@dmsdc-ai/aigentry-telepty 0.1.69 → 0.1.70

package/cli.js

@@ -3,6 +3,7 @@
 const path = require('path');
 const os = require('os');
 const fs = require('fs');
+const { constants: osConstants } = require('os');
 const WebSocket = require('ws');
 const { execSync, spawn } = require('child_process');
 const readline = require('readline');
@@ -11,7 +12,7 @@ const updateNotifier = require('update-notifier');
 const pkg = require('./package.json');
 const { getConfig } = require('./auth');
 const { cleanupDaemonProcesses } = require('./daemon-control');
-const { attachInteractiveTerminal, getTerminalSize } = require('./interactive-terminal');
+const { attachInteractiveTerminal, getTerminalSize, restoreTerminalModes } = require('./interactive-terminal');
 const { getRuntimeInfo } = require('./runtime-info');
 const { formatHostLabel, groupSessionsByHost, pickSessionTarget } = require('./session-routing');
 const { runInteractiveSkillInstaller } = require('./skill-installer');
@@ -43,9 +44,14 @@ function resetInteractiveInput(stream = process.stdin) {
     return;
   }
 
+  if (stream.isTTY && (stream.isRaw || stream.__teleptyRawModeActive)) {
+    restoreTerminalModes(process.stdout);
+  }
+
   if (stream.isTTY && typeof stream.setRawMode === 'function') {
     try {
       stream.setRawMode(false);
+      stream.__teleptyRawModeActive = false;
     } catch {
       // Ignore raw-mode reset failures when the TTY is already gone.
     }
@@ -101,6 +107,10 @@ process.stdin.on('error', (error) => {
   process.stderr.write(`\n❌ Telepty stdin error: ${error.message}\n`);
 });
 
+process.on('exit', () => {
+  resetInteractiveInput(process.stdin);
+});
+
 // Check for updates unless explicitly disabled for tests/CI.
 if (!process.env.NO_UPDATE_NOTIFIER && !process.env.TELEPTY_DISABLE_UPDATE_NOTIFIER) {
   updateNotifier({pkg}).notify({ isGlobal: true });
@@ -196,61 +206,46 @@ async function repairLocalDaemon(options = {}) {
 
 function getDiscoveryHosts() {
   const hosts = new Set();
-
   if (REMOTE_HOST && REMOTE_HOST !== '127.0.0.1') {
     hosts.add(REMOTE_HOST);
   } else {
     hosts.add('127.0.0.1');
   }
-
-  const extraHosts = String(process.env.TELEPTY_DISCOVERY_HOSTS || '')
-    .split(',')
-    .map((host) => host.trim())
-    .filter(Boolean);
-  extraHosts.forEach((host) => hosts.add(host));
-
-  // Include relay peers for cross-machine session discovery
-  const relayPeers = String(process.env.TELEPTY_RELAY_PEERS || '')
-    .split(',')
-    .map((host) => host.trim())
-    .filter(Boolean);
-  relayPeers.forEach((host) => hosts.add(host));
-
-  // Include SSH tunnel-connected peers
-  const connectedHosts = crossMachine.getConnectedHosts();
-  connectedHosts.forEach((host) => hosts.add(host));
-
   return Array.from(hosts);
 }
 
 async function discoverSessions(options = {}) {
   await ensureDaemonRunning();
-  const hosts = getDiscoveryHosts();
   const allSessions = [];
 
   if (!options.silent) {
     process.stdout.write('\x1b[36m🔍 Discovering active sessions across connected machines...\x1b[0m\n');
   }
 
-  await Promise.all(hosts.map(async (host) => {
-    try {
-      const res = await fetchWithAuth(`http://${host}:${PORT}/api/sessions`, {
-        signal: AbortSignal.timeout(1500)
+  // Local daemon sessions
+  try {
+    const res = await fetchWithAuth(`http://127.0.0.1:${PORT}/api/sessions`, {
+      signal: AbortSignal.timeout(1500)
+    });
+    if (res.ok) {
+      const sessions = await res.json();
+      sessions.forEach((session) => {
+        allSessions.push({ host: '127.0.0.1', ...session });
       });
-      if (res.ok) {
-        const sessions = await res.json();
-        sessions.forEach((session) => {
-          allSessions.push({ host, ...session });
-        });
-      }
-    } catch (e) {
-      // Ignore nodes that don't have telepty running
     }
-  }));
+  } catch {}
+
+  // Remote peer sessions via SSH direct
+  const remoteSessions = crossMachine.discoverAllRemoteSessions();
+  allSessions.push(...remoteSessions);
 
   return allSessions;
 }
 
+function isRemoteSession(session) {
+  return session.remote === true || (session.host && session.host !== '127.0.0.1' && session.host.includes('@'));
+}
+
 async function resolveSessionTarget(sessionRef, options = {}) {
   const sessions = options.sessions || await discoverSessions({ silent: true });
   return pickSessionTarget(sessionRef, sessions, REMOTE_HOST);
@@ -729,7 +724,7 @@ async function main() {
     };
     const cmdBase = path.basename(command).replace(/\..*$/, '');
     const promptPattern = PROMPT_PATTERNS[cmdBase] || /[❯>$#%]\s*$/;
-    let promptReady = true;  // assume ready initially for first inject
+    let promptReady = false;  // wait for CLI prompt before accepting inject
     const injectQueue = [];
 
     let queueFlushTimer = null;
@@ -751,7 +746,7 @@ async function main() {
         if (injectQueue.length > 0) {
           flushInjectQueue();
         }
-      }, 3000);
+      }, 15000);
     }
 
     // Connect to daemon WebSocket with auto-reconnect
@@ -793,6 +788,10 @@ async function main() {
         // No resize trick on reconnect — it causes visible flickering across all
         // terminals when the daemon restarts and multiple sessions reconnect at once.
         reconnectAttempts = 0;
+        // Re-send ready on reconnect so new daemon knows CLI is ready
+        if (readyNotified && promptReady) {
+          daemonWs.send(JSON.stringify({ type: 'ready' }));
+        }
       });
 
       daemonWs.on('message', (message) => {
@@ -863,6 +862,31 @@ async function main() {
         child.resize(size.cols, size.rows);
       }
     });
+    let allowSessionClosed = false;
+    const allowSignalHandlers = new Map();
+
+    function closeAllowSession() {
+      if (allowSessionClosed) {
+        return false;
+      }
+
+      allowSessionClosed = true;
+      cleanupTerminal();
+      process.stdout.write(`\x1b]0;\x07`);
+      fetchWithAuth(`${DAEMON_URL}/api/sessions/${encodeURIComponent(sessionId)}`, { method: 'DELETE' }).catch(() => {});
+      if (reconnectTimer) clearTimeout(reconnectTimer);
+      try {
+        daemonWs.close();
+      } catch {}
+      for (const [signalName, handler] of allowSignalHandlers) {
+        process.off(signalName, handler);
+      }
+      return true;
+    }
+
+    function exitAllowSession(code) {
+      setTimeout(() => process.exit(code), 25);
+    }
 
     // Intercept terminal title escape sequences and prefix with session ID
     const titlePrefix = `\u26A1 ${sessionId}`;
@@ -874,6 +898,7 @@ async function main() {
     }
 
     // Relay PTY output to current terminal + send to daemon for attach clients
+    let readyNotified = false;
     child.onData((data) => {
       const rewritten = rewriteTitleSequences(data);
       process.stdout.write(rewritten);
@@ -884,22 +909,36 @@ async function main() {
       if (promptPattern.test(data)) {
         promptReady = true;
         flushInjectQueue();
+        // Notify daemon that CLI is ready for inject
+        if (!readyNotified && wsReady && daemonWs.readyState === 1) {
+          readyNotified = true;
+          daemonWs.send(JSON.stringify({ type: 'ready' }));
+        }
       }
     });
 
     // Handle child exit
     child.onExit(({ exitCode }) => {
-      cleanupTerminal();
-      process.stdout.write(`\x1b]0;\x07`);
+      if (!closeAllowSession()) {
+        return;
+      }
       console.log(`\n\x1b[33mSession '${sessionId}' exited (code ${exitCode}).\x1b[0m`);
-
-      // Deregister from daemon
-      fetchWithAuth(`${DAEMON_URL}/api/sessions/${encodeURIComponent(sessionId)}`, { method: 'DELETE' }).catch(() => {});
-      if (reconnectTimer) clearTimeout(reconnectTimer);
-      daemonWs.close();
-      process.exit(exitCode || 0);
+      exitAllowSession(exitCode || 0);
     });
 
+    for (const signalName of ['SIGTERM', 'SIGHUP', 'SIGQUIT']) {
+      const handler = () => {
+        closeAllowSession();
+        try {
+          child.kill(signalName);
+        } catch {}
+        const signalCode = osConstants.signals[signalName] || 1;
+        exitAllowSession(128 + signalCode);
+      };
+      allowSignalHandlers.set(signalName, handler);
+      process.on(signalName, handler);
+    }
+
     // Graceful shutdown on SIGINT (let child handle it via PTY)
     process.on('SIGINT', () => {});
 
@@ -1011,6 +1050,34 @@ async function main() {
     return;
   }
 
+  if (cmd === 'read-screen') {
+    const sessionId = args[1];
+    if (!sessionId) { console.error('❌ Usage: telepty read-screen <session_id> [--lines N] [--raw]'); process.exit(1); }
+
+    const linesIndex = args.indexOf('--lines');
+    const lines = (linesIndex !== -1 && args[linesIndex + 1]) ? args[linesIndex + 1] : '50';
+    const raw = args.includes('--raw');
+
+    try {
+      const target = await resolveSessionTarget(sessionId);
+      if (!target) {
+        console.error(`❌ Session '${sessionId}' was not found on any discovered host.`);
+        process.exit(1);
+      }
+
+      const res = await fetchWithAuth(`http://${target.host}:${PORT}/api/sessions/${encodeURIComponent(target.id)}/screen?lines=${lines}${raw ? '&raw=1' : ''}`);
+      const data = await res.json();
+      if (!res.ok) { console.error(`❌ Error: ${data.error}`); process.exit(1); }
+
+      if (!data.screen) {
+        console.log('(empty screen)');
+      } else {
+        console.log(data.screen);
+      }
+    } catch (e) { console.error(`❌ ${e.message || 'Failed to connect to the target daemon.'}`); }
+    return;
+  }
+
   if (cmd === 'inject') {
     // Check for --no-enter flag
     const noEnterIndex = args.indexOf('--no-enter');
@@ -1049,14 +1116,24 @@ async function main() {
         process.exit(1);
       }
 
-      // Entitlement: remote session check
-      if (target.host && target.host !== '127.0.0.1' && target.host !== 'localhost') {
+      // Remote session: use SSH direct execution
+      if (isRemoteSession(target)) {
         const { checkEntitlement } = require('./entitlement');
         const ent = checkEntitlement({ feature: 'telepty.remote_sessions' });
         if (!ent.allowed) {
           console.error(`⚠️  ${ent.reason}\n   Upgrade: ${ent.upgrade_url}`);
           process.exit(1);
         }
+        const result = crossMachine.remoteInject(target.peerName, target.id, prompt, {
+          from: fromId,
+          no_enter: noEnter
+        });
+        if (result.success) {
+          console.log(`✅ Context injected successfully into '\x1b[36m${target.id}\x1b[0m' @ ${target.peerName}.`);
+        } else {
+          console.error(`❌ Error: ${result.error}`);
+        }
+        return;
       }
 
       const body = { prompt, no_enter: noEnter };
@@ -1069,8 +1146,7 @@ async function main() {
       });
       const data = await res.json();
       if (!res.ok) { console.error(`❌ Error: ${data.error}`); return; }
-      const hostSuffix = target.host === '127.0.0.1' ? '' : ` @ ${target.host}`;
-      console.log(`✅ Context injected successfully into '\x1b[36m${target.id}\x1b[0m'${hostSuffix}.`);
+      console.log(`✅ Context injected successfully into '\x1b[36m${target.id}\x1b[0m'.`);
     } catch (e) { console.error(`❌ ${e.message || 'Failed to connect to the target daemon.'}`); }
     return;
   }
@@ -1881,8 +1957,6 @@ Discuss the following topic from your project's perspective. Engage with other s
     if (result.success) {
       console.log(`\x1b[32m✅ Connected to ${result.name}\x1b[0m`);
       console.log(`   Machine ID: ${result.machineId}`);
-      console.log(`   Local port: ${result.localPort}`);
-      console.log(`   Version: ${result.version}`);
       console.log(`\nSessions on ${result.name} are now discoverable via \x1b[36mtelepty list\x1b[0m`);
     } else {
       console.error(`\x1b[31m❌ ${result.error}\x1b[0m`);
@@ -2023,6 +2097,7 @@ Usage:
   telepty list                                   List all active sessions across discovered hosts
   telepty attach [id[@host]]                     Attach to a session (Interactive picker if no ID)
   telepty inject [--no-enter] [--from <id>] [--reply-to <id>] <id[@host]> "<prompt>"    Inject text into a single session
+  telepty read-screen <id[@host]> [--lines N] [--raw]                  Read session screen buffer
   telepty reply "<text>"                         Reply to the session that last injected into $TELEPTY_SESSION_ID
   telepty multicast <id1[@host],id2[@host]> "<prompt>"  Inject text into multiple specific sessions
   telepty broadcast "<prompt>"                   Inject text into ALL active sessions

package/cross-machine.js

@@ -1,15 +1,17 @@
 'use strict';
 
-const { spawn } = require('child_process');
+const { execSync, spawn } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
 const PEERS_PATH = path.join(os.homedir(), '.telepty', 'peers.json');
-const BASE_LOCAL_PORT = 3849; // tunnels start at this port
+const CONTROL_DIR = path.join(os.homedir(), '.telepty', 'ssh');
 
-// In-memory active tunnels
-const activeTunnels = new Map(); // name -> { process, localPort, target, connectedAt, ... }
+// SSH ControlMaster socket path pattern
+function controlPath(target) {
+  return path.join(CONTROL_DIR, `ctrl-${target.replace(/[^a-zA-Z0-9@.-]/g, '_')}`);
+}
 
 function loadPeers() {
   try {
@@ -25,155 +27,188 @@ function savePeers(data) {
   } catch {}
 }
 
-function getNextLocalPort() {
-  const usedPorts = new Set([...activeTunnels.values()].map(t => t.localPort));
-  let port = BASE_LOCAL_PORT;
-  while (usedPorts.has(port)) port++;
-  return port;
-}
+// In-memory active peers
+const activePeers = new Map(); // name -> { target, controlSocket, connectedAt, machineId }
 
 /**
- * Connect to a remote machine via SSH tunnel.
- * @param {string} target - "user@host" or "host" (uses current user)
- * @param {object} options - { name, port }
- * @returns {Promise<object>} - { success, name, localPort, machineId, version } or { success: false, error }
+ * Connect to a remote machine via SSH ControlMaster.
  */
 async function connect(target, options = {}) {
-  const remotePort = options.port || 3848;
-  const localPort = getNextLocalPort();
-
-  // Parse target
   let sshTarget = target;
   if (!target.includes('@')) {
     sshTarget = `${os.userInfo().username}@${target}`;
   }
 
-  const name = options.name || target.split('@').pop().split('.')[0]; // short hostname
+  const name = options.name || target.split('@').pop().split('.')[0];
 
-  // Check if already connected
-  if (activeTunnels.has(name)) {
-    const existing = activeTunnels.get(name);
-    return { success: false, error: `Already connected to ${name} on port ${existing.localPort}` };
+  if (activePeers.has(name)) {
+    return { success: false, error: `Already connected to ${name}` };
   }
 
-  // Create SSH tunnel
-  const tunnel = spawn('ssh', [
-    '-N',                                           // No remote command
-    '-L', `${localPort}:localhost:${remotePort}`,   // Local port forwarding
-    '-o', 'ServerAliveInterval=30',                 // Keep alive
-    '-o', 'ServerAliveCountMax=3',                  // Disconnect after 3 missed keepalives
-    '-o', 'ExitOnForwardFailure=yes',               // Fail if port forwarding fails
-    '-o', 'ConnectTimeout=10',                      // Connection timeout
-    '-o', 'StrictHostKeyChecking=accept-new',       // Auto-accept new host keys
-    sshTarget
-  ], {
-    stdio: ['ignore', 'pipe', 'pipe'],
-    detached: false
-  });
-
-  // Wait for tunnel to establish or fail
-  const result = await new Promise((resolve) => {
-    let stderr = '';
-    const timeout = setTimeout(() => {
-      // If process is still running after 5s, tunnel is up
-      if (!tunnel.killed && tunnel.exitCode === null) {
-        resolve({ success: true });
-      } else {
-        resolve({ success: false, error: stderr || 'Connection timeout' });
-      }
-    }, 5000);
-
-    tunnel.stderr.on('data', (data) => { stderr += data.toString(); });
-    tunnel.on('exit', (code) => {
-      clearTimeout(timeout);
-      if (code !== 0) {
-        resolve({ success: false, error: stderr || `SSH exited with code ${code}` });
-      }
-    });
-    tunnel.on('error', (err) => {
-      clearTimeout(timeout);
-      resolve({ success: false, error: err.message });
-    });
-  });
+  // Ensure control directory exists
+  fs.mkdirSync(CONTROL_DIR, { recursive: true });
+
+  const ctrlPath = controlPath(sshTarget);
 
-  if (!result.success) {
-    tunnel.kill();
-    return result;
+  // Start SSH ControlMaster
+  try {
+    execSync([
+      'ssh', '-o', 'ControlMaster=auto',
+      '-o', `ControlPath=${ctrlPath}`,
+      '-o', 'ControlPersist=600',
+      '-o', 'ConnectTimeout=10',
+      '-o', 'ServerAliveInterval=30',
+      '-o', 'ServerAliveCountMax=3',
+      '-o', 'StrictHostKeyChecking=accept-new',
+      '-N', '-f', // Go to background
+      sshTarget
+    ].join(' '), { timeout: 15000, stdio: ['pipe', 'pipe', 'pipe'] });
+  } catch (err) {
+    return { success: false, error: `SSH connection failed: ${err.message}` };
   }
 
-  // Verify remote daemon is accessible through tunnel
+  // Verify remote telepty is available
+  let machineId = name;
   try {
-    const res = await fetch(`http://127.0.0.1:${localPort}/api/meta`, {
-      signal: AbortSignal.timeout(3000)
-    });
-    if (!res.ok) throw new Error('Daemon not responding');
-    const meta = await res.json();
-
-    const peerInfo = {
-      process: tunnel,
-      localPort,
-      target: sshTarget,
-      name,
-      machineId: meta.machine_id || name,
-      version: meta.version || 'unknown',
-      connectedAt: new Date().toISOString()
-    };
-
-    activeTunnels.set(name, peerInfo);
-
-    // Persist peer for reconnection
-    const peers = loadPeers();
-    peers.peers[name] = {
-      target: sshTarget,
-      remotePort,
-      lastConnected: peerInfo.connectedAt,
-      machineId: peerInfo.machineId
-    };
-    savePeers(peers);
-
-    // Monitor tunnel health
-    tunnel.on('exit', () => {
-      console.log(`[PEER] SSH tunnel to ${name} disconnected`);
-      activeTunnels.delete(name);
-    });
+    const output = execSync(
+      `ssh -o ControlPath=${ctrlPath} ${sshTarget} "hostname"`,
+      { timeout: 5000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
+    ).trim();
+    if (output) machineId = output;
+  } catch {}
 
-    return {
-      success: true,
-      name,
-      localPort,
-      machineId: peerInfo.machineId,
-      version: peerInfo.version
-    };
+  // Verify telepty CLI is available on remote
+  try {
+    execSync(
+      `ssh -o ControlPath=${ctrlPath} ${sshTarget} "telepty list --json"`,
+      { timeout: 10000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
+    );
   } catch (err) {
-    tunnel.kill();
-    return { success: false, error: `Remote daemon not accessible: ${err.message}` };
+    // Clean up ControlMaster
+    try { execSync(`ssh -O exit -o ControlPath=${ctrlPath} ${sshTarget}`, { stdio: 'pipe' }); } catch {}
+    return { success: false, error: `Remote telepty not available: ${err.message}` };
   }
+
+  const peerInfo = {
+    target: sshTarget,
+    controlSocket: ctrlPath,
+    name,
+    machineId,
+    connectedAt: new Date().toISOString()
+  };
+
+  activePeers.set(name, peerInfo);
+
+  // Persist peer
+  const peers = loadPeers();
+  peers.peers[name] = {
+    target: sshTarget,
+    lastConnected: peerInfo.connectedAt,
+    machineId
+  };
+  savePeers(peers);
+
+  return { success: true, name, machineId };
 }
 
 function disconnect(name) {
-  const tunnel = activeTunnels.get(name);
-  if (!tunnel) {
+  const peer = activePeers.get(name);
+  if (!peer) {
     return { success: false, error: `Not connected to ${name}` };
   }
-  tunnel.process.kill();
-  activeTunnels.delete(name);
+
+  // Close ControlMaster
+  try {
+    execSync(`ssh -O exit -o ControlPath=${peer.controlSocket} ${peer.target}`, {
+      timeout: 5000, stdio: ['pipe', 'pipe', 'pipe']
+    });
+  } catch {}
+
+  activePeers.delete(name);
   return { success: true, name };
 }
 
 function disconnectAll() {
-  const names = [...activeTunnels.keys()];
+  const names = [...activePeers.keys()];
   names.forEach(name => disconnect(name));
   return { disconnected: names };
 }
 
+/**
+ * List sessions on a remote peer via SSH.
+ * @returns {Array} sessions with host info
+ */
+function listRemoteSessions(name) {
+  const peer = activePeers.get(name);
+  if (!peer) return [];
+
+  try {
+    const output = execSync(
+      `ssh -o ControlPath=${peer.controlSocket} ${peer.target} "telepty list --json"`,
+      { timeout: 10000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
+    );
+    const sessions = JSON.parse(output);
+    return sessions.map(s => ({ ...s, host: peer.target, peerName: name, remote: true }));
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Discover sessions across all connected peers.
+ * @returns {Array} all remote sessions
+ */
+function discoverAllRemoteSessions() {
+  const allSessions = [];
+  for (const [name] of activePeers) {
+    allSessions.push(...listRemoteSessions(name));
+  }
+  return allSessions;
+}
+
+/**
+ * Inject text into a remote session via SSH.
+ */
+function remoteInject(name, sessionId, prompt, options = {}) {
+  const peer = activePeers.get(name);
+  if (!peer) return { success: false, error: `Not connected to ${name}` };
+
+  try {
+    const escaped = prompt.replace(/'/g, "'\\''");
+    const fromFlag = options.from ? `--from '${options.from}'` : '';
+    const noEnterFlag = options.no_enter ? '--no-enter' : '';
+    execSync(
+      `ssh -o ControlPath=${peer.controlSocket} ${peer.target} "telepty inject ${noEnterFlag} ${fromFlag} '${sessionId}' '${escaped}'"`,
+      { timeout: 15000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
+    );
+    return { success: true };
+  } catch (err) {
+    return { success: false, error: err.message };
+  }
+}
+
+/**
+ * Spawn an interactive SSH attach to a remote session.
+ * Returns the child process for stdin/stdout piping.
+ */
+function remoteAttach(name, sessionId) {
+  const peer = activePeers.get(name);
+  if (!peer) return null;
+
+  return spawn('ssh', [
+    '-o', `ControlPath=${peer.controlSocket}`,
+    '-t', // Force TTY allocation
+    peer.target,
+    'telepty', 'attach', sessionId
+  ], { stdio: ['pipe', 'pipe', 'pipe'] });
+}
+
 function listActivePeers() {
-  return [...activeTunnels.entries()].map(([name, info]) => ({
+  return [...activePeers.entries()].map(([name, info]) => ({
     name,
     target: info.target,
-    localPort: info.localPort,
     machineId: info.machineId,
-    connectedAt: info.connectedAt,
-    host: `127.0.0.1:${info.localPort}`
+    connectedAt: info.connectedAt
   }));
 }
 
@@ -182,25 +217,31 @@ function listKnownPeers() {
 }
 
 /**
- * Get all connected peer hosts for discovery.
- * @returns {string[]} Array of "127.0.0.1:PORT" strings
+ * Find which peer has a given session.
+ * @returns {{ peerName, peer } | null}
  */
+function findSessionPeer(sessionId) {
+  for (const [name] of activePeers) {
+    const sessions = listRemoteSessions(name);
+    if (sessions.some(s => s.id === sessionId)) {
+      return { peerName: name, peer: activePeers.get(name) };
+    }
+  }
+  return null;
+}
+
+// Backward compat - getConnectedHosts no longer returns HTTP hosts
+// Instead returns peer names for SSH-based discovery
 function getConnectedHosts() {
-  return [...activeTunnels.values()].map(t => `127.0.0.1:${t.localPort}`);
+  return []; // No HTTP hosts - use discoverAllRemoteSessions() instead
 }
 
-/**
- * Get connected host for a specific peer.
- * @param {string} name - Peer name
- * @returns {string|null} "127.0.0.1:PORT" or null
- */
 function getPeerHost(name) {
-  const tunnel = activeTunnels.get(name);
-  return tunnel ? `127.0.0.1:${tunnel.localPort}` : null;
+  return null; // No HTTP host - use SSH direct
 }
 
 function removePeer(name) {
-  disconnect(name); // disconnect if active
+  disconnect(name);
   const peers = loadPeers();
   delete peers.peers[name];
   savePeers(peers);
@@ -217,5 +258,10 @@ module.exports = {
   getPeerHost,
   removePeer,
   loadPeers,
+  listRemoteSessions,
+  discoverAllRemoteSessions,
+  remoteInject,
+  remoteAttach,
+  findSessionPeer,
   PEERS_PATH
 };

package/daemon.js

@@ -139,6 +139,17 @@ const sessions = {};
 const handoffs = {};
 const threads = {};
 
+function appendToOutputRing(session, data) {
+  if (!session.outputRing) session.outputRing = [];
+  session.outputRing.push(data);
+  // Keep total data under ~200KB limit by trimming old entries
+  let totalLen = session.outputRing.reduce((sum, d) => sum + d.length, 0);
+  while (totalLen > 200000 && session.outputRing.length > 1) {
+    totalLen -= session.outputRing[0].length;
+    session.outputRing.shift();
+  }
+}
+
 // Detect terminal environment at daemon startup
 const DETECTED_TERMINAL = terminalBackend.detectTerminal();
 console.log(`[DAEMON] Terminal backend: ${DETECTED_TERMINAL}`);
@@ -152,8 +163,7 @@ for (const [id, meta] of Object.entries(_persisted)) {
       command: meta.command || 'wrapped', cwd: meta.cwd || process.cwd(),
       createdAt: meta.createdAt || new Date().toISOString(),
       lastActivityAt: meta.lastActivityAt || new Date().toISOString(),
-      clients: new Set(), isClosing: false
-    };
+      clients: new Set(), isClosing: false, outputRing: [], ready: false,     };
     console.log(`[PERSIST] Restored session ${id} (awaiting reconnect)`);
   }
 }
@@ -261,8 +271,10 @@ app.post('/api/sessions/spawn', (req, res) => {
       createdAt: new Date().toISOString(),
       lastActivityAt: new Date().toISOString(),
       clients: new Set(),
-      isClosing: false
-    };
+      isClosing: false,
+      outputRing: [],
+      ready: true,
+          };
     sessions[session_id] = sessionRecord;
 
     // Broadcast session creation to bus
@@ -284,6 +296,8 @@ app.post('/api/sessions/spawn', (req, res) => {
         return;
       }
 
+      appendToOutputRing(currentSession, data);
+
       // Send to direct WS clients
       currentSession.clients.forEach(ws => {
         if (ws.readyState === 1) ws.send(JSON.stringify({ type: 'output', data }));
@@ -345,8 +359,10 @@ app.post('/api/sessions/register', (req, res) => {
     createdAt: new Date().toISOString(),
     lastActivityAt: new Date().toISOString(),
     clients: new Set(),
-    isClosing: false
-  };
+    isClosing: false,
+    outputRing: [],
+    ready: false,
+      };
   // Check for existing session with same base alias and emit replaced event
   const baseAlias = session_id.replace(/-\d+$/, '');
   const replaced = Object.keys(sessions).find(id => {
@@ -404,7 +420,8 @@ app.get('/api/sessions', (req, res) => {
       createdAt: session.createdAt,
       lastActivityAt: session.lastActivityAt || null,
       idleSeconds,
-      active_clients: session.clients.size
+      active_clients: session.clients.size,
+      ready: session.ready || false
     };
   });
   if (idleGt !== null) {
@@ -473,8 +490,8 @@ app.post('/api/sessions/multicast/inject', (req, res) => {
     const session = sessions[id];
     if (session) {
       try {
-        // cmux auto-detect at daemon level (text + enter)
-        if (DETECTED_TERMINAL === 'cmux') {
+        // cmux per-session backend (text + enter)
+        if (session.backend === 'cmux') {
           const ok = terminalBackend.cmuxSendText(id, prompt);
           if (ok) {
             setTimeout(() => terminalBackend.cmuxSendEnter(id), 300);
@@ -546,8 +563,8 @@ app.post('/api/sessions/broadcast/inject', (req, res) => {
   Object.keys(sessions).forEach(id => {
     const session = sessions[id];
     try {
-      // cmux auto-detect at daemon level (text + enter)
-      if (DETECTED_TERMINAL === 'cmux') {
+      // cmux per-session backend (text + enter)
+      if (session.backend === 'cmux') {
         const ok = terminalBackend.cmuxSendText(id, prompt);
         if (ok) {
           setTimeout(() => terminalBackend.cmuxSendEnter(id), 300);
@@ -769,11 +786,10 @@ app.post('/api/sessions/:id/submit', (req, res) => {
   console.log(`[SUBMIT] Session ${id} (${session.command}) using strategy: ${strategy}`);
 
   let success = false;
-  // cmux auto-detect at daemon level
-  if (DETECTED_TERMINAL === 'cmux') {
+  // cmux per-session backend
+  if (session.backend === 'cmux') {
     success = terminalBackend.cmuxSendEnter(id);
   }
-  // Session-level cmux backend
   if (!success && session.backend === 'cmux' && session.cmuxWorkspaceId) {
     success = submitViaCmux(id);
   }
@@ -812,11 +828,10 @@ app.post('/api/sessions/submit-all', (req, res) => {
     const strategy = getSubmitStrategy(session.command);
     let success = false;
 
-    // cmux auto-detect at daemon level
-    if (DETECTED_TERMINAL === 'cmux') {
+    // cmux per-session backend
+    if (session.backend === 'cmux') {
       success = terminalBackend.cmuxSendEnter(id);
     }
-    // Session-level cmux backend
     if (!success && session.backend === 'cmux' && session.cmuxWorkspaceId) {
       success = submitViaCmux(id);
     }
@@ -885,28 +900,37 @@ app.post('/api/sessions/:id/inject', (req, res) => {
     if (session.type === 'wrapped') {
       // For wrapped sessions: try cmux send (daemon-level auto-detect),
       // then kitty send-text (bypasses allow bridge queue),
-      // then WS as fallback, then submit via cmux/osascript/kitty/WS
-      const sock = findKittySocket();
-      if (!session.kittyWindowId && sock) session.kittyWindowId = findKittyWindowId(sock, id);
-      const wid = session.kittyWindowId;
+      // then WS as fallback, then submit via consistent path for CR.
+      //
+      // When session is NOT ready (CLI hasn't shown prompt yet), skip cmux/kitty
+      // because they bypass the allow-bridge's prompt-ready queue.
+      // The WS path sends to the allow-bridge which queues until CLI is ready.
+      const sock = session.ready ? findKittySocket() : null;
+      if (sock && !session.kittyWindowId) session.kittyWindowId = findKittyWindowId(sock, id);
+      const wid = session.ready ? session.kittyWindowId : null;
 
       let kittyOk = false;
       let cmuxOk = false;
+      let deliveryPath = null; // 'cmux', 'kitty', 'ws'
 
-      // cmux backend: send text directly to surface (daemon-level auto-detect)
-      if (DETECTED_TERMINAL === 'cmux') {
+      // cmux per-session backend: send text directly to surface (only when ready)
+      if (session.ready && session.backend === 'cmux') {
         cmuxOk = terminalBackend.cmuxSendText(id, finalPrompt);
-        if (cmuxOk) console.log(`[INJECT] cmux send for ${id}`);
+        if (cmuxOk) {
+          deliveryPath = 'cmux';
+          console.log(`[INJECT] cmux send for ${id}`);
+        }
       }
 
       if (!cmuxOk && wid && sock) {
-        // Kitty send-text primary (bypasses allow bridge queue)
+        // Kitty send-text primary (only when ready — bypasses allow bridge queue)
         try {
           const escaped = finalPrompt.replace(/\\/g, '\\\\').replace(/'/g, "'\\''");
           require('child_process').execSync(`kitty @ --to unix:${sock} send-text --match id:${wid} '${escaped}'`, {
             timeout: 5000, stdio: ['pipe', 'pipe', 'pipe']
           });
           kittyOk = true;
+          deliveryPath = 'kitty';
           console.log(`[INJECT] Kitty send-text for ${id} (window ${wid})`);
         } catch {
           // Invalidate cached window ID — window may have changed or been closed
@@ -914,52 +938,75 @@ app.post('/api/sessions/:id/inject', (req, res) => {
         }
       }
       if (!cmuxOk && !kittyOk) {
-        // Fallback: WS (works with new allow bridges that have queue flush)
+        // WS path: allow-bridge has its own prompt-ready queue
         const wsOk = writeToSession(finalPrompt);
         if (!wsOk) {
           return res.status(503).json({ error: 'Process not connected' });
         }
-        console.log(`[INJECT] WS fallback for ${id}`);
+        deliveryPath = 'ws';
+        if (!session.ready) {
+          console.log(`[INJECT] WS (not ready, allow-bridge will queue) for ${id}`);
+        } else {
+          console.log(`[INJECT] WS fallback for ${id}`);
+        }
       }
 
       if (!no_enter) {
         setTimeout(() => {
           let submitted = false;
 
-          // 1. cmux backend: send-key return to surface (daemon-level auto-detect)
-          if (DETECTED_TERMINAL === 'cmux') {
-            submitted = terminalBackend.cmuxSendEnter(id);
-            if (submitted) console.log(`[INJECT] cmux submit for ${id}`);
-          }
-
-          // 2. Session-level cmux (registered backend)
-          if (!submitted && session.backend === 'cmux' && session.cmuxWorkspaceId) {
-            submitted = submitViaCmux(id);
-            if (submitted) console.log(`[INJECT] cmux session-level submit for ${id}`);
-          }
-
-          // 3. kitty/default: osascript primary
-          if (!submitted) {
-            const submitStrategy = getSubmitStrategy(session.command);
-            const keyCombo = submitStrategy === 'osascript_cmd_enter' ? 'cmd_enter' : 'return_key';
-            submitted = submitViaOsascript(id, keyCombo);
-          }
-
-          // 4. Fallback: kitty send-text → WS
-          if (!submitted) {
-            console.log(`[INJECT] submit fallback for ${id}`);
+          // Use the SAME path that delivered text for CR to guarantee ordering
+          if (deliveryPath === 'cmux') {
+            // cmux: send-key return via same surface
+            if (session.backend === 'cmux') {
+              submitted = terminalBackend.cmuxSendEnter(id);
+              if (submitted) console.log(`[INJECT] cmux submit for ${id}`);
+            }
+            if (!submitted && session.backend === 'cmux' && session.cmuxWorkspaceId) {
+              submitted = submitViaCmux(id);
+              if (submitted) console.log(`[INJECT] cmux session-level submit for ${id}`);
+            }
+          } else if (deliveryPath === 'kitty') {
+            // kitty: send-text CR via same window (not osascript!)
             if (wid && sock) {
               try {
                 require('child_process').execSync(`kitty @ --to unix:${sock} send-text --match id:${wid} $'\\r'`, {
                   timeout: 3000, stdio: ['pipe', 'pipe', 'pipe']
                 });
+                submitted = true;
+                console.log(`[INJECT] kitty submit for ${id} (window ${wid})`);
               } catch {
-                writeToSession('\r');
+                session.kittyWindowId = null;
               }
-            } else {
-              writeToSession('\r');
             }
           }
+          // deliveryPath === 'ws' or any fallback:
+          // Try terminal-level submit first (bypasses PTY ICRNL which converts CR→LF)
+          // This matters for cmux/kitty sessions where text went via WS but
+          // the application expects CR(13) not LF(10) from Enter.
+          if (!submitted && session.backend === 'cmux') {
+            submitted = terminalBackend.cmuxSendEnter(id);
+            if (submitted) console.log(`[INJECT] cmux submit (fallback) for ${id}`);
+          }
+          if (!submitted && session.backend === 'cmux' && session.cmuxWorkspaceId) {
+            submitted = submitViaCmux(id);
+            if (submitted) console.log(`[INJECT] cmux session-level submit (fallback) for ${id}`);
+          }
+          if (!submitted && wid && sock) {
+            try {
+              require('child_process').execSync(`kitty @ --to unix:${sock} send-text --match id:${wid} $'\\r'`, {
+                timeout: 3000, stdio: ['pipe', 'pipe', 'pipe']
+              });
+              submitted = true;
+              console.log(`[INJECT] kitty submit (fallback) for ${id}`);
+            } catch {
+              session.kittyWindowId = null;
+            }
+          }
+          if (!submitted) {
+            writeToSession('\r');
+            console.log(`[INJECT] WS submit for ${id}`);
+          }
 
           // Update tab title (kitty-specific, safe to fail)
           if (wid && sock) {
@@ -970,7 +1017,7 @@ app.post('/api/sessions/:id/inject', (req, res) => {
             } catch {}
           }
         }, 500);
-        submitResult = { deferred: true, strategy: DETECTED_TERMINAL === 'cmux' ? 'cmux_auto' : (session.backend === 'cmux' ? 'cmux_with_fallback' : 'osascript_with_fallback') };
+        submitResult = { deferred: true, strategy: deliveryPath || 'ws' };
       }
     } else {
       // Spawned sessions: direct PTY write
@@ -1042,6 +1089,53 @@ app.post('/api/sessions/:id/inject', (req, res) => {
   }
 });
 
+// GET /api/sessions/:id/screen — read current screen buffer
+app.get('/api/sessions/:id/screen', (req, res) => {
+  const requestedId = req.params.id;
+  const resolvedId = resolveSessionAlias(requestedId);
+  if (!resolvedId) return res.status(404).json({ error: 'Session not found', requested: requestedId });
+  const session = sessions[resolvedId];
+
+  const lines = parseInt(req.query.lines) || 50;
+  const raw = req.query.raw === '1' || req.query.raw === 'true';
+
+  if (!session.outputRing || session.outputRing.length === 0) {
+    return res.json({ session_id: resolvedId, screen: '', lines: 0, raw: false });
+  }
+
+  // Join all buffered output
+  const fullOutput = session.outputRing.join('');
+
+  // Strip ANSI escape sequences for clean text
+  function stripAnsi(str) {
+    return str
+      .replace(/[[0-9;]*[a-zA-Z]/g, '')      // CSI sequences
+      .replace(/][^]*/g, '')          // OSC sequences (BEL terminated)
+      .replace(/][^]*\\/g, '')  // OSC sequences (ST terminated)
+      .replace(/[()][AB012]/g, '')              // Character set selection
+      .replace(/[>=<]/g, '')                    // Keypad mode
+      .replace(/[[?]?[0-9;]*[hlsurm]/g, '') // Mode set/reset
+      .replace(/[[0-9;]*[ABCDHJ]/g, '')       // Cursor movement
+      .replace(/[[0-9;]*[KG]/g, '')           // Line clearing
+      .replace(/\r/g, '');                         // Carriage returns
+  }
+
+  const cleaned = raw ? fullOutput : stripAnsi(fullOutput);
+
+  // Take last N lines
+  const allLines = cleaned.split('\n');
+  const lastLines = allLines.slice(-lines);
+  const screen = lastLines.join('\n').trim();
+
+  res.json({
+    session_id: resolvedId,
+    screen,
+    lines: lastLines.length,
+    total_lines: allLines.length,
+    raw: !!raw
+  });
+});
+
 app.patch('/api/sessions/:id', (req, res) => {
   const requestedId = req.params.id;
   const resolvedId = resolveSessionAlias(requestedId);
@@ -1129,8 +1223,8 @@ function busAutoRoute(msg) {
   const wid = targetSession.kittyWindowId;
   let delivered = false;
 
-  // cmux backend: send text + enter to surface (daemon-level auto-detect)
-  if (!delivered && DETECTED_TERMINAL === 'cmux') {
+  // cmux per-session backend: send text + enter to surface
+  if (!delivered && targetSession.backend === 'cmux') {
     const textOk = terminalBackend.cmuxSendText(targetId, prompt);
     if (textOk) {
       setTimeout(() => terminalBackend.cmuxSendEnter(targetId), 500);
@@ -1541,8 +1635,10 @@ wss.on('connection', (ws, req) => {
       createdAt: new Date().toISOString(),
       lastActivityAt: new Date().toISOString(),
       clients: new Set([ws]),
-      isClosing: false
-    };
+      isClosing: false,
+      outputRing: [],
+      ready: false,
+          };
     sessions[sessionId] = autoSession;
     console.log(`[WS] Auto-registered wrapped session ${sessionId} on reconnect`);
     // Set tab title via kitty (no \x0c redraw — it causes flickering on multi-session reconnect)
@@ -1587,11 +1683,25 @@ wss.on('connection', (ws, req) => {
           // Owner sending output -> broadcast to other clients + update activity
           if (type === 'output') {
             activeSession.lastActivityAt = new Date().toISOString();
+            appendToOutputRing(activeSession, data);
             activeSession.clients.forEach(client => {
               if (client !== ws && client.readyState === 1) {
                 client.send(JSON.stringify({ type: 'output', data }));
               }
             });
+          } else if (type === 'ready') {
+            activeSession.ready = true;
+            activeSession.lastActivityAt = new Date().toISOString();
+            console.log(`[READY] Session ${sessionId} CLI is ready for inject`);
+            // Broadcast readiness to bus (cmux/kitty paths now enabled for this session)
+            const readyMsg = JSON.stringify({
+              type: 'session_ready',
+              session_id: sessionId,
+              timestamp: new Date().toISOString()
+            });
+            busClients.forEach(client => {
+              if (client.readyState === 1) client.send(readyMsg);
+            });
           }
         } else {
           // Non-owner client input -> forward to owner as inject

package/interactive-terminal.js

@@ -1,5 +1,25 @@
 'use strict';
 
+const fs = require('fs');
+
+const TERMINAL_CLEANUP_SEQUENCE = [
+  '\x1b[?1049l', // Leave the alternate screen if the child died before cleanup.
+  '\x1b[?25h',   // Ensure the cursor is visible again.
+  '\x1b[?1l',    // Disable application cursor keys.
+  '\x1b>',       // Disable application keypad mode.
+  '\x1b[?1000l',
+  '\x1b[?1002l',
+  '\x1b[?1003l',
+  '\x1b[?1004l',
+  '\x1b[?1005l',
+  '\x1b[?1006l',
+  '\x1b[?1007l',
+  '\x1b[?1015l',
+  '\x1b[<u',     // Disable kitty keyboard protocol.
+  '\x1b[>4;0m',  // Disable modifyOtherKeys.
+  '\x1b[?2004l'  // Disable bracketed paste.
+].join('');
+
 function getTerminalSize(output, fallback = {}) {
   const envCols = Number.parseInt(process.env.COLUMNS || '', 10);
   const envRows = Number.parseInt(process.env.LINES || '', 10);
@@ -31,10 +51,30 @@ function removeListener(stream, eventName, handler) {
   }
 }
 
+function restoreTerminalModes(output) {
+  if (!output) {
+    return;
+  }
+
+  try {
+    if (typeof output.fd === 'number') {
+      fs.writeSync(output.fd, TERMINAL_CLEANUP_SEQUENCE);
+      return;
+    }
+
+    if (typeof output.write === 'function') {
+      output.write(TERMINAL_CLEANUP_SEQUENCE);
+    }
+  } catch {
+    // Ignore cleanup failures when the TTY is already gone.
+  }
+}
+
 function attachInteractiveTerminal(input, output, handlers = {}) {
   const { onData = null, onResize = null } = handlers;
 
   if (input && input.isTTY && typeof input.setRawMode === 'function') {
+    input.__teleptyRawModeActive = true;
     input.setRawMode(true);
   }
 
@@ -57,15 +97,20 @@ function attachInteractiveTerminal(input, output, handlers = {}) {
 
     if (input && input.isTTY && typeof input.setRawMode === 'function') {
       input.setRawMode(false);
+      input.__teleptyRawModeActive = false;
     }
 
     if (input && typeof input.pause === 'function') {
       input.pause();
     }
+
+    restoreTerminalModes(output);
   };
 }
 
 module.exports = {
   attachInteractiveTerminal,
-  getTerminalSize
+  getTerminalSize,
+  restoreTerminalModes,
+  TERMINAL_CLEANUP_SEQUENCE
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dmsdc-ai/aigentry-telepty",
-  "version": "0.1.69",
+  "version": "0.1.70",
   "main": "daemon.js",
   "bin": {
     "aigentry-telepty": "install.js",