@prohost/cli 0.14.0 → 0.16.0

package/dist/codehost/relay.js

@@ -22,6 +22,7 @@ import { randomBytes } from 'node:crypto';
 import WebSocket from 'ws';
 import { endpointProblem } from '../agent/base-url.js';
 import { USER_AGENT } from '../version.js';
+import { historyFrame } from './history.js';
 import { isValidId, parseControl, TERMINAL_WINDOWS } from './tmux.js';
 export const CONTROL_PATH = '/v1/code-hosts/control';
 export const STREAM_PATH = '/v1/code-hosts/stream';
@@ -77,9 +78,52 @@ export function parseDial(frame) {
         mode: frame.mode === 'watch' ? 'watch' : 'type',
     };
 }
-/** Pipe one terminal stream over one open socket until either side ends. */
+/**
+ * Pipe one terminal stream over one open socket until either side ends.
+ *
+ * Text controls in: `resize`, `input`, `hello`, `claim`, `history` (answered with the pane's
+ * scroll-back, only once the viewer said hello: an older page never sees one), `ping`.
+ */
 export function pipeStream(ws, stream, onClosed) {
     let done = false;
+    let greeted = false;
+    /** One capture at a time per viewer: a burst of asks is answered by the one after the last. */
+    let reading;
+    let queued;
+    const sendText = (frame) => {
+        if (done || ws.readyState !== WebSocket.OPEN)
+            return;
+        if (ws.bufferedAmount > MAX_STREAM_BUFFERED_BYTES) {
+            finish('slow_consumer');
+            return;
+        }
+        try {
+            ws.send(JSON.stringify(frame));
+        }
+        catch {
+            /* closing anyway */
+        }
+    };
+    const answerHistory = (request) => {
+        if (reading) {
+            // An ask still waiting is superseded: the viewer only uses the latest answer.
+            if (queued)
+                sendText({ type: 'history', id: queued.id, error: 'unavailable' });
+            queued = request;
+            return;
+        }
+        const read = stream.history
+            ? stream.history(request.lines).catch(() => ({ ok: false, error: 'capture_failed' }))
+            : Promise.resolve({ ok: false, error: 'unavailable' });
+        reading = read.then((result) => {
+            sendText(historyFrame(request.id, result));
+            reading = undefined;
+            const next = queued;
+            queued = undefined;
+            if (next && !done)
+                answerHistory(next);
+        });
+    };
     const finish = (reason) => {
         if (done)
             return;
@@ -128,10 +172,16 @@ export function pipeStream(ws, stream, onClosed) {
             stream.resize(control.cols, control.rows);
         else if (control.type === 'input')
             stream.write(Buffer.from(control.data, 'utf8'));
-        else if (control.type === 'hello')
+        else if (control.type === 'hello') {
+            greeted = true;
             stream.hello?.(control.client);
+        }
         else if (control.type === 'claim')
             stream.claim?.();
+        else if (control.type === 'history') {
+            if (greeted)
+                answerHistory(control);
+        }
         else if (control.type === 'ping')
             ws.send(JSON.stringify({ type: 'pong' }));
     });
@@ -206,6 +256,8 @@ export class CodeHostRelay {
     /** Bumped by {@link dropStreams}: a dial begun before a drop never opens. */
     generation = 0;
     refused;
+    /** Authenticating with {@link CodeHostRelayOptions.fallbackApiKey} after `apiKey` was refused. */
+    usingFallback = false;
     log;
     Ctor;
     setTimer;
@@ -366,7 +418,7 @@ export class CodeHostRelay {
                 try {
                     ws.send(JSON.stringify({
                         type: 'auth',
-                        api_key: this.options.apiKey,
+                        api_key: this.usingFallback ? this.options.fallbackApiKey : this.options.apiKey,
                         machine_id: this.options.machineId,
                         ...(this.options.instanceId ? { instance_id: this.options.instanceId } : {}),
                         machine: this.options.machine,
@@ -431,6 +483,15 @@ export class CodeHostRelay {
             }
             case 'auth_error': {
                 const reason = String(frame.reason ?? 'unknown');
+                // Only "a valid key, but not a pairing this server knows" — a server from
+                // before computer keys. A revoked or invalid key never falls back.
+                if (!this.usingFallback && this.options.fallbackApiKey && reason === 'not_paired') {
+                    // This server doesn't take the first key here: try the second at once.
+                    this.usingFallback = true;
+                    this.log(`    … code-host relay refused the computer key (${reason}); using the adopted agent key`);
+                    ws.close();
+                    return;
+                }
                 if (this.refused !== reason)
                     this.log(`    ✗ code-host relay refused this machine: ${reason}`);
                 this.refused = reason;
@@ -483,6 +544,11 @@ export class CodeHostRelay {
             this.dialError(dial.streamId, 'remote_terminal_disabled');
             return;
         }
+        if (this.options.dialsPaused?.()) {
+            // The relay's own word for "not now" (it knows no other).
+            this.dialError(dial.streamId, 'remote_terminal_disabled');
+            return;
+        }
         const url = relayUrl(this.options.baseUrl, STREAM_PATH);
         if (!url)
             return;

package/dist/codehost/sizing.d.ts

@@ -8,9 +8,13 @@
  * option, which tmux 3.4 can't start with), from its creation on, and this module picks one viewer
  * per window to size it to (the approved policy, CONTRACTS C3):
  *
- * - a viewer that attaches, types, sends `{"type":"claim"}` (a phone on ready / foreground / touch,
- *   the desktop's "Use this window's size"), or reports focus (`ESC [ I`) takes it — never a
- *   `watch` viewer, which can't type (it sizes a window only nobody else shows);
+ * - a viewer that attaches, sends `{"type":"claim"}` (a phone on ready / foreground / touch / before
+ *   it types, the desktop's "Use this window's size"), or reports focus (`ESC [ I`: its window came
+ *   to the front) takes it — never a `watch` viewer, which can't type (it sizes a window only
+ *   nobody else shows);
+ * - typing alone takes it only from a sizing viewer idle {@link IDLE_TAKEOVER_MS} (CONTRACTS-R2
+ *   R2): two viewers typing in turn no longer resize the window, and redraw Claude Code's whole
+ *   transcript, on every keystroke;
  * - when the sizing viewer leaves, the one active most recently among those left takes over;
  * - a handover or resize reaches tmux once it has been quiet {@link HANDOVER_DEBOUNCE_MS}, and only
  *   when the size changes: Claude Code reprints its whole transcript on every width change.
@@ -60,6 +64,8 @@ export declare const HANDOVER_DEBOUNCE_MS = 300;
 export declare const MODE_CHECK_MS = 150;
 /** A held shell nobody attached to starts anyway after this long. */
 export declare const HOLD_FALLBACK_MS = 60000;
+/** Typing takes the window's size from a sizing viewer that hasn't typed or claimed for this long. */
+export declare const IDLE_TAKEOVER_MS = 30000;
 export declare function holdChannel(name: string): string;
 /**
  * `command`, run once the window's hold is released. Waits on the tmux server the pane runs in
@@ -93,14 +99,21 @@ export interface TerminalSizingOptions {
 export interface SizingViewer {
     hello(client: ViewerClient): void;
     resize(cols: number, rows: number): void;
-    /** Size the window to this viewer now: it typed, focused, or asked. A `watch` viewer's is ignored. */
+    /** Size the window to this viewer now: it attached, focused, or asked. A `watch` viewer's is ignored. */
     claim(): void;
+    /**
+     * This viewer typed: it sizes the window only if nobody else does, or the one who does has been
+     * idle {@link IDLE_TAKEOVER_MS}. A `watch` viewer's is ignored.
+     */
+    typed(): void;
     /**
      * This viewer's input may have changed the pane's copy mode. `moved`: it can move copy mode (a
      * wheel step, a drag, the prefix key, a keystroke), so this viewer is now who scrolled; else
      * (an emulator report) the mode is only read again.
      */
     scrolled(moved?: boolean): void;
+    /** This viewer's input is what scrolled the pane back (it may move through its own copy mode). */
+    isScroller(): boolean;
     leave(): void;
     onSizer(listener: (frame: SizerFrame) => void): void;
 }
@@ -161,3 +174,8 @@ export declare class TerminalSizing {
     private settle;
     private release;
 }
+/**
+ * What a chunk of a viewer's input says about who sizes the window: a focus-in report (its window
+ * came to the front) claims it; anything a person typed only takes it from an idle sizing viewer.
+ */
+export declare function noteInputTakeover(viewer: Pick<SizingViewer, 'claim' | 'typed'>, data: Uint8Array): void;

package/dist/codehost/sizing.js

@@ -8,9 +8,13 @@
  * option, which tmux 3.4 can't start with), from its creation on, and this module picks one viewer
  * per window to size it to (the approved policy, CONTRACTS C3):
  *
- * - a viewer that attaches, types, sends `{"type":"claim"}` (a phone on ready / foreground / touch,
- *   the desktop's "Use this window's size"), or reports focus (`ESC [ I`) takes it — never a
- *   `watch` viewer, which can't type (it sizes a window only nobody else shows);
+ * - a viewer that attaches, sends `{"type":"claim"}` (a phone on ready / foreground / touch / before
+ *   it types, the desktop's "Use this window's size"), or reports focus (`ESC [ I`: its window came
+ *   to the front) takes it — never a `watch` viewer, which can't type (it sizes a window only
+ *   nobody else shows);
+ * - typing alone takes it only from a sizing viewer idle {@link IDLE_TAKEOVER_MS} (CONTRACTS-R2
+ *   R2): two viewers typing in turn no longer resize the window, and redraw Claude Code's whole
+ *   transcript, on every keystroke;
  * - when the sizing viewer leaves, the one active most recently among those left takes over;
  * - a handover or resize reaches tmux once it has been quiet {@link HANDOVER_DEBOUNCE_MS}, and only
  *   when the size changes: Claude Code reprints its whole transcript on every width change.
@@ -28,7 +32,7 @@
  * page's fit showed one prompt per resize. A held window runs `tmux wait-for <channel>` before its
  * shell (see {@link holdCommand}); the first viewer's resizes going quiet signals it.
  */
-import { leaveCopyModeArgs, paneInModeArgs, windowTarget } from './tmux.js';
+import { hasFocusIn, isHumanInput, leaveCopyModeArgs, paneInModeArgs, windowTarget } from './tmux.js';
 export const VIEWER_KINDS = new Set(['phone', 'tablet', 'desktop']);
 const MAX_LABEL_CHARS = 40;
 /** A `hello` frame's `client`, made safe to repeat to another viewer. */
@@ -53,6 +57,8 @@ export const HANDOVER_DEBOUNCE_MS = 300;
 export const MODE_CHECK_MS = 150;
 /** A held shell nobody attached to starts anyway after this long. */
 export const HOLD_FALLBACK_MS = 60_000;
+/** Typing takes the window's size from a sizing viewer that hasn't typed or claimed for this long. */
+export const IDLE_TAKEOVER_MS = 30_000;
 export function holdChannel(name) {
     return `prohost-hold-${name}`;
 }
@@ -171,7 +177,14 @@ export class TerminalSizing {
     }
     join(name, size) {
         const state = this.state(name);
-        const viewer = { id: this.nextId++, cols: size.cols, rows: size.rows, watch: size.watch === true, activeAt: ++this.seq };
+        const viewer = {
+            id: this.nextId++,
+            cols: size.cols,
+            rows: size.rows,
+            watch: size.watch === true,
+            activeAt: ++this.seq,
+            inputAt: this.now(),
+        };
         state.viewers.set(viewer.id, viewer);
         // Attaching claims the size, as tmux did (`window-size latest`): a watch viewer only a window
         // nobody else shows.
@@ -208,7 +221,23 @@ export class TerminalSizing {
                     this.settle(name, state);
             },
             claim: () => {
-                if (left || state.owner === viewer.id || viewer.watch)
+                if (left || viewer.watch)
+                    return;
+                viewer.inputAt = this.now();
+                if (state.owner === viewer.id)
+                    return;
+                this.handOver(name, state, viewer);
+            },
+            typed: () => {
+                if (left || viewer.watch)
+                    return;
+                const now = this.now();
+                viewer.inputAt = now;
+                if (state.owner === viewer.id)
+                    return;
+                const owner = state.owner === undefined ? undefined : state.viewers.get(state.owner);
+                // The sizing viewer is at it too: its size stays until it goes quiet, or this one asks.
+                if (owner && now - owner.inputAt < IDLE_TAKEOVER_MS)
                     return;
                 this.handOver(name, state, viewer);
             },
@@ -221,6 +250,7 @@ export class TerminalSizing {
                 }
                 this.checkMode(name, state);
             },
+            isScroller: () => !left && state.scroller === viewer.id,
             leave: () => {
                 if (left)
                     return;
@@ -392,3 +422,13 @@ export class TerminalSizing {
         await this.options.tmux(releaseHoldArgs(name));
     }
 }
+/**
+ * What a chunk of a viewer's input says about who sizes the window: a focus-in report (its window
+ * came to the front) claims it; anything a person typed only takes it from an idle sizing viewer.
+ */
+export function noteInputTakeover(viewer, data) {
+    if (hasFocusIn(data))
+        viewer.claim();
+    else if (isHumanInput(data))
+        viewer.typed();
+}

package/dist/codehost/terminals.d.ts

@@ -23,6 +23,7 @@ import { execFile } from 'node:child_process';
 import type { InstalledAgent } from './agents.js';
 import type { CheckoutResult } from './checkouts.js';
 import type { CodeThreadEventSink } from './events.js';
+import type { HistoryResult } from './history.js';
 import type { PtySpawn } from './pty.js';
 import { TerminalSizing } from './sizing.js';
 import type { SizerFrame, ViewerClient } from './sizing.js';
@@ -79,6 +80,11 @@ export interface StartRequest {
     folder?: string;
     /** With {@link folder}: a worktree and branch of the folder's git checkout instead of in place. */
     separateCopy?: boolean;
+    /**
+     * Claude Code / Codex start without their permission prompts (see {@link agentCommandLine}):
+     * nothing asks, so no `permission_request` reaches the inbox. Absent (an older server): they ask.
+     */
+    skipPermissions?: boolean;
 }
 /**
  * Why `input` did not get a reply through, when the server should hear it (it
@@ -144,6 +150,8 @@ export interface TerminalStream {
     claim?(): void;
     /** Who sizes the window, for a viewer that said hello. */
     onSizer?(listener: (frame: SizerFrame) => void): void;
+    /** The pane's last `lines` of history and its screen, as text with colours (`history.ts`). */
+    history?(lines: number): Promise<HistoryResult>;
 }
 export type AttachResult = {
     ok: true;
@@ -175,13 +183,28 @@ export type StartResult = {
  * at all (0, 408, 429, 5xx) it is retried.
  */
 export declare function isDefinitive(status: number): boolean;
+/** Claude Code's flag for a thread started with `skipPermissions`: no permission prompt, ever. */
+export declare const CLAUDE_SKIP_PERMISSIONS_FLAG = "--dangerously-skip-permissions";
+/**
+ * Codex's (`codex --help`, 0.146): no approval prompt and no sandbox, as Claude Code's flag. Its
+ * `-a never` alone would keep the sandbox, where a command needing the network fails instead of asking.
+ */
+export declare const CODEX_SKIP_PERMISSIONS_FLAG = "--dangerously-bypass-approvals-and-sandbox";
 /** The shell command line a thread's agent window runs. */
 export declare function agentCommandLine(agent: CodeAgent, options: {
     claudeSettings: string;
     claudeInvocationSettings?: string;
+    /**
+     * With {@link skipPermissions}: the same `--settings` documents that also record the owner's
+     * acceptance of Claude Code's bypass-mode warning (`hooks.ts`); without them that warning shows.
+     */
+    claudeSkipSettings?: string;
+    claudeInvocationSkipSettings?: string;
     hookShim?: string;
     codexNotify: string;
     hasGoal: boolean;
+    /** Start the agent without its permission prompts (a shell has none). */
+    skipPermissions?: boolean;
 }): string;
 export interface CodeTerminalsOptions {
     /** `$PROHOST_HOME` for this host; exported to every window. */
@@ -204,6 +227,9 @@ export interface CodeTerminalsOptions {
     hookFiles: {
         claudeSettings: string;
         claudeInvocationSettings?: string;
+        /** The skip-prompts twins of the two documents above (see {@link agentCommandLine}). */
+        claudeSkipSettings?: string;
+        claudeInvocationSkipSettings?: string;
         hookShim?: string;
         codexNotify: string;
     };
@@ -253,6 +279,8 @@ export interface CodeTerminalsOptions {
 }
 /** What the thread says while Claude Code waits on its trust dialog. */
 export declare const TRUST_PROMPT_NOTE = "Claude Code is asking whether to trust this folder before it starts. Answer in the terminal.";
+/** What the thread says while Claude Code waits on that warning. */
+export declare const BYPASS_PROMPT_NOTE = "Claude Code asks once to confirm it may run commands without asking. Answer in the terminal.";
 export declare class CodeTerminals {
     private readonly options;
     private readonly records;
@@ -343,8 +371,11 @@ export declare class CodeTerminals {
      */
     private trustOwnWorktree;
     /**
-     * Watch a new Claude Code window for its trust dialog, only to tell the thread it waits on it
-     * (needs-you, not Working). It never decides whether a reply types: the ready mark does.
+     * Watch a new Claude Code window for its first-run screens, only to tell the thread it waits on
+     * one (needs-you, not Working): the folder's trust dialog, and, for a thread that skips permission
+     * prompts, Claude Code's one-time bypass warning (it comes up after the trust dialog is answered,
+     * so it is looked for longer once that was said). Each is said once. It never decides whether a
+     * reply types: the ready mark does.
      */
     private watchTrustPrompt;
     private known;

package/dist/codehost/terminals.js

@@ -29,11 +29,13 @@ import { markTurn } from './activity.js';
 import { missingAgentReason } from './agents.js';
 import { claudeConfigDir, claudeTrusts, trustClaudeWorkspace } from './claude_trust.js';
 import { event } from './events.js';
+import { readHistory } from './history.js';
 import { CODE_THREAD_ID_ENV, TERMINAL_ID_ENV } from './hooks.js';
 import { MAX_OPEN_PTYS } from './pty.js';
 import { claudeSessionSince, isReady, markReady } from './ready.js';
 import { defaultSizeArgs, HOLD_OPTION, holdChannel, holdCommand, resizeWindowArgs, TerminalSizing } from './sizing.js';
-import { attachArgs, baseArgs, clampDim, DEFAULT_COLS, DEFAULT_ROWS, hasFocusIn, hasSessionArgs, isCopyModeExitKey, isHumanInput, isTypedText, isInterruptInput, isScrollGesture, leaveCopyModeArgs, mayEnterCopyMode, paneInModeArgs, isValidId, killSessionArgs, listWindowsArgs, newSessionArgs, newWindowArgs, parseListWindows, sendTextCommands, setWindowMetaArgs, TERMINAL_WINDOWS, DAEMON_ONLY_ENV, paneEnv, viewSessionName, windowName, windowTarget, } from './tmux.js';
+import { noteInputTakeover } from './sizing.js';
+import { attachArgs, baseArgs, clampDim, DEFAULT_COLS, DEFAULT_ROWS, hasSessionArgs, isCopyModeExitKey, isHumanInput, isTypedText, isInterruptInput, isScrollGesture, leaveCopyModeArgs, mayEnterCopyMode, paneInModeArgs, isValidId, killSessionArgs, listWindowsArgs, newSessionArgs, newWindowArgs, parseListWindows, sendTextCommands, setWindowMetaArgs, TERMINAL_WINDOWS, DAEMON_ONLY_ENV, paneEnv, viewSessionName, windowName, windowTarget, } from './tmux.js';
 export const CODE_AGENTS = ['claude_code', 'codex', 'shell'];
 export const GOAL_ENV = 'PROHOST_CODE_THREAD_GOAL';
 /** Window option set when the agent exits and its window becomes a shell. */
@@ -60,7 +62,8 @@ const PASTE_SETTLE_MS = 150;
 export function execTmux(binary = 'tmux') {
     return (args, stdin, timeoutMs = 10_000) => new Promise((resolve) => {
         // The first call starts the server, whose panes inherit this env.
-        const options = { timeout: timeoutMs, maxBuffer: 1024 * 1024, env: paneEnv(process.env) };
+        // Room for a viewer's scroll-back (`capture-pane`, up to 10,000 lines with their colours).
+        const options = { timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024, env: paneEnv(process.env) };
         const child = execFile(binary, args, options, (error, stdout, stderr) => {
             resolve({
                 ok: error === null,
@@ -86,12 +89,20 @@ export function isDefinitive(status) {
         return true;
     return status >= 400 && status < 500 && ![401, 403, 408, 429].includes(status);
 }
+/** Claude Code's flag for a thread started with `skipPermissions`: no permission prompt, ever. */
+export const CLAUDE_SKIP_PERMISSIONS_FLAG = '--dangerously-skip-permissions';
+/**
+ * Codex's (`codex --help`, 0.146): no approval prompt and no sandbox, as Claude Code's flag. Its
+ * `-a never` alone would keep the sandbox, where a command needing the network fails instead of asking.
+ */
+export const CODEX_SKIP_PERMISSIONS_FLAG = '--dangerously-bypass-approvals-and-sandbox';
 /** The shell command line a thread's agent window runs. */
 export function agentCommandLine(agent, options) {
     // `--` first: a goal is the agent's prompt, never an option, however it
     // starts (`--dangerously-skip-permissions`, or a word Codex would read as a
     // subcommand).
     const goal = options.hasGoal ? ` -- "$${GOAL_ENV}"` : '';
+    const skip = options.skipPermissions === true;
     const shell = 'exec "${SHELL:-/bin/zsh}" -l';
     if (agent === 'shell')
         return shell;
@@ -101,22 +112,52 @@ export function agentCommandLine(agent, options) {
     // (`input` and `approve` refuse a window carrying the mark).
     const after = `tmux set-option -w ${EXITED_OPTION} 1 2>/dev/null; ` +
         `printf '\\n[${label} exited — this window is now a shell in the thread worktree]\\n'; ${shell}`;
-    if (agent === 'codex')
-        return `codex -c ${shellQuote(options.codexNotify, 'darwin')}${goal}; ${after}`;
-    if (options.claudeInvocationSettings && options.hookShim) {
+    if (agent === 'codex') {
+        const flags = skip ? ` ${CODEX_SKIP_PERMISSIONS_FLAG}` : '';
+        return `codex${flags} -c ${shellQuote(options.codexNotify, 'darwin')}${goal}; ${after}`;
+    }
+    const claude = `command claude${skip ? ` ${CLAUDE_SKIP_PERMISSIONS_FLAG}` : ''} --settings`;
+    // A window that skips prompts reads the documents that also accept Claude Code's bypass warning.
+    const settings = (skip && options.claudeSkipSettings) || options.claudeSettings;
+    const invocationSettings = (skip && options.claudeInvocationSkipSettings) || options.claudeInvocationSettings;
+    if (invocationSettings && options.hookShim) {
         const check = `${shellQuote(options.hookShim, 'darwin')} claude CheckInvocationProtocol`;
-        return `if ${check}; then PROHOST_INVOCATION_PROTOCOL=1 command claude --settings ${shellQuote(options.claudeInvocationSettings, 'darwin')}${goal}; ` +
-            `else PROHOST_INVOCATION_PROTOCOL=0 command claude --settings ${shellQuote(options.claudeSettings, 'darwin')}${goal}; fi; ${after}`;
+        return `if ${check}; then PROHOST_INVOCATION_PROTOCOL=1 ${claude} ${shellQuote(invocationSettings, 'darwin')}${goal}; ` +
+            `else PROHOST_INVOCATION_PROTOCOL=0 ${claude} ${shellQuote(settings, 'darwin')}${goal}; fi; ${after}`;
     }
-    return `PROHOST_INVOCATION_PROTOCOL=0 command claude --settings ${shellQuote(options.claudeSettings, 'darwin')}${goal}; ${after}`;
+    return `PROHOST_INVOCATION_PROTOCOL=0 ${claude} ${shellQuote(settings, 'darwin')}${goal}; ${after}`;
+}
+/**
+ * A phrase as a first-run screen shows it: Claude Code wraps its own text inside a bordered box (a
+ * narrow window breaks it anywhere, and `capture-pane -J` joins only tmux's wraps), so words may be
+ * apart by any whitespace or the box's border.
+ */
+function screenPhrase(...phrases) {
+    const gap = String.raw `[\s│┃|]+`;
+    const escape = (word) => word.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(phrases.map((phrase) => phrase.split(' ').map(escape).join(gap)).join('|'), 'i');
 }
 /** Claude Code's workspace trust dialog, as its first screen shows it. */
-const TRUST_SCREEN = /Is this a project you created or one you trust|Do you trust the files in this folder/i;
+const TRUST_SCREEN = screenPhrase('Is this a project you created or one you trust', 'Do you trust the files in this folder');
 /** How many times after launch the host looks for that dialog, and how far apart. */
 const TRUST_WATCH_ATTEMPTS = 30;
+/**
+ * A thread that skips prompts, once the trust dialog was said: how long (polls) it still looks for
+ * the bypass warning, which comes up only after that dialog is answered, however long that takes.
+ */
+const BYPASS_WATCH_ATTEMPTS = 600;
 const TRUST_POLL_MS = 1_000;
 /** What the thread says while Claude Code waits on its trust dialog. */
 export const TRUST_PROMPT_NOTE = 'Claude Code is asking whether to trust this folder before it starts. Answer in the terminal.';
+/**
+ * Claude Code's one-time warning before its first `--dangerously-skip-permissions` run on a login
+ * that never accepted it. A skipping window's `--settings` document accepts it (`hooks.ts`,
+ * `skipDangerousModePermissionPrompt`); this is the fallback for a Claude Code that shows it anyway:
+ * the thread says it waits on the person.
+ */
+const BYPASS_SCREEN = screenPhrase('In Bypass Permissions mode, Claude Code will not ask');
+/** What the thread says while Claude Code waits on that warning. */
+export const BYPASS_PROMPT_NOTE = 'Claude Code asks once to confirm it may run commands without asking. Answer in the terminal.';
 /**
  * The environment a Code thread's Claude Code starts with, beyond its account's:
  * no Claude in Chrome. A thread runs where nobody may be watching, and the
@@ -428,7 +469,10 @@ export class CodeTerminals {
         // to), not tmux's 80x24: every resize after it makes a shell redraw its prompt, and a TUI its screen.
         const size = this.sizing.lastSize();
         await this.tmux(defaultSizeArgs(size.cols, size.rows));
-        const command = agentCommandLine(request.agent, { ...this.options.hookFiles, hasGoal: goal.length > 0 });
+        // Never with remote control off: then nothing from ProhostAI may run a command here unasked
+        // (a goal is the agent's first instruction). The server only asks; the Mac decides.
+        const skips = request.skipPermissions === true && request.agent !== 'shell' && this.canType();
+        const command = agentCommandLine(request.agent, { ...this.options.hookFiles, hasGoal: goal.length > 0, skipPermissions: skips });
         // A shell thread's shell waits for its first viewer's size to settle (`sizing.ts`): one prompt.
         const held = request.agent === 'shell';
         const created = await this.tmux(newWindowArgs({
@@ -471,7 +515,7 @@ export class CodeTerminals {
         // Claude Code may ask first (not pre-trusted, or the record didn't hold), and no hook says
         // so: every new Claude window is watched, and the thread is told when it waits on it.
         if (request.agent === 'claude_code')
-            void this.watchTrustPrompt(request.codeThreadId, request.terminalId, name);
+            void this.watchTrustPrompt(request.codeThreadId, request.terminalId, name, skips);
         return { ok: true, adopted: false, reported };
     }
     /**
@@ -496,22 +540,38 @@ export class CodeTerminals {
         return trusted;
     }
     /**
-     * Watch a new Claude Code window for its trust dialog, only to tell the thread it waits on it
-     * (needs-you, not Working). It never decides whether a reply types: the ready mark does.
+     * Watch a new Claude Code window for its first-run screens, only to tell the thread it waits on
+     * one (needs-you, not Working): the folder's trust dialog, and, for a thread that skips permission
+     * prompts, Claude Code's one-time bypass warning (it comes up after the trust dialog is answered,
+     * so it is looked for longer once that was said). Each is said once. It never decides whether a
+     * reply types: the ready mark does.
      */
-    async watchTrustPrompt(codeThreadId, terminalId, name) {
-        for (let attempt = 0; attempt < (this.options.trustWatchAttempts ?? TRUST_WATCH_ATTEMPTS); attempt += 1) {
-            // A hook ran: it is past the dialog, whatever the screen shows.
+    async watchTrustPrompt(codeThreadId, terminalId, name, skips = false) {
+        const screens = [
+            { screen: TRUST_SCREEN, note: TRUST_PROMPT_NOTE, log: 'asks whether to trust its folder' },
+            ...(skips
+                ? [{ screen: BYPASS_SCREEN, note: BYPASS_PROMPT_NOTE, log: 'asks to confirm running without permission prompts' }]
+                : []),
+        ];
+        const said = new Set();
+        let attempts = this.options.trustWatchAttempts ?? TRUST_WATCH_ATTEMPTS;
+        for (let attempt = 0; attempt < attempts; attempt += 1) {
+            // A hook ran: it is past every first-run screen, whatever the screen shows.
             if (this.isReady(terminalId) !== false)
                 return;
             const pane = await this.tmux(['capture-pane', '-p', '-J', '-t', windowTarget(name)]);
             if (!pane.ok)
                 return;
-            // Re-checked after the capture: a hook that ran meanwhile means the dialog was just answered.
-            if (TRUST_SCREEN.test(pane.stdout) && this.isReady(terminalId) === false) {
-                this.log(`    ! code thread ${codeThreadId.slice(0, 12)}: Claude Code asks whether to trust its folder`);
-                await this.options.events.post(codeThreadId, event('stop', { finalText: TRUST_PROMPT_NOTE, question: true }, this.now()));
-                return;
+            const shown = screens.find((entry) => !said.has(entry.note) && entry.screen.test(pane.stdout));
+            // Re-checked after the capture: a hook that ran meanwhile means the screen was just answered.
+            if (shown && this.isReady(terminalId) === false) {
+                this.log(`    ! code thread ${codeThreadId.slice(0, 12)}: Claude Code ${shown.log}`);
+                await this.options.events.post(codeThreadId, event('stop', { finalText: shown.note, question: true }, this.now()));
+                said.add(shown.note);
+                if (said.size === screens.length)
+                    return;
+                // The next screen waits on this one's answer: look for it from now, for longer.
+                attempts = attempt + 1 + Math.max(attempts, BYPASS_WATCH_ATTEMPTS);
             }
             await this.sleep(TRUST_POLL_MS);
         }
@@ -852,17 +912,18 @@ export class CodeTerminals {
             write: (data) => {
                 if (closed || watchOnly || data.length === 0)
                     return;
-                // The person typing (or focusing this terminal) sizes the window (`sizing.ts`).
-                const claims = isHumanInput(data) || hasFocusIn(data);
                 if (held) {
                     held.push(data);
                     return;
                 }
                 // Navigation keys (arrows, paging, other escape sequences and control keys) still move
-                // through scrollback; only text leaves copy mode on its way to the agent.
-                if (!this.sizing.mayBeScrolled(name) || !(isTypedText(data) || isCopyModeExitKey(data))) {
-                    if (claims)
-                        sizer.claim();
+                // through the scrollback of the viewer who scrolled; only text leaves copy mode on its way
+                // to the agent. Anything another viewer types leaves someone else's copy mode first.
+                const scrolled = this.sizing.mayBeScrolled(name);
+                const othersScroll = scrolled && !sizer.isScroller() && isHumanInput(data);
+                if (!scrolled || (!othersScroll && !(isTypedText(data) || isCopyModeExitKey(data)))) {
+                    // Focusing this terminal sizes the window to it; typing does once the sizing viewer is idle (`sizing.ts`).
+                    noteInputTakeover(sizer, data);
                     deliver(data);
                     return;
                 }
@@ -878,14 +939,14 @@ export class CodeTerminals {
                     const left = read.ok && (!inMode || (await this.tmux(['send-keys', '-X', '-t', windowTarget(name), 'cancel'])).ok);
                     if (left)
                         this.sizing.leftCopyMode(name);
-                    sizer.claim();
+                    noteInputTakeover(sizer, data);
                     const pending = held ?? [];
                     held = undefined;
                     pending.forEach((chunk, index) => {
                         if (index === 0 && inMode && isCopyModeExitKey(chunk))
                             return;
-                        if (index > 0 && (isHumanInput(chunk) || hasFocusIn(chunk)))
-                            sizer.claim();
+                        if (index > 0)
+                            noteInputTakeover(sizer, chunk);
                         deliver(chunk);
                     });
                 })();
@@ -912,6 +973,7 @@ export class CodeTerminals {
                     sizer.claim();
             },
             onSizer: (listener) => sizer.onSizer(listener),
+            history: (lines) => closed ? Promise.resolve({ ok: false, error: 'unavailable' }) : readHistory((args) => this.tmux(args), name, lines),
         };
         return { ok: true, stream };
     }

package/dist/codehost/tmux.d.ts

@@ -138,7 +138,8 @@ export declare const APPROVAL_DECISIONS: ReadonlySet<string>;
 export declare function clampDim(raw: unknown, fallback: number): number;
 /**
  * A text control frame. Input arrives as binary or `input`; `hello` says what the viewer is and
- * `claim` asks to size the window to it (see `sizing.ts`). Anything else is ignored.
+ * `claim` asks to size the window to it (see `sizing.ts`); `history` asks for the pane's
+ * scroll-back as text (`history.ts`). Anything else is ignored.
  */
 export type ControlFrame = {
     type: 'resize';
@@ -152,6 +153,10 @@ export type ControlFrame = {
     client: ViewerClient;
 } | {
     type: 'claim';
+} | {
+    type: 'history';
+    id: string;
+    lines: number;
 } | {
     type: 'ping';
 } | {

package/dist/codehost/tmux.js

@@ -19,6 +19,7 @@
  * window options set at creation.
  */
 import crypto from 'node:crypto';
+import { parseHistoryRequest } from './history.js';
 import { parseViewerClient } from './sizing.js';
 /** Prefix of `tmux -L <socket>`: this host's private tmux server (one per `$PROHOST_HOME`). */
 export const TMUX_SOCKET_PREFIX = 'prohost';
@@ -292,6 +293,8 @@ export function parseControl(text) {
         return { type: 'hello', client: parseViewerClient(f.client) };
     if (f.type === 'claim')
         return { type: 'claim' };
+    if (f.type === 'history')
+        return parseHistoryRequest(f);
     if (f.type === 'ping' || f.type === 'pong')
         return { type: f.type };
     return null;