@prohost/cli 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -6,6 +6,21 @@ builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
 ## Unreleased
 
+## 0.15.0
+
+- **Code threads on this Mac: scroll back locally, no flashing, no permission prompts.**
+  - A viewer can ask for the pane's history (`history` control frame, answered only to viewers
+    that said `hello`; `tmux capture-pane`, bounded), so the web terminal scrolls it locally
+    instead of putting the shared pane into copy mode (#22333).
+  - The window's size changes hands on an explicit takeover (attach, focus-in, `claim`) or after
+    the sizing viewer has been idle, not on every keystroke from another viewer; resizes stay
+    debounced and no-op resizes are skipped (#22333).
+  - Claude Code and Codex threads started by the Mac's owner skip permission prompts
+    (`--dangerously-skip-permissions`, `--dangerously-bypass-approvals-and-sandbox`) when the
+    start asks for it, only while remote control is on; the host declares
+    `code_thread_skip_permissions` beside `remote_terminal`. Claude's one-time bypass warning is
+    pre-accepted only in the settings files those windows use (#22332).
+
 ## 0.14.0
 
 - **Code threads on this Mac: installed agents, honest shells, one prompt, who sizes.**

package/dist/agent/run.js

@@ -52,7 +52,7 @@ import { SessionStore, sessionKeyFor } from './sessionstore.js';
 import { verifySignature } from './signature.js';
 import { VENUE_RUN_TOKEN_CAPABILITY, apiForRun, claudeSupportsVenueSessions, claudeVenueCommand, VENUE_PROGRESS, VENUE_SESSION_FEATURE, VENUE_SESSION_FRAME, VENUE_SESSION_OPEN_FRAME, VENUE_GRANT_CHECK_MS, VENUE_EXPIRY_MARGIN_MS, VENUE_GRANT_ENDED_ERROR, VENUE_GRANT_EXPIRED_ERROR, isVenueRun, venueEnv, venueGrantLive, venueGrantRemainingMs, venueRunFromSession, venueWorkdir, } from './venue.js';
 import { RUN_REPOS_ENV_VAR, WorktreeManager } from './worktrees.js';
-import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, RefusedDeliveryError, REMOTE_TERMINAL_CAPABILITY, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, } from '../codehost/host.js';
+import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, RefusedDeliveryError, REMOTE_TERMINAL_CAPABILITY, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, } from '../codehost/host.js';
 import { loadSettings as loadCodeHostSettings } from '../codehost/settings.js';
 import { isWebhookEvent } from '../forward.js';
 import { DEFAULT_WS_URL } from '../listen.js';
@@ -1418,10 +1418,19 @@ export async function runAgentHarness(options) {
             // With folder starts (`folder` / `separateCopy`): the server sends one only to a socket saying so.
             // With the agents whose binaries resolve here, re-checked per frame: the server offers only those.
             ...(codeHost?.authorized()
-                ? [CODE_THREADS_CAPABILITY, CODE_THREAD_FOLDERS_CAPABILITY, codeHost.instanceCapability(), ...(codeHost.agentCapabilities?.() ?? [])]
+                ? [
+                    CODE_THREADS_CAPABILITY,
+                    CODE_THREAD_FOLDERS_CAPABILITY,
+                    codeHost.instanceCapability(),
+                    ...(codeHost.agentCapabilities?.() ?? []),
+                ]
                 : []),
             // Read on every frame, so `remote off` stops being declared at the next one.
-            ...(codeHost?.authorized() && codeHost.remoteTerminalAllowed() ? [REMOTE_TERMINAL_CAPABILITY] : []),
+            // With it, skipping permission prompts (`skipPermissions` on a start): only while remote control
+            // is on, as the host applies it only then; the server records a thread as skipping only so.
+            ...(codeHost?.authorized() && codeHost.remoteTerminalAllowed()
+                ? [REMOTE_TERMINAL_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY]
+                : []),
         ],
         // `--machine` names this machine everywhere, exactly as given: whoever set it never sends the
         // real hostname. Only the real hostname is cut to its short form.

package/dist/codehost/history.d.ts

@@ -0,0 +1,80 @@
+/**
+ * A viewer's local scroll-back (CONTRACTS-R2 R1): the pane's history as text, so the viewer
+ * scrolls it on its own screen instead of driving tmux copy mode over the network (one wheel
+ * step per round trip, and copy mode is the PANE's: one viewer's scroll froze everyone's view).
+ *
+ * - client → server: `{"type":"history","id":<string>,"lines":<int, capped 10000>}`;
+ * - server → that client only: `{"type":"history","id","text","cols","rows"}`, the history and
+ *   visible screen as `tmux capture-pane -p -e -J -S -<lines>` prints them (SGR colours kept,
+ *   wrapped lines joined), or `{"type":"history","id","error":"<code>"}`.
+ *
+ * Answered only to a viewer that said `hello` (an older page never sees one), and bounded: a
+ * frame never exceeds {@link HISTORY_MAX_FRAME_BYTES}; the oldest lines go first.
+ */
+/** Most lines a viewer may ask for. */
+export declare const HISTORY_MAX_LINES = 10000;
+/** Lines asked for when a request names none (or an unusable number). */
+export declare const HISTORY_DEFAULT_LINES = 2000;
+/**
+ * Largest answer, as sent (JSON): the relay carries it over Redis and the cloud pipe's upstream
+ * socket takes at most 1 MiB, so this stays well under both.
+ */
+export declare const HISTORY_MAX_FRAME_BYTES: number;
+/** A request id: what the viewer matches its answer by. */
+export declare const HISTORY_ID_PATTERN: RegExp;
+export type HistoryError = 'alternate_screen' | 'capture_failed' | 'unavailable';
+export interface HistoryRequest {
+    type: 'history';
+    id: string;
+    lines: number;
+}
+export type HistoryFrame = {
+    type: 'history';
+    id: string;
+    text: string;
+    cols: number;
+    rows: number;
+} | {
+    type: 'history';
+    id: string;
+    error: HistoryError;
+};
+export type HistoryResult = {
+    ok: true;
+    text: string;
+    cols: number;
+    rows: number;
+} | {
+    ok: false;
+    error: HistoryError;
+};
+/** `lines` as asked, within 1..{@link HISTORY_MAX_LINES}. */
+export declare function clampHistoryLines(raw: unknown): number;
+/** A `history` request frame's fields, or `null` when it can't be answered (no usable id). */
+export declare function parseHistoryRequest(frame: Record<string, unknown>): HistoryRequest | null;
+/**
+ * `-p` print, `-e` keep the SGR escapes (colours, bold), `-J` join wrapped lines (the viewer
+ * wraps them at its own width), `-S -<lines>` from that far back in the history to the screen's end.
+ */
+export declare function captureHistoryArgs(name: string, lines: number): string[];
+/** The pane's size, and whether a program (vim, less) holds its alternate screen: `<cols> <rows> <0|1>`. */
+export declare function paneGeometryArgs(name: string): string[];
+export declare function parsePaneGeometry(stdout: string): {
+    cols: number;
+    rows: number;
+    alternate: boolean;
+} | null;
+/**
+ * The answer to request `id`, at most `maxBytes` as JSON: whole lines are dropped from the top
+ * (the oldest) until it fits. tmux ends its capture with a newline, which is not a line.
+ */
+export declare function historyFrame(id: string, result: HistoryResult, maxBytes?: number): HistoryFrame;
+export type HistoryTmux = (args: string[]) => Promise<{
+    ok: boolean;
+    stdout?: string;
+}>;
+/**
+ * Read `lines` of window `name`'s history. A pane in the alternate screen (a full-screen program)
+ * has no scroll-back to show: the viewer falls back to sending it the wheel.
+ */
+export declare function readHistory(tmux: HistoryTmux, name: string, lines: number): Promise<HistoryResult>;

package/dist/codehost/history.js

@@ -0,0 +1,98 @@
+/**
+ * A viewer's local scroll-back (CONTRACTS-R2 R1): the pane's history as text, so the viewer
+ * scrolls it on its own screen instead of driving tmux copy mode over the network (one wheel
+ * step per round trip, and copy mode is the PANE's: one viewer's scroll froze everyone's view).
+ *
+ * - client → server: `{"type":"history","id":<string>,"lines":<int, capped 10000>}`;
+ * - server → that client only: `{"type":"history","id","text","cols","rows"}`, the history and
+ *   visible screen as `tmux capture-pane -p -e -J -S -<lines>` prints them (SGR colours kept,
+ *   wrapped lines joined), or `{"type":"history","id","error":"<code>"}`.
+ *
+ * Answered only to a viewer that said `hello` (an older page never sees one), and bounded: a
+ * frame never exceeds {@link HISTORY_MAX_FRAME_BYTES}; the oldest lines go first.
+ */
+import { windowTarget } from './tmux.js';
+/** Most lines a viewer may ask for. */
+export const HISTORY_MAX_LINES = 10_000;
+/** Lines asked for when a request names none (or an unusable number). */
+export const HISTORY_DEFAULT_LINES = 2_000;
+/**
+ * Largest answer, as sent (JSON): the relay carries it over Redis and the cloud pipe's upstream
+ * socket takes at most 1 MiB, so this stays well under both.
+ */
+export const HISTORY_MAX_FRAME_BYTES = 768 * 1024;
+/** A request id: what the viewer matches its answer by. */
+export const HISTORY_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+/** `lines` as asked, within 1..{@link HISTORY_MAX_LINES}. */
+export function clampHistoryLines(raw) {
+    const n = typeof raw === 'number' && Number.isFinite(raw) ? Math.trunc(raw) : Number.NaN;
+    if (!Number.isFinite(n) || n < 1)
+        return HISTORY_DEFAULT_LINES;
+    return Math.min(n, HISTORY_MAX_LINES);
+}
+/** A `history` request frame's fields, or `null` when it can't be answered (no usable id). */
+export function parseHistoryRequest(frame) {
+    if (frame.type !== 'history' || typeof frame.id !== 'string' || !HISTORY_ID_PATTERN.test(frame.id))
+        return null;
+    return { type: 'history', id: frame.id, lines: clampHistoryLines(frame.lines) };
+}
+/**
+ * `-p` print, `-e` keep the SGR escapes (colours, bold), `-J` join wrapped lines (the viewer
+ * wraps them at its own width), `-S -<lines>` from that far back in the history to the screen's end.
+ */
+export function captureHistoryArgs(name, lines) {
+    return ['capture-pane', '-p', '-e', '-J', '-S', `-${clampHistoryLines(lines)}`, '-t', windowTarget(name)];
+}
+/** The pane's size, and whether a program (vim, less) holds its alternate screen: `<cols> <rows> <0|1>`. */
+export function paneGeometryArgs(name) {
+    return ['display-message', '-p', '-t', windowTarget(name), '#{pane_width} #{pane_height} #{alternate_on}'];
+}
+export function parsePaneGeometry(stdout) {
+    const match = /^(\d+) (\d+) ([01])$/.exec(stdout.trim());
+    if (!match)
+        return null;
+    const cols = Number(match[1]);
+    const rows = Number(match[2]);
+    if (cols < 1 || rows < 1)
+        return null;
+    return { cols, rows, alternate: match[3] === '1' };
+}
+const frameBytes = (frame) => Buffer.byteLength(JSON.stringify(frame), 'utf8');
+/**
+ * The answer to request `id`, at most `maxBytes` as JSON: whole lines are dropped from the top
+ * (the oldest) until it fits. tmux ends its capture with a newline, which is not a line.
+ */
+export function historyFrame(id, result, maxBytes = HISTORY_MAX_FRAME_BYTES) {
+    if (!result.ok)
+        return { type: 'history', id, error: result.error };
+    let lines = result.text.replace(/\r/g, '').replace(/\n$/, '').split('\n');
+    const build = () => ({ type: 'history', id, text: lines.join('\n'), cols: result.cols, rows: result.rows });
+    let frame = build();
+    let size = frameBytes(frame);
+    while (size > maxBytes && lines.length > 1) {
+        // Proportionally, with a margin, so a big history takes a few passes rather than thousands.
+        const keep = Math.max(1, Math.min(lines.length - 1, Math.floor((lines.length * maxBytes) / size) - 1));
+        lines = lines.slice(lines.length - keep);
+        frame = build();
+        size = frameBytes(frame);
+    }
+    if (size > maxBytes)
+        return { type: 'history', id, error: 'capture_failed' };
+    return frame;
+}
+/**
+ * Read `lines` of window `name`'s history. A pane in the alternate screen (a full-screen program)
+ * has no scroll-back to show: the viewer falls back to sending it the wheel.
+ */
+export async function readHistory(tmux, name, lines) {
+    const geometryRead = await tmux(paneGeometryArgs(name));
+    const geometry = geometryRead.ok ? parsePaneGeometry(geometryRead.stdout ?? '') : null;
+    if (!geometry)
+        return { ok: false, error: 'capture_failed' };
+    if (geometry.alternate)
+        return { ok: false, error: 'alternate_screen' };
+    const capture = await tmux(captureHistoryArgs(name, lines));
+    if (!capture.ok)
+        return { ok: false, error: 'capture_failed' };
+    return { ok: true, text: capture.stdout ?? '', cols: geometry.cols, rows: geometry.rows };
+}

package/dist/codehost/hooks.d.ts

@@ -73,8 +73,14 @@ export declare function hookShimPath(env?: NodeJS.ProcessEnv): string;
 export declare function claudeSettingsPath(env?: NodeJS.ProcessEnv): string;
 /** The shim script: env-guarded, then the current CLI's `hook` command. */
 export declare function hookShimScript(nodePath: string, cliEntrypoint: string): string;
-/** The `--settings` document Claude Code is launched with: hooks only. */
-export declare function claudeHookSettings(shimPath: string, invocationProtocol?: boolean): Record<string, unknown>;
+/**
+ * The `--settings` document Claude Code is launched with: hooks only, and, for a window started
+ * without permission prompts (`skipsPermissions`), the owner's acceptance of Claude Code's one-time
+ * bypass-mode warning: `skipDangerousModePermissionPrompt` ("whether the user has accepted the
+ * bypass permissions mode dialog", Claude Code's settings schema; read from `--settings` too). Only
+ * that window's document carries it: every other window launches without bypass mode, as before.
+ */
+export declare function claudeHookSettings(shimPath: string, invocationProtocol?: boolean, skipsPermissions?: boolean): Record<string, unknown>;
 /** Codex `-c notify=[...]` value (TOML array), naming the shim. */
 export declare function codexNotifyOverride(shimPath: string): string;
 /** Write the shim and Claude settings. Called on every daemon start. */
@@ -82,6 +88,8 @@ export declare function installHookFiles(nodePath: string, cliEntrypoint: string
     shim: string;
     claudeSettings: string;
     claudeInvocationSettings: string;
+    claudeSkipSettings: string;
+    claudeInvocationSkipSettings: string;
 };
 /** Last non-empty line, clipped — the inbox row's preview. */
 export declare function previewOf(text: string): string | undefined;

package/dist/codehost/hooks.js

@@ -123,8 +123,14 @@ export function hookShimScript(nodePath, cliEntrypoint) {
         '',
     ].join('\n');
 }
-/** The `--settings` document Claude Code is launched with: hooks only. */
-export function claudeHookSettings(shimPath, invocationProtocol = false) {
+/**
+ * The `--settings` document Claude Code is launched with: hooks only, and, for a window started
+ * without permission prompts (`skipsPermissions`), the owner's acceptance of Claude Code's one-time
+ * bypass-mode warning: `skipDangerousModePermissionPrompt` ("whether the user has accepted the
+ * bypass permissions mode dialog", Claude Code's settings schema; read from `--settings` too). Only
+ * that window's document carries it: every other window launches without bypass mode, as before.
+ */
+export function claudeHookSettings(shimPath, invocationProtocol = false, skipsPermissions = false) {
     const hooks = {};
     for (const name of CLAUDE_HOOK_EVENTS) {
         // The PermissionRequest hook waits for a decision from ProhostAI (`--wait`), within its own
@@ -154,7 +160,7 @@ export function claudeHookSettings(shimPath, invocationProtocol = false) {
         hooks.PostToolUse = [{ hooks: [{
                         type: 'command', command: `${shellQuote(shimPath, 'darwin')} claude PostToolUse`, timeout: 10,
                     }] }];
-    return { hooks };
+    return skipsPermissions ? { hooks, skipDangerousModePermissionPrompt: true } : { hooks };
 }
 /** Codex `-c notify=[...]` value (TOML array), naming the shim. */
 export function codexNotifyOverride(shimPath) {
@@ -173,7 +179,12 @@ export function installHookFiles(nodePath, cliEntrypoint, env = process.env) {
     writePrivateJson(claudeSettings, claudeHookSettings(shim));
     const claudeInvocationSettings = path.join(codeHostDir(env), 'claude-invocation-settings.json');
     writePrivateJson(claudeInvocationSettings, claudeHookSettings(shim, true));
-    return { shim, claudeSettings, claudeInvocationSettings };
+    // The same two for a window started without permission prompts (`agentCommandLine`).
+    const claudeSkipSettings = path.join(codeHostDir(env), 'claude-settings-skip-permissions.json');
+    writePrivateJson(claudeSkipSettings, claudeHookSettings(shim, false, true));
+    const claudeInvocationSkipSettings = path.join(codeHostDir(env), 'claude-invocation-settings-skip-permissions.json');
+    writePrivateJson(claudeInvocationSkipSettings, claudeHookSettings(shim, true, true));
+    return { shim, claudeSettings, claudeInvocationSettings, claudeSkipSettings, claudeInvocationSkipSettings };
 }
 // ── Parsing what the agents hand their hooks ───────────────────────────────
 function asObject(value) {

package/dist/codehost/host.d.ts

@@ -45,6 +45,13 @@ export declare const HOST_INSTANCE_CAPABILITY_PREFIX = "host_instance_";
  * sends a folder start only to a socket that declared it.
  */
 export declare const CODE_THREAD_FOLDERS_CAPABILITY = "code_thread_folders";
+/**
+ * Declared beside {@link REMOTE_TERMINAL_CAPABILITY} (only while remote control is on) by a host
+ * that reads `skipPermissions` in `code_thread.start_requested`: Claude Code and Codex then start
+ * without permission prompts (`agentCommandLine`); with remote control off they always ask. The
+ * server records a thread as skipping only for a socket that declared it.
+ */
+export declare const CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY = "code_thread_skip_permissions";
 /** `code_thread.start_requested` data (camelCase per the contract), or `null`. */
 export declare function parseStartRequest(data: Record<string, unknown>): StartRequest | null;
 /** `code_thread.input_requested` data, or `null`. */

package/dist/codehost/host.js

@@ -56,6 +56,13 @@ export const HOST_INSTANCE_CAPABILITY_PREFIX = 'host_instance_';
  * sends a folder start only to a socket that declared it.
  */
 export const CODE_THREAD_FOLDERS_CAPABILITY = 'code_thread_folders';
+/**
+ * Declared beside {@link REMOTE_TERMINAL_CAPABILITY} (only while remote control is on) by a host
+ * that reads `skipPermissions` in `code_thread.start_requested`: Claude Code and Codex then start
+ * without permission prompts (`agentCommandLine`); with remote control off they always ask. The
+ * server records a thread as skipping only for a socket that declared it.
+ */
+export const CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY = 'code_thread_skip_permissions';
 function text(value) {
     return typeof value === 'string' ? value : undefined;
 }
@@ -78,6 +85,8 @@ export function parseStartRequest(data) {
         branch: text(data.branch) || undefined,
         agent,
         ...(folder ? { folder, separateCopy: data.separateCopy === true } : {}),
+        // Only an explicit `true` skips the prompts: a server before the choice sends nothing.
+        ...(data.skipPermissions === true ? { skipPermissions: true } : {}),
     };
 }
 /** `code_thread.input_requested` data, or `null`. */
@@ -180,6 +189,7 @@ export class CodeHost {
             checkouts: this.checkouts,
             events: this.events,
             hookFiles: { claudeSettings: hookFiles.claudeSettings, claudeInvocationSettings: hookFiles.claudeInvocationSettings,
+                claudeSkipSettings: hookFiles.claudeSkipSettings, claudeInvocationSkipSettings: hookFiles.claudeInvocationSkipSettings,
                 hookShim: hookFiles.shim, codexNotify: codexNotifyOverride(hookFiles.shim) },
             accountEnv: options.accountEnv,
             agentInstalled: (agent) => resolvesOnPath(AGENT_BINARIES[agent], this.env),

package/dist/codehost/relay.d.ts

@@ -53,7 +53,12 @@ export interface DialFrame {
 }
 /** A `dial` frame, or `null` when it is not one this host can act on. */
 export declare function parseDial(frame: Record<string, unknown>): DialFrame | null;
-/** Pipe one terminal stream over one open socket until either side ends. */
+/**
+ * Pipe one terminal stream over one open socket until either side ends.
+ *
+ * Text controls in: `resize`, `input`, `hello`, `claim`, `history` (answered with the pane's
+ * scroll-back, only once the viewer said hello: an older page never sees one), `ping`.
+ */
 export declare function pipeStream(ws: WebSocket, stream: TerminalStream, onClosed: (reason: string) => void): void;
 /** Whose pairing this is, as the relay's `auth_ok` names it. */
 export interface PairingIdentity {

package/dist/codehost/relay.js

@@ -22,6 +22,7 @@ import { randomBytes } from 'node:crypto';
 import WebSocket from 'ws';
 import { endpointProblem } from '../agent/base-url.js';
 import { USER_AGENT } from '../version.js';
+import { historyFrame } from './history.js';
 import { isValidId, parseControl, TERMINAL_WINDOWS } from './tmux.js';
 export const CONTROL_PATH = '/v1/code-hosts/control';
 export const STREAM_PATH = '/v1/code-hosts/stream';
@@ -77,9 +78,52 @@ export function parseDial(frame) {
         mode: frame.mode === 'watch' ? 'watch' : 'type',
     };
 }
-/** Pipe one terminal stream over one open socket until either side ends. */
+/**
+ * Pipe one terminal stream over one open socket until either side ends.
+ *
+ * Text controls in: `resize`, `input`, `hello`, `claim`, `history` (answered with the pane's
+ * scroll-back, only once the viewer said hello: an older page never sees one), `ping`.
+ */
 export function pipeStream(ws, stream, onClosed) {
     let done = false;
+    let greeted = false;
+    /** One capture at a time per viewer: a burst of asks is answered by the one after the last. */
+    let reading;
+    let queued;
+    const sendText = (frame) => {
+        if (done || ws.readyState !== WebSocket.OPEN)
+            return;
+        if (ws.bufferedAmount > MAX_STREAM_BUFFERED_BYTES) {
+            finish('slow_consumer');
+            return;
+        }
+        try {
+            ws.send(JSON.stringify(frame));
+        }
+        catch {
+            /* closing anyway */
+        }
+    };
+    const answerHistory = (request) => {
+        if (reading) {
+            // An ask still waiting is superseded: the viewer only uses the latest answer.
+            if (queued)
+                sendText({ type: 'history', id: queued.id, error: 'unavailable' });
+            queued = request;
+            return;
+        }
+        const read = stream.history
+            ? stream.history(request.lines).catch(() => ({ ok: false, error: 'capture_failed' }))
+            : Promise.resolve({ ok: false, error: 'unavailable' });
+        reading = read.then((result) => {
+            sendText(historyFrame(request.id, result));
+            reading = undefined;
+            const next = queued;
+            queued = undefined;
+            if (next && !done)
+                answerHistory(next);
+        });
+    };
     const finish = (reason) => {
         if (done)
             return;
@@ -128,10 +172,16 @@ export function pipeStream(ws, stream, onClosed) {
             stream.resize(control.cols, control.rows);
         else if (control.type === 'input')
             stream.write(Buffer.from(control.data, 'utf8'));
-        else if (control.type === 'hello')
+        else if (control.type === 'hello') {
+            greeted = true;
             stream.hello?.(control.client);
+        }
         else if (control.type === 'claim')
             stream.claim?.();
+        else if (control.type === 'history') {
+            if (greeted)
+                answerHistory(control);
+        }
         else if (control.type === 'ping')
             ws.send(JSON.stringify({ type: 'pong' }));
     });

package/dist/codehost/sizing.d.ts

@@ -8,9 +8,13 @@
  * option, which tmux 3.4 can't start with), from its creation on, and this module picks one viewer
  * per window to size it to (the approved policy, CONTRACTS C3):
  *
- * - a viewer that attaches, types, sends `{"type":"claim"}` (a phone on ready / foreground / touch,
- *   the desktop's "Use this window's size"), or reports focus (`ESC [ I`) takes it — never a
- *   `watch` viewer, which can't type (it sizes a window only nobody else shows);
+ * - a viewer that attaches, sends `{"type":"claim"}` (a phone on ready / foreground / touch / before
+ *   it types, the desktop's "Use this window's size"), or reports focus (`ESC [ I`: its window came
+ *   to the front) takes it — never a `watch` viewer, which can't type (it sizes a window only
+ *   nobody else shows);
+ * - typing alone takes it only from a sizing viewer idle {@link IDLE_TAKEOVER_MS} (CONTRACTS-R2
+ *   R2): two viewers typing in turn no longer resize the window, and redraw Claude Code's whole
+ *   transcript, on every keystroke;
  * - when the sizing viewer leaves, the one active most recently among those left takes over;
  * - a handover or resize reaches tmux once it has been quiet {@link HANDOVER_DEBOUNCE_MS}, and only
  *   when the size changes: Claude Code reprints its whole transcript on every width change.
@@ -60,6 +64,8 @@ export declare const HANDOVER_DEBOUNCE_MS = 300;
 export declare const MODE_CHECK_MS = 150;
 /** A held shell nobody attached to starts anyway after this long. */
 export declare const HOLD_FALLBACK_MS = 60000;
+/** Typing takes the window's size from a sizing viewer that hasn't typed or claimed for this long. */
+export declare const IDLE_TAKEOVER_MS = 30000;
 export declare function holdChannel(name: string): string;
 /**
  * `command`, run once the window's hold is released. Waits on the tmux server the pane runs in
@@ -93,14 +99,21 @@ export interface TerminalSizingOptions {
 export interface SizingViewer {
     hello(client: ViewerClient): void;
     resize(cols: number, rows: number): void;
-    /** Size the window to this viewer now: it typed, focused, or asked. A `watch` viewer's is ignored. */
+    /** Size the window to this viewer now: it attached, focused, or asked. A `watch` viewer's is ignored. */
     claim(): void;
+    /**
+     * This viewer typed: it sizes the window only if nobody else does, or the one who does has been
+     * idle {@link IDLE_TAKEOVER_MS}. A `watch` viewer's is ignored.
+     */
+    typed(): void;
     /**
      * This viewer's input may have changed the pane's copy mode. `moved`: it can move copy mode (a
      * wheel step, a drag, the prefix key, a keystroke), so this viewer is now who scrolled; else
      * (an emulator report) the mode is only read again.
      */
     scrolled(moved?: boolean): void;
+    /** This viewer's input is what scrolled the pane back (it may move through its own copy mode). */
+    isScroller(): boolean;
     leave(): void;
     onSizer(listener: (frame: SizerFrame) => void): void;
 }
@@ -161,3 +174,8 @@ export declare class TerminalSizing {
     private settle;
     private release;
 }
+/**
+ * What a chunk of a viewer's input says about who sizes the window: a focus-in report (its window
+ * came to the front) claims it; anything a person typed only takes it from an idle sizing viewer.
+ */
+export declare function noteInputTakeover(viewer: Pick<SizingViewer, 'claim' | 'typed'>, data: Uint8Array): void;

package/dist/codehost/sizing.js

@@ -8,9 +8,13 @@
  * option, which tmux 3.4 can't start with), from its creation on, and this module picks one viewer
  * per window to size it to (the approved policy, CONTRACTS C3):
  *
- * - a viewer that attaches, types, sends `{"type":"claim"}` (a phone on ready / foreground / touch,
- *   the desktop's "Use this window's size"), or reports focus (`ESC [ I`) takes it — never a
- *   `watch` viewer, which can't type (it sizes a window only nobody else shows);
+ * - a viewer that attaches, sends `{"type":"claim"}` (a phone on ready / foreground / touch / before
+ *   it types, the desktop's "Use this window's size"), or reports focus (`ESC [ I`: its window came
+ *   to the front) takes it — never a `watch` viewer, which can't type (it sizes a window only
+ *   nobody else shows);
+ * - typing alone takes it only from a sizing viewer idle {@link IDLE_TAKEOVER_MS} (CONTRACTS-R2
+ *   R2): two viewers typing in turn no longer resize the window, and redraw Claude Code's whole
+ *   transcript, on every keystroke;
  * - when the sizing viewer leaves, the one active most recently among those left takes over;
  * - a handover or resize reaches tmux once it has been quiet {@link HANDOVER_DEBOUNCE_MS}, and only
  *   when the size changes: Claude Code reprints its whole transcript on every width change.
@@ -28,7 +32,7 @@
  * page's fit showed one prompt per resize. A held window runs `tmux wait-for <channel>` before its
  * shell (see {@link holdCommand}); the first viewer's resizes going quiet signals it.
  */
-import { leaveCopyModeArgs, paneInModeArgs, windowTarget } from './tmux.js';
+import { hasFocusIn, isHumanInput, leaveCopyModeArgs, paneInModeArgs, windowTarget } from './tmux.js';
 export const VIEWER_KINDS = new Set(['phone', 'tablet', 'desktop']);
 const MAX_LABEL_CHARS = 40;
 /** A `hello` frame's `client`, made safe to repeat to another viewer. */
@@ -53,6 +57,8 @@ export const HANDOVER_DEBOUNCE_MS = 300;
 export const MODE_CHECK_MS = 150;
 /** A held shell nobody attached to starts anyway after this long. */
 export const HOLD_FALLBACK_MS = 60_000;
+/** Typing takes the window's size from a sizing viewer that hasn't typed or claimed for this long. */
+export const IDLE_TAKEOVER_MS = 30_000;
 export function holdChannel(name) {
     return `prohost-hold-${name}`;
 }
@@ -171,7 +177,14 @@ export class TerminalSizing {
     }
     join(name, size) {
         const state = this.state(name);
-        const viewer = { id: this.nextId++, cols: size.cols, rows: size.rows, watch: size.watch === true, activeAt: ++this.seq };
+        const viewer = {
+            id: this.nextId++,
+            cols: size.cols,
+            rows: size.rows,
+            watch: size.watch === true,
+            activeAt: ++this.seq,
+            inputAt: this.now(),
+        };
         state.viewers.set(viewer.id, viewer);
         // Attaching claims the size, as tmux did (`window-size latest`): a watch viewer only a window
         // nobody else shows.
@@ -208,7 +221,23 @@ export class TerminalSizing {
                     this.settle(name, state);
             },
             claim: () => {
-                if (left || state.owner === viewer.id || viewer.watch)
+                if (left || viewer.watch)
+                    return;
+                viewer.inputAt = this.now();
+                if (state.owner === viewer.id)
+                    return;
+                this.handOver(name, state, viewer);
+            },
+            typed: () => {
+                if (left || viewer.watch)
+                    return;
+                const now = this.now();
+                viewer.inputAt = now;
+                if (state.owner === viewer.id)
+                    return;
+                const owner = state.owner === undefined ? undefined : state.viewers.get(state.owner);
+                // The sizing viewer is at it too: its size stays until it goes quiet, or this one asks.
+                if (owner && now - owner.inputAt < IDLE_TAKEOVER_MS)
                     return;
                 this.handOver(name, state, viewer);
             },
@@ -221,6 +250,7 @@ export class TerminalSizing {
                 }
                 this.checkMode(name, state);
             },
+            isScroller: () => !left && state.scroller === viewer.id,
             leave: () => {
                 if (left)
                     return;
@@ -392,3 +422,13 @@ export class TerminalSizing {
         await this.options.tmux(releaseHoldArgs(name));
     }
 }
+/**
+ * What a chunk of a viewer's input says about who sizes the window: a focus-in report (its window
+ * came to the front) claims it; anything a person typed only takes it from an idle sizing viewer.
+ */
+export function noteInputTakeover(viewer, data) {
+    if (hasFocusIn(data))
+        viewer.claim();
+    else if (isHumanInput(data))
+        viewer.typed();
+}

package/dist/codehost/terminals.d.ts

@@ -23,6 +23,7 @@ import { execFile } from 'node:child_process';
 import type { InstalledAgent } from './agents.js';
 import type { CheckoutResult } from './checkouts.js';
 import type { CodeThreadEventSink } from './events.js';
+import type { HistoryResult } from './history.js';
 import type { PtySpawn } from './pty.js';
 import { TerminalSizing } from './sizing.js';
 import type { SizerFrame, ViewerClient } from './sizing.js';
@@ -79,6 +80,11 @@ export interface StartRequest {
     folder?: string;
     /** With {@link folder}: a worktree and branch of the folder's git checkout instead of in place. */
     separateCopy?: boolean;
+    /**
+     * Claude Code / Codex start without their permission prompts (see {@link agentCommandLine}):
+     * nothing asks, so no `permission_request` reaches the inbox. Absent (an older server): they ask.
+     */
+    skipPermissions?: boolean;
 }
 /**
  * Why `input` did not get a reply through, when the server should hear it (it
@@ -144,6 +150,8 @@ export interface TerminalStream {
     claim?(): void;
     /** Who sizes the window, for a viewer that said hello. */
     onSizer?(listener: (frame: SizerFrame) => void): void;
+    /** The pane's last `lines` of history and its screen, as text with colours (`history.ts`). */
+    history?(lines: number): Promise<HistoryResult>;
 }
 export type AttachResult = {
     ok: true;
@@ -175,13 +183,28 @@ export type StartResult = {
  * at all (0, 408, 429, 5xx) it is retried.
  */
 export declare function isDefinitive(status: number): boolean;
+/** Claude Code's flag for a thread started with `skipPermissions`: no permission prompt, ever. */
+export declare const CLAUDE_SKIP_PERMISSIONS_FLAG = "--dangerously-skip-permissions";
+/**
+ * Codex's (`codex --help`, 0.146): no approval prompt and no sandbox, as Claude Code's flag. Its
+ * `-a never` alone would keep the sandbox, where a command needing the network fails instead of asking.
+ */
+export declare const CODEX_SKIP_PERMISSIONS_FLAG = "--dangerously-bypass-approvals-and-sandbox";
 /** The shell command line a thread's agent window runs. */
 export declare function agentCommandLine(agent: CodeAgent, options: {
     claudeSettings: string;
     claudeInvocationSettings?: string;
+    /**
+     * With {@link skipPermissions}: the same `--settings` documents that also record the owner's
+     * acceptance of Claude Code's bypass-mode warning (`hooks.ts`); without them that warning shows.
+     */
+    claudeSkipSettings?: string;
+    claudeInvocationSkipSettings?: string;
     hookShim?: string;
     codexNotify: string;
     hasGoal: boolean;
+    /** Start the agent without its permission prompts (a shell has none). */
+    skipPermissions?: boolean;
 }): string;
 export interface CodeTerminalsOptions {
     /** `$PROHOST_HOME` for this host; exported to every window. */
@@ -204,6 +227,9 @@ export interface CodeTerminalsOptions {
     hookFiles: {
         claudeSettings: string;
         claudeInvocationSettings?: string;
+        /** The skip-prompts twins of the two documents above (see {@link agentCommandLine}). */
+        claudeSkipSettings?: string;
+        claudeInvocationSkipSettings?: string;
         hookShim?: string;
         codexNotify: string;
     };
@@ -253,6 +279,8 @@ export interface CodeTerminalsOptions {
 }
 /** What the thread says while Claude Code waits on its trust dialog. */
 export declare const TRUST_PROMPT_NOTE = "Claude Code is asking whether to trust this folder before it starts. Answer in the terminal.";
+/** What the thread says while Claude Code waits on that warning. */
+export declare const BYPASS_PROMPT_NOTE = "Claude Code asks once to confirm it may run commands without asking. Answer in the terminal.";
 export declare class CodeTerminals {
     private readonly options;
     private readonly records;
@@ -343,8 +371,11 @@ export declare class CodeTerminals {
      */
     private trustOwnWorktree;
     /**
-     * Watch a new Claude Code window for its trust dialog, only to tell the thread it waits on it
-     * (needs-you, not Working). It never decides whether a reply types: the ready mark does.
+     * Watch a new Claude Code window for its first-run screens, only to tell the thread it waits on
+     * one (needs-you, not Working): the folder's trust dialog, and, for a thread that skips permission
+     * prompts, Claude Code's one-time bypass warning (it comes up after the trust dialog is answered,
+     * so it is looked for longer once that was said). Each is said once. It never decides whether a
+     * reply types: the ready mark does.
      */
     private watchTrustPrompt;
     private known;

package/dist/codehost/terminals.js

@@ -29,11 +29,13 @@ import { markTurn } from './activity.js';
 import { missingAgentReason } from './agents.js';
 import { claudeConfigDir, claudeTrusts, trustClaudeWorkspace } from './claude_trust.js';
 import { event } from './events.js';
+import { readHistory } from './history.js';
 import { CODE_THREAD_ID_ENV, TERMINAL_ID_ENV } from './hooks.js';
 import { MAX_OPEN_PTYS } from './pty.js';
 import { claudeSessionSince, isReady, markReady } from './ready.js';
 import { defaultSizeArgs, HOLD_OPTION, holdChannel, holdCommand, resizeWindowArgs, TerminalSizing } from './sizing.js';
-import { attachArgs, baseArgs, clampDim, DEFAULT_COLS, DEFAULT_ROWS, hasFocusIn, hasSessionArgs, isCopyModeExitKey, isHumanInput, isTypedText, isInterruptInput, isScrollGesture, leaveCopyModeArgs, mayEnterCopyMode, paneInModeArgs, isValidId, killSessionArgs, listWindowsArgs, newSessionArgs, newWindowArgs, parseListWindows, sendTextCommands, setWindowMetaArgs, TERMINAL_WINDOWS, DAEMON_ONLY_ENV, paneEnv, viewSessionName, windowName, windowTarget, } from './tmux.js';
+import { noteInputTakeover } from './sizing.js';
+import { attachArgs, baseArgs, clampDim, DEFAULT_COLS, DEFAULT_ROWS, hasSessionArgs, isCopyModeExitKey, isHumanInput, isTypedText, isInterruptInput, isScrollGesture, leaveCopyModeArgs, mayEnterCopyMode, paneInModeArgs, isValidId, killSessionArgs, listWindowsArgs, newSessionArgs, newWindowArgs, parseListWindows, sendTextCommands, setWindowMetaArgs, TERMINAL_WINDOWS, DAEMON_ONLY_ENV, paneEnv, viewSessionName, windowName, windowTarget, } from './tmux.js';
 export const CODE_AGENTS = ['claude_code', 'codex', 'shell'];
 export const GOAL_ENV = 'PROHOST_CODE_THREAD_GOAL';
 /** Window option set when the agent exits and its window becomes a shell. */
@@ -60,7 +62,8 @@ const PASTE_SETTLE_MS = 150;
 export function execTmux(binary = 'tmux') {
     return (args, stdin, timeoutMs = 10_000) => new Promise((resolve) => {
         // The first call starts the server, whose panes inherit this env.
-        const options = { timeout: timeoutMs, maxBuffer: 1024 * 1024, env: paneEnv(process.env) };
+        // Room for a viewer's scroll-back (`capture-pane`, up to 10,000 lines with their colours).
+        const options = { timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024, env: paneEnv(process.env) };
         const child = execFile(binary, args, options, (error, stdout, stderr) => {
             resolve({
                 ok: error === null,
@@ -86,12 +89,20 @@ export function isDefinitive(status) {
         return true;
     return status >= 400 && status < 500 && ![401, 403, 408, 429].includes(status);
 }
+/** Claude Code's flag for a thread started with `skipPermissions`: no permission prompt, ever. */
+export const CLAUDE_SKIP_PERMISSIONS_FLAG = '--dangerously-skip-permissions';
+/**
+ * Codex's (`codex --help`, 0.146): no approval prompt and no sandbox, as Claude Code's flag. Its
+ * `-a never` alone would keep the sandbox, where a command needing the network fails instead of asking.
+ */
+export const CODEX_SKIP_PERMISSIONS_FLAG = '--dangerously-bypass-approvals-and-sandbox';
 /** The shell command line a thread's agent window runs. */
 export function agentCommandLine(agent, options) {
     // `--` first: a goal is the agent's prompt, never an option, however it
     // starts (`--dangerously-skip-permissions`, or a word Codex would read as a
     // subcommand).
     const goal = options.hasGoal ? ` -- "$${GOAL_ENV}"` : '';
+    const skip = options.skipPermissions === true;
     const shell = 'exec "${SHELL:-/bin/zsh}" -l';
     if (agent === 'shell')
         return shell;
@@ -101,22 +112,52 @@ export function agentCommandLine(agent, options) {
     // (`input` and `approve` refuse a window carrying the mark).
     const after = `tmux set-option -w ${EXITED_OPTION} 1 2>/dev/null; ` +
         `printf '\\n[${label} exited — this window is now a shell in the thread worktree]\\n'; ${shell}`;
-    if (agent === 'codex')
-        return `codex -c ${shellQuote(options.codexNotify, 'darwin')}${goal}; ${after}`;
-    if (options.claudeInvocationSettings && options.hookShim) {
+    if (agent === 'codex') {
+        const flags = skip ? ` ${CODEX_SKIP_PERMISSIONS_FLAG}` : '';
+        return `codex${flags} -c ${shellQuote(options.codexNotify, 'darwin')}${goal}; ${after}`;
+    }
+    const claude = `command claude${skip ? ` ${CLAUDE_SKIP_PERMISSIONS_FLAG}` : ''} --settings`;
+    // A window that skips prompts reads the documents that also accept Claude Code's bypass warning.
+    const settings = (skip && options.claudeSkipSettings) || options.claudeSettings;
+    const invocationSettings = (skip && options.claudeInvocationSkipSettings) || options.claudeInvocationSettings;
+    if (invocationSettings && options.hookShim) {
         const check = `${shellQuote(options.hookShim, 'darwin')} claude CheckInvocationProtocol`;
-        return `if ${check}; then PROHOST_INVOCATION_PROTOCOL=1 command claude --settings ${shellQuote(options.claudeInvocationSettings, 'darwin')}${goal}; ` +
-            `else PROHOST_INVOCATION_PROTOCOL=0 command claude --settings ${shellQuote(options.claudeSettings, 'darwin')}${goal}; fi; ${after}`;
+        return `if ${check}; then PROHOST_INVOCATION_PROTOCOL=1 ${claude} ${shellQuote(invocationSettings, 'darwin')}${goal}; ` +
+            `else PROHOST_INVOCATION_PROTOCOL=0 ${claude} ${shellQuote(settings, 'darwin')}${goal}; fi; ${after}`;
     }
-    return `PROHOST_INVOCATION_PROTOCOL=0 command claude --settings ${shellQuote(options.claudeSettings, 'darwin')}${goal}; ${after}`;
+    return `PROHOST_INVOCATION_PROTOCOL=0 ${claude} ${shellQuote(settings, 'darwin')}${goal}; ${after}`;
+}
+/**
+ * A phrase as a first-run screen shows it: Claude Code wraps its own text inside a bordered box (a
+ * narrow window breaks it anywhere, and `capture-pane -J` joins only tmux's wraps), so words may be
+ * apart by any whitespace or the box's border.
+ */
+function screenPhrase(...phrases) {
+    const gap = String.raw `[\s│┃|]+`;
+    const escape = (word) => word.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(phrases.map((phrase) => phrase.split(' ').map(escape).join(gap)).join('|'), 'i');
 }
 /** Claude Code's workspace trust dialog, as its first screen shows it. */
-const TRUST_SCREEN = /Is this a project you created or one you trust|Do you trust the files in this folder/i;
+const TRUST_SCREEN = screenPhrase('Is this a project you created or one you trust', 'Do you trust the files in this folder');
 /** How many times after launch the host looks for that dialog, and how far apart. */
 const TRUST_WATCH_ATTEMPTS = 30;
+/**
+ * A thread that skips prompts, once the trust dialog was said: how long (polls) it still looks for
+ * the bypass warning, which comes up only after that dialog is answered, however long that takes.
+ */
+const BYPASS_WATCH_ATTEMPTS = 600;
 const TRUST_POLL_MS = 1_000;
 /** What the thread says while Claude Code waits on its trust dialog. */
 export const TRUST_PROMPT_NOTE = 'Claude Code is asking whether to trust this folder before it starts. Answer in the terminal.';
+/**
+ * Claude Code's one-time warning before its first `--dangerously-skip-permissions` run on a login
+ * that never accepted it. A skipping window's `--settings` document accepts it (`hooks.ts`,
+ * `skipDangerousModePermissionPrompt`); this is the fallback for a Claude Code that shows it anyway:
+ * the thread says it waits on the person.
+ */
+const BYPASS_SCREEN = screenPhrase('In Bypass Permissions mode, Claude Code will not ask');
+/** What the thread says while Claude Code waits on that warning. */
+export const BYPASS_PROMPT_NOTE = 'Claude Code asks once to confirm it may run commands without asking. Answer in the terminal.';
 /**
  * The environment a Code thread's Claude Code starts with, beyond its account's:
  * no Claude in Chrome. A thread runs where nobody may be watching, and the
@@ -428,7 +469,10 @@ export class CodeTerminals {
         // to), not tmux's 80x24: every resize after it makes a shell redraw its prompt, and a TUI its screen.
         const size = this.sizing.lastSize();
         await this.tmux(defaultSizeArgs(size.cols, size.rows));
-        const command = agentCommandLine(request.agent, { ...this.options.hookFiles, hasGoal: goal.length > 0 });
+        // Never with remote control off: then nothing from ProhostAI may run a command here unasked
+        // (a goal is the agent's first instruction). The server only asks; the Mac decides.
+        const skips = request.skipPermissions === true && request.agent !== 'shell' && this.canType();
+        const command = agentCommandLine(request.agent, { ...this.options.hookFiles, hasGoal: goal.length > 0, skipPermissions: skips });
         // A shell thread's shell waits for its first viewer's size to settle (`sizing.ts`): one prompt.
         const held = request.agent === 'shell';
         const created = await this.tmux(newWindowArgs({
@@ -471,7 +515,7 @@ export class CodeTerminals {
         // Claude Code may ask first (not pre-trusted, or the record didn't hold), and no hook says
         // so: every new Claude window is watched, and the thread is told when it waits on it.
         if (request.agent === 'claude_code')
-            void this.watchTrustPrompt(request.codeThreadId, request.terminalId, name);
+            void this.watchTrustPrompt(request.codeThreadId, request.terminalId, name, skips);
         return { ok: true, adopted: false, reported };
     }
     /**
@@ -496,22 +540,38 @@ export class CodeTerminals {
         return trusted;
     }
     /**
-     * Watch a new Claude Code window for its trust dialog, only to tell the thread it waits on it
-     * (needs-you, not Working). It never decides whether a reply types: the ready mark does.
+     * Watch a new Claude Code window for its first-run screens, only to tell the thread it waits on
+     * one (needs-you, not Working): the folder's trust dialog, and, for a thread that skips permission
+     * prompts, Claude Code's one-time bypass warning (it comes up after the trust dialog is answered,
+     * so it is looked for longer once that was said). Each is said once. It never decides whether a
+     * reply types: the ready mark does.
      */
-    async watchTrustPrompt(codeThreadId, terminalId, name) {
-        for (let attempt = 0; attempt < (this.options.trustWatchAttempts ?? TRUST_WATCH_ATTEMPTS); attempt += 1) {
-            // A hook ran: it is past the dialog, whatever the screen shows.
+    async watchTrustPrompt(codeThreadId, terminalId, name, skips = false) {
+        const screens = [
+            { screen: TRUST_SCREEN, note: TRUST_PROMPT_NOTE, log: 'asks whether to trust its folder' },
+            ...(skips
+                ? [{ screen: BYPASS_SCREEN, note: BYPASS_PROMPT_NOTE, log: 'asks to confirm running without permission prompts' }]
+                : []),
+        ];
+        const said = new Set();
+        let attempts = this.options.trustWatchAttempts ?? TRUST_WATCH_ATTEMPTS;
+        for (let attempt = 0; attempt < attempts; attempt += 1) {
+            // A hook ran: it is past every first-run screen, whatever the screen shows.
             if (this.isReady(terminalId) !== false)
                 return;
             const pane = await this.tmux(['capture-pane', '-p', '-J', '-t', windowTarget(name)]);
             if (!pane.ok)
                 return;
-            // Re-checked after the capture: a hook that ran meanwhile means the dialog was just answered.
-            if (TRUST_SCREEN.test(pane.stdout) && this.isReady(terminalId) === false) {
-                this.log(`    ! code thread ${codeThreadId.slice(0, 12)}: Claude Code asks whether to trust its folder`);
-                await this.options.events.post(codeThreadId, event('stop', { finalText: TRUST_PROMPT_NOTE, question: true }, this.now()));
-                return;
+            const shown = screens.find((entry) => !said.has(entry.note) && entry.screen.test(pane.stdout));
+            // Re-checked after the capture: a hook that ran meanwhile means the screen was just answered.
+            if (shown && this.isReady(terminalId) === false) {
+                this.log(`    ! code thread ${codeThreadId.slice(0, 12)}: Claude Code ${shown.log}`);
+                await this.options.events.post(codeThreadId, event('stop', { finalText: shown.note, question: true }, this.now()));
+                said.add(shown.note);
+                if (said.size === screens.length)
+                    return;
+                // The next screen waits on this one's answer: look for it from now, for longer.
+                attempts = attempt + 1 + Math.max(attempts, BYPASS_WATCH_ATTEMPTS);
             }
             await this.sleep(TRUST_POLL_MS);
         }
@@ -852,17 +912,18 @@ export class CodeTerminals {
             write: (data) => {
                 if (closed || watchOnly || data.length === 0)
                     return;
-                // The person typing (or focusing this terminal) sizes the window (`sizing.ts`).
-                const claims = isHumanInput(data) || hasFocusIn(data);
                 if (held) {
                     held.push(data);
                     return;
                 }
                 // Navigation keys (arrows, paging, other escape sequences and control keys) still move
-                // through scrollback; only text leaves copy mode on its way to the agent.
-                if (!this.sizing.mayBeScrolled(name) || !(isTypedText(data) || isCopyModeExitKey(data))) {
-                    if (claims)
-                        sizer.claim();
+                // through the scrollback of the viewer who scrolled; only text leaves copy mode on its way
+                // to the agent. Anything another viewer types leaves someone else's copy mode first.
+                const scrolled = this.sizing.mayBeScrolled(name);
+                const othersScroll = scrolled && !sizer.isScroller() && isHumanInput(data);
+                if (!scrolled || (!othersScroll && !(isTypedText(data) || isCopyModeExitKey(data)))) {
+                    // Focusing this terminal sizes the window to it; typing does once the sizing viewer is idle (`sizing.ts`).
+                    noteInputTakeover(sizer, data);
                     deliver(data);
                     return;
                 }
@@ -878,14 +939,14 @@ export class CodeTerminals {
                     const left = read.ok && (!inMode || (await this.tmux(['send-keys', '-X', '-t', windowTarget(name), 'cancel'])).ok);
                     if (left)
                         this.sizing.leftCopyMode(name);
-                    sizer.claim();
+                    noteInputTakeover(sizer, data);
                     const pending = held ?? [];
                     held = undefined;
                     pending.forEach((chunk, index) => {
                         if (index === 0 && inMode && isCopyModeExitKey(chunk))
                             return;
-                        if (index > 0 && (isHumanInput(chunk) || hasFocusIn(chunk)))
-                            sizer.claim();
+                        if (index > 0)
+                            noteInputTakeover(sizer, chunk);
                         deliver(chunk);
                     });
                 })();
@@ -912,6 +973,7 @@ export class CodeTerminals {
                     sizer.claim();
             },
             onSizer: (listener) => sizer.onSizer(listener),
+            history: (lines) => closed ? Promise.resolve({ ok: false, error: 'unavailable' }) : readHistory((args) => this.tmux(args), name, lines),
         };
         return { ok: true, stream };
     }

package/dist/codehost/tmux.d.ts

@@ -138,7 +138,8 @@ export declare const APPROVAL_DECISIONS: ReadonlySet<string>;
 export declare function clampDim(raw: unknown, fallback: number): number;
 /**
  * A text control frame. Input arrives as binary or `input`; `hello` says what the viewer is and
- * `claim` asks to size the window to it (see `sizing.ts`). Anything else is ignored.
+ * `claim` asks to size the window to it (see `sizing.ts`); `history` asks for the pane's
+ * scroll-back as text (`history.ts`). Anything else is ignored.
  */
 export type ControlFrame = {
     type: 'resize';
@@ -152,6 +153,10 @@ export type ControlFrame = {
     client: ViewerClient;
 } | {
     type: 'claim';
+} | {
+    type: 'history';
+    id: string;
+    lines: number;
 } | {
     type: 'ping';
 } | {

package/dist/codehost/tmux.js

@@ -19,6 +19,7 @@
  * window options set at creation.
  */
 import crypto from 'node:crypto';
+import { parseHistoryRequest } from './history.js';
 import { parseViewerClient } from './sizing.js';
 /** Prefix of `tmux -L <socket>`: this host's private tmux server (one per `$PROHOST_HOME`). */
 export const TMUX_SOCKET_PREFIX = 'prohost';
@@ -292,6 +293,8 @@ export function parseControl(text) {
         return { type: 'hello', client: parseViewerClient(f.client) };
     if (f.type === 'claim')
         return { type: 'claim' };
+    if (f.type === 'history')
+        return parseHistoryRequest(f);
     if (f.type === 'ping' || f.type === 'pong')
         return { type: f.type };
     return null;

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.14.0";
+export declare const CLI_VERSION = "0.15.0";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.14.0";
+export declare const USER_AGENT = "prohost-cli/0.15.0";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.14.0';
+export const CLI_VERSION = '0.15.0';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",