toBe(true);
+      expect(inbox.getById(item.id)).toBeDefined();
+    });
+
+    it('resolveIfDialogGone clears a late-hook item on the next working signal', () => {
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'permission',
+        capture: () => WORKING_FRAME,
+      });
+      inbox.resolveIfDialogGone('s1');
+      expect(inbox.getById(item.id)).toBeUndefined();
+    });
+
+    it('the delayed staleness pass resolves a late-hook item with no working signal needed', () => {
+      const { resolved } = collect(inbox);
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'permission',
+        capture: () => WORKING_FRAME,
+      });
+      expect(item.options).toBeUndefined();
+
+      vi.advanceTimersByTime(600); // re-capture: enrichment only, never resolves
+      expect(inbox.getById(item.id)).toBeDefined();
+
+      vi.advanceTimersByTime(2400); // the delayed staleness pass
+      expect(inbox.getById(item.id)).toBeUndefined();
+      expect(resolved.at(-1)).toMatchObject({ id: item.id, resolution: 'resolved_in_terminal' });
+    });
+
+    it('a dialog Ink paints late is NOT resolved by the delayed pass', () => {
+      // The paint race the re-capture exists for: the hook can beat Ink to the
+      // screen. Resolving inside that window would clear the alert for a dialog
+      // that was about to appear, so the frame is what decides, every time.
+      let frame = WORKING_FRAME;
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'permission',
+        capture: () => frame,
+      });
+      frame = LIVE_DIALOG_FRAME; // Ink finishes painting
+
+      vi.advanceTimersByTime(600);
+      expect(inbox.getById(item.id)?.options).toHaveLength(4);
+      vi.advanceTimersByTime(2400);
+      expect(inbox.getById(item.id)).toBeDefined();
+    });
+
+    it('resolving cancels both pending timers', () => {
+      const { updated } = collect(inbox);
+      const item = inbox.notePrompt({
+        sessionId: 's1',
+        sessionName: 'w1',
+        kind: 'permission',
+        capture: () => PERMISSION_FRAME,
+      });
+      inbox.dismiss(item.id);
+      vi.advanceTimersByTime(5000);
+      expect(updated).toHaveLength(0);
+      expect(inbox.listPending()).toHaveLength(0);
+    });
+
+    it('resolveIfDialogGone is a no-op for a session with nothing pending', () => {
+      const { resolved } = collect(inbox);
+      expect(() => inbox.resolveIfDialogGone('nobody')).not.toThrow();
+      expect(resolved).toHaveLength(0);
+    });
+  });
+
   it('stop() clears items and silences events', () => {
     const { resolved } = collect(inbox);
     inbox.notePrompt({ sessionId: 's1', sessionName: 'w1', kind: 'permission' });

test/claude-scrollback-strip.test.ts

@@ -147,3 +147,94 @@ describe('tmux-backed shell: strip tmux’s own client smcup, keep everything el
     }
   });
 });
+
+/**
+ * Whatever the strip removes, the server has to remember, because after it runs
+ * nothing downstream can ever see it. The browser hand-encodes click reports for
+ * these modes (`_sendSyntheticSgrTap`), and with no state to consult it did that
+ * on EVERY click, delivering mouse reports to a CLI that never asked for them.
+ */
+describe('stripped mouse-tracking state', () => {
+  const trackingOf = (session: Session) => session.toState().cliMouseTracking;
+
+  it('starts off, and stays off for output that never enables tracking', () => {
+    const session = new Session({ workingDir: '/tmp', mode: 'claude' });
+    expect(trackingOf(session)).toBeUndefined();
+
+    handleOutput(session, 'plain output\x1b[?1049h\x1b[3J');
+
+    expect(trackingOf(session)).toBeUndefined();
+  });
+
+  it('follows the CLI enabling and disabling a tracking mode', () => {
+    const session = new Session({ workingDir: '/tmp', mode: 'claude' });
+    const changes: boolean[] = [];
+    session.on('mouseTrackingChanged', (active: boolean) => changes.push(active));
+
+    handleOutput(session, '\x1b[?1002hdialog');
+    expect(trackingOf(session)).toBe(true);
+
+    handleOutput(session, '\x1b[?1002ldismissed');
+    expect(trackingOf(session)).toBeUndefined();
+    expect(changes).toEqual([true, false]);
+  });
+
+  it('ignores encoding and alt-scroll modes, which do not ask about clicks', () => {
+    // 1005/1006 pick an ENCODING and 1007 is alt-scroll. Counting them would put
+    // the stray reports straight back: a CLI can select SGR encoding without ever
+    // asking to be told where the user clicked.
+    const session = new Session({ workingDir: '/tmp', mode: 'claude' });
+
+    handleOutput(session, '\x1b[?1006h\x1b[?1005h\x1b[?1007h');
+
+    expect(trackingOf(session)).toBeUndefined();
+  });
+
+  it('stays on until the LAST tracking mode goes away', () => {
+    const session = new Session({ workingDir: '/tmp', mode: 'claude' });
+
+    handleOutput(session, '\x1b[?1000h\x1b[?1002h\x1b[?1006h');
+    expect(trackingOf(session)).toBe(true);
+
+    // A TUI may disable a mode it never enabled; that must not clear the rest.
+    handleOutput(session, '\x1b[?1003l');
+    expect(trackingOf(session)).toBe(true);
+
+    handleOutput(session, '\x1b[?1000l');
+    expect(trackingOf(session)).toBe(true);
+
+    handleOutput(session, '\x1b[?1002l');
+    expect(trackingOf(session)).toBeUndefined();
+  });
+
+  it('emits only on a real transition, so a repainting TUI costs nothing', () => {
+    const session = new Session({ workingDir: '/tmp', mode: 'claude' });
+    const changes: boolean[] = [];
+    session.on('mouseTrackingChanged', (active: boolean) => changes.push(active));
+
+    handleOutput(session, '\x1b[?1002h\x1b[?1002h\x1b[?1002h');
+
+    expect(changes).toEqual([true]);
+  });
+
+  it('sees a sequence split across PTY chunks, like the strip that carries it', () => {
+    const session = new Session({ workingDir: '/tmp', mode: 'claude' });
+
+    handleOutput(session, 'before\x1b[?100');
+    handleOutput(session, '2h after');
+
+    expect(session.terminalBuffer).toBe('before after');
+    expect(trackingOf(session)).toBe(true);
+  });
+
+  it('tracks nothing for a mode whose DECSETs are never stripped', () => {
+    // shell keeps its mouse DECSETs, so xterm sees them and owns the reporting.
+    // A flag set here would mean a SECOND, hand-encoded report on every click.
+    const session = new Session({ workingDir: '/tmp', mode: 'shell', useMux: true });
+
+    handleOutput(session, '\x1b[?1002hhtop');
+
+    expect(trackingOf(session)).toBeUndefined();
+    expect(session.terminalBuffer).toBe('\x1b[?1002hhtop');
+  });
+});

test/cli-executable-resolver.test.ts

@@ -0,0 +1,400 @@
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { EXEC_TIMEOUT_MS } from '../src/config/exec-timeout.js';
+import {
+  cliResolveRetryDelayMs,
+  createCliExecutableResolver,
+  createProductionCliResolverHost,
+  formatCliNotFoundMessage,
+  type CliResolverHost,
+} from '../src/utils/cli-executable-resolver.js';
+
+// Pass-through spy on execFileSync so the vitest-hermeticity test below can
+// PROVE the un-injected production host never spawns anything.
+const { execFileSyncSpy } = vi.hoisted(() => ({ execFileSyncSpy: vi.fn() }));
+vi.mock('node:child_process', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:child_process')>();
+  execFileSyncSpy.mockImplementation(actual.execFileSync as (...args: unknown[]) => unknown);
+  return { ...actual, execFileSync: execFileSyncSpy };
+});
+
+const BEGIN_MARKER = '__CODEMAN_CLI_RESOLVE_BEGIN__';
+const END_MARKER = '__CODEMAN_CLI_RESOLVE_END__';
+
+const temporaryDirectories: string[] = [];
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+function host(overrides: Partial<CliResolverHost> = {}): CliResolverHost {
+  return {
+    processPath: '/usr/bin:/bin',
+    shellPath: '/bin/bash',
+    shellArgs: ['-i', '-l'],
+    findOnProcessPath: vi.fn(() => null),
+    findInLoginShell: vi.fn(() => null),
+    exists: vi.fn(() => false),
+    ...overrides,
+  };
+}
+
+describe('createCliExecutableResolver', () => {
+  it('prefers the server process PATH over common directories and the login shell', () => {
+    const h = host({
+      findOnProcessPath: vi.fn(() => '/process/bin/codex'),
+      findInLoginShell: vi.fn(() => '/shell/bin/codex'),
+      exists: vi.fn(() => true),
+    });
+    const resolver = createCliExecutableResolver({ binary: 'codex', searchDirs: ['/known/bin'] }, h);
+
+    expect(resolver.resolve()).toMatchObject({ binaryPath: '/process/bin/codex', source: 'process-path' });
+    expect(h.exists).toHaveBeenCalledTimes(1);
+    expect(h.findInLoginShell).not.toHaveBeenCalled();
+  });
+
+  it('prefers common directories in order over the login shell', () => {
+    const h = host({
+      findInLoginShell: vi.fn(() => '/shell/bin/codex'),
+      exists: vi.fn((path) => path === '/second/bin/codex' || path === '/shell/bin/codex'),
+    });
+    const resolver = createCliExecutableResolver({ binary: 'codex', searchDirs: ['/first/bin', '/second/bin'] }, h);
+
+    expect(resolver.resolve()).toMatchObject({ binaryPath: '/second/bin/codex', source: 'common-directory' });
+    expect(h.exists).toHaveBeenNthCalledWith(1, '/first/bin/codex');
+    expect(h.exists).toHaveBeenNthCalledWith(2, '/second/bin/codex');
+    expect(h.findInLoginShell).not.toHaveBeenCalled();
+  });
+
+  it('finds an executable exposed only by the interactive login shell', () => {
+    const h = host({
+      findInLoginShell: vi.fn(() => '/home/u/.nvm/versions/node/v22/bin/codex'),
+      exists: vi.fn((path) => path === '/home/u/.nvm/versions/node/v22/bin/codex'),
+    });
+    const resolver = createCliExecutableResolver({ binary: 'codex', searchDirs: ['/known/bin'] }, h);
+
+    expect(resolver.resolve()).toMatchObject({
+      binaryPath: '/home/u/.nvm/versions/node/v22/bin/codex',
+      directory: '/home/u/.nvm/versions/node/v22/bin',
+      source: 'login-shell',
+    });
+  });
+
+  it('continues after a validator rejects an earlier candidate', () => {
+    const h = host({
+      findOnProcessPath: vi.fn(() => '/usr/bin/pi'),
+      findInLoginShell: vi.fn(() => '/home/u/.npm/bin/pi'),
+      exists: vi.fn(() => true),
+    });
+    const resolver = createCliExecutableResolver(
+      {
+        binary: 'pi',
+        searchDirs: [],
+        validateCandidate: (path) =>
+          path.includes('.npm') ? { accepted: true, metadata: '0.84.1' } : { accepted: false },
+      },
+      h
+    );
+
+    expect(resolver.resolve()).toMatchObject({
+      binaryPath: '/home/u/.npm/bin/pi',
+      source: 'login-shell',
+      metadata: '0.84.1',
+    });
+  });
+
+  it('caches success, and retries a miss only after the backoff elapses', () => {
+    let now = 0;
+    const findInLoginShell = vi.fn<() => string | null>().mockReturnValueOnce(null).mockReturnValue('/new/bin/codex');
+    const h = host({ findInLoginShell, exists: vi.fn((path) => path === '/new/bin/codex') });
+    const resolver = createCliExecutableResolver({ binary: 'codex', searchDirs: [], now: () => now }, h);
+
+    expect(resolver.resolve()).toBeNull();
+    // Within the backoff window the miss is answered from the negative cache:
+    // the chain — whose login-shell tail is a synchronous 5s-bounded spawn —
+    // must NOT re-run per call, or a missing CLI stalls every status request.
+    now = cliResolveRetryDelayMs(1) - 1;
+    expect(resolver.resolve()).toBeNull();
+    expect(findInLoginShell).toHaveBeenCalledTimes(1);
+
+    // Once the backoff elapses the retry runs, so installing a CLI while the
+    // server is up is still picked up without a restart.
+    now = cliResolveRetryDelayMs(1);
+    expect(resolver.resolve()?.binaryPath).toBe('/new/bin/codex');
+    expect(resolver.resolve()?.binaryPath).toBe('/new/bin/codex');
+    expect(findInLoginShell).toHaveBeenCalledTimes(2);
+  });
+
+  it('doubles the retry delay per consecutive miss and caps it at five minutes', () => {
+    let now = 0;
+    const findInLoginShell = vi.fn(() => null);
+    const resolver = createCliExecutableResolver(
+      { binary: 'codex', searchDirs: [], now: () => now },
+      host({ findInLoginShell })
+    );
+
+    expect(cliResolveRetryDelayMs(0)).toBe(0);
+    expect(cliResolveRetryDelayMs(1)).toBe(60_000);
+    expect(cliResolveRetryDelayMs(2)).toBe(120_000);
+    expect(cliResolveRetryDelayMs(3)).toBe(240_000);
+    expect(cliResolveRetryDelayMs(4)).toBe(300_000);
+    expect(cliResolveRetryDelayMs(60)).toBe(300_000);
+
+    // Consecutive misses stack: after the second miss the SECOND delay applies.
+    expect(resolver.resolve()).toBeNull();
+    now += cliResolveRetryDelayMs(1);
+    expect(resolver.resolve()).toBeNull();
+    expect(findInLoginShell).toHaveBeenCalledTimes(2);
+    now += cliResolveRetryDelayMs(2) - 1;
+    expect(resolver.resolve()).toBeNull();
+    expect(findInLoginShell).toHaveBeenCalledTimes(2);
+    now += 1;
+    expect(resolver.resolve()).toBeNull();
+    expect(findInLoginShell).toHaveBeenCalledTimes(3);
+  });
+
+  it('rejects unsafe binary names', () => {
+    const h = host();
+
+    expect(() => createCliExecutableResolver({ binary: 'codex;id', searchDirs: [] }, h)).toThrow(
+      'Unsafe CLI binary name'
+    );
+    expect(() => createCliExecutableResolver({ binary: '../codex', searchDirs: [] }, h)).toThrow(
+      'Unsafe CLI binary name'
+    );
+  });
+
+  it('rejects relative and nonexistent candidates', () => {
+    let now = 0;
+    const findInLoginShell = vi
+      .fn<() => string | null>()
+      .mockReturnValueOnce('relative/codex')
+      .mockReturnValue('/missing/codex');
+    const h = host({ findInLoginShell, exists: vi.fn(() => false) });
+    const resolver = createCliExecutableResolver({ binary: 'codex', searchDirs: [], now: () => now }, h);
+
+    expect(resolver.resolve()).toBeNull();
+    now = cliResolveRetryDelayMs(1);
+    expect(resolver.resolve()).toBeNull();
+    expect(h.exists).toHaveBeenCalledTimes(1);
+    expect(h.exists).toHaveBeenCalledWith('/missing/codex');
+  });
+});
+
+describe('formatCliNotFoundMessage', () => {
+  it('includes only the base install hint and bounded resolution diagnostics', () => {
+    const base = 'Codex CLI not found. Install with: npm install -g @openai/codex';
+    const diagnostics = {
+      binary: 'codex',
+      processPath: '/usr/bin:/bin',
+      shellPath: '/bin/bash',
+      shellArgs: ['-i', '-l'],
+      searchDirs: ['/home/u/.local/bin', '/usr/local/bin'],
+      API_KEY: 'super-secret',
+    };
+    const message = formatCliNotFoundMessage(base, diagnostics);
+
+    expect(message).toContain(base);
+    expect(message).toContain('Server PATH: /usr/bin:/bin');
+    expect(message).toContain('Login shell: /bin/bash -i -l');
+    expect(message).toContain('Checked directories: /home/u/.local/bin, /usr/local/bin');
+    expect(message).not.toContain('API_KEY');
+    expect(message).not.toContain('super-secret');
+  });
+
+  it('marks empty diagnostic values without dumping arbitrary environment data', () => {
+    const message = formatCliNotFoundMessage('Missing CLI', {
+      binary: 'codex',
+      processPath: '',
+      shellPath: '',
+      shellArgs: [],
+      searchDirs: [],
+    });
+
+    expect(message).toBe('Missing CLI\nServer PATH: (empty)\nLogin shell: (none)\nChecked directories: (none)');
+    expect(message).not.toContain('HOME=');
+    expect(message).not.toContain('TOKEN=');
+  });
+
+  it('flattens control characters and bounds every diagnostic field', () => {
+    const pathological = `first\r\nforged label: value\u0000${'x'.repeat(10_000)}`;
+    const message = formatCliNotFoundMessage('Missing CLI', {
+      binary: 'codex',
+      processPath: pathological,
+      shellPath: pathological,
+      shellArgs: [pathological],
+      searchDirs: [pathological, pathological],
+    });
+    const lines = message.split('\n');
+
+    expect(lines).toHaveLength(4);
+    expect(lines[1]).toMatch(/^Server PATH: first forged label: value x+…$/);
+    expect(lines[2]).toMatch(/^Login shell: first forged label: value x+…$/);
+    expect(lines[3]).toMatch(/^Checked directories: first forged label: value x+…$/);
+    expect(lines.slice(1).every((line) => line.length <= 1_050)).toBe(true);
+  });
+});
+
+describe('createProductionCliResolverHost', () => {
+  // Hermeticity gate (the guards PR #329 deleted, restored shared): under
+  // vitest an un-injected host must neither scan the machine nor spawn a login
+  // shell — route tests hitting the per-CLI status endpoints would otherwise
+  // walk the real PATH and execute real binaries on whatever box runs the suite.
+  it('never scans the machine or spawns a login shell under vitest without injected IO', () => {
+    const root = mkdtempSync(join(tmpdir(), 'codeman-cli-vitest-gate-'));
+    temporaryDirectories.push(root);
+    writeFileSync(join(root, 'codex'), '#!/bin/sh\n');
+    chmodSync(join(root, 'codex'), 0o755);
+    execFileSyncSpy.mockClear();
+
+    const gatedHost = createProductionCliResolverHost({
+      processPath: root,
+      shellPath: '/bin/bash',
+      shellArgs: ['-i', '-l'],
+    });
+
+    // The real, executable candidate is invisible: the filesystem predicate is inert.
+    expect(gatedHost.findOnProcessPath('codex')).toBeNull();
+    expect(gatedHost.exists(join(root, 'codex'))).toBe(false);
+    // The login-shell step yields nothing and never reaches execFileSync.
+    expect(gatedHost.findInLoginShell('codex')).toBeNull();
+    expect(execFileSyncSpy).not.toHaveBeenCalled();
+
+    // The same fixture through the test-only real-IO opt-in IS found, proving
+    // the nulls above come from the vitest gate rather than from the fixture.
+    const optedInHost = createProductionCliResolverHost({
+      processPath: root,
+      shellPath: '/bin/bash',
+      shellArgs: ['-i', '-l'],
+      runCommand: () => '',
+      allowRealIoUnderVitest: true,
+    });
+    expect(optedInHost.findOnProcessPath('codex')).toBe(join(root, 'codex'));
+  });
+
+  it('resolves through injected IO hooks under vitest (injection is the opt-in)', () => {
+    const runCommand = vi.fn(() => `${BEGIN_MARKER}\n/home/u/.nvm/bin/codex\n${END_MARKER}`);
+    const productionHost = createProductionCliResolverHost({
+      processPath: '',
+      shellPath: '/bin/bash',
+      shellArgs: ['-i', '-l'],
+      runCommand,
+      isExecutableFile: () => true,
+    });
+    const resolver = createCliExecutableResolver({ binary: 'codex', searchDirs: [] }, productionHost);
+
+    expect(resolver.resolve()).toMatchObject({
+      binaryPath: '/home/u/.nvm/bin/codex',
+      source: 'login-shell',
+    });
+    expect(runCommand).toHaveBeenCalledTimes(1);
+  });
+
+  it('searches the captured process PATH directly in directory order without running a command', () => {
+    const runCommand = vi.fn(() => '');
+    const isExecutableFile = vi.fn((path: string) => path === '/second/bin/codex');
+    const productionHost = createProductionCliResolverHost({
+      processPath: '/first/bin:/second/bin:/third/bin',
+      shellPath: '/bin/bash',
+      shellArgs: ['-i', '-l'],
+      runCommand,
+      isExecutableFile,
+    });
+
+    expect(productionHost.findOnProcessPath('codex')).toBe('/second/bin/codex');
+    expect(isExecutableFile).toHaveBeenNthCalledWith(1, '/first/bin/codex');
+    expect(isExecutableFile).toHaveBeenNthCalledWith(2, '/second/bin/codex');
+    expect(runCommand).not.toHaveBeenCalled();
+  });
+
+  it('accepts only executable regular files with the production predicate', () => {
+    const root = mkdtempSync(join(tmpdir(), 'codeman-cli-resolver-'));
+    temporaryDirectories.push(root);
+    const executableDirectory = join(root, 'executable');
+    const plainDirectory = join(root, 'plain');
+    const directoryCandidate = join(root, 'directory');
+    mkdirSync(executableDirectory);
+    mkdirSync(plainDirectory);
+    mkdirSync(directoryCandidate);
+    writeFileSync(join(executableDirectory, 'codex'), '#!/bin/sh\n');
+    chmodSync(join(executableDirectory, 'codex'), 0o755);
+    writeFileSync(join(plainDirectory, 'codex'), '#!/bin/sh\n');
+    mkdirSync(join(directoryCandidate, 'codex'));
+    const productionHost = createProductionCliResolverHost({
+      processPath: [directoryCandidate, plainDirectory, executableDirectory].join(':'),
+      shellPath: '/bin/bash',
+      shellArgs: ['-i', '-l'],
+      // This test exists to exercise the REAL executable-regular-file predicate
+      // against its own temp fixtures, so it opts out of the vitest inert-IO
+      // gate; the stubbed runCommand keeps the login-shell path inert anyway.
+      runCommand: () => '',
+      allowRealIoUnderVitest: true,
+    });
+
+    expect(productionHost.findOnProcessPath('codex')).toBe(join(executableDirectory, 'codex'));
+  });
+
+  it('uses the resolved shell, allowlisted args, tagged command, and bounded timeout', () => {
+    const runCommand = vi.fn(() =>
+      ['/profile/absolute-noise', BEGIN_MARKER, '/home/u/.nvm/bin/codex', END_MARKER, '/exit-trap/absolute-noise'].join(
+        '\n'
+      )
+    );
+    const productionHost = createProductionCliResolverHost({
+      processPath: '',
+      shellPath: '/usr/bin/fish',
+      shellArgs: ['-i', '-l'],
+      runCommand,
+      isExecutableFile: () => true,
+    });
+
+    expect(productionHost.findInLoginShell('codex')).toBe('/home/u/.nvm/bin/codex');
+    expect(runCommand).toHaveBeenCalledWith(
+      '/usr/bin/fish',
+      ['-i', '-l', '-c', `printf '%s\\n' '${BEGIN_MARKER}'; command -v -- codex; printf '%s\\n' '${END_MARKER}'`],
+      {
+        encoding: 'utf8',
+        timeout: EXEC_TIMEOUT_MS,
+        stdio: ['ignore', 'pipe', 'ignore'],
+        // SIGKILL is load-bearing: interactive bash ignores SIGTERM, and
+        // execFileSync's timeout only sends the signal, then keeps waiting.
+        killSignal: 'SIGKILL',
+      }
+    );
+  });
+
+  it.each([
+    ['mismatched basename', `${BEGIN_MARKER}\n/opt/bin/not-codex\n${END_MARKER}`],
+    ['missing begin marker', `/opt/bin/codex\n${END_MARKER}`],
+    ['missing end marker', `${BEGIN_MARKER}\n/opt/bin/codex`],
+    ['absolute output outside markers', `/profile/codex\n${BEGIN_MARKER}\nrelative/codex\n${END_MARKER}\n/exit/codex`],
+  ])('rejects malformed tagged shell output: %s', (_name, output) => {
+    const productionHost = createProductionCliResolverHost({
+      processPath: '',
+      shellPath: '/bin/bash',
+      shellArgs: ['-i', '-l'],
+      runCommand: () => output,
+      isExecutableFile: () => true,
+    });
+
+    expect(productionHost.findInLoginShell('codex')).toBeNull();
+  });
+
+  it('returns null when the shell command throws', () => {
+    const productionHost = createProductionCliResolverHost({
+      processPath: '',
+      shellPath: '/bin/bash',
+      shellArgs: ['-i', '-l'],
+      runCommand: () => {
+        throw new Error('exit 1');
+      },
+      isExecutableFile: () => true,
+    });
+
+    expect(productionHost.findInLoginShell('codex')).toBeNull();
+  });
+});

test/codex-snapshot-replay.test.ts

@@ -32,7 +32,7 @@ describe('xterm snapshot/replay (codex tab-switch)', () => {
     const declaration = source.indexOf('let restoredSnapshot = false;', selectStart);
     const snapshotBranch = source.indexOf("if (snapshot && !sessionIsBusy && session?.mode !== 'shell')", selectStart);
     const rewriteDecision = source.indexOf(
-      'restoredSnapshot || clearedForBusy || data.terminalBuffer !== cachedBuffer',
+      'restoredSnapshot || clearedBeforeFresh || data.terminalBuffer !== cachedBuffer',
       selectStart
     );
 
@@ -58,7 +58,9 @@ describe('xterm snapshot/replay (codex tab-switch)', () => {
     // Snapshot restore must NOT short-circuit the canonical fetch.
     expect(snapshotBlock).not.toContain('this._finishBufferLoad();');
     expect(postSnapshotRestore).toContain('restoredSnapshot');
-    expect(postSnapshotRestore).toContain('restoredSnapshot || clearedForBusy || data.terminalBuffer !== cachedBuffer');
+    expect(postSnapshotRestore).toContain(
+      'restoredSnapshot || clearedBeforeFresh || data.terminalBuffer !== cachedBuffer'
+    );
   });
 
   it('forces replay after clearing a busy tab even when the fetched frame matches cache', () => {
@@ -71,8 +73,8 @@ describe('xterm snapshot/replay (codex tab-switch)', () => {
     expect(cacheRestore).toBeGreaterThan(-1);
     expect(busyClear).toBeGreaterThan(cacheRestore);
     expect(needsRewrite).toBeGreaterThan(busyClear);
-    expect(replayBlock).toContain('clearedForBusy');
-    expect(replayBlock).toContain('restoredSnapshot || clearedForBusy || data.terminalBuffer !== cachedBuffer');
+    expect(replayBlock).toContain('clearedBeforeFresh');
+    expect(replayBlock).toContain('restoredSnapshot || clearedBeforeFresh || data.terminalBuffer !== cachedBuffer');
   });
 
   it('loads the SerializeAddon and keeps a per-session snapshot map', () => {

test/dependency-security.test.ts

@@ -90,10 +90,12 @@ function expectNoVulnerableBraceExpansion(lock: PackageLock): void {
   expect(versions, 'brace-expansion should be present in package-lock.json').not.toHaveLength(0);
   for (const version of versions) {
     const major = Number(version.split('.')[0]);
+    // GHSA-3jxr-9vmj-r5cp (exponential-time expansion DoS) covers <=1.1.17 || 3.0.0 - 5.0.8,
+    // which is why both live branches moved up rather than just the 5.x one.
     if (major === 1) {
       expect(
-        compareVersions(version, '1.1.13'),
-        `brace-expansion@${version} should be >= 1.1.13`
+        compareVersions(version, '1.1.18'),
+        `brace-expansion@${version} should be >= 1.1.18`
       ).toBeGreaterThanOrEqual(0);
     } else if (major === 4) {
       expect(
@@ -101,7 +103,7 @@ function expectNoVulnerableBraceExpansion(lock: PackageLock): void {
         `brace-expansion@${version} should not remain on vulnerable 4.x`
       ).toBeGreaterThanOrEqual(0);
     } else if (major === 5) {
-      expect(compareVersions(version, '5.0.6'), `brace-expansion@${version} should be >= 5.0.6`).toBeGreaterThanOrEqual(
+      expect(compareVersions(version, '5.0.9'), `brace-expansion@${version} should be >= 5.0.9`).toBeGreaterThanOrEqual(
         0
       );
     }
@@ -113,7 +115,7 @@ describe('dependency security policy', () => {
     const rootPackage = readJson<PackageLockPackage>('package.json');
     const xtermPackage = readJson<PackageLockPackage>('packages/xterm-zerolag-input/package.json');
 
-    expect(rootPackage.dependencies?.['@fastify/static']).toBe('^9.1.3');
+    expect(rootPackage.dependencies?.['@fastify/static']).toBe('^10.1.3');
     expect(rootPackage.dependencies?.fastify).toBe('^5.8.5');
     expect(rootPackage.dependencies?.uuid).toBe('^14.0.0');
     expect(rootPackage.devDependencies?.['@remotion/cli']).toBe('4.0.473');
@@ -130,11 +132,21 @@ describe('dependency security policy', () => {
     expectEveryLockedVersionAtLeast(lock, 'vitest', '4.1.0');
     expectEveryLockedVersionAtLeast(lock, '@vitest/coverage-v8', '4.1.0');
     expectEveryLockedVersionAtLeast(lock, 'fastify', '5.8.5');
-    expectEveryLockedVersionAtLeast(lock, '@fastify/static', '9.1.3');
+    // GHSA-8pvw-jcv7-9cmj (authorization bypass via non-canonical URL paths) covers
+    // <=10.1.1, so every 9.x is affected and the fix is only on the 10.x line.
+    expectEveryLockedVersionAtLeast(lock, '@fastify/static', '10.1.2');
     expectEveryLockedVersionAtLeast(lock, 'ip-address', '10.2.0');
     expectEveryLockedVersionAtLeast(lock, 'uuid', '14.0.0');
+    // ⚠️ Floor stays 8.20.1, NOT 8.21.0. Production ws is already 8.21.0 and clear of
+    // GHSA-96hv-2xvq-fx4p, but @remotion/renderer bundles its own ws@8.20.1 and remotion
+    // is pinned to 4.0.473 on purpose (the compositor refuses to start on a version
+    // mismatch). That copy is devDependencies-only and never ships to users.
     expectEveryLockedVersionAtLeast(lock, 'ws', '8.20.1');
-    expectEveryLockedVersionAtLeast(lock, 'fast-uri', '3.1.2');
+    // GHSA-v2hh-gcrm-f6hx (host confusion via literal backslash authority delimiter)
+    // covers 3.0.0 - 3.1.4.
+    expectEveryLockedVersionAtLeast(lock, 'fast-uri', '3.1.5');
+    // GHSA-c96f-x56v-gq3h (HTTP/2 DDoS) covers <=9.6.0.
+    expectEveryLockedVersionAtLeast(lock, 'find-my-way', '9.7.0');
     expectEveryLockedVersionAtLeast(lock, 'basic-ftp', '5.3.1');
     expectEveryLockedVersionAtLeast(lock, 'flatted', '3.4.2');
     expectNoVulnerableBraceExpansion(lock);

test/file-query.test.ts

@@ -0,0 +1,98 @@
+/**
+ * @fileoverview Tests for the pure file-query matcher (COD-236).
+ *
+ * Node-safe: no fs, no ports, no jsdom. Just the compile/apply matcher.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { compileFileQuery, matchFileQuery } from '../src/utils/file-query.js';
+
+describe('compileFileQuery', () => {
+  it('returns null for empty / whitespace-only queries', () => {
+    expect(compileFileQuery('')).toBeNull();
+    expect(compileFileQuery('   ')).toBeNull();
+    expect(compileFileQuery('\t\n')).toBeNull();
+  });
+
+  it('does a case-insensitive substring match on the name by default', () => {
+    const m = compileFileQuery('Route');
+    expect(m).not.toBeNull();
+    expect(m!('file-routes.ts', 'src/web/file-routes.ts')).toBe(true);
+    expect(m!('FILE-ROUTES.TS', 'src/FILE-ROUTES.TS')).toBe(true);
+    expect(m!('session.ts', 'src/session.ts')).toBe(false);
+  });
+
+  it('matches against the relative path when the query contains a slash (substring)', () => {
+    const m = compileFileQuery('web/file');
+    expect(m).not.toBeNull();
+    // Name alone would not contain the slash — must match the relative path.
+    expect(m!('file-routes.ts', 'src/web/file-routes.ts')).toBe(true);
+    expect(m!('file-routes.ts', 'src/api/file-routes.ts')).toBe(false);
+  });
+
+  it('compiles an anchored, case-insensitive glob for * against the name', () => {
+    const m = compileFileQuery('*.ts');
+    expect(m).not.toBeNull();
+    expect(m!('session.ts', 'src/session.ts')).toBe(true);
+    expect(m!('SESSION.TS', 'src/SESSION.TS')).toBe(true);
+    // Anchored: .ts must be at the end, not merely contained.
+    expect(m!('session.tsx', 'src/session.tsx')).toBe(false);
+    expect(m!('notes.md', 'notes.md')).toBe(false);
+  });
+
+  it('treats ? as a single-character glob wildcard', () => {
+    const m = compileFileQuery('a?c.txt');
+    expect(m).not.toBeNull();
+    expect(m!('abc.txt', 'abc.txt')).toBe(true);
+    expect(m!('axc.txt', 'axc.txt')).toBe(true);
+    // ? matches exactly one char, not zero and not two.
+    expect(m!('ac.txt', 'ac.txt')).toBe(false);
+    expect(m!('abbc.txt', 'abbc.txt')).toBe(false);
+  });
+
+  it('escapes regex metacharacters other than * and ? in glob mode', () => {
+    // The dot is a literal, not "any char"; the + is literal too.
+    const m = compileFileQuery('v1.2+*.log');
+    expect(m).not.toBeNull();
+    expect(m!('v1.2+final.log', 'v1.2+final.log')).toBe(true);
+    expect(m!('v1X2Yfinal.log', 'v1X2Yfinal.log')).toBe(false);
+  });
+
+  it('matches a glob against the relative path when it contains a slash', () => {
+    const m = compileFileQuery('src/*.ts');
+    expect(m).not.toBeNull();
+    expect(m!('session.ts', 'src/session.ts')).toBe(true);
+    expect(m!('session.ts', 'lib/session.ts')).toBe(false);
+  });
+
+  it('stays fast on a pathological star-heavy pattern (no regex backtracking)', () => {
+    // `*a*a*a…` compiled to `^.*a.*a…$` is the classic backtracking blowup —
+    // as a RegExp this match takes effectively forever and this test fails by
+    // timeout. The two-pointer glob walk answers it in linear-ish time; the
+    // 500ms ceiling is generous so a loaded CI box cannot flake it.
+    const m = compileFileQuery('*a'.repeat(40) + 'b');
+    expect(m).not.toBeNull();
+    const started = performance.now();
+    expect(m!('a'.repeat(200), 'a'.repeat(200))).toBe(false);
+    expect(performance.now() - started).toBeLessThan(500);
+  });
+
+  it('treats an overlong query as no search, like an empty one', () => {
+    // The glob walk is O(text · pattern); the length cap is what bounds it.
+    expect(compileFileQuery('a'.repeat(257))).toBeNull();
+    expect(compileFileQuery('a'.repeat(256))).not.toBeNull();
+  });
+});
+
+describe('matchFileQuery', () => {
+  it('compiles then applies in one call', () => {
+    expect(matchFileQuery('route', 'file-routes.ts', 'src/file-routes.ts')).toBe(true);
+    expect(matchFileQuery('*.md', 'readme.md', 'docs/readme.md')).toBe(true);
+    expect(matchFileQuery('*.md', 'readme.txt', 'docs/readme.txt')).toBe(false);
+  });
+
+  it('returns false when the query compiles to null (empty)', () => {
+    expect(matchFileQuery('', 'anything.ts', 'src/anything.ts')).toBe(false);
+    expect(matchFileQuery('   ', 'anything.ts', 'src/anything.ts')).toBe(false);
+  });
+});

test/history-truncation-notice.test.ts

@@ -122,6 +122,18 @@ describe('the in-terminal truncation line is gone (static guard)', () => {
     expect(app).not.toContain('earlier output truncated for performance');
   });
 
+  it('loads a bounded shell tail first and keeps full history user-triggered', () => {
+    const app = readFileSync(resolve(PUBLIC, 'app.js'), 'utf8');
+    expect(app).toContain("session?.mode !== 'shell' && !this._fullHistoryLoaded.has(sessionId)");
+    expect(app).toContain("!restoredSnapshot && session?.mode !== 'shell'");
+    expect(app).toContain('`/api/sessions/${sessionId}/terminal?tail=${TERMINAL_TAIL_SIZE}`');
+    expect(app).toContain('fetch(`/api/sessions/${sessionId}/terminal?full=1`)');
+    expect(app).toContain("if (this.sessions.get(sessionId)?.mode !== 'shell')");
+    expect(app).toContain("if (session?.mode === 'shell')");
+    expect(app).toContain("if (!force && session?.mode === 'shell') return;");
+    expect(app).toContain("trigger: force ? 'full-history-button' : 'full-history-scroll'");
+  });
+
   it('renders the banner through textContent, never innerHTML', () => {
     const app = readFileSync(resolve(PUBLIC, 'app.js'), 'utf8');
     const start = app.indexOf('_renderHistoryTruncationBanner() {');

test/input-cjk.test.ts

@@ -5,7 +5,7 @@
  * composition/keydown/input event sequences against a stub textarea.
  * Focus: the intermittent "Chinese characters silently lost" failure modes —
  * stuck composition state, deferred flush racing the next composition, and
- * the keydown-echo suppression window swallowing a real IME commit.
+ * physical-key punctuation transformed into full-width IME output.
  */
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
@@ -116,6 +116,36 @@ describe('CJK input module', () => {
     expect(textarea.value).toBe(PHANTOM);
   });
 
+  it('lets the IME transform printable keys before sending full-width punctuation', () => {
+    const { textarea, sent } = loadCjkHarness();
+    const committed = Array.from('，。！？；：“”、《》、（）');
+    const physicalKeys = [',', '.', '!', '?', ';', ':', '"', '"', '\\', '<', '>', '\\', '(', ')'];
+
+    textarea.fire('compositionstart');
+    textarea.value = PHANTOM + '中文';
+    textarea.fire('input', { isComposing: true, inputType: 'insertCompositionText' });
+    textarea.fire('compositionend');
+    vi.advanceTimersByTime(10);
+    vi.advanceTimersByTime(1000);
+
+    for (const [index, punctuation] of committed.entries()) {
+      const preventDefault = vi.fn();
+      textarea.fire('keydown', {
+        key: physicalKeys[index],
+        ctrlKey: false,
+        altKey: false,
+        metaKey: false,
+        preventDefault,
+      });
+      expect(preventDefault).not.toHaveBeenCalled();
+
+      textarea.value = PHANTOM + punctuation;
+      textarea.fire('input', { isComposing: false, inputType: 'insertText' });
+    }
+
+    expect(sent).toEqual(['中文', ...committed]);
+  });
+
   it('recovers committed text when compositionend never fires (stuck composition)', () => {
     const { textarea, sent } = loadCjkHarness();
 
@@ -124,6 +154,7 @@ describe('CJK input module', () => {
     textarea.value = PHANTOM + '你好';
     // The commit arrives as a plain input event outside composition.
     textarea.fire('input', { isComposing: false, inputType: 'insertText' });
+    expect(sent).toEqual([]);
     vi.advanceTimersByTime(200);
 
     expect(sent).toEqual(['你好']);
@@ -151,30 +182,28 @@ describe('CJK input module', () => {
     expect(sent).toEqual(['你好世界']);
   });
 
-  it('does not discard an IME commit landing inside the keydown echo window', () => {
+  it('sends the transformed IME commit that follows a printable keydown', () => {
     const { textarea, sent } = loadCjkHarness();
 
-    // English char goes out immediately via keydown.
+    vi.advanceTimersByTime(1000);
+    // The physical key is not committed text and must not be sent by itself.
     textarea.fire('keydown', { key: 'a', ctrlKey: false, altKey: false, metaKey: false });
-    expect(sent).toEqual(['a']);
+    expect(sent).toEqual([]);
 
-    // Within 100ms the IME commits Chinese via a bare input event.
+    // The browser/IME supplies the canonical text in the following input.
     vi.advanceTimersByTime(50);
     textarea.value = PHANTOM + '你好';
     textarea.fire('input', { isComposing: false, inputType: 'insertText' });
-    vi.advanceTimersByTime(200);
 
-    expect(sent).toEqual(['a', '你好']);
+    expect(sent).toEqual(['你好']);
   });
 
-  it('still suppresses the true textarea echo of a keydown-sent character', () => {
+  it('sends a printable physical key exactly once after its input event', () => {
     const { textarea, sent } = loadCjkHarness();
 
     textarea.fire('keydown', { key: 'a', ctrlKey: false, altKey: false, metaKey: false });
-    expect(sent).toEqual(['a']);
+    expect(sent).toEqual([]);
 
-    // Third-party IME ignored preventDefault — the same char echoes into
-    // the textarea. It must be dropped, not sent twice.
     vi.advanceTimersByTime(10);
     textarea.value = PHANTOM + 'a';
     textarea.fire('input', { isComposing: false, inputType: 'insertText' });
@@ -242,6 +271,8 @@ describe('CJK input module', () => {
     vi.advanceTimersByTime(10);
 
     textarea.fire('keydown', { key: '囍', ctrlKey: false, altKey: false, metaKey: false });
+    textarea.value = PHANTOM + '囍';
+    textarea.fire('input', { isComposing: false, inputType: 'insertText' });
     textarea.value = PHANTOM + '秘密';
     textarea.fire('blur');
     expect(sent).toEqual(['秘密口令', '囍']);

test/mobile-keyboard-bottom-padding.test.ts

@@ -0,0 +1,178 @@
+// Port: none (pure logic in a vm context — no browser, no server).
+//
+// On phones the toolbar and the keyboard accessory bar are `position: fixed`, so
+// they take no layout space: `main`'s padding-bottom is the ONLY thing reserving
+// room for them, and every pixel taken out of it is a pixel of terminal painted
+// underneath them.
+//
+// `_shrinkPaddingToFit` reclaims the sub-row slack left after a keyboard-driven
+// re-fit. It used to take the whole slack, which pulled the terminal's bottom edge
+// down under those bars — and the row the following re-fit gained was painted
+// behind them, clipping the last line of a long wrapped prompt: the bottom half of
+// the text being typed. The floor is now the bars' MEASURED height.
+//
+// Lives outside test/mobile/ deliberately — that suite is Playwright-driven and
+// excluded from `npm run test:ci`, so a regression guarded only there is invisible
+// to CI (same reasoning as terminal-scroll-intent.test.ts).
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import vm from 'node:vm';
+import { describe, expect, it } from 'vitest';
+
+const SOURCE = readFileSync(resolve(import.meta.dirname, '../src/web/public/mobile-handlers.js'), 'utf8');
+
+interface Bar {
+  offsetHeight: number;
+  hidden?: boolean;
+}
+
+interface Setup {
+  paddingBottom: string;
+  containerHeight: number;
+  rows: number;
+  cellH: number;
+  bars: Partial<Record<'.toolbar' | '.keyboard-accessory-bar' | '#cjkInput.cjk-input-visible', Bar>>;
+}
+
+/**
+ * Load mobile-handlers.js and hand back its KeyboardHandler plus the fake `main`
+ * whose inline padding the function edits.
+ *
+ * `const KeyboardHandler = {...}` is a lexical binding that does not survive to a
+ * second `vm.runInContext`, so the export is appended to the SAME script.
+ */
+function loadHandler(setup: Setup) {
+  const main = { style: { paddingBottom: setup.paddingBottom } };
+  const container = { clientHeight: setup.containerHeight };
+  let fits = 0;
+  const app = {
+    terminal: {
+      rows: setup.rows,
+      _core: { _renderService: { dimensions: { css: { cell: { height: setup.cellH } } } } },
+    },
+    fitAddon: {
+      fit: () => {
+        fits++;
+      },
+    },
+  };
+  const context = vm.createContext({
+    console,
+    app,
+    navigator: { userAgent: 'test', maxTouchPoints: 1 },
+    window: {
+      addEventListener: () => {},
+      matchMedia: () => ({ matches: false }),
+      scrollTo: () => {},
+      getComputedStyle: (el: Bar) => ({ display: el.hidden ? 'none' : 'block', visibility: 'visible' }),
+    },
+    document: {
+      body: { classList: { add: () => {}, remove: () => {} } },
+      addEventListener: () => {},
+      getElementById: (id: string) => (id === 'terminalContainer' ? container : null),
+      querySelector: (sel: string) =>
+        sel === '.main' ? main : (setup.bars as Record<string, Bar | undefined>)[sel] || null,
+    },
+    setTimeout: () => 1,
+    clearTimeout: () => {},
+  });
+  vm.runInContext(`${SOURCE}\nglobalThis.__KH = KeyboardHandler;`, context, { filename: 'mobile-handlers.js' });
+  return { handler: (context as { __KH: any }).__KH, main, fits: () => fits };
+}
+
+// 10 rows × 19px = 190 in a 200px container → 10px of slack, less than one row.
+const BASE: Setup = {
+  paddingBottom: '84px',
+  containerHeight: 200,
+  rows: 10,
+  cellH: 19,
+  bars: { '.toolbar': { offsetHeight: 40 }, '.keyboard-accessory-bar': { offsetHeight: 44 } },
+};
+
+describe('_shrinkPaddingToFit', () => {
+  it('reclaims the slack when the reservation over-reserves', () => {
+    // Bars really need 60px, 84 is reserved → the 10px of slack is free to take.
+    const { handler, main } = loadHandler({
+      ...BASE,
+      bars: { '.toolbar': { offsetHeight: 30 }, '.keyboard-accessory-bar': { offsetHeight: 30 } },
+    });
+
+    handler._shrinkPaddingToFit();
+
+    expect(main.style.paddingBottom).toBe('74px');
+  });
+
+  it('never shrinks into the space the bars actually occupy', () => {
+    // 40 + 44 = 84: the reservation is exactly right, so there is nothing to take
+    // even though the terminal has 10px of slack.
+    const { handler, main } = loadHandler(BASE);
+
+    handler._shrinkPaddingToFit();
+
+    expect(main.style.paddingBottom).toBe('84px');
+  });
+
+  it('stops part-way when only some of the slack is free', () => {
+    // Bars need 78px of the reserved 84 → 6px may be reclaimed, not the full 10.
+    const { handler, main } = loadHandler({
+      ...BASE,
+      bars: { '.toolbar': { offsetHeight: 34 }, '.keyboard-accessory-bar': { offsetHeight: 44 } },
+    });
+
+    handler._shrinkPaddingToFit();
+
+    expect(main.style.paddingBottom).toBe('78px');
+  });
+
+  it('is a no-op, never a grow, when the bars are taller than the reservation', () => {
+    // Growing the padding here would resize the terminal as a side effect of a
+    // function that exists to reclaim slack.
+    const { handler, main } = loadHandler({
+      ...BASE,
+      bars: { '.toolbar': { offsetHeight: 60 }, '.keyboard-accessory-bar': { offsetHeight: 60 } },
+    });
+
+    handler._shrinkPaddingToFit();
+
+    expect(main.style.paddingBottom).toBe('84px');
+  });
+
+  it('does not count a hidden bar', () => {
+    // The accessory bar is display:none until the keyboard opens; counting it
+    // would block a reclaim that is genuinely free.
+    const { handler, main } = loadHandler({
+      ...BASE,
+      bars: { '.toolbar': { offsetHeight: 40 }, '.keyboard-accessory-bar': { offsetHeight: 44, hidden: true } },
+    });
+
+    handler._shrinkPaddingToFit();
+
+    expect(main.style.paddingBottom).toBe('74px');
+  });
+
+  it('counts the CJK input strip when it is on screen', () => {
+    const { handler, main } = loadHandler({
+      ...BASE,
+      bars: {
+        '.toolbar': { offsetHeight: 30 },
+        '.keyboard-accessory-bar': { offsetHeight: 30 },
+        '#cjkInput.cjk-input-visible': { offsetHeight: 20 },
+      },
+    });
+
+    handler._shrinkPaddingToFit();
+
+    expect(main.style.paddingBottom).toBe('80px');
+  });
+
+  it('leaves the padding alone when the slack is a whole row or more', () => {
+    // A full row of slack means the re-fit will claim it as a row; padding is not
+    // the lever here.
+    const { handler, main, fits } = loadHandler({ ...BASE, containerHeight: 190 + 19 });
+
+    handler._shrinkPaddingToFit();
+
+    expect(main.style.paddingBottom).toBe('84px');
+    expect(fits()).toBe(0);
+  });
+});

test/pi-cli-resolver.test.ts

@@ -0,0 +1,132 @@
+/**
+ * @fileoverview Tests for the Pi CLI resolver wrapper.
+ *
+ * Pi is the resolver with a version probe: `pi` is a short, generic binary
+ * name, so a resolved path is only accepted once `pi --version` prints a
+ * semver-shaped string. The probe EXECUTES the candidate, which is exactly why
+ * it must never run under vitest — the hermeticity test below pins that gate
+ * with a real executable fixture that would make the test fail loudly if the
+ * gate were deleted again (as PR #329 once did).
+ */
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createPiResolverForTest } from '../src/utils/pi-cli-resolver.js';
+import {
+  cliResolveRetryDelayMs,
+  createProductionCliResolverHost,
+  type CliResolverHost,
+} from '../src/utils/cli-executable-resolver.js';
+
+const temporaryDirectories: string[] = [];
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+function createHost(
+  options: {
+    processPathResult?: string | null;
+    loginShellResults?: Array<string | null>;
+    existingPaths?: string[];
+  } = {}
+): CliResolverHost {
+  const loginShellResults = [...(options.loginShellResults ?? [])];
+  const existingPaths = new Set(options.existingPaths ?? []);
+  return {
+    processPath: '/service/bin',
+    shellPath: '/bin/zsh',
+    shellArgs: ['-l'],
+    findOnProcessPath: () => options.processPathResult ?? null,
+    findInLoginShell: () => loginShellResults.shift() ?? null,
+    exists: (path) => existingPaths.has(path),
+  };
+}
+
+describe('Pi CLI resolver', () => {
+  it('accepts a candidate the version probe verifies and carries the version as metadata', () => {
+    const binaryPath = '/service/bin/pi';
+    const probe = vi.fn(() => '0.84.1');
+    const resolver = createPiResolverForTest(
+      createHost({ processPathResult: binaryPath, existingPaths: [binaryPath] }),
+      probe
+    );
+
+    expect(resolver.resolve()).toMatchObject({
+      binaryPath,
+      directory: '/service/bin',
+      source: 'process-path',
+      metadata: '0.84.1',
+    });
+    expect(probe).toHaveBeenCalledWith(binaryPath);
+  });
+
+  it('rejects a candidate the probe refuses and falls through to a later one', () => {
+    // An unrelated `pi` on the service PATH (probe returns null) must not mask
+    // the real coding agent found by the login shell.
+    const impostor = '/service/bin/pi';
+    const genuine = '/login-shell/bin/pi';
+    const probe = vi.fn((binPath: string) => (binPath === genuine ? '0.84.1' : null));
+    const resolver = createPiResolverForTest(
+      createHost({
+        processPathResult: impostor,
+        loginShellResults: [genuine],
+        existingPaths: [impostor, genuine],
+      }),
+      probe
+    );
+
+    expect(resolver.resolve()).toMatchObject({ binaryPath: genuine, source: 'login-shell', metadata: '0.84.1' });
+  });
+
+  it('negative-caches a miss and retries only after the backoff elapses', () => {
+    const binaryPath = '/late/bin/pi';
+    let now = 0;
+    const probe = vi.fn(() => '0.84.1');
+    const resolver = createPiResolverForTest(
+      createHost({ loginShellResults: [null, binaryPath], existingPaths: [binaryPath] }),
+      probe,
+      () => now
+    );
+
+    expect(resolver.resolve()).toBeNull();
+    expect(resolver.resolve()).toBeNull(); // within the backoff: no re-run
+    expect(probe).not.toHaveBeenCalled();
+    now = cliResolveRetryDelayMs(1);
+    expect(resolver.resolve()?.metadata).toBe('0.84.1');
+    expect(resolver.resolve()?.binaryPath).toBe(binaryPath);
+  });
+
+  it('never executes a pi candidate under vitest (the ambient probe is VITEST-gated)', () => {
+    // A REAL executable fixture that prints a valid version. If the guard in
+    // probePiVersion is ever removed again, the probe runs this script, the
+    // resolution SUCCEEDS, and this test fails — pinning hermeticity by
+    // behavior rather than by source text. (The suites must never execute
+    // whatever `pi` binary the machine running them happens to carry.)
+    const root = mkdtempSync(join(tmpdir(), 'codeman-pi-vitest-gate-'));
+    temporaryDirectories.push(root);
+    const binaryPath = join(root, 'pi');
+    writeFileSync(binaryPath, '#!/bin/sh\necho 0.99.0\n');
+    chmodSync(binaryPath, 0o755);
+    const hostOptions = {
+      processPath: root,
+      shellPath: '/bin/bash',
+      shellArgs: ['-i', '-l'] as string[],
+      runCommand: () => '',
+      isExecutableFile: (path: string) => path === binaryPath,
+    };
+
+    // Default (ambient) probe: the candidate is found but never executed, so
+    // the VITEST gate reports it unusable and resolution misses.
+    const gated = createPiResolverForTest(createProductionCliResolverHost(hostOptions));
+    expect(gated.resolve()).toBeNull();
+
+    // Control: identical setup with an injected probe resolves, proving the
+    // null above comes from the gate, not from the fixture or the host.
+    const control = createPiResolverForTest(createProductionCliResolverHost(hostOptions), () => '0.99.0');
+    expect(control.resolve()).toMatchObject({ binaryPath, metadata: '0.99.0' });
+  });
+});

test/ralph-loop.test.ts

@@ -129,6 +129,36 @@ describe('RalphLoop', () => {
     vi.useRealTimers();
   });
 
+  describe('reschedule loop (regression)', () => {
+    // tick() is the only path that calls setRalphLoopState with lastCheckAt and
+    // no status field; start() carries status:'running', stop() status:'stopped'.
+    const countTicks = () =>
+      (mockState.store.setRalphLoopState as any).mock.calls.filter(
+        (c: any[]) => c[0]?.lastCheckAt !== undefined && c[0]?.status === undefined
+      ).length;
+
+    it('keeps rescheduling past the second tick', async () => {
+      // Real timers + a tiny poll interval: tick()'s async internals settle
+      // naturally on the event loop, avoiding fake-timer microtask fragility.
+      vi.useRealTimers();
+      loop.destroy();
+      // Keep the loop in the "running, should keep polling" state so it actually
+      // exercises the reschedule path: min duration unreached + autoGenerate on
+      // makes shouldStop() false (idle sessions are mocked empty, so nothing is
+      // actually generated). Otherwise an empty queue self-stops after 1 tick.
+      loop = new RalphLoop({ pollIntervalMs: 5, minDurationMs: 60_000, autoGenerateTasks: true });
+
+      await loop.start();
+      await new Promise((resolve) => setTimeout(resolve, 80)); // ~16 poll intervals
+      loop.stop();
+
+      // The bug: the loopTimer handle is never nulled in the setTimeout callback,
+      // so the `loopTimer === null` reschedule guard is false after the first fire
+      // and the loop dies at exactly 2 ticks. Fixed -> many ticks.
+      expect(countTicks()).toBeGreaterThanOrEqual(3);
+    });
+  });
+
   describe('initial state', () => {
     it('should start in stopped status', () => {
       expect(loop.status).toBe('stopped');
@@ -296,11 +326,7 @@ describe('RalphLoop', () => {
   describe('getStats', () => {
     it('should return complete stats object', async () => {
       const mockRunningTask = { id: '2', status: 'running', isTimedOut: () => false };
-      mockState.taskQueue.tasks = [
-        { id: '1', status: 'pending' },
-        mockRunningTask,
-        { id: '3', status: 'completed' },
-      ];
+      mockState.taskQueue.tasks = [{ id: '1', status: 'pending' }, mockRunningTask, { id: '3', status: 'completed' }];
       mockState.taskQueue.getRunningTasks.mockReturnValue([mockRunningTask]);
 
       await loop.start();

test/repo-status.test.ts

@@ -0,0 +1,281 @@
+/**
+ * @fileoverview Unit tests for the repository-status pure helpers: ahead/behind
+ * + log + symref parsing, env parsing, the remote-set / role / tracking-remote
+ * decisions, credential redaction of the returned fields, and the single-flight
+ * TTL cache that keeps the async status computation off the git hot path.
+ * No IO, no git, no port — safe to run individually.
+ *
+ * npm test -- test/repo-status.test.ts
+ */
+
+import { describe, it, expect } from 'vitest';
+import {
+  parseAheadBehind,
+  parseLogLines,
+  parseSymrefDefaultBranch,
+  parseRemotesEnv,
+  parseTrackingRemote,
+  resolveRemoteSet,
+  roleForRemote,
+  isSafeGitPositional,
+  redactRemoteStatus,
+  createSingleFlightCache,
+} from '../src/web/repo-status.js';
+import { redactGitCredentials } from '../src/git-clone.js';
+import type { RepoRemoteStatus } from '../src/types/update.js';
+
+describe('parseAheadBehind', () => {
+  it('parses tab-separated left/right counts as ahead/behind', () => {
+    expect(parseAheadBehind('3\t14')).toEqual({ ahead: 3, behind: 14 });
+  });
+  it('parses space-separated counts', () => {
+    expect(parseAheadBehind('0 0')).toEqual({ ahead: 0, behind: 0 });
+  });
+  it('tolerates surrounding whitespace/newline', () => {
+    expect(parseAheadBehind('  5   2 \n')).toEqual({ ahead: 5, behind: 2 });
+  });
+  it('returns null on malformed output', () => {
+    expect(parseAheadBehind('')).toBeNull();
+    expect(parseAheadBehind('abc')).toBeNull();
+    expect(parseAheadBehind('1')).toBeNull();
+  });
+});
+
+describe('parseLogLines', () => {
+  it('splits each line into sha + subject', () => {
+    const out = 'a1b2c3 fix: thing\nd4e5f6 COD-9 add digest';
+    expect(parseLogLines(out)).toEqual([
+      { sha: 'a1b2c3', subject: 'fix: thing' },
+      { sha: 'd4e5f6', subject: 'COD-9 add digest' },
+    ]);
+  });
+  it('handles a subject with no space (sha only)', () => {
+    expect(parseLogLines('deadbee')).toEqual([{ sha: 'deadbee', subject: '' }]);
+  });
+  it('ignores blank lines', () => {
+    expect(parseLogLines('\n  \nabc123 hi\n')).toEqual([{ sha: 'abc123', subject: 'hi' }]);
+  });
+  it('returns [] for empty input', () => {
+    expect(parseLogLines('')).toEqual([]);
+  });
+});
+
+describe('parseSymrefDefaultBranch', () => {
+  it('extracts the default branch from ls-remote --symref output', () => {
+    const out = 'ref: refs/heads/master\tHEAD\n0123abc\tHEAD';
+    expect(parseSymrefDefaultBranch(out)).toBe('master');
+  });
+  it('handles main', () => {
+    expect(parseSymrefDefaultBranch('ref: refs/heads/main\tHEAD')).toBe('main');
+  });
+  it('returns null when no symref line present', () => {
+    expect(parseSymrefDefaultBranch('0123abc\tHEAD')).toBeNull();
+  });
+  it('rejects a hostile branch that would smuggle a git flag (argv injection)', () => {
+    // A malicious remote sets HEAD to a `-`-leading "branch"; the capture must
+    // not start with `-`, so this yields null rather than `--upload-pack=...`.
+    expect(parseSymrefDefaultBranch('ref: refs/heads/--upload-pack=touch\tHEAD')).toBeNull();
+  });
+});
+
+describe('isSafeGitPositional', () => {
+  it('accepts normal remote/branch names', () => {
+    expect(isSafeGitPositional('origin')).toBe(true);
+    expect(isSafeGitPositional('feature/foo')).toBe(true);
+  });
+  it('rejects flag-injecting and empty values', () => {
+    expect(isSafeGitPositional('--upload-pack=touch /tmp/x')).toBe(false);
+    expect(isSafeGitPositional('-x')).toBe(false);
+    expect(isSafeGitPositional('')).toBe(false);
+    expect(isSafeGitPositional(null)).toBe(false);
+    expect(isSafeGitPositional(undefined)).toBe(false);
+  });
+});
+
+describe('parseRemotesEnv', () => {
+  it('splits comma list, trims, drops empties', () => {
+    expect(parseRemotesEnv('origin, bitbucket ,, fork')).toEqual(['origin', 'bitbucket', 'fork']);
+  });
+  it('returns [] for null/undefined/empty', () => {
+    expect(parseRemotesEnv(null)).toEqual([]);
+    expect(parseRemotesEnv(undefined)).toEqual([]);
+    expect(parseRemotesEnv('')).toEqual([]);
+  });
+});
+
+describe('resolveRemoteSet', () => {
+  it('defaults to tracking-remote first, then origin (the maintainer-fork layout)', () => {
+    // local branch tracks bitbucket; origin is the canonical upstream.
+    const set = resolveRemoteSet({
+      existingRemotes: ['bitbucket', 'fork', 'origin'],
+      trackingRemote: 'bitbucket',
+      envRemotes: [],
+    });
+    expect(set).toEqual(['bitbucket', 'origin']);
+  });
+
+  it('collapses to a single entry when origin IS the tracking remote', () => {
+    const set = resolveRemoteSet({
+      existingRemotes: ['origin'],
+      trackingRemote: 'origin',
+      envRemotes: [],
+    });
+    expect(set).toEqual(['origin']);
+  });
+
+  it('falls back to just origin when there is no tracking remote', () => {
+    const set = resolveRemoteSet({
+      existingRemotes: ['origin', 'fork'],
+      trackingRemote: null,
+      envRemotes: [],
+    });
+    expect(set).toEqual(['origin']);
+  });
+
+  it('honors CODEMAN_UPDATE_REMOTES order and filters to existing remotes', () => {
+    const set = resolveRemoteSet({
+      existingRemotes: ['origin', 'bitbucket', 'fork'],
+      trackingRemote: 'bitbucket',
+      envRemotes: ['fork', 'origin', 'ghost'],
+    });
+    expect(set).toEqual(['fork', 'origin']); // 'ghost' dropped (does not exist)
+  });
+
+  it('returns [] when env names none of the existing remotes', () => {
+    const set = resolveRemoteSet({
+      existingRemotes: ['origin'],
+      trackingRemote: null,
+      envRemotes: ['nope'],
+    });
+    expect(set).toEqual([]);
+  });
+});
+
+describe('roleForRemote', () => {
+  it('labels the tracking remote as tracking even if named origin', () => {
+    expect(roleForRemote('origin', 'origin')).toBe('tracking');
+    expect(roleForRemote('bitbucket', 'bitbucket')).toBe('tracking');
+  });
+  it('labels origin/upstream (when not tracking) as upstream', () => {
+    expect(roleForRemote('origin', 'bitbucket')).toBe('upstream');
+    expect(roleForRemote('upstream', 'origin')).toBe('upstream');
+  });
+  it('labels anything else as other', () => {
+    expect(roleForRemote('fork', 'bitbucket')).toBe('other');
+  });
+});
+
+describe('parseTrackingRemote', () => {
+  it('extracts the remote name from a remote-tracking short ref', () => {
+    expect(parseTrackingRemote('origin/master')).toBe('origin');
+    expect(parseTrackingRemote('bitbucket/feature/nested')).toBe('bitbucket');
+  });
+  it('returns null for a LOCAL-branch upstream (ref with no slash)', () => {
+    // `git branch -u otherbranch` makes @{upstream} a bare branch name; the old
+    // slice(0, indexOf('/')) turned "master" into "maste" here.
+    expect(parseTrackingRemote('master')).toBeNull();
+    expect(parseTrackingRemote('main')).toBeNull();
+  });
+  it('returns null for null/empty/degenerate refs', () => {
+    expect(parseTrackingRemote(null)).toBeNull();
+    expect(parseTrackingRemote(undefined)).toBeNull();
+    expect(parseTrackingRemote('')).toBeNull();
+    expect(parseTrackingRemote('/leading-slash')).toBeNull();
+  });
+});
+
+describe('credential redaction', () => {
+  it('redactGitCredentials masks scheme://user:secret@host pairs', () => {
+    expect(redactGitCredentials('https://user:ghp_token123@github.com/o/r.git')).toBe(
+      'https://***:***@github.com/o/r.git'
+    );
+    expect(redactGitCredentials('plain text, no url')).toBe('plain text, no url');
+    expect(redactGitCredentials('https://github.com/o/r.git')).toBe('https://github.com/o/r.git');
+  });
+
+  it('redactRemoteStatus masks the url field', () => {
+    const status: RepoRemoteStatus = {
+      name: 'origin',
+      url: 'https://alice:s3cret@example.com/repo.git',
+      role: 'upstream',
+      compareRef: 'origin/master',
+      ahead: 1,
+      behind: 2,
+      incoming: [{ sha: 'abc', subject: 'hi' }],
+    };
+    const out = redactRemoteStatus(status);
+    expect(out.url).toBe('https://***:***@example.com/repo.git');
+    // Everything else passes through untouched.
+    expect(out.name).toBe('origin');
+    expect(out.compareRef).toBe('origin/master');
+    expect(out.ahead).toBe(1);
+    expect(out.behind).toBe(2);
+    expect(out.incoming).toEqual([{ sha: 'abc', subject: 'hi' }]);
+    expect(out.error).toBeUndefined();
+  });
+
+  it('redactRemoteStatus masks credentials echoed into the error string by git stderr', () => {
+    const status: RepoRemoteStatus = {
+      name: 'origin',
+      url: 'https://alice:s3cret@example.com/repo.git',
+      role: 'upstream',
+      compareRef: '',
+      ahead: 0,
+      behind: 0,
+      incoming: [],
+      error: "Could not reach origin: fatal: unable to access 'https://alice:s3cret@example.com/repo.git/'",
+    };
+    const out = redactRemoteStatus(status);
+    expect(out.error).toBe("Could not reach origin: fatal: unable to access 'https://***:***@example.com/repo.git/'");
+    expect(out.error).not.toContain('s3cret');
+    expect(out.url).not.toContain('s3cret');
+  });
+});
+
+describe('createSingleFlightCache', () => {
+  it('shares one in-flight computation across concurrent callers', async () => {
+    let calls = 0;
+    let release!: (v: string) => void;
+    const cache = createSingleFlightCache(60_000, () => {
+      calls++;
+      return new Promise<string>((resolve) => {
+        release = resolve;
+      });
+    });
+    const a = cache.get();
+    const b = cache.get();
+    release('result');
+    expect(await a).toBe('result');
+    expect(await b).toBe('result');
+    expect(calls).toBe(1);
+  });
+
+  it('serves a fresh-enough cached result without recomputing', async () => {
+    let calls = 0;
+    const cache = createSingleFlightCache(60_000, async () => ++calls);
+    expect(await cache.get()).toBe(1);
+    expect(await cache.get()).toBe(1);
+    expect(calls).toBe(1);
+  });
+
+  it('recomputes once the TTL has elapsed', async () => {
+    let calls = 0;
+    const cache = createSingleFlightCache(60_000, async () => ++calls);
+    expect(await cache.get()).toBe(1);
+    // Inject a "now" past the TTL instead of sleeping.
+    expect(await cache.get(Date.now() + 60_001)).toBe(2);
+    expect(calls).toBe(2);
+  });
+
+  it('does not cache a rejected computation — the next call retries', async () => {
+    let calls = 0;
+    const cache = createSingleFlightCache(60_000, async () => {
+      calls++;
+      if (calls === 1) throw new Error('boom');
+      return 'ok';
+    });
+    await expect(cache.get()).rejects.toThrow('boom');
+    expect(await cache.get()).toBe('ok');
+    expect(calls).toBe(2);
+  });
+});

test/response-viewer-external-links.test.ts

@@ -0,0 +1,177 @@
+/**
+ * @fileoverview Response-viewer links open in a NEW tab (`CodemanApp._renderMarkdown`).
+ *
+ * `marked` emits a bare `<a href>` and the markdown sanitizer's allowlist carries no
+ * `target`, so every link in the chat used to navigate the CURRENT tab. On a phone that
+ * unloads the whole dashboard — SSE, terminal buffers, unsent composer text — and the OS
+ * back gesture reloads it from scratch, with no middle-click or open-in-new-tab affordance
+ * to work around it. That is the "links don't open on mobile" report.
+ *
+ * `_renderMarkdown` therefore decorates anchors AFTER sanitizing, which makes it the single
+ * source of both attributes: whatever an agent wrote is already stripped by then, and `rel`
+ * is set on the same element in the same pass, so no page Codeman opens can reach back
+ * through `window.opener` (reverse tabnabbing).
+ *
+ * Drives the SHIPPING artifacts — vendored `marked`, vendored DOMPurify + `sanitize-html.js`,
+ * and `app.js` itself — in a `vm` with a jsdom document injected (the technique from
+ * markdown-sanitizer.test.ts / response-viewer-file-links.test.ts; a per-file jsdom
+ * environment would externalize node:fs under vite).
+ *
+ * No port / server needed.
+ */
+import { readFileSync } from 'node:fs';
+import { performance } from 'node:perf_hooks';
+import { resolve } from 'node:path';
+import vm from 'node:vm';
+import { JSDOM } from 'jsdom';
+import { describe, expect, it, vi } from 'vitest';
+
+const publicFile = (name: string) => readFileSync(resolve(import.meta.dirname, '../src/web/public', name), 'utf8');
+
+const dom = new JSDOM('<!DOCTYPE html><html><body></body></html>');
+const jsdomWindow = dom.window as unknown as Window & typeof globalThis;
+const { document, NodeFilter } = dom.window;
+
+/** The shipping sanitizer: vendored DOMPurify bound to our jsdom window + the real config. */
+function loadShippingSanitizer(): (html: string) => string {
+  const dpModule: { exports: unknown } = { exports: {} };
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
+  new Function('module', 'exports', publicFile('vendor/dompurify.min.js'))(dpModule, dpModule.exports);
+  const DOMPurify = (dpModule.exports as (win: unknown) => unknown)(jsdomWindow);
+
+  const sanModule: { exports: { createMarkdownSanitizer?: (dp: unknown) => (html: string) => string } } = {
+    exports: {},
+  };
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
+  new Function('module', 'exports', publicFile('sanitize-html.js'))(sanModule, sanModule.exports);
+  const create = sanModule.exports.createMarkdownSanitizer;
+  if (typeof create !== 'function') throw new Error('createMarkdownSanitizer not exported');
+  return create(DOMPurify);
+}
+
+/** The vendored `marked` build the page loads, evaluated as CommonJS. */
+function loadShippingMarked(): { parse: (src: string, opts?: unknown) => string } {
+  const module: { exports: unknown } = { exports: {} };
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
+  new Function('module', 'exports', publicFile('vendor/marked.min.js'))(module, module.exports);
+  return module.exports as { parse: (src: string, opts?: unknown) => string };
+}
+
+type RenderApp = { _renderMarkdown(text: string): string };
+
+function loadCodemanAppClass(): { prototype: RenderApp } {
+  const context = vm.createContext({
+    console,
+    performance,
+    setInterval: vi.fn(),
+    clearInterval: vi.fn(),
+    setTimeout,
+    clearTimeout,
+    requestAnimationFrame: vi.fn(),
+    HTMLCanvasElement: class HTMLCanvasElement {},
+    fetch: vi.fn(),
+    document,
+    NodeFilter,
+    localStorage: { length: 0, key: vi.fn(), getItem: vi.fn(), setItem: vi.fn(), removeItem: vi.fn() },
+    // The page wires the sanitizer onto window; _sanitizeHtml fails closed without it,
+    // and a closed-failing render would make every assertion below vacuous.
+    window: { addEventListener: vi.fn(), removeEventListener: vi.fn(), sanitizeMarkdownHtml: loadShippingSanitizer() },
+    marked: loadShippingMarked(),
+    MobileDetection: {},
+  });
+  vm.runInContext(
+    `${publicFile('constants.js')}\n${publicFile('app.js')}\nglobalThis.__CodemanApp = CodemanApp;`,
+    context
+  );
+  return (context as { __CodemanApp: { prototype: RenderApp } }).__CodemanApp;
+}
+
+const CodemanApp = loadCodemanAppClass();
+
+/** Render markdown the way the response viewer does and return the resulting element. */
+function render(markdown: string): HTMLElement {
+  const app = Object.create(CodemanApp.prototype) as RenderApp;
+  const root = document.createElement('div');
+  root.className = 'rv-text';
+  root.innerHTML = app._renderMarkdown(markdown);
+  return root as unknown as HTMLElement;
+}
+
+const anchor = (root: HTMLElement, index = 0) => Array.from(root.querySelectorAll('a'))[index];
+
+describe('response viewer external links', () => {
+  it('opens a markdown link in a new tab, with rel set in the same pass', () => {
+    const root = render('See [the docs](https://example.com/docs?a=1&b=2) for details.');
+
+    const a = anchor(root);
+    expect(a, 'the link survived sanitizing').toBeDefined();
+    expect(a.getAttribute('href')).toBe('https://example.com/docs?a=1&b=2');
+    expect(a.getAttribute('target')).toBe('_blank');
+    expect(a.getAttribute('rel')).toBe('noopener noreferrer');
+  });
+
+  it('opens an autolinked bare URL in a new tab too', () => {
+    // gfm autolinks a bare URL, which is how an agent usually prints one.
+    const root = render('Login at https://claude.ai/oauth/authorize?code=true&client_id=abc to continue.');
+
+    const a = anchor(root);
+    expect(a.getAttribute('href')).toBe('https://claude.ai/oauth/authorize?code=true&client_id=abc');
+    expect(a.getAttribute('target')).toBe('_blank');
+    expect(a.getAttribute('rel')).toBe('noopener noreferrer');
+  });
+
+  it('sends a same-origin path to a new tab as well — it is still a navigation away', () => {
+    const root = render('Check [status](/api/status).');
+
+    expect(anchor(root).getAttribute('target')).toBe('_blank');
+  });
+
+  it('leaves an in-page fragment link alone', () => {
+    // A target here would open a second copy of the app to scroll it.
+    const root = render('Jump to [the section](#results).');
+
+    const a = anchor(root);
+    expect(a.getAttribute('href')).toBe('#results');
+    expect(a.hasAttribute('target')).toBe(false);
+    expect(a.hasAttribute('rel')).toBe(false);
+  });
+
+  it('leaves mailto: and tel: to the OS instead of stranding an empty tab', () => {
+    const root = render('Mail [me](mailto:a@example.com) or call [now](tel:+15551234).');
+
+    for (const a of Array.from(root.querySelectorAll('a'))) {
+      expect(a.hasAttribute('target'), a.getAttribute('href') || '').toBe(false);
+    }
+  });
+
+  it('is the ONLY source of target/rel: an agent cannot ask for an opener', () => {
+    // The sanitizer's allowlist has neither attribute, so agent-authored ones are gone
+    // before this pass runs — and the pass sets both together, so `rel` can never end up
+    // weaker than the target it accompanies.
+    const root = render('<a href="https://evil.example/" target="_self" rel="opener">click</a>');
+
+    const a = anchor(root);
+    expect(a.getAttribute('target')).toBe('_blank');
+    expect(a.getAttribute('rel')).toBe('noopener noreferrer');
+  });
+
+  it('still drops a javascript: link rather than decorating it', () => {
+    const root = render('[x](javascript:alert(1))');
+
+    const a = anchor(root);
+    // DOMPurify strips the unsafe href; whatever is left must not carry a target either,
+    // which would turn a hollow anchor into a window-opening one.
+    expect(a?.getAttribute('href') ?? null).toBeNull();
+    expect(a?.hasAttribute('target') ?? false).toBe(false);
+  });
+
+  it('keeps code blocks and their copy affordance intact', () => {
+    // The anchor pass shares the one template walk with the code-block wrapper; a mistake
+    // there would silently drop the toolbar rather than fail loudly.
+    const root = render('```\nconst a = 1;\n```');
+
+    expect(root.querySelector('.rv-code-wrap')).not.toBeNull();
+    expect(root.querySelector('.rv-copy-btn')).not.toBeNull();
+    expect(root.querySelector('pre code')?.textContent).toContain('const a = 1;');
+  });
+});

test/response-viewer-transcript.test.ts

@@ -0,0 +1,462 @@
+import { describe, expect, it } from 'vitest';
+import {
+  getLastTranscriptResponse,
+  isExternalCliTranscriptMode,
+  parseExternalCliTranscript,
+} from '../src/web/response-viewer-transcript.js';
+import { isExternalCliMode } from '../src/session.js';
+import type { SessionMode } from '../src/types.js';
+
+describe('response viewer transcript parser', () => {
+  it('extracts structured COD transcript blocks and keeps labeled status/tool entries', () => {
+    const transcript = `
+╭──────────────────────────────────────────────────────╮
+│ >_ OpenAI Codex (v0.143.0)                           │
+│ model:     gpt-5.4 medium   /model to change         │
+│ directory: /mnt/c/Users/aakhter/.../kb              │
+╰──────────────────────────────────────────────────────╯
+
+Tip: Use /side to start a side conversation in a temporary fork without polluting the main thread.
+
+› i need to create a naming recommendation for project helix
+
+gpt-5.4 medium · kb · main · Ready · Context 100% left
+
+• Explored
+  └ Read SKILL.md
+
+Subject: Naming Recommendation for Project Helix
+
+The product helps customers move virtual machine workloads between hypervisors while keeping operations
+stable. It improves visibility into application dependencies, supports pre-migration validation, and reduces
+the risk
+and effort involved in moving workloads.
+
+› Improve documentation in @filename
+
+gpt-5.4 medium · kb · main · Ready · Context 92% left
+`.trim();
+
+    const blocks = parseExternalCliTranscript(transcript, 'codex');
+
+    expect(blocks.map((block) => block.kind)).toEqual([
+      'status',
+      'prompt',
+      'status',
+      'tool',
+      'response',
+      'prompt',
+      'status',
+    ]);
+    expect(blocks[0]?.label).toBe('Status');
+    expect(blocks[3]?.label).toBe('Tool');
+    expect(blocks[4]?.text).toContain('reduces the risk and effort involved');
+    expect(blocks[4]?.text).not.toContain('reduces\nthe risk');
+
+    // The frontend's loadFullContext() renders via msg.role: 'user' gets the
+    // "You" badge, everything else the agent badge. A block without role
+    // rendered every prompt as the agent.
+    expect(blocks[1]?.role).toBe('user');
+    expect(blocks[5]?.role).toBe('user');
+    expect(blocks[0]?.role).toBe('assistant');
+    expect(blocks[3]?.role).toBe('assistant');
+    expect(blocks[4]?.role).toBe('assistant');
+  });
+
+  it('returns the most recent completed response when the last block is a new prompt', () => {
+    const transcript = `
+› say again
+
+Final polished answer
+With two lines
+
+› Improve documentation in @filename
+
+gpt-5.4 medium · kb · main · Ready · Context 92% left
+`.trim();
+
+    const blocks = parseExternalCliTranscript(transcript, 'codex');
+
+    expect(getLastTranscriptResponse(blocks)).toBe('Final polished answer\nWith two lines');
+  });
+
+  it('drops box-drawing dividers from the last response and treats worked-for lines as status', () => {
+    const transcript = `
+────────────────────────────────────────────────────────────────────────
+
+• The launcher supports CODEMAN_APP_DIR, so I can deploy this exact worktree without merging it back first.
+
+────────────────────────────────────────────────────────────────────────
+
+• Deployed.
+
+The local Codeman service is now running from the worktree at app/.worktrees/cod-215-response-viewer on
+commit 8bbcf77bafbdbf01a34653386c256b685898ad06.
+
+Verified:
+
+- process pid: 2708947
+- HTTPS health: https://127.0.0.1:3000/ returned 401 as expected
+
+One detail: I had to restart it outside the sandbox because the sandboxed launch path could not see tmux.
+
+─ Worked for 1m 51s ───────────────────────────────────────────────────
+
+› what are these lines in the middle column?
+`.trim();
+
+    const blocks = parseExternalCliTranscript(transcript, 'codex');
+
+    expect(getLastTranscriptResponse(blocks)).toContain('• Deployed.');
+    expect(getLastTranscriptResponse(blocks)).not.toContain('────────────────');
+    expect(getLastTranscriptResponse(blocks)).not.toContain('Worked for 1m 51s');
+    expect(blocks.some((block) => block.kind === 'status' && block.text === 'Worked for 1m 51s')).toBe(true);
+  });
+
+  // COD-226: multiline prompt continuations (2-space Codex gutter) must stay in the
+  // Prompt block, not be misclassified as Response. The gutter is authoritative ahead
+  // of every structural detector (divider, prompt-marker, tool, status).
+  describe('COD-226 multiline prompt gutter is authoritative', () => {
+    it('keeps bullet/prose continuations and internal blank lines in the Prompt block', () => {
+      const transcript = `
+› i think we can improve this slide. or maybe a follow on slide. here is what i'm thinking:
+  * left hand side: current AI stack (frontier model, cloud hosted, sovereign concerns)
+  right hand -> future enterprise stack: frontier model (optional, cloud), on-prem model router, OSS models
+
+  make the point that the right hand side addresses the concerns.
+
+gpt-5.4 medium · kb · main · Ready · Context 100% left
+
+• Explored
+  └ Read SKILL.md
+
+Here is the actual assistant answer that starts at column zero and is a real response.
+
+› next prompt
+`.trim();
+
+      const blocks = parseExternalCliTranscript(transcript, 'codex');
+      const promptBlocks = blocks.filter((b) => b.kind === 'prompt');
+
+      // Exactly two prompts, and the first holds the whole multiline prompt.
+      expect(promptBlocks).toHaveLength(2);
+      expect(promptBlocks[0]?.text).toContain('left hand side');
+      expect(promptBlocks[0]?.text).toContain('right hand');
+      expect(promptBlocks[0]?.text).toContain('make the point that the right hand side');
+
+      // The continuation must NOT have leaked into a Response block.
+      const responseBlocks = blocks.filter((b) => b.kind === 'response');
+      expect(responseBlocks.some((b) => b.text.includes('make the point'))).toBe(false);
+      expect(getLastTranscriptResponse(blocks)).toContain('actual assistant answer');
+      expect(getLastTranscriptResponse(blocks)).not.toContain('make the point');
+    });
+
+    it('does not let an indented divider inside a prompt flush the Prompt block', () => {
+      const transcript = `
+› compare these two layouts
+  first layout uses a single column
+  ────────────────────────────
+  second layout uses two columns
+
+The response begins here at column zero.
+`.trim();
+
+      const blocks = parseExternalCliTranscript(transcript, 'codex');
+      const promptBlocks = blocks.filter((b) => b.kind === 'prompt');
+
+      expect(promptBlocks).toHaveLength(1);
+      expect(promptBlocks[0]?.text).toContain('first layout');
+      expect(promptBlocks[0]?.text).toContain('second layout uses two columns');
+      expect(getLastTranscriptResponse(blocks)).toBe('The response begins here at column zero.');
+    });
+
+    it('treats a gutter-indented literal › as prompt content, not a new prompt', () => {
+      const transcript = `
+› here is my question about the ui
+  › should this arrow start a new prompt?
+  no it should not — it is part of my question
+
+Answer at column zero.
+`.trim();
+
+      const blocks = parseExternalCliTranscript(transcript, 'codex');
+      const promptBlocks = blocks.filter((b) => b.kind === 'prompt');
+
+      // The gutter-indented › must NOT open a second prompt.
+      expect(promptBlocks).toHaveLength(1);
+      expect(promptBlocks[0]?.text).toContain('here is my question');
+      expect(promptBlocks[0]?.text).toContain('no it should not');
+      expect(getLastTranscriptResponse(blocks)).toBe('Answer at column zero.');
+    });
+
+    // The two exact live roadmap-tab examples from the ticket (AC: use both verbatim).
+    it('live example 1: two-line prompt keeps the gutter continuation in the Prompt block', () => {
+      const transcript = `
+› create uid for each feature so it's easy to ref.
+  for the p200 - why is diffentiation only 2/5?
+`.trim();
+
+      const blocks = parseExternalCliTranscript(transcript, 'codex');
+      const promptBlocks = blocks.filter((b) => b.kind === 'prompt');
+
+      expect(promptBlocks).toHaveLength(1);
+      expect(promptBlocks[0]?.text).toContain('create uid for each feature');
+      expect(promptBlocks[0]?.text).toContain('for the p200 - why is diffentiation only 2/5?');
+      // The continuation must not have leaked into a Response block.
+      expect(blocks.some((b) => b.kind === 'response')).toBe(false);
+    });
+
+    it('live example 2: five-line prompt (bullet + prose + blank + prose) stays one Prompt block', () => {
+      const transcript = `
+› i think we can improve this slide. or maybe a follow on slide. here is what i'm thinking:
+  * left hand side... current AI stack: (frontier model), large component cloud hosted, soverign concerns etc.
+  right hand -> future-enterprise-stack: frontier-model (optional, in cloud), on-prem: model router, OSS models, rest of stack (gpus, data, etc.)
+
+  make the point that the right hand side addresses the concerns.
+`.trim();
+
+      const blocks = parseExternalCliTranscript(transcript, 'codex');
+      const promptBlocks = blocks.filter((b) => b.kind === 'prompt');
+
+      expect(promptBlocks).toHaveLength(1);
+      expect(promptBlocks[0]?.text).toContain('left hand side');
+      expect(promptBlocks[0]?.text).toContain('right hand -> future-enterprise-stack');
+      expect(promptBlocks[0]?.text).toContain('make the point that the right hand side addresses the concerns');
+      expect(blocks.some((b) => b.kind === 'response')).toBe(false);
+    });
+
+    it('still separates a single-line prompt from a column-zero response (no regression)', () => {
+      const transcript = `
+› say again
+
+Final polished answer at column zero.
+
+› next
+`.trim();
+
+      const blocks = parseExternalCliTranscript(transcript, 'codex');
+      const promptBlocks = blocks.filter((b) => b.kind === 'prompt');
+
+      expect(promptBlocks).toHaveLength(2);
+      expect(promptBlocks[0]?.text).toBe('say again');
+      expect(getLastTranscriptResponse(blocks)).toBe('Final polished answer at column zero.');
+    });
+  });
+
+  // COD-227: Last Response must return the final assistant answer, not tool logs.
+  // A response bullet beginning with a tool-like verb (• Created …) must not be
+  // classified as Tool, and genuine • Calling / • Called blocks must be classified
+  // as Tool. Disambiguator: a verb-bullet is a tool header only when followed by a
+  // box-drawing result tree (└│├); Calling/Called are always tool markers.
+  describe('COD-227 tool-header vs response disambiguation', () => {
+    const MINIMAL_REPRO = `
+› new jira issue
+
+• The fresh read shows a formatting problem.
+
+• Calling
+└ atlassian.jira_update_issue({})
+
+• Called atlassian.jira_get_issue({})
+└ { result: true }
+
+• Created COD-226: View Response → More misclassifies multiline prompt continuations as responses.
+
+  It includes:
+
+  - Two concrete failures
+  - Regression-test criteria
+`.trim();
+
+    it('returns the final • Created … answer, not the Jira Calling/Called tool log', () => {
+      const blocks = parseExternalCliTranscript(MINIMAL_REPRO, 'codex');
+      const last = getLastTranscriptResponse(blocks);
+
+      expect(last).toContain('Created COD-226');
+      expect(last).toContain('Two concrete failures');
+      // Must exclude tool invocations, raw results, and earlier commentary.
+      expect(last).not.toContain('atlassian.jira');
+      expect(last).not.toContain('Calling');
+      expect(last).not.toContain('Called');
+      expect(last).not.toContain('fresh read');
+    });
+
+    it('classifies genuine • Calling / • Called (with box-drawing results) as Tool', () => {
+      const blocks = parseExternalCliTranscript(MINIMAL_REPRO, 'codex');
+      const toolText = blocks
+        .filter((b) => b.kind === 'tool')
+        .map((b) => b.text)
+        .join('\n');
+
+      expect(toolText).toContain('Calling');
+      expect(toolText).toContain('Called');
+      expect(toolText).toContain('atlassian.jira_update_issue');
+      // The final answer must not have been swallowed into the tool block.
+      expect(toolText).not.toContain('Created COD-226');
+    });
+
+    it('labels the repro chronologically: Prompt, Response (commentary), Tool, Response (final)', () => {
+      const blocks = parseExternalCliTranscript(MINIMAL_REPRO, 'codex');
+
+      expect(blocks.map((b) => b.kind)).toEqual(['prompt', 'response', 'tool', 'response']);
+      expect(blocks[1]?.text).toContain('fresh read');
+      expect(blocks[3]?.text).toContain('Created COD-226');
+    });
+
+    it('does not classify a verb-prefixed prose bullet as Tool when no result tree follows', () => {
+      const transcript = `
+› do it
+
+• Created COD-999: a brand new issue with a descriptive title.
+
+  Follow-up prose that belongs to the same answer.
+`.trim();
+
+      const blocks = parseExternalCliTranscript(transcript, 'codex');
+
+      expect(blocks.some((b) => b.kind === 'tool')).toBe(false);
+      expect(getLastTranscriptResponse(blocks)).toContain('Created COD-999');
+      expect(getLastTranscriptResponse(blocks)).toContain('Follow-up prose');
+    });
+
+    it('does not regress a genuine verb tool block that has a box-drawing continuation', () => {
+      const transcript = `
+› look around
+
+• Explored
+  └ Read SKILL.md
+
+Here is the assistant answer at column zero.
+`.trim();
+
+      const blocks = parseExternalCliTranscript(transcript, 'codex');
+
+      expect(blocks.some((b) => b.kind === 'tool' && b.text.includes('Explored'))).toBe(true);
+      expect(getLastTranscriptResponse(blocks)).toBe('Here is the assistant answer at column zero.');
+    });
+  });
+
+  // The divider-status detector used to be /^[─-]+\s*(.+?)\s*[─-]{3,}$/, whose
+  // lazy middle backtracked catastrophically on a long dash run that does not
+  // end in 3+ dashes (measured >2min at 8,000 chars). Pane text is
+  // agent-controlled and buffers reach 32MB, so the pattern was replaced by a
+  // linear counter walk. Same approach as the glob-matcher ReDoS fix (68ae9a8):
+  // the hostile input below fails by timeout with the RegExp version.
+  describe('divider-status ReDoS hardening', () => {
+    it('classifies a hostile 10k dash run in linear time', () => {
+      const hostile = '-'.repeat(10_000) + '>';
+      const started = Date.now();
+      const blocks = parseExternalCliTranscript(`› q\n${hostile}`, 'opencode');
+      const elapsed = Date.now() - started;
+
+      expect(elapsed).toBeLessThan(2_000);
+      // No 3-dash tail, so the line is not a status divider — it stays prose.
+      expect(blocks.some((b) => b.kind === 'response' && b.text.includes('>'))).toBe(true);
+      expect(blocks.some((b) => b.kind === 'status')).toBe(false);
+    });
+
+    // The counter walk must keep the EXACT accept set and captured content of
+    // the old regex (including its backtracking quirks on all-dash lines), so
+    // brute-force both against a corpus. The old regex is safe here: probes are
+    // capped at 24 chars, far below the blowup threshold.
+    it('matches the old regex char-for-char on a brute-force corpus', () => {
+      const oldNormalize = (line: string): string | null => {
+        const trimmed = line.trim();
+        const matched = trimmed.match(/^[─-]+\s*(.+?)\s*[─-]{3,}$/);
+        if (!matched) return null;
+        return matched[1]?.trim() || null;
+      };
+
+      // Observe the private normalizeDividerStatusLine through the parser: after
+      // a prompt, a column-zero probe from this alphabet is a status block iff
+      // the divider detector matched, and the status text is its return value.
+      // (The alphabet triggers no other status arm; letters are limited to 'x'.)
+      const observedStatusText = (probe: string): string | null => {
+        const blocks = parseExternalCliTranscript(`› q\n${probe}`, 'opencode');
+        const status = blocks.find((b) => b.kind === 'status');
+        return status ? status.text : null;
+      };
+
+      const directed = [
+        '──── Status ────',
+        '─ Worked for 1m 51s ───────',
+        '---',
+        '----',
+        '-----',
+        '------',
+        '-------',
+        '---- ---',
+        '-    ---',
+        '--x',
+        'x---',
+        '----x',
+        '----x--',
+        '----x---',
+        '─x───',
+        '- x ---',
+        '--- x -',
+        '─── ──',
+        '-\tx\t---',
+        '--->----',
+        '─-─- x x ─-─',
+        '- x x x ----',
+      ];
+
+      // Deterministic LCG so a failure reproduces byte-identically.
+      let seed = 0x2f6e2b1;
+      const rand = () => {
+        seed = (seed * 1103515245 + 12345) & 0x7fffffff;
+        return seed / 0x80000000;
+      };
+      const alphabet = ['-', '-', '─', '─', ' ', ' ', '\t', 'x', '>'];
+      const probes = [...directed];
+      for (let i = 0; i < 3000; i += 1) {
+        const len = Math.floor(rand() * 25);
+        let probe = '';
+        for (let j = 0; j < len; j += 1) {
+          probe += alphabet[Math.floor(rand() * alphabet.length)];
+        }
+        probes.push(probe);
+      }
+
+      for (const raw of probes) {
+        const probe = raw.trim();
+        // Divider-only lines (8+ dash/whitespace chars) are consumed by
+        // isDividerOnlyLine before the status detector ever runs, in both the
+        // old and new worlds — the detector is unobservable there.
+        if (!probe || /^[\s─-]{8,}$/.test(probe)) continue;
+        expect(observedStatusText(probe), `probe: ${JSON.stringify(probe)}`).toBe(oldNormalize(probe));
+      }
+    });
+  });
+
+  // EXTERNAL_CLI_MODES is a local duplicate of isExternalCliMode() in
+  // src/session.ts (importing session.ts would drag node-pty and the whole
+  // session layer into the pure transcript module). This pin is what keeps the
+  // two from drifting — 'pi' was missing here while isExternalCliMode() had it,
+  // which left pi sessions with the exact empty-viewer symptom the transcript
+  // branch exists to fix.
+  describe('mode parity with isExternalCliMode()', () => {
+    // Exhaustive by construction: adding a SessionMode without deciding its
+    // transcript behavior fails to compile here.
+    const ALL_SESSION_MODES: Record<SessionMode, true> = {
+      claude: true,
+      shell: true,
+      opencode: true,
+      codex: true,
+      gemini: true,
+      antigravity: true,
+      pi: true,
+    };
+
+    it('agrees with isExternalCliMode() for every SessionMode', () => {
+      for (const mode of Object.keys(ALL_SESSION_MODES) as SessionMode[]) {
+        expect(isExternalCliTranscriptMode(mode), `mode: ${mode}`).toBe(isExternalCliMode(mode));
+      }
+    });
+
+    it('covers pi', () => {
+      expect(isExternalCliTranscriptMode('pi')).toBe(true);
+    });
+  });
+});

test/routes/file-search-mode.test.ts

@@ -0,0 +1,94 @@
+/**
+ * GET /api/sessions/:id/files?q=... — search mode.
+ *
+ * A query turns the endpoint from a nested tree into a flat match list. Two
+ * properties are worth pinning: the walk must recurse PAST non-matching
+ * directories (searching is pointless if a file whose parents don't match is
+ * unreachable), and an empty query must leave the default tree response exactly
+ * as it was, since that is every existing caller.
+ *
+ * Runs against a real temp directory rather than a mocked fs: the value here is
+ * the traversal, and a mocked readdir would just be asserting the mock.
+ * Port: none (app.inject).
+ */
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeEach, describe, expect, it } from 'vitest';
+
+import { createRouteTestHarness, type RouteTestHarness } from './_route-test-utils.js';
+import { registerFileRoutes } from '../../src/web/routes/file-routes.js';
+
+const root = mkdtempSync(join(tmpdir(), 'codeman-file-search-'));
+mkdirSync(join(root, 'src', 'deep', 'nested'), { recursive: true });
+mkdirSync(join(root, 'node_modules', 'pkg'), { recursive: true });
+writeFileSync(join(root, 'README.md'), '#\n');
+writeFileSync(join(root, 'src', 'widget.ts'), 'x\n');
+writeFileSync(join(root, 'src', 'deep', 'nested', 'widget-test.ts'), 'x\n');
+writeFileSync(join(root, 'node_modules', 'pkg', 'widget.ts'), 'x\n');
+
+afterAll(() => rmSync(root, { recursive: true, force: true }));
+
+describe('files endpoint search mode', () => {
+  let harness: RouteTestHarness;
+
+  beforeEach(async () => {
+    harness = await createRouteTestHarness(registerFileRoutes);
+    harness.ctx._session.workingDir = root;
+  });
+
+  const get = async (query: string) => {
+    const res = await harness.app.inject({
+      method: 'GET',
+      url: `/api/sessions/${harness.ctx._sessionId}/files${query}`,
+    });
+    expect(res.statusCode).toBe(200);
+    return JSON.parse(res.body);
+  };
+
+  it('returns a flat match list and reaches files under non-matching directories', () => {
+    return get('?q=widget').then((body) => {
+      expect(body.success).toBe(true);
+      expect(body.data.mode).toBe('search');
+
+      const paths = body.data.matches.map((m: { path: string }) => m.path).sort();
+      // deep/nested matches only because the walk recursed through `src` and
+      // `deep`, neither of which matches 'widget' itself.
+      expect(paths).toEqual([join('src', 'deep', 'nested', 'widget-test.ts'), join('src', 'widget.ts')]);
+      expect(body.data.matchCount).toBe(2);
+      expect(body.data.query).toBe('widget');
+      // The nested tree is not built in search mode.
+      expect(body.data.tree).toEqual([]);
+    });
+  });
+
+  it('still honours the excluded-directory list while searching', async () => {
+    const body = await get('?q=widget');
+    const paths = body.data.matches.map((m: { path: string }) => m.path);
+
+    expect(paths.some((p: string) => p.includes('node_modules'))).toBe(false);
+  });
+
+  it('leaves the default tree response untouched when no query is given', async () => {
+    const body = await get('');
+
+    expect(body.data.mode).toBeUndefined();
+    expect(body.data.matches).toBeUndefined();
+    expect(Array.isArray(body.data.tree)).toBe(true);
+    expect(body.data.tree.length).toBeGreaterThan(0);
+  });
+
+  it('treats a whitespace-only query as no query at all', async () => {
+    const body = await get('?q=%20%20');
+
+    expect(body.data.mode).toBeUndefined();
+    expect(Array.isArray(body.data.tree)).toBe(true);
+  });
+
+  it('reports directories that match as well as files', async () => {
+    const body = await get('?q=nested');
+
+    expect(body.data.matches).toHaveLength(1);
+    expect(body.data.matches[0]).toMatchObject({ name: 'nested', type: 'directory' });
+  });
+});

test/routes/session-routes-external-cli-last-response.test.ts

@@ -0,0 +1,168 @@
+/**
+ * @fileoverview Tests for the external-CLI branch of GET /api/sessions/:id/last-response.
+ *
+ * Uses app.inject() — no real HTTP ports needed.
+ * Port: N/A (app.inject doesn't open ports)
+ *
+ * OpenCode / Gemini / Antigravity / Pi render their own TUIs and never write a
+ * Claude transcript under ~/.claude/projects, so before this branch existed the
+ * handler fell through to the Claude scan, found nothing, and the response viewer
+ * was permanently empty for those modes. These tests pin:
+ *   - the pane buffer is segmented and the LAST response is returned
+ *   - ?context=full carries the parsed blocks, and the short form omits them
+ *   - ?context=full blocks carry role — the frontend renders via msg.role, so a
+ *     block without it lost the "You" badge on prompts
+ *   - a pane that has produced no output reports hasContext: false rather than 404ing
+ *   - Claude mode still takes the Claude path (regression guard)
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import Fastify, { type FastifyInstance } from 'fastify';
+import fastifyCookie from '@fastify/cookie';
+import { createMockRouteContext, createMockSession, type MockRouteContext } from '../mocks/index.js';
+import { ApiErrorCode, httpStatusForErrorCode } from '../../src/types.js';
+import { registerSessionRoutes } from '../../src/web/routes/session-routes.js';
+
+interface LocalHarness {
+  app: FastifyInstance;
+  ctx: MockRouteContext;
+}
+
+/** Mirror of the production uniform-envelope hook (server.ts), as in the sibling suites. */
+async function createEnvelopeHarness(
+  registerFn: (app: FastifyInstance, ctx: MockRouteContext) => void
+): Promise<LocalHarness> {
+  const app = Fastify({ logger: false });
+  await app.register(fastifyCookie);
+
+  const ctx = createMockRouteContext();
+  registerFn(app, ctx);
+
+  app.addHook('preSerialization', (req, reply, payload: unknown, done) => {
+    if (!req.url.startsWith('/api')) return done(null, payload);
+    if (payload === null || typeof payload !== 'object') return done(null, payload);
+    if (Buffer.isBuffer(payload) || typeof (payload as { pipe?: unknown }).pipe === 'function') {
+      return done(null, payload);
+    }
+    const p = payload as { success?: unknown; errorCode?: unknown };
+    if (p.success === false) {
+      if (reply.statusCode === 200 && typeof p.errorCode === 'string') {
+        reply.code(httpStatusForErrorCode(p.errorCode as ApiErrorCode));
+      }
+      return done(null, payload);
+    }
+    if (p.success === true) return done(null, payload);
+    return done(null, { success: true, data: payload });
+  });
+
+  await app.ready();
+  return { app, ctx };
+}
+
+// A pane as one of these CLIs actually leaves it: banner, a `›` prompt line, a
+// status divider, a tool-activity marker, then the assistant's prose.
+const PANE = `
+╭──────────────────────────────────────────────────────╮
+│ >_ OpenCode                                          │
+│ directory: /workspace/project                        │
+╰──────────────────────────────────────────────────────╯
+
+› summarise the retry logic
+
+model · project · main · Ready · Context 100% left
+
+• Explored
+  └ Read src/retry.ts
+
+The retry helper backs off exponentially and gives up after five attempts.
+
+› now document it
+
+model · project · main · Ready · Context 92% left
+
+• Called write_file
+
+Documented the helper in docs/retry.md, including the five-attempt ceiling.
+`.trim();
+
+describe('GET /api/sessions/:id/last-response — external CLI panes', () => {
+  let harness: LocalHarness;
+  let session: ReturnType<typeof createMockSession>;
+
+  beforeEach(async () => {
+    harness = await createEnvelopeHarness(registerSessionRoutes);
+    session = harness.ctx._session;
+  });
+
+  async function lastResponse(full = false) {
+    const res = await harness.app.inject({
+      method: 'GET',
+      url: `/api/sessions/${session.id}/last-response${full ? '?context=full' : ''}`,
+    });
+    return { res, body: JSON.parse(res.body) };
+  }
+
+  for (const mode of ['opencode', 'gemini', 'antigravity', 'pi'] as const) {
+    it(`returns the last assistant response from the ${mode} pane buffer`, async () => {
+      session.mode = mode;
+      session.terminalBuffer = PANE;
+
+      const { res, body } = await lastResponse();
+
+      expect(res.statusCode).toBe(200);
+      // The LAST response, not the first — the viewer shows the current turn.
+      expect(body.data.text).toContain('Documented the helper in docs/retry.md');
+      expect(body.data.text).not.toContain('backs off exponentially');
+      expect(body.data.hasContext).toBe(true);
+      // Short form stays short: blocks only travel under ?context=full.
+      expect(body.data.messages).toBeUndefined();
+    });
+  }
+
+  it('carries the parsed blocks under ?context=full', async () => {
+    session.mode = 'opencode';
+    session.terminalBuffer = PANE;
+
+    const { body } = await lastResponse(true);
+
+    const kinds = body.data.messages.map((block: { kind: string }) => block.kind);
+    expect(kinds).toContain('prompt');
+    expect(kinds).toContain('response');
+    expect(kinds).toContain('tool');
+    // Both user turns survive segmentation, so the viewer can show the exchange.
+    const prompts = body.data.messages.filter((b: { kind: string }) => b.kind === 'prompt');
+    expect(prompts).toHaveLength(2);
+    expect(prompts[1].text).toContain('now document it');
+
+    // loadFullContext() renders via msg.role — without it every block got the
+    // agent badge and the user's own prompts lost their "You" attribution.
+    for (const block of body.data.messages as Array<{ kind: string; role: string }>) {
+      expect(block.role).toBe(block.kind === 'prompt' ? 'user' : 'assistant');
+    }
+  });
+
+  it('reports hasContext false for a pane that has produced no output', async () => {
+    session.mode = 'gemini';
+    // Session created but nothing rendered yet. Any non-prompt line counts as
+    // prose to the parser, so the empty pane is the honest no-context case.
+    session.terminalBuffer = '';
+
+    const { res, body } = await lastResponse();
+
+    expect(res.statusCode).toBe(200);
+    expect(body.data.text).toBe('');
+    expect(body.data.hasContext).toBe(false);
+  });
+
+  it('leaves Claude mode on the Claude transcript path', async () => {
+    // Regression guard: a claude pane must NOT be segmented off its terminal
+    // buffer, or a real transcript would be shadowed by scraped pane text.
+    session.mode = 'claude';
+    session.terminalBuffer = PANE;
+
+    const { res, body } = await lastResponse();
+
+    expect(res.statusCode).toBe(200);
+    expect(body.data.text).not.toContain('Documented the helper');
+  });
+});

test/routes/session-routes.test.ts

@@ -789,6 +789,7 @@ describe('session-routes', () => {
       expect(body.data.terminalBuffer).toContain(lastLine);
       expect(body.data.source).toBe('mux-full-history');
       expect(typeof body.data.fullSize).toBe('number');
+      expect(res.headers['server-timing']).toMatch(/^capture;dur=\d+\.\d, prepare;dur=\d+\.\d, total;dur=\d+\.\d$/);
     });
 
     it('full reload (?full=1) returns the tmux capture ALONE — byte history is not duplicated', async () => {

test/static-cache-headers.test.ts

@@ -0,0 +1,97 @@
+/**
+ * @fileoverview `@fastify/static`'s `setHeaders` callback is what sets Cache-Control
+ * on every asset Codeman serves, and v10 silently changed its contract.
+ *
+ * In v9 the first argument was a Node `ServerResponse`, so the body called
+ * `res.setHeader(...)`. In v10 it is a `FastifyReply`, which has no `setHeader`, so
+ * the v9 body throws `TypeError: res.setHeader is not a function` from inside
+ * `@fastify/static` on EVERY static request. Nothing in the type-checker catches a
+ * revert (the callback's parameter is inferred), and nothing else in the suite reads
+ * these headers, so without this file the whole caching contract is untested.
+ *
+ * That contract is load-bearing: assets are served `immutable` for a year, and
+ * `index.html` must revalidate every time or a deploy leaves browsers on stale
+ * markup (see `cacheBustAssets` in server.ts).
+ *
+ * These tests drive a REAL WebServer on purpose. Asserting against an inline
+ * re-registration of the plugin would keep passing after a revert in server.ts.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import { WebServer } from '../src/web/server.js';
+
+const TEST_PORT = 3183;
+
+/**
+ * Fetch and fully drain the body. Both halves matter for teardown: an unconsumed
+ * body leaves undici holding the socket, and a pooled keep-alive socket makes
+ * `server.stop()` wait for it, which times out the afterAll hook.
+ */
+async function get(url: string): Promise<Response> {
+  const res = await fetch(url, { headers: { connection: 'close' } });
+  await res.arrayBuffer();
+  return res;
+}
+
+describe('static asset Cache-Control headers', () => {
+  let server: WebServer;
+  let baseUrl: string;
+
+  beforeAll(async () => {
+    server = new WebServer(TEST_PORT, false, true);
+    await server.start();
+    baseUrl = `http://localhost:${TEST_PORT}`;
+  });
+
+  afterAll(async () => {
+    await server.stop();
+  }, 60000);
+
+  it('serves a static asset at all (proves setHeaders did not throw)', async () => {
+    // The v9-form regression surfaces here first: @fastify/static invokes setHeaders
+    // while streaming, so a TypeError inside it takes the response down rather than
+    // merely omitting a header.
+    const res = await get(`${baseUrl}/app.js`);
+    expect(res.status).toBe(200);
+  });
+
+  it('marks long-lived assets immutable', async () => {
+    const res = await get(`${baseUrl}/app.js`);
+    expect(res.headers.get('cache-control')).toBe('public, max-age=31536000, immutable');
+  });
+
+  it('makes static HTML revalidate so deploys are picked up', async () => {
+    // ⚠️ upload.html, NOT index.html. `/index.html` has its own explicit route that
+    // answers from renderIndexHtml() and never reaches @fastify/static, so asserting
+    // on it passes even with setHeaders fully broken (verified: reverting server.ts
+    // to the v9 form fails the two /app.js tests and leaves an index.html assertion
+    // green). upload.html has no route of its own, so it is the only HTML that
+    // actually exercises the `.html` branch of setHeaders.
+    const res = await get(`${baseUrl}/upload.html`);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('cache-control')).toBe('no-cache');
+  });
+
+  it('lets a route keep the Cache-Control it set, so sw.js stays uncached', async () => {
+    // Regression guard for the OTHER half of the v10 change. setHeaders runs for
+    // sendFile() too, and v10 moved it from the raw response onto the reply, which
+    // flipped precedence: the callback started overriding routes instead of being
+    // overridden by them. That gave /sw.js `immutable, max-age=31536000` in place of
+    // the `no-cache, no-store` its route sets — a service worker pinned for a year,
+    // which is unrecoverable from the server side because clients stop asking.
+    // Measured against v9 to confirm this is the historical behaviour, not a guess.
+    const res = await get(`${baseUrl}/sw.js`);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('cache-control')).toBe('no-cache, no-store');
+  });
+
+  it('serves the rendered index with no-cache too, via its own route', async () => {
+    // Different code path from the above, same contract: index.html is generated per
+    // request (cacheBustAssets stamps ?v= onto every asset ref), so caching it would
+    // pin browsers to the asset versions current at deploy time.
+    const res = await get(`${baseUrl}/index.html`);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('cache-control')).toContain('no-cache');
+  });
+});

test/terminal-auto-copy.test.ts

@@ -0,0 +1,334 @@
+/**
+ * Auto Copy (copy-on-select) guards.
+ *
+ * The feature is invisible when it works, so every bug in it is silent: a
+ * clipboard that quietly stops updating, or one that quietly overwrites itself
+ * on an unrelated click. These tests drive the SHIPPED decision helper
+ * (constants.js) and the SHIPPED flush (terminal-ui.js), plus the settings
+ * wiring that decides whether the toggle reaches the code at all.
+ */
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import vm from 'node:vm';
+import { describe, expect, it, vi } from 'vitest';
+
+const publicDir = resolve(import.meta.dirname, '../src/web/public');
+const read = (name: string) => readFileSync(resolve(publicDir, name), 'utf8');
+
+function loadHarness() {
+  const CodemanApp = function CodemanApp(this: any) {};
+  const windowRef: Record<string, any> = {};
+  const documentListeners = new Map<string, ((ev: any) => void)[]>();
+  let activeElement: any = null;
+  let now = 1_000;
+
+  const RealDate = Date;
+  const DateStub: any = function DateStub(this: any, ...args: any[]) {
+    return new (RealDate as any)(...args);
+  };
+  DateStub.now = () => now;
+
+  const context = vm.createContext({
+    window: windowRef,
+    document: {
+      body: { classList: { contains: () => false } },
+      get activeElement() {
+        return activeElement;
+      },
+      getElementById: () => null,
+      addEventListener: (type: string, listener: (ev: any) => void) => {
+        const list = documentListeners.get(type) ?? [];
+        list.push(listener);
+        documentListeners.set(type, list);
+      },
+    },
+    CodemanApp,
+    console: { warn: vi.fn(), log: vi.fn(), debug: vi.fn() },
+    _crashDiag: { log: vi.fn() },
+    Date: DateStub,
+    performance: { now: () => now },
+    requestAnimationFrame: (_fn: () => void) => 1,
+    setTimeout: (_fn: () => void) => 1,
+    Blob: function Blob() {},
+    URL: { createObjectURL: () => 'blob:yield', revokeObjectURL: () => {} },
+    Worker: function Worker(this: any) {
+      this.postMessage = () => {};
+    },
+    MobileDetection: { isTouchDevice: () => false },
+    KeyboardHandler: { keyboardVisible: false },
+    DEC_SYNC_STRIP_RE: /\x1b\[\?2026[hl]/g,
+    TERMINAL_CHUNK_SIZE: 32 * 1024,
+  });
+
+  vm.runInContext(read('constants.js'), context, { filename: 'constants.js' });
+  vm.runInContext(read('terminal-ui.js'), context, { filename: 'terminal-ui.js' });
+
+  const app = new (CodemanApp as any)();
+  const toasts: { message: string; type: string }[] = [];
+  app.showToast = (message: string, type: string) => toasts.push({ message, type });
+  app._copyText = vi.fn(async () => true);
+  app.loadAppSettingsFromStorage = () => ({ autoCopySelection: true });
+  app.terminal = {
+    hasSelection: () => true,
+    getSelection: () => 'copied text',
+    clearSelection: vi.fn(),
+    focus: vi.fn(),
+  };
+
+  return {
+    app,
+    windowRef,
+    toasts,
+    setNow: (value: number) => {
+      now = value;
+    },
+    setActiveElement: (element: any) => {
+      activeElement = element;
+    },
+  };
+}
+
+describe('decideAutoCopy', () => {
+  const decide = (params: Record<string, unknown>) => loadHarness().windowRef.CodemanAutoCopy.decide(params);
+
+  it('does nothing while the setting is off', () => {
+    expect(decide({ enabled: false, text: 'hello', pending: true })).toBe('skip');
+  });
+
+  it('ignores a blank or whitespace-only selection', () => {
+    // A drag across empty cells; a wall of spaces is never what the gesture meant.
+    expect(decide({ enabled: true, text: '   \n  ', pending: true })).toBe('skip');
+    expect(decide({ enabled: true, text: '', pending: true })).toBe('skip');
+  });
+
+  it('copies a genuine selection change even when the text repeats', () => {
+    // Re-selecting the same text after copying something else in between is a
+    // deliberate act, so `pending` outranks the text dedupe.
+    expect(decide({ enabled: true, text: 'same', lastCopied: 'same', pending: true })).toBe('copy');
+  });
+
+  it('copies changed text when onSelectionChange has not fired yet', () => {
+    // xterm fires onSelectionChange from its OWN document mouseup handler, and
+    // listener order between the two is not something the app controls, so the
+    // first copy of a drag must not depend on `pending`.
+    expect(decide({ enabled: true, text: 'fresh', lastCopied: 'stale', pending: false })).toBe('copy');
+  });
+
+  it('leaves an unchanged selection alone on an unrelated mouseup', () => {
+    expect(decide({ enabled: true, text: 'same', lastCopied: 'same', pending: false })).toBe('skip');
+  });
+
+  it('refuses a selection past the size cap instead of truncating it', () => {
+    const { windowRef } = loadHarness();
+    const huge = 'x'.repeat(windowRef.CodemanAutoCopy.MAX_CHARS + 1);
+    expect(windowRef.CodemanAutoCopy.decide({ enabled: true, text: huge, pending: true })).toBe('too-large');
+  });
+});
+
+describe('_flushAutoCopySelection', () => {
+  it('copies the selection without clearing it or stealing focus', async () => {
+    const { app } = loadHarness();
+    app._autoCopyPending = true;
+
+    await app._flushAutoCopySelection();
+
+    expect(app._copyText).toHaveBeenCalledWith('copied text');
+    // The two things copyTerminalSelection does and this path must not: clearing
+    // makes the text vanish under the cursor that highlighted it, and focusing
+    // opens the on-screen keyboard over it on a phone.
+    expect(app.terminal.clearSelection).not.toHaveBeenCalled();
+    expect(app.terminal.focus).not.toHaveBeenCalled();
+  });
+
+  it('starts the copy synchronously, inside the gesture that triggered it', () => {
+    // Both clipboard paths need user activation: Firefox gates
+    // navigator.clipboard.writeText on it, and execCommand('copy') (the
+    // plain-HTTP fallback) must run in the gesture's own task.
+    const { app } = loadHarness();
+    app._autoCopyPending = true;
+
+    void app._flushAutoCopySelection();
+
+    expect(app._copyText).toHaveBeenCalledTimes(1);
+  });
+
+  it('stays silent while the setting is off', async () => {
+    const { app, toasts } = loadHarness();
+    app.loadAppSettingsFromStorage = () => ({ autoCopySelection: false });
+    app._autoCopyPending = true;
+
+    await app._flushAutoCopySelection();
+
+    expect(app._copyText).not.toHaveBeenCalled();
+    expect(toasts).toEqual([]);
+  });
+
+  it('treats a missing setting as off', async () => {
+    const { app } = loadHarness();
+    app.loadAppSettingsFromStorage = () => ({});
+    app._autoCopyPending = true;
+
+    await app._flushAutoCopySelection();
+
+    expect(app._copyText).not.toHaveBeenCalled();
+  });
+
+  it('announces itself once per page load, then goes quiet', async () => {
+    const { app, toasts } = loadHarness();
+    let text = 'first';
+    app.terminal.getSelection = () => text;
+
+    app._autoCopyPending = true;
+    await app._flushAutoCopySelection();
+    text = 'second';
+    app._autoCopyPending = true;
+    await app._flushAutoCopySelection();
+
+    expect(app._copyText).toHaveBeenCalledTimes(2);
+    expect(toasts).toEqual([{ message: 'Auto Copy: selection copied', type: 'success' }]);
+  });
+
+  it('disarms the pending flag so the next unrelated mouseup copies nothing', async () => {
+    const { app } = loadHarness();
+    app._autoCopyPending = true;
+
+    await app._flushAutoCopySelection();
+    await app._flushAutoCopySelection();
+
+    expect(app._autoCopyPending).toBe(false);
+    expect(app._copyText).toHaveBeenCalledTimes(1);
+  });
+
+  it('hands focus back when the execCommand fallback took it', async () => {
+    const { app, setActiveElement } = loadHarness();
+    const terminalTextarea = { focus: vi.fn(), isConnected: true };
+    setActiveElement(terminalTextarea);
+    // The fallback appends a temp textarea, selects it, then removes it, which
+    // leaves the document with no focused element at all.
+    app._copyText = vi.fn(async () => {
+      setActiveElement(null);
+      return true;
+    });
+    app._autoCopyPending = true;
+
+    await app._flushAutoCopySelection();
+
+    expect(terminalTextarea.focus).toHaveBeenCalledTimes(1);
+  });
+
+  it('leaves focus alone when the clipboard API never moved it', async () => {
+    const { app, setActiveElement } = loadHarness();
+    const terminalTextarea = { focus: vi.fn(), isConnected: true };
+    setActiveElement(terminalTextarea);
+    app._autoCopyPending = true;
+
+    await app._flushAutoCopySelection();
+
+    expect(terminalTextarea.focus).not.toHaveBeenCalled();
+  });
+
+  it('reports a blocked clipboard and lets the next gesture retry the same text', async () => {
+    const { app, toasts } = loadHarness();
+    app._copyText = vi.fn(async () => false);
+    app._autoCopyPending = true;
+
+    await app._flushAutoCopySelection();
+    expect(toasts).toEqual([{ message: 'Auto Copy failed: the browser blocked clipboard access', type: 'error' }]);
+
+    // Without the reset, the dedupe would swallow every retry of the same text.
+    app._autoCopyPending = false;
+    await app._flushAutoCopySelection();
+    expect(app._copyText).toHaveBeenCalledTimes(2);
+  });
+
+  it('throttles the failure toast so a blocked clipboard cannot spam every drag', async () => {
+    const { app, toasts, setNow } = loadHarness();
+    app._copyText = vi.fn(async () => false);
+
+    app._autoCopyPending = true;
+    await app._flushAutoCopySelection();
+    setNow(2_000);
+    app._autoCopyPending = true;
+    await app._flushAutoCopySelection();
+    expect(toasts).toHaveLength(1);
+
+    setNow(1_000 + 10_001);
+    app._autoCopyPending = true;
+    await app._flushAutoCopySelection();
+    expect(toasts).toHaveLength(2);
+  });
+
+  it('refuses an oversized selection and says how to copy it anyway', async () => {
+    const { app, toasts, windowRef } = loadHarness();
+    const huge = 'x'.repeat(windowRef.CodemanAutoCopy.MAX_CHARS + 1);
+    app.terminal.getSelection = () => huge;
+    app._autoCopyPending = true;
+
+    await app._flushAutoCopySelection();
+
+    expect(app._copyText).not.toHaveBeenCalled();
+    expect(toasts).toEqual([{ message: 'Selection too large to copy automatically. Press Ctrl+C.', type: 'warning' }]);
+  });
+
+  it('does nothing when the selection was already dropped', async () => {
+    const { app } = loadHarness();
+    app.terminal.hasSelection = () => false;
+    app._autoCopyPending = true;
+
+    await app._flushAutoCopySelection();
+
+    expect(app._copyText).not.toHaveBeenCalled();
+  });
+});
+
+describe('Auto Copy wiring', () => {
+  const terminalUi = read('terminal-ui.js');
+  const settingsUi = read('settings-ui.js');
+  const html = read('index.html');
+  const schemas = readFileSync(resolve(import.meta.dirname, '../src/web/schemas.ts'), 'utf8');
+
+  it('arms on a selection change and disarms when the selection is dropped', () => {
+    const start = terminalUi.indexOf('this.terminal.onSelectionChange?.(');
+    expect(start).toBeGreaterThan(-1);
+    const body = terminalUi.slice(start, start + 1200);
+    expect(body).toContain('this._autoCopyPending = false;');
+    expect(body).toContain('this._autoCopyPending = true;');
+  });
+
+  it('flushes from the document mouseup, not from the selection change', () => {
+    // Copying inside onSelectionChange would be one clipboard write per cell the
+    // drag crosses.
+    expect(terminalUi).toContain("document.addEventListener('mouseup', () => this._flushAutoCopySelection());");
+    const start = terminalUi.indexOf('this.terminal.onSelectionChange?.(');
+    const body = terminalUi.slice(start, terminalUi.indexOf('_autoCopyListenerInstalled', start));
+    expect(body).not.toContain('_flushAutoCopySelection');
+  });
+
+  it('flushes from the touch gesture end, which never produces a mouseup', () => {
+    // The touch path preventDefaults its touchend to stop the compat mouse pair
+    // from stealing the selection back, so phones need their own call.
+    const start = terminalUi.indexOf('_endTouchSelectionGesture() {');
+    expect(start).toBeGreaterThan(-1);
+    expect(terminalUi.slice(start, start + 900)).toContain('this._flushAutoCopySelection();');
+  });
+
+  it('keeps the toggle per-device: display key, stripped from the PUT, absent from the schema', () => {
+    const displayKeys = settingsUi.slice(
+      settingsUi.indexOf('const displayKeys = new Set(['),
+      settingsUi.indexOf('])', settingsUi.indexOf('const displayKeys = new Set(['))
+    );
+    expect(displayKeys).toContain("'autoCopySelection'");
+    // SettingsUpdateSchema is .strict(), so a key it does not declare 400s the
+    // whole settings PUT if the client sends it.
+    expect(settingsUi).toContain('autoCopySelection: _acs,');
+    expect(schemas).not.toContain('autoCopySelection');
+  });
+
+  it('keeps the control loadable and savable by id', () => {
+    expect(html).toContain('id="appSettingsAutoCopySelection"');
+    expect(settingsUi).toContain(
+      "document.getElementById('appSettingsAutoCopySelection').checked = settings.autoCopySelection === true;"
+    );
+    expect(settingsUi).toContain("autoCopySelection: document.getElementById('appSettingsAutoCopySelection').checked,");
+  });
+});

test/terminal-copy-shortcut.test.ts

@@ -12,7 +12,7 @@
  * emitted through onData (the bytes that would reach the PTY).
  *
  * Browser-driven, so it is excluded from `npm run test:ci` like the other
- * Playwright suites. Run locally: npm test -- test/terminal-copy-shortcut.test.ts
+ * Playwright suites. Run locally: npm run test:browser -- test/terminal-copy-shortcut.test.ts
  *
  * Port: 3174 (per MEMORY.md, ports 3150+ for tests)
  */
@@ -23,6 +23,7 @@ import { WebServer } from '../src/web/server.js';
 
 const PORT = 3174;
 const BASE_URL = `http://localhost:${PORT}`;
+const IME_PUNCTUATION = '，。！？；：“”、《》、（）';
 
 describe('terminal Ctrl+C smart copy', () => {
   let server: WebServer;
@@ -102,6 +103,59 @@ describe('terminal Ctrl+C smart copy', () => {
     }));
   }
 
+  async function captureImeInput(targetPage: Page) {
+    await targetPage.waitForFunction(() => (window as any).app?.terminal, null, { timeout: 30000 });
+    await targetPage.evaluate(() => {
+      const term = (window as any).app.terminal;
+      (window as any).__data = [];
+      if (!(window as any).__dataHooked) {
+        term.onData((d: string) => (window as any).__data.push(d));
+        (window as any).__dataHooked = true;
+      }
+      (document.querySelector('.xterm-helper-textarea') as HTMLElement).focus();
+    });
+
+    const cdp = await targetPage.context().newCDPSession(targetPage);
+    await cdp.send('Input.imeSetComposition', { text: '中文', selectionStart: 2, selectionEnd: 2 });
+    await cdp.send('Input.insertText', { text: '中文' });
+    await targetPage.waitForFunction(() => (window as any).__data.join('') === '中文', null, { polling: 10 });
+
+    let expected = '中文';
+    for (const punctuation of Array.from(IME_PUNCTUATION)) {
+      // Keep keydown -> DOM mutation -> input in one browser task, as a
+      // native key default action does. Separate CDP calls can let xterm's
+      // zero-delay textarea diff run before Input.insertText reaches the page.
+      await targetPage.evaluate((text) => {
+        const textarea = document.querySelector('.xterm-helper-textarea') as HTMLTextAreaElement;
+        const down = new KeyboardEvent('keydown', {
+          key: 'Process',
+          code: 'Unidentified',
+          bubbles: true,
+          cancelable: true,
+          composed: true,
+        });
+        Object.defineProperties(down, { keyCode: { value: 229 }, which: { value: 229 } });
+        textarea.dispatchEvent(down);
+        if (!document.execCommand('insertText', false, text)) throw new Error('browser rejected insertText');
+        const up = new KeyboardEvent('keyup', {
+          key: 'Process',
+          code: 'Unidentified',
+          bubbles: true,
+          cancelable: true,
+          composed: true,
+        });
+        Object.defineProperties(up, { keyCode: { value: 229 }, which: { value: 229 } });
+        textarea.dispatchEvent(up);
+      }, punctuation);
+      expected += punctuation;
+      await targetPage.waitForFunction((text) => (window as any).__data.join('') === text, expected, {
+        polling: 10,
+      });
+    }
+
+    return targetPage.evaluate(() => (window as any).__data as string[]);
+  }
+
   it('copies the selection and sends nothing to the PTY', async () => {
     await setup('COPY-CASE-SELECTED', true);
     await page.keyboard.press('Control+c');
@@ -163,4 +217,20 @@ describe('terminal Ctrl+C smart copy', () => {
     expect(res.data.join('')).toContain('SENTINEL'); // pasted text, not ^V
     expect(res.data.join('')).not.toContain('\x16');
   });
+
+  it('forwards full-width punctuation after a Chinese IME composition', async () => {
+    await setup('IME-PUNCTUATION', false);
+    const desktopChunks = await captureImeInput(page);
+    expect(desktopChunks.join('')).toBe('中文' + IME_PUNCTUATION);
+
+    const touchContext = await browser.newContext({ hasTouch: true });
+    try {
+      const touchPage = await touchContext.newPage();
+      await touchPage.goto(BASE_URL, { waitUntil: 'domcontentloaded' });
+      const touchChunks = await captureImeInput(touchPage);
+      expect(touchChunks.join('')).toBe('中文' + IME_PUNCTUATION);
+    } finally {
+      await touchContext.close();
+    }
+  });
 });

test/terminal-flush-budget.test.ts

@@ -89,7 +89,7 @@ describe('terminal flush budget', () => {
     expect(app.pendingWrites.join('')).toHaveLength(32 * 1024);
   });
 
-  it('waits for xterm to process small buffer replays before completing buffer load', async () => {
+  it('releases the live-output gate but waits for xterm to parse a small replay', async () => {
     const { app, writes } = loadTerminalUiHarness('codex');
     let writeDone: (() => void) | undefined;
     let resolved = false;
@@ -109,13 +109,90 @@ describe('terminal flush budget', () => {
     expect(writes).toEqual(['fresh tmux pane frame']);
     expect(writeDone).toBeTypeOf('function');
     expect(resolved).toBe(false);
-    expect(finishBufferLoad).not.toHaveBeenCalled();
+    expect(finishBufferLoad).toHaveBeenCalledOnce();
 
     writeDone?.();
     await promise;
 
     expect(resolved).toBe(true);
-    expect(finishBufferLoad).toHaveBeenCalledOnce();
+  });
+
+  it('paces a large enqueue and releases live output before the parse marker completes', async () => {
+    const { app, writes } = loadTerminalUiHarness('shell');
+    const scheduled: Array<() => void> = [];
+    let parseDone: (() => void) | undefined;
+    let resolved = false;
+    let result: { parsedAt: number; bufferLength: number; completed: boolean } | undefined;
+    app._safeYield = (callback: () => void) => scheduled.push(callback);
+    app.isTerminalAtBottom = () => true;
+    app.terminal.buffer = { active: { length: 37 } };
+    app.terminal.write = (data: string, callback?: () => void) => {
+      writes.push(data);
+      if (callback) parseDone = callback;
+    };
+
+    const promise = app.chunkedTerminalWrite('x'.repeat(3 * 32 * 1024)).then((value: typeof result) => {
+      result = value;
+      resolved = true;
+    });
+    expect(writes).toEqual([]);
+    expect(scheduled).toHaveLength(1);
+
+    scheduled.shift()?.();
+    expect(writes.map((write) => write.length)).toEqual([32 * 1024]);
+    expect(scheduled).toHaveLength(1);
+
+    scheduled.shift()?.();
+    expect(writes.map((write) => write.length)).toEqual([32 * 1024, 32 * 1024]);
+    expect(resolved).toBe(false);
+
+    scheduled.shift()?.();
+    expect(writes.map((write) => write.length)).toEqual([32 * 1024, 32 * 1024, 32 * 1024, 0]);
+    expect(app._isLoadingBuffer).toBe(false);
+    expect(resolved).toBe(false);
+
+    app.batchTerminalWrite('new output after snapshot');
+    expect(app._loadBufferQueue).toBe(null);
+    expect(app.pendingWrites).toEqual(['new output after snapshot']);
+
+    parseDone?.();
+    app.terminal.buffer.active.length = 42;
+    await promise;
+    expect(resolved).toBe(true);
+    expect(result?.bufferLength).toBe(37);
+    expect(result?.completed).toBe(true);
+  });
+
+  it('marks a parse callback stale when a newer replay supersedes it', async () => {
+    const { app } = loadTerminalUiHarness('shell');
+    let parseDone: (() => void) | undefined;
+    app.terminal.write = (_data: string, callback?: () => void) => {
+      parseDone = callback;
+    };
+
+    const firstReplay = app.chunkedTerminalWrite('old snapshot');
+    app._chunkedWriteGen += 1;
+    parseDone?.();
+
+    await expect(firstReplay).resolves.toMatchObject({ completed: false });
+  });
+
+  it('scans xterm rows from buffer.length instead of double-counting baseY', () => {
+    const { app } = loadTerminalUiHarness('shell');
+    const getLine = vi.fn((index: number) =>
+      index === 99 || index === 77 ? { translateToString: () => 'content' } : undefined
+    );
+    app.terminal = {
+      rows: 24,
+      buffer: { active: { baseY: 76, length: 100, getLine } },
+      scrollToBottom: vi.fn(),
+      scrollToLine: vi.fn(),
+    };
+
+    app.scrollToLastNonEmptyLine();
+
+    expect(getLine.mock.calls[0]?.[0]).toBe(99);
+    expect(app.terminal.scrollToLine).toHaveBeenCalledWith(77);
   });
 
   it('keeps stale buffer load owners from finishing a newer load', () => {

test/terminal-font.test.ts

@@ -0,0 +1,58 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import vm from 'node:vm';
+import { describe, expect, it } from 'vitest';
+
+function loadFontHelper() {
+  const context = vm.createContext({ window: {}, globalThis: {} });
+  const source = readFileSync(resolve(import.meta.dirname, '../src/web/public/constants.js'), 'utf8');
+  vm.runInContext(source, context, { filename: 'constants.js' });
+  return (
+    context.window as {
+      CodemanTerminalFont: {
+        DEFAULT_STACK: string;
+        resolve: (custom?: unknown) => string;
+      };
+    }
+  ).CodemanTerminalFont;
+}
+
+const font = loadFontHelper();
+
+describe('CodemanTerminalFont', () => {
+  it('returns the default stack for empty or missing input', () => {
+    expect(font.resolve(undefined)).toBe(font.DEFAULT_STACK);
+    expect(font.resolve('')).toBe(font.DEFAULT_STACK);
+    expect(font.resolve('   ')).toBe(font.DEFAULT_STACK);
+    expect(font.resolve(42)).toBe(font.DEFAULT_STACK);
+  });
+
+  it('keeps the symbols fallback ahead of monospace in the default stack', () => {
+    const symbolsAt = font.DEFAULT_STACK.indexOf('"Symbols Nerd Font Mono"');
+    const monoAt = font.DEFAULT_STACK.lastIndexOf('monospace');
+    expect(symbolsAt).toBeGreaterThan(-1);
+    expect(monoAt).toBeGreaterThan(symbolsAt);
+  });
+
+  it('prepends a custom family and preserves the full default stack', () => {
+    expect(font.resolve('Menlo')).toBe(`Menlo, ${font.DEFAULT_STACK}`);
+  });
+
+  it('quotes names that need quoting for CSS', () => {
+    expect(font.resolve('JetBrainsMono Nerd Font')).toBe(`"JetBrainsMono Nerd Font", ${font.DEFAULT_STACK}`);
+  });
+
+  it('normalizes already-quoted input instead of double-quoting', () => {
+    expect(font.resolve('"JetBrainsMono Nerd Font"')).toBe(`"JetBrainsMono Nerd Font", ${font.DEFAULT_STACK}`);
+    expect(font.resolve("'Iosevka Term'")).toBe(`"Iosevka Term", ${font.DEFAULT_STACK}`);
+  });
+
+  it('accepts a comma-separated list', () => {
+    expect(font.resolve('Iosevka, MesloLGS NF')).toBe(`Iosevka, "MesloLGS NF", ${font.DEFAULT_STACK}`);
+  });
+
+  it('drops generic families so they cannot shadow the symbols fallback', () => {
+    expect(font.resolve('monospace')).toBe(font.DEFAULT_STACK);
+    expect(font.resolve('Hack, monospace')).toBe(`Hack, ${font.DEFAULT_STACK}`);
+  });
+});

test/terminal-logical-line.test.ts

@@ -0,0 +1,137 @@
+// Port: none (a pure function in a vm context — no browser, no server).
+//
+// `terminalLogicalLine` (constants.js) reconstructs the logical line a terminal row
+// belongs to. Two consumers depend on it and must not disagree: the link provider
+// matches its patterns over this text, and touch selection measures words and whole
+// lines with it.
+//
+// The bug it exists to fix, reported from a phone: an agent printing a numbered list
+//
+//     1. https://github.com/users/someone/packages/container/p
+//        ackage/thing
+//
+// opened only `…/container/p`. Ink wraps its own output and emits a real newline, so
+// nothing is flagged `isWrapped`, and the continuation carries the list's indent —
+// joining the rows verbatim put whitespace in the middle of the URL, where the
+// pattern stops. "Line" was broken by the same shape: it walked `isWrapped` only, so
+// it grabbed the single row on screen.
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import vm from 'node:vm';
+import { describe, expect, it } from 'vitest';
+
+const SOURCE = readFileSync(resolve(import.meta.dirname, '../src/web/public/constants.js'), 'utf8');
+
+type Row = { text: string; wrapped?: boolean };
+type Logical = {
+  startRow: number;
+  endRow: number;
+  text: string;
+  offsetToCell: (offset: number) => { row: number; col: number };
+  cellToOffset: (row: number, col: number) => number;
+} | null;
+
+const COLS = 60;
+
+function load(): (buffer: unknown, row: number, cols: number, maxRows?: number) => Logical {
+  const context = vm.createContext({ console, window: undefined });
+  vm.runInContext(`${SOURCE}\nglobalThis.__fn = terminalLogicalLine;`, context, { filename: 'constants.js' });
+  return (context as { __fn: never })['__fn'] as never;
+}
+
+/** An xterm-shaped buffer: untrimmed rows pad to the full width, as xterm's do. */
+function buffer(rows: Row[]) {
+  return {
+    length: rows.length,
+    getLine: (r: number) =>
+      r >= 0 && r < rows.length
+        ? {
+            isWrapped: !!rows[r].wrapped,
+            translateToString: (trim?: boolean) => (trim === false ? rows[r].text.padEnd(COLS) : rows[r].text),
+          }
+        : undefined,
+  };
+}
+
+const terminalLogicalLine = load();
+const URL_RE = /https?:\/\/(?:[^\s"'<>|;&)\]\x00-\x1f]|&(?!&))+/;
+
+describe('terminalLogicalLine', () => {
+  // Row 0 runs to the last column — the only trace a hard wrap leaves — and row 1
+  // carries the three spaces the list indent put there.
+  const HEAD = '1. https://example.com/';
+  const ROW0 = HEAD + 'a'.repeat(COLS - HEAD.length);
+  const ROW1 = '   ackage/thing';
+  const HARD = [{ text: ROW0 }, { text: ROW1 }];
+
+  it('stitches a hard wrap and drops the indent the continuation carries', () => {
+    const line = terminalLogicalLine(buffer(HARD), 0, COLS)!;
+
+    expect(line.startRow).toBe(0);
+    expect(line.endRow).toBe(1);
+    expect(line.text).toBe(ROW0 + 'ackage/thing');
+    // The whole URL now matches, which is the entire point.
+    expect(line.text.match(URL_RE)![0]).toBe('https://example.com/' + 'a'.repeat(COLS - HEAD.length) + 'ackage/thing');
+  });
+
+  it('finds the same line from the continuation row', () => {
+    // A tap or hover lands on either row; both must resolve the whole thing.
+    const line = terminalLogicalLine(buffer(HARD), 1, COLS)!;
+
+    expect([line.startRow, line.endRow]).toEqual([0, 1]);
+    expect(line.text).toBe(ROW0 + 'ackage/thing');
+  });
+
+  it('maps offsets back to the right cell across the dropped indent', () => {
+    const line = terminalLogicalLine(buffer(HARD), 0, COLS)!;
+    const at = line.text.indexOf('ackage/thing');
+
+    // 'a' of 'ackage' is the 4th cell of row 1 (0-based col 3), after the indent.
+    expect(line.offsetToCell(at)).toEqual({ row: 1, col: 3 });
+    // …and the reverse direction agrees.
+    expect(line.cellToOffset(1, 3)).toBe(at);
+    // Row 0 is unshifted.
+    expect(line.offsetToCell(3)).toEqual({ row: 0, col: 3 });
+    expect(line.cellToOffset(0, 3)).toBe(3);
+  });
+
+  it('keeps a SOFT continuation verbatim, indent and all', () => {
+    // The emulator inserts nothing when it wraps, so leading spaces there are real
+    // content and dropping them would corrupt the text.
+    const soft = [{ text: 'x'.repeat(COLS) }, { text: '   tail', wrapped: true }];
+    const line = terminalLogicalLine(buffer(soft), 1, COLS)!;
+
+    expect(line.text).toBe('x'.repeat(COLS) + '   tail');
+    expect(line.offsetToCell(COLS)).toEqual({ row: 1, col: 0 });
+  });
+
+  it('does not stitch a row that stops short of the last column', () => {
+    // A line that genuinely ended is not a wrap, and over-reaching would glue
+    // unrelated output into one link.
+    const rows = [{ text: 'short line' }, { text: 'next line' }];
+    const line = terminalLogicalLine(buffer(rows), 0, COLS)!;
+
+    expect([line.startRow, line.endRow]).toEqual([0, 0]);
+    expect(line.text).toBe('short line');
+  });
+
+  it('bounds the span so a screenful of full-width output cannot be re-scanned per hover', () => {
+    const rows = Array.from({ length: 40 }, () => ({ text: 'y'.repeat(COLS) }));
+    const line = terminalLogicalLine(buffer(rows), 30, COLS, 4)!;
+
+    expect(line.endRow - line.startRow).toBeLessThanOrEqual(4);
+  });
+
+  it('trims only the final row, so every earlier offset stays aligned to a cell', () => {
+    const rows = [{ text: 'z'.repeat(COLS) }, { text: 'tail' }];
+    const line = terminalLogicalLine(buffer(rows), 0, COLS)!;
+
+    // Row 0 contributes exactly COLS characters; the last row is trimmed.
+    expect(line.text).toBe('z'.repeat(COLS) + 'tail');
+    expect(line.offsetToCell(COLS)).toEqual({ row: 1, col: 0 });
+  });
+
+  it('answers null for a row that does not exist', () => {
+    expect(terminalLogicalLine(buffer([{ text: 'a' }]), 5, COLS)).toBeNull();
+  });
+});

test/terminal-touch-tap.test.ts

@@ -8,8 +8,11 @@ function loadTerminalUiHarness() {
   let now = 1_000;
   let keyboardVisible = false;
   let activeElement: unknown = null;
+  // The module hangs its constants off window (CodemanTerminalInput) and the URL branch of
+  // the link provider opens through window.open, so tests need a handle on the same object.
+  const windowRef: Record<string, any> = {};
   const context = vm.createContext({
-    window: {},
+    window: windowRef,
     document: {
       body: { classList: { contains: () => false } },
       get activeElement() {
@@ -18,7 +21,7 @@ function loadTerminalUiHarness() {
       getElementById: () => null,
     },
     CodemanApp,
-    console: { warn: vi.fn(), log: vi.fn() },
+    console: { warn: vi.fn(), log: vi.fn(), debug: vi.fn() },
     _crashDiag: { log: vi.fn() },
     performance: { now: () => now },
     requestAnimationFrame: (_fn: () => void) => 1,
@@ -43,12 +46,18 @@ function loadTerminalUiHarness() {
     TERMINAL_CHUNK_SIZE: 32 * 1024,
   });
 
+  // constants.js first: the link provider calls absoluteFilePathPattern() and
+  // previewsInFileViewer() at scan time, and the SHIPPED definitions are what keep a tap and
+  // a hover resolving the same links.
+  const constants = readFileSync(resolve(import.meta.dirname, '../src/web/public/constants.js'), 'utf8');
   const code = readFileSync(resolve(import.meta.dirname, '../src/web/public/terminal-ui.js'), 'utf8');
+  vm.runInContext(constants, context, { filename: 'constants.js' });
   vm.runInContext(code, context, { filename: 'terminal-ui.js' });
 
   const app = new (CodemanApp as any)();
   return {
     app,
+    windowRef,
     setNow: (value: number) => {
       now = value;
     },
@@ -88,13 +97,23 @@ function createTerminalGrid(lines: string[], cursorY: number, wrappedRows = new
       active: {
         viewportY: 0,
         baseY: 0,
+        length: lines.length,
         cursorY,
         getLine: (row: number) =>
           row >= 0 && row < lines.length
-            ? { isWrapped: wrappedRows.has(row), translateToString: () => lines[row] }
+            ? {
+                isWrapped: wrappedRows.has(row),
+                // xterm pads an UNTRIMMED row to the full width; the selection offset
+                // math is linear over joined rows and would shift without it.
+                translateToString: (trim?: boolean) => (trim === false ? lines[row].padEnd(80) : lines[row]),
+              }
             : undefined,
       },
     },
+    select: vi.fn(),
+    clearSelection: vi.fn(),
+    hasSelection: () => false,
+    getSelectionPosition: () => undefined,
     element: {
       querySelector: (selector: string) =>
         selector === '.xterm-screen' ? { getBoundingClientRect: () => ({ left: 0, top: 0 }) } : null,
@@ -121,7 +140,7 @@ describe('terminal touch tap mouse guard', () => {
   it('routes a readback row to the TUI while keeping the prompt row as keyboard input', () => {
     const { app } = loadTerminalUiHarness();
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'codex' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'codex', cliMouseTracking: true }]]);
     app.terminal = createTerminalGrid(
       ['Agent readback mentions › inline', '  tap to collapse', '', '', '› ask', 'gpt-5 · Context 80% left'],
       4
@@ -136,7 +155,7 @@ describe('terminal touch tap mouse guard', () => {
   it('classifies Claude background-agent status as content rather than keyboard input', () => {
     const { app } = loadTerminalUiHarness();
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'claude', cliVersion: '2.1.220' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliVersion: '2.1.220', cliMouseTracking: true }]]);
     app.terminal = createTerminalGrid(
       ['', '', '', '• Working (1m 50s • esc to ', 'interrupt) · 1 background teammate', ''],
       4,
@@ -149,7 +168,7 @@ describe('terminal touch tap mouse guard', () => {
   it('keeps the live cursor focusable when Claude temporarily omits its prompt glyph', () => {
     const { app } = loadTerminalUiHarness();
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
     app.terminal = createTerminalGrid(['Prior response', '', 'ready for input', '', 'status footer', ''], 2);
 
     expect(app._classifyMobileTerminalTap(9, 33)).toBe('input');
@@ -159,7 +178,7 @@ describe('terminal touch tap mouse guard', () => {
   it('treats a highlighted numbered choice as TUI content, not an input prompt', () => {
     const { app } = loadTerminalUiHarness();
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
     app.terminal = createTerminalGrid(['Would you like to proceed?', '', '❯ 1. Yes', '  2. No', '', ''], 2);
 
     expect(app._classifyMobileTerminalTap(9, 33)).toBe('content');
@@ -174,7 +193,7 @@ describe('terminal touch tap mouse guard', () => {
     // commits an answer) as the only thing a phone could do.
     const { app, setActiveElement } = loadTerminalUiHarness();
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
     app.terminal = createTerminalGrid(
       ['Do you want to proceed?', '', '❯ 1. Yes', '  2. No, tell Claude what to do', '', ''],
       2
@@ -200,7 +219,7 @@ describe('terminal touch tap mouse guard', () => {
   it('collapses TUI readback content without opening or retaining the keyboard', () => {
     const { app, setActiveElement } = loadTerminalUiHarness();
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'codex' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'codex', cliMouseTracking: true }]]);
     app.terminal = createTerminalGrid(
       ['Agent readback', '  tap to collapse', '', '', '› ask', 'gpt-5 · Context 80% left'],
       4
@@ -233,7 +252,7 @@ describe('terminal touch tap mouse guard', () => {
   it('closes the keyboard on a second tap of INERT transcript content', () => {
     const { app, setActiveElement } = loadTerminalUiHarness();
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
     app.terminal = createTerminalGrid(['transcript line', '', '', '', '❯ ', ''], 4);
     app._sendInputAsync = vi.fn();
 
@@ -309,7 +328,7 @@ describe('terminal touch tap mouse guard', () => {
     const { app } = loadTerminalUiHarness();
     const sent: Array<{ id: string; data: string }> = [];
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
     app._sendInputAsync = (id: string, data: string) => sent.push({ id, data });
     app.terminal = {
       cols: 80,
@@ -320,7 +339,7 @@ describe('terminal touch tap mouse guard', () => {
       _core: { _renderService: { dimensions: { css: { cell: { width: 8, height: 16 } } } } },
     };
 
-    expect(app._sessionUsesServerMouseStrip()).toBe(true);
+    expect(app._shouldReportMouseToCli()).toBe(true);
     // touch at x=10+8*20+1, y=20+16*5+1 → col 21, row 6 (1-based)
     app._sendSyntheticSgrTap(171, 101);
 
@@ -347,19 +366,60 @@ describe('terminal touch tap mouse guard', () => {
     expect(sent).toEqual(['\x1b[<0;1;24M\x1b[<0;1;24m']);
   });
 
-  it('does not treat shell sessions as server-mouse-strip mode', () => {
+  it('never hand-reports for a shell session, even with tracking somehow set', () => {
+    // Shell DECSETs are NOT stripped (narrow strip), so xterm's own encoder owns
+    // the mouse there and a second, hand-encoded report would double-report.
     const { app } = loadTerminalUiHarness();
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'shell' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'shell', cliMouseTracking: true }]]);
 
-    expect(app._sessionUsesServerMouseStrip()).toBe(false);
+    expect(app._shouldReportMouseToCli()).toBe(false);
+  });
+
+  it('hand-reports only while the CLI actually has mouse tracking on', () => {
+    // The server strips the DECSETs, so xterm can never see them and the browser
+    // reported EVERY click. A claude pane sitting at its composer, or one that
+    // fell back to a shell prompt, was receiving mouse reports it never asked
+    // for; a shell prints those as literal text and they garble the next line.
+    const { app } = loadTerminalUiHarness();
+    app.activeSessionId = 'sess-1';
+
+    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    expect(app._shouldReportMouseToCli()).toBe(false);
+
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: false }]]);
+    expect(app._shouldReportMouseToCli()).toBe(false);
+
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
+    expect(app._shouldReportMouseToCli()).toBe(true);
+  });
+
+  it('desktop click: sends nothing while the CLI has no mouse mode on', () => {
+    const { app } = loadTerminalUiHarness();
+    const sent: string[] = [];
+    app.activeSessionId = 'sess-1';
+    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app._sendInputAsync = (_id: string, data: string) => sent.push(data);
+    app.terminal = createTerminalGrid(['some output', '', '\u276f '], 2);
+    app._linkHovered = false;
+
+    app._handleDesktopTerminalClick({
+      isTrusted: true,
+      button: 0,
+      detail: 1,
+      clientX: 40,
+      clientY: 10,
+      target: { closest: (sel: string) => (sel === '.xterm-screen' ? {} : null) },
+    });
+
+    expect(sent).toEqual([]);
   });
 
   it('desktop click: encodes SGR press+release for a plain left-click in strip mode', () => {
     const { app } = loadTerminalUiHarness();
     const sent: Array<{ id: string; data: string }> = [];
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
     app._sendInputAsync = (id: string, data: string) => sent.push({ id, data });
     app.terminal = {
       cols: 80,
@@ -434,7 +494,7 @@ describe('terminal touch tap mouse guard', () => {
     const { app } = loadTerminalUiHarness();
     const sent: string[] = [];
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
     app._sendInputAsync = (_id: string, data: string) => sent.push(data);
     app.terminal = {
       cols: 80,
@@ -468,7 +528,7 @@ describe('terminal touch tap mouse guard', () => {
     const { app, setNow } = loadTerminalUiHarness();
     const sent: string[] = [];
     app.activeSessionId = 'sess-1';
-    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
     app._sendInputAsync = (_id: string, data: string) => sent.push(data);
     app.terminal = {
       cols: 80,
@@ -732,3 +792,434 @@ describe('terminal touch tap mouse guard', () => {
     expect(event.stopImmediatePropagation).not.toHaveBeenCalled();
   });
 });
+
+describe('terminal link tap', () => {
+  // xterm resolves a link from mousemove and activates it on mouseup over its SCREEN element.
+  // A touch tap produces none of those (touch-action:none and touchstart's preventDefault
+  // suppress the compatibility mouse events, the post-tap guard drops the rest, and the
+  // synthetic pair this app dispatches for mouse REPORTING lands on the .xterm root, an
+  // ancestor of the node the linkifier listens on). So the tap path activates the link
+  // itself, through the same provider, or every URL and path in the terminal stays inert on
+  // a phone.
+  //
+  // Grid geometry from createTerminalGrid: 8×16 cells, screen rect at (0,0), viewportY 0 —
+  // so 0-based character index i on 0-based row r sits at (i * 8 + 4, r * 16 + 8).
+  const at = (index: number, row = 0) => ({ clientX: index * 8 + 4, clientY: row * 16 + 8 });
+
+  /** A claude-mode app with the shipped link provider registered over `lines`. */
+  function linkHarness(lines: string[], cursorY = lines.length - 1) {
+    const harness = loadTerminalUiHarness();
+    const { app, windowRef } = harness;
+    const sent: string[] = [];
+    app.activeSessionId = 'sess-1';
+    app.sessions = new Map([['sess-1', { mode: 'claude', cliMouseTracking: true }]]);
+    app._sendInputAsync = (_id: string, data: string) => sent.push(data);
+    app.terminal = createTerminalGrid(lines, cursorY);
+    app.terminal.registerLinkProvider = vi.fn();
+    app.openFilePreview = vi.fn();
+    app.openLogViewerWindow = vi.fn();
+    app._isExternalPreviewPath = () => false;
+    windowRef.open = vi.fn();
+    app.registerFilePathLinkProvider();
+    return { app, windowRef, sent };
+  }
+
+  it('opens a URL under the finger in a new tab', () => {
+    const line = 'Login at https://claude.ai/oauth/authorize?code=true&client_id=abc to finish';
+    const { app, windowRef } = linkHarness([line, '', '❯ ']);
+
+    expect(app._handleMobileTerminalTap(at(line.indexOf('https')), false, 'content')).toBe('link');
+    expect(windowRef.open).toHaveBeenCalledWith(
+      'https://claude.ai/oauth/authorize?code=true&client_id=abc',
+      '_blank',
+      'noopener,noreferrer'
+    );
+  });
+
+  it('sends no mouse report for the tap it just spent on a link', () => {
+    // The CLI must not also see a click there: that is how a tap on a URL printed inside a
+    // permission dialog would answer the dialog. Desktop already skips the SGR tap for a
+    // hovered link (_handleDesktopTerminalClick).
+    const line = 'see https://example.com/x for more';
+    const { app, sent } = linkHarness([line, '', '❯ ']);
+
+    expect(app._shouldReportMouseToCli()).toBe(true);
+    app._handleMobileTerminalTap(at(line.indexOf('https')), false, 'content');
+
+    expect(sent).toEqual([]);
+  });
+
+  it('leaves a tap beside the link as an ordinary tap', () => {
+    // Containment is xterm's own rule (flattened cell index), so tap and click agree on
+    // where a link ends; a tap on the prose around it keeps its mouse report.
+    const line = 'see https://example.com/x for more';
+    const { app, windowRef, sent } = linkHarness([line, '', '❯ ']);
+
+    expect(app._handleMobileTerminalTap(at(line.indexOf('for more') + 3), false, 'content')).toBe('content');
+    expect(windowRef.open).not.toHaveBeenCalled();
+    expect(sent).toHaveLength(1);
+  });
+
+  it('opens a tapped file path in the preview overlay', () => {
+    const line = 'wrote the chart to /tmp/out/chart.png just now';
+    const { app } = linkHarness([line, '', '❯ ']);
+
+    expect(app._handleMobileTerminalTap(at(line.indexOf('/tmp')), false, 'content')).toBe('link');
+    expect(app.openFilePreview).toHaveBeenCalledWith('/tmp/out/chart.png', 'sess-1');
+    expect(app.openLogViewerWindow).not.toHaveBeenCalled();
+  });
+
+  it('sends a tapped log path to the log viewer', () => {
+    const line = 'tail -f /var/log/app.log';
+    const { app } = linkHarness([line, '', '❯ ']);
+
+    expect(app._handleMobileTerminalTap(at(line.indexOf('/var')), false, 'content')).toBe('link');
+    expect(app.openLogViewerWindow).toHaveBeenCalledWith('/var/log/app.log', 'sess-1');
+  });
+
+  it('activates a link in scrollback, where the tap sends no report at all', () => {
+    // A scrolled-up tap deliberately reports nothing (it would land on whatever row now
+    // occupies the cell), but reading old output and tapping a URL in it is the common case.
+    const line = 'docs at https://example.com/guide';
+    const { app, windowRef, sent } = linkHarness([line, '', '']);
+
+    expect(app._handleMobileTerminalTap(at(line.indexOf('https')), false, 'history')).toBe('link');
+    expect(windowRef.open).toHaveBeenCalledOnce();
+    expect(sent).toEqual([]);
+  });
+
+  it('never hijacks a TUI-owned choice row that happens to carry a path', () => {
+    // On a phone the dialog is the only interaction that matters, and its rows routinely
+    // name the very file a link would open — answering it must keep winning.
+    // ⚠️ The caret is parked on the QUESTION row, not the choice: with the caret on the
+    // tapped row this would pass through _tapIsOnCaretLine and pin nothing.
+    const line = '❯ 1. Yes, edit /home/user/src/app.ts';
+    const { app, windowRef, sent } = linkHarness(['Do you want to make this edit?', line, '  2. No, keep it as is'], 0);
+
+    expect(app._handleMobileTerminalTap(at(line.indexOf('/home'), 1), false, 'content')).toBe('content');
+    expect(windowRef.open).not.toHaveBeenCalled();
+    expect(app.openFilePreview).not.toHaveBeenCalled();
+    expect(sent).toHaveLength(1); // the choice still reaches the CLI
+  });
+
+  it('leaves a URL the user typed in the composer editable', () => {
+    // Tapping your own prompt text means "put the caret here". Opening it instead would
+    // punish the phone gesture for fixing a typo in a pasted link.
+    const composer = '❯ summarize https://example.com/guide for me';
+    const { app, windowRef, sent } = linkHarness(['earlier output', '', composer], 2);
+
+    expect(app._handleMobileTerminalTap(at(composer.indexOf('https'), 2), true, 'input')).toBe('input');
+    expect(windowRef.open).not.toHaveBeenCalled();
+    expect(sent).toHaveLength(1); // the tap still positions the caret via the mouse report
+  });
+
+  it('activates a link in a plain shell session, where every tap classifies as input', () => {
+    // A shell has no TUI to own taps, so _classifyMobileTerminalTap short-circuits to
+    // 'input' for the whole screen — gating link taps on the intent would leave every URL
+    // in shell output (curl, npm, git remote) inert. The caret line is the real boundary.
+    const line = 'remote: https://github.com/Ark0N/Codeman.git';
+    const harness = loadTerminalUiHarness();
+    const { app, windowRef } = harness;
+    app.activeSessionId = 'sess-1';
+    app.sessions = new Map([['sess-1', { mode: 'shell' }]]);
+    app._sendInputAsync = vi.fn();
+    app.terminal = createTerminalGrid([line, '', 'bash-5.3$ '], 2);
+    app.terminal.registerLinkProvider = vi.fn();
+    windowRef.open = vi.fn();
+    app.registerFilePathLinkProvider();
+
+    // No cachedIntent below: real classification runs, and for a shell it answers 'input'.
+    const point = at(line.indexOf('https'));
+    expect(app._classifyMobileTerminalTap(point.clientX, point.clientY)).toBe('input');
+    expect(app._handleMobileTerminalTap(point, false)).toBe('link');
+    expect(windowRef.open).toHaveBeenCalledWith(
+      'https://github.com/Ark0N/Codeman.git',
+      '_blank',
+      'noopener,noreferrer'
+    );
+  });
+
+  it('keeps taps working when no provider was ever registered', () => {
+    const harness = loadTerminalUiHarness();
+    const { app } = harness;
+    app.activeSessionId = 'sess-1';
+    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.terminal = createTerminalGrid(['plain output', '', '❯ '], 2);
+
+    expect(app._terminalLinkAtPoint(4, 8)).toBeNull();
+    expect(app._activateTerminalLinkAtPoint(4, 8)).toBe(false);
+  });
+});
+
+describe('terminal touch selection', () => {
+  // Copying from a phone was impossible in three layers at once: `user-select: none`
+  // on the whole terminal subtree, a WebGL renderer that draws glyphs as pixels with
+  // only the accessibility tree behind them, and xterm's selection being a mouse DRAG
+  // while the tap path dispatches a zero-movement mousedown/mouseup pair. The gesture
+  // therefore drives xterm's own `select()`, which is renderer-independent.
+  //
+  // Grid geometry (createTerminalGrid): 80 cols, 8×16 cells, screen rect at (0,0),
+  // viewportY 0 — 0-based index i on 0-based row r sits at (i * 8 + 4, r * 16 + 8).
+  const at = (index: number, row = 0) => ({ clientX: index * 8 + 4, clientY: row * 16 + 8 });
+  const press = (app: any, index: number, row = 0) =>
+    app._beginTouchSelection(at(index, row).clientX, at(index, row).clientY);
+  const dragTo = (app: any, index: number, row = 0) =>
+    app._extendTouchSelection(at(index, row).clientX, at(index, row).clientY);
+  const COLS = 80;
+  const LINE = 'wrote the chart to /tmp/out/chart.png just now';
+  const PATH_AT = LINE.indexOf('/tmp');
+
+  function selectionHarness(lines = [LINE, '', '❯ '], cursorY = 2, wrapped = new Set<number>()) {
+    const { app, setNow } = loadTerminalUiHarness();
+    app.activeSessionId = 'sess-1';
+    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app._sendInputAsync = vi.fn();
+    app.terminal = createTerminalGrid(lines, cursorY, wrapped);
+    return { app, setNow, select: app.terminal.select as ReturnType<typeof vi.fn> };
+  }
+
+  it('selects the whitespace-delimited token under a long press', () => {
+    // Whitespace is the only delimiter on purpose: a punctuation-aware word rule
+    // cuts a path, a URL or a hash in half, which is exactly what you came to copy.
+    const { app, select } = selectionHarness();
+
+    expect(press(app, PATH_AT + 4)).toBe(true);
+    expect(select).toHaveBeenCalledWith(PATH_AT, 0, '/tmp/out/chart.png'.length);
+  });
+
+  it('selects nothing when the press lands on blank space', () => {
+    const { app, select } = selectionHarness();
+
+    expect(press(app, LINE.length + 10)).toBe(false);
+    expect(select).not.toHaveBeenCalled();
+  });
+
+  it('grows the selection as the finger drags past the anchor word', () => {
+    const { app, select } = selectionHarness();
+    press(app, PATH_AT + 4);
+    select.mockClear();
+
+    dragTo(app, LINE.length - 1);
+
+    // From the word's start through the cell under the finger, inclusive.
+    expect(select).toHaveBeenCalledWith(PATH_AT, 0, LINE.length - PATH_AT);
+  });
+
+  it('keeps the anchor word inside the selection when the drag goes backwards', () => {
+    const { app, select } = selectionHarness();
+    press(app, PATH_AT + 4);
+    select.mockClear();
+
+    dragTo(app, 6);
+
+    const wordEnd = PATH_AT + '/tmp/out/chart.png'.length;
+    expect(select).toHaveBeenCalledWith(6, 0, wordEnd - 6);
+  });
+
+  it('extends across rows, where a linear length is what xterm wants', () => {
+    const { app, select } = selectionHarness(['first row text', 'second row text', '❯ '], 2);
+    press(app, 0);
+    select.mockClear();
+
+    dragTo(app, 5, 1);
+
+    // Row 1 cell 5 is absolute cell 85; the selection runs from 0 through it.
+    expect(select).toHaveBeenCalledWith(0, 0, COLS + 6);
+  });
+
+  it('Line takes the whole logical line, wraps included, without the padding', () => {
+    const wrappedTail = 'tail';
+    const { app, select } = selectionHarness(['x'.repeat(COLS), wrappedTail, '❯ '], 2, new Set([1]));
+    press(app, 2, 1);
+    select.mockClear();
+
+    app._selectTouchSelectionLine();
+
+    expect(select).toHaveBeenCalledWith(0, 0, COLS + wrappedTail.length);
+  });
+
+  it('a tap while a selection is up extends it instead of moving the cursor', () => {
+    const { app, select } = selectionHarness();
+    press(app, PATH_AT + 4);
+    select.mockClear();
+
+    expect(app._handleMobileTerminalTap(at(LINE.length - 1), false, 'content')).toBe('select');
+    expect(select).toHaveBeenCalledWith(PATH_AT, 0, LINE.length - PATH_AT);
+    // and the CLI never sees a click it would act on
+    expect(app._sendInputAsync).not.toHaveBeenCalled();
+  });
+
+  it('copies through the shared clipboard path and drops the selection', () => {
+    // copyTerminalSelection is the one that falls back to execCommand, which is the
+    // only route that works on the plain-HTTP LAN install the installer offers.
+    const { app } = selectionHarness();
+    app.copyTerminalSelection = vi.fn().mockResolvedValue(true);
+    press(app, PATH_AT + 4);
+
+    return app._copyTouchSelection().then(() => {
+      expect(app.copyTerminalSelection).toHaveBeenCalledOnce();
+      expect(app._touchSelectionActive).toBe(false);
+      expect(app._touchSelectionAnchor).toBeNull();
+      expect(app.terminal.clearSelection).toHaveBeenCalled();
+    });
+  });
+
+  it('lifting the finger cannot let a compat mousedown steal focus and drop the selection', () => {
+    // The bug this pins: on lift the browser synthesizes a trusted mousedown, xterm
+    // focuses on it (keyboard up) and SelectionService resets the model (bar gone).
+    // Ending the gesture arms the same guard the tap path uses.
+    const { app } = selectionHarness();
+    const { element, dispatch } = createElementHarness();
+    app.terminal.element = { ...app.terminal.element, addEventListener: element.addEventListener };
+    app._installMobileTapMouseGuard();
+
+    press(app, PATH_AT + 4);
+    app._endTouchSelectionGesture();
+
+    const ev = { isTrusted: true, preventDefault: vi.fn(), stopImmediatePropagation: vi.fn() };
+    dispatch('mousedown', ev);
+
+    expect(ev.preventDefault).toHaveBeenCalledOnce();
+    expect(ev.stopImmediatePropagation).toHaveBeenCalledOnce();
+    expect(app._touchSelecting).toBe(false);
+    expect(app._touchSelectionActive).toBe(true); // the selection outlives the gesture
+  });
+
+  it('copying does not pop the on-screen keyboard back over the text', () => {
+    // copyTerminalSelection hands focus to the terminal, which on a phone means the
+    // keyboard covers what you just copied with nothing waiting to be typed.
+    const { app } = selectionHarness();
+    app.copyTerminalSelection = vi.fn().mockResolvedValue(true);
+    press(app, PATH_AT + 4);
+    app._blurMobileTerminalInput = vi.fn(); // stubbed AFTER the press, which blurs too
+
+    return app._copyTouchSelection().then(() => {
+      expect(app._blurMobileTerminalInput).toHaveBeenCalledOnce();
+    });
+  });
+
+  it('blurs the terminal input if anything focuses it during the gesture', () => {
+    // The one that matters on Android: Chrome runs its own long-press handling at
+    // ~500ms and focuses the helper textarea directly — no mouse event to guard, so
+    // the keyboard shot up over the selection the instant it appeared.
+    const { app, setNow } = selectionHarness();
+    const listeners = new Map<string, () => void>();
+    app.terminal.textarea = {
+      addEventListener: (type: string, fn: () => void) => listeners.set(type, fn),
+      classList: { contains: (n: string) => n === 'xterm-helper-textarea' },
+      blur: vi.fn(),
+    };
+    app._installTouchSelectionFocusGuard();
+    press(app, PATH_AT + 4);
+    app._endTouchSelectionGesture();
+
+    // Whatever focused it, the guard takes the focus straight back off.
+    app._blurMobileTerminalInput = vi.fn();
+    listeners.get('focus')?.();
+    expect(app._blurMobileTerminalInput).toHaveBeenCalledOnce();
+
+    // …and the guard expires on its own, so a stuck flag can never make the
+    // keyboard permanently unreachable.
+    setNow(1_000 + 5_000);
+    app._blurMobileTerminalInput = vi.fn();
+    listeners.get('focus')?.();
+    expect(app._blurMobileTerminalInput).not.toHaveBeenCalled();
+  });
+
+  it('survives a missing bar container instead of throwing mid-gesture', () => {
+    // index.html is read once at server start, so the bar is built in JS — and a
+    // solo popup or an early gesture can run before the container exists.
+    const { app } = selectionHarness();
+
+    expect(() => app._showTouchSelectionBar()).not.toThrow();
+    expect(app._ensureTouchSelectionBar()).toBeNull();
+  });
+});
+
+describe('terminal wrapped-line handling', () => {
+  // Reported from a phone against the shipped fix: an agent's numbered list wraps its
+  // URL, and tapping it opened only the part on screen. Ink emits a real newline (so
+  // nothing is flagged isWrapped) and indents the continuation under the list marker,
+  // so joining the rows verbatim put whitespace inside the URL. "Line" broke the same
+  // way, grabbing the one visible row.
+  //
+  // Grid: 80 cols, 8×16 cells, screen rect at (0,0), viewportY 0.
+  const COLS = 80;
+  const at = (index: number, row = 0) => ({ clientX: index * 8 + 4, clientY: row * 16 + 8 });
+  const press = (app: any, index: number, row = 0) =>
+    app._beginTouchSelection(at(index, row).clientX, at(index, row).clientY);
+  const HEAD = '1. https://example.com/';
+  // Row 0 runs to the last column, which is the only trace a hard wrap leaves.
+  const ROW0 = HEAD + 'a'.repeat(COLS - HEAD.length);
+  const ROW1 = '   ackage/thing';
+  const FULL_URL = 'https://example.com/' + 'a'.repeat(COLS - HEAD.length) + 'ackage/thing';
+
+  function wrappedHarness() {
+    const { app, windowRef } = loadTerminalUiHarness();
+    app.activeSessionId = 'sess-1';
+    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app._sendInputAsync = vi.fn();
+    app.terminal = createTerminalGrid([ROW0, ROW1, '❯ '], 2);
+    app.terminal.registerLinkProvider = vi.fn();
+    app.openFilePreview = vi.fn();
+    app.openLogViewerWindow = vi.fn();
+    app._isExternalPreviewPath = () => false;
+    windowRef.open = vi.fn();
+    app.registerFilePathLinkProvider();
+    return { app, windowRef, select: app.terminal.select as ReturnType<typeof vi.fn> };
+  }
+
+  it('opens the WHOLE wrapped URL, not the part on screen', () => {
+    const { app, windowRef } = wrappedHarness();
+
+    expect(app._handleMobileTerminalTap(at(HEAD.length + 5), false, 'content')).toBe('link');
+    expect(windowRef.open).toHaveBeenCalledWith(FULL_URL, '_blank', 'noopener,noreferrer');
+  });
+
+  it('opens the whole URL from the continuation row too', () => {
+    // Tapping the second half is the natural gesture when that is what you can see.
+    const { app, windowRef } = wrappedHarness();
+
+    expect(app._handleMobileTerminalTap(at(5, 1), false, 'content')).toBe('link');
+    expect(windowRef.open).toHaveBeenCalledWith(FULL_URL, '_blank', 'noopener,noreferrer');
+  });
+
+  it('selects a token that spans the wrap, across both rows', () => {
+    const { app, select } = wrappedHarness();
+
+    press(app, 5, 1); // inside 'ackage/thing' on the continuation row
+    // From the URL's first cell (row 0, col 3) through the token's last cell
+    // (row 1, col 14). The run covers the indent cells between the halves, because
+    // an xterm selection is one contiguous run and a gap cannot be expressed.
+    const index = 3;
+    const end = COLS + ROW1.length - 1;
+    expect(select).toHaveBeenCalledWith(3, 0, end - index + 1);
+  });
+
+  it('Line takes every row of a HARD-wrapped line, not just the visible one', () => {
+    const { app, select } = wrappedHarness();
+    press(app, HEAD.length + 5);
+    select.mockClear();
+
+    app._selectTouchSelectionLine();
+
+    // Row 0 col 0 through row 1's last non-blank cell.
+    expect(select).toHaveBeenCalledWith(0, 0, COLS + ROW1.length);
+  });
+
+  it('does not reach into the next line when a row stops short of the edge', () => {
+    // Over-reaching would glue unrelated output into one link or one "Line".
+    const { app, select } = loadTerminalUiHarness();
+    void select;
+    app.activeSessionId = 'sess-1';
+    app.sessions = new Map([['sess-1', { mode: 'claude' }]]);
+    app.terminal = createTerminalGrid(['short output', 'https://example.com/next', '❯ '], 2);
+    app.terminal.registerLinkProvider = vi.fn();
+    app.registerFilePathLinkProvider();
+
+    press(app, 2); // inside 'short'
+    app._selectTouchSelectionLine();
+
+    expect(app.terminal.select).toHaveBeenCalledWith(0, 0, 'short output'.length);
+  });
+});

test/tmux-manager.test.ts

@@ -675,6 +675,7 @@ describe('TmuxManager (unit)', () => {
           sessionId: 'abc12345-1234-5678-90ab-cdef12345678',
           workingDir: '/mnt/gdrive/project with spaces',
           mode: 'shell',
+          historyLimit: 250_000,
         });
 
         expect(session.workingDir).toBe('/mnt/gdrive/project with spaces');
@@ -683,7 +684,9 @@ describe('TmuxManager (unit)', () => {
         const newSessionCall = mockedExecSync.mock.calls.find(
           ([cmd]) => typeof cmd === 'string' && cmd.includes(' new-session ')
         );
-        expect(newSessionCall?.[0]).toBe(`tmux -L 'codeman' new-session -ds "codeman-abc12345" -c /tmp`);
+        expect(newSessionCall?.[0]).toBe(
+          `tmux -L 'codeman' set-option -g history-limit 250000 \\; new-session -ds "codeman-abc12345" -c /tmp \\; set-option -t "codeman-abc12345" history-limit 250000`
+        );
         expect(newSessionCall?.[1]).toEqual(expect.objectContaining({ cwd: '/tmp' }));
 
         const respawnCall = mockedExecSync.mock.calls.find(
@@ -696,6 +699,59 @@ describe('TmuxManager (unit)', () => {
       }
     });
 
+    it('changes the global history default on tmux versions that cannot resize panes', async () => {
+      const NonTestTmuxManager = await importWithTmuxCommandsEnabled();
+      const nonTestManager = new NonTestTmuxManager();
+
+      try {
+        await nonTestManager.setHistoryLimit(200_000);
+        const historyCall = mockedExec.mock.calls.find(
+          ([cmd]) => typeof cmd === 'string' && cmd.includes(' history-limit ')
+        );
+        expect(historyCall?.[0]).toBe(`tmux -L 'codeman' set-option -g history-limit 200000`);
+        expect(historyCall?.[0]).not.toContain(' -t ');
+      } finally {
+        nonTestManager.destroy();
+      }
+    });
+
+    it('targets only the new and tracked sessions on tmux 3.7+', async () => {
+      mockedExecSync.mockImplementation((cmd: string) => {
+        if (typeof cmd === 'string' && cmd.endsWith(' -V')) return 'tmux 3.7b\n';
+        if (typeof cmd === 'string' && cmd.includes('which tmux')) return '/usr/bin/tmux\n';
+        if (typeof cmd === 'string' && cmd.includes('display-message') && cmd.includes('#{pane_pid}')) return '4242\n';
+        return '';
+      });
+      const NonTestTmuxManager = await importWithTmuxCommandsEnabled();
+      const nonTestManager = new NonTestTmuxManager();
+
+      try {
+        await nonTestManager.createSession({
+          sessionId: 'def67890-1234-5678-90ab-cdef12345678',
+          workingDir: '/project',
+          mode: 'shell',
+          historyLimit: 250_000,
+        });
+        const newSessionCall = mockedExecSync.mock.calls.find(
+          ([cmd]) => typeof cmd === 'string' && cmd.includes(' new-session ')
+        );
+        expect(newSessionCall?.[0]).toBe(
+          `tmux -L 'codeman' new-session -ds "codeman-def67890" -c /tmp \\; set-option -t "codeman-def67890" history-limit 250000`
+        );
+        expect(newSessionCall?.[0]).not.toContain('set-option -g');
+
+        mockedExec.mockClear();
+        await nonTestManager.setHistoryLimit(200_000);
+        const historyCall = mockedExec.mock.calls.find(
+          ([cmd]) => typeof cmd === 'string' && cmd.includes(' history-limit ')
+        );
+        expect(historyCall?.[0]).toBe(`tmux -L 'codeman' set-option -t 'codeman-def67890' history-limit 200000`);
+        expect(historyCall?.[0]).not.toContain('set-option -g');
+      } finally {
+        nonTestManager.destroy();
+      }
+    });
+
     it('respawns existing panes from /tmp and cd-bounces into the requested workspace', async () => {
       const NonTestTmuxManager = await importWithTmuxCommandsEnabled();
       const nonTestManager = new NonTestTmuxManager();