@songsid/agend 2.3.4-beta.3 → 2.3.4-beta.4

package/dist/ui/shared/panel-view.js

@@ -26,7 +26,7 @@ import { viewStore } from "./view-roster-store.js";
 /** #1580: the app's stream says the fleet is not answering (a restart): the View's polls skip their turn until it is. */
 const fleetUnreachable = () => appStore.get().connection === "reconnecting";
 import { navigate } from "./app-nav.js";
-import { viewPath } from "./app-route.js";
+import { logPath, sectionPath, viewPath } from "./app-route.js";
 import { Dialog } from "./ui-dialog.js";
 import { Empty, ErrorState, Skeleton } from "./ui-states.js";
 import { Icon } from "./ui-icons.js";
@@ -198,8 +198,8 @@ export function ViewPanel({ route, navKey }) {
   else if (!it) body = html`<div data-trust="panel-content" class="panel-body center"><${Empty} icon="alert" title=${tn("notFound", { name })} hint=${tn("notFoundHint")} /></div>`;
   else if (guest && !trusted) body = html`<div data-trust="panel-content" class="panel-body center"><${Empty} icon="view" title=${tn("guestNeedsTrusted")} hint=${tn("guestNeedsTrustedHint")} /></div>`;
   else if (guest) body = html`<p data-trust="panel-content" class="v-watching" role="note">${tn("guestWatching")}</p>
-    <${Terminal} key=${name} name=${name} lease=${lease} density=${density} every=${GUEST_PANE_MS} />`;
-  else body = html`<${Terminal} key=${name} name=${name} lease=${lease} density=${density} />
+    <${Terminal} key=${name} name=${name} lease=${lease} density=${density} every=${GUEST_PANE_MS} backend=${it.backend || ""} signedIn=${false} />`;
+  else body = html`<${Terminal} key=${name} name=${name} lease=${lease} density=${density} backend=${it.backend || ""} signedIn=${!viewOnly} />
     <${ViewIdentity} it=${it} viewOnly=${viewOnly} onEdit=${() => setDialog("edit")} />`;
 
   return html`<div data-effect-panel="view" class="panel p-view">
@@ -214,11 +214,73 @@ export function ViewPanel({ route, navKey }) {
 
 /** #2855: how often a guest's View reads the pane (the server allows it two reads a second). */
 const GUEST_PANE_MS = 1000;
-/** The live terminal: the pane every 800 ms (passive), drawn as escaped markup, its font fitted to the pane's grid. */
-function Terminal({ name, lease, density, every = 800 }) {
+/**
+ * The live terminal: the pane every 800 ms (passive), drawn as escaped markup, its font fitted to the pane's grid.
+ *
+ * M-2262 (the user, hmsg-435f6df6): scrolling back. Following (the default), it shows the pane's screen as it is now.
+ * Scrolling up — the wheel, a touch drag, PageUp/↑/Home, or "Earlier output" — reads the pane's scrollback once
+ * (`?history=1`: tmux's history above the screen, bounded) and shows it: reading. While reading, nothing moves the
+ * person: the refresh keeps reading the screen only to say "New output below", and never redraws. "Jump to latest"
+ * (or End), or scrolling to the bottom, follows again. Everything happens in this page, over text tmux was asked to
+ * capture: never copy-mode and never a key to the pane (hmsg-b8a170c0 — scrolling must never affect delivery).
+ */
+/** How long a scrollback note stays (it covers the terminal's bottom rows). */
+const NOTE_MS = 6000;
+/** A scroll this soon after the person's own wheel, touch, key or pointer is theirs (not one this page made). */
+const GESTURE_MS = 1000;
+/**
+ * #2969 review (Prism P3): is `live` (a screen read) still what `shown` ends with — the screen as it was when reading
+ * began (the scrollback's last lines, or the screen itself)? Trailing blank rows are not content.
+ */
+export function sameScreen(shown, live) {
+  if (shown == null || live == null) return shown === live;
+  const trim = (t) => String(t).replace(/\n+$/, "");
+  const s = trim(shown).split("\n"), l = trim(live).split("\n");
+  return s.length >= l.length && s.slice(s.length - l.length).join("\n") === l.join("\n");
+}
+/** M-2262 survey: CLIs that redraw their whole window (no tmux scrollback even outside the alternate screen). */
+const REDRAWS_IN_PLACE = new Set(["grok"]);
+/** M-2262 survey: the full-screen CLIs (the alternate screen, or redrawn in place) — tmux keeps nothing above their screen. */
+const FULL_SCREEN = new Set(["claude-code", "opencode", "grok"]);   // agy: its chat UI unverified — found by the read
+/** The full-screen CLIs whose earlier output the Log tab shows (it reads their transcript: log-service.ts). */
+const LOG_HAS_HISTORY = new Set(["claude-code"]);
+/**
+ * M-2267 option (2), the leader's safe default: where a full-screen CLI's earlier output is — its Log tab (or that the
+ * Log tab is off, and where to turn it on). Only for whom the Log tab is (a signed-in session on the full app; never a
+ * guest or a View-only reader: they get the plain words), and only for a CLI the Log tab reads.
+ */
+function logLinkFor(name, backend, signedIn) {
+  if (!signedIn || !LOG_HAS_HISTORY.has(backend)) return null;
+  const on = typeof document !== "undefined" && document.body?.dataset?.logTab === "1";
+  return on ? { href: logPath(name), text: tn("earlierInLog") } : { href: sectionPath("web-dashboard"), text: tn("logTabOff") };
+}
+function Terminal({ name, lease, density, every = 800, backend = "", signedIn = false }) {
   const term = useRef(null), pre = useRef(null);
   const grid = useRef({ cols: 0, rows: 0, applied: 0, key: "" });
   const [problem, setProblem] = useState(null);
+  // "follow" | "loading" | "reading"; the screen's text when reading began, the newest read since; a note about history.
+  const [mode, setModeState] = useState("follow");
+  const modeRef = useRef("follow");
+  const setMode = (m) => { modeRef.current = m; setModeState(m); };
+  const [newBelow, setNewBelow] = useState(false);
+  const [historyNote, setHistoryNoteState] = useState(null);
+  // A CLI found to keep no scrollback (full screen): nothing is offered or read again for it; the note says why, briefly.
+  const [noScrollback, setNoScrollback] = useState(FULL_SCREEN.has(backend));
+  const noScrollbackRef = useRef(FULL_SCREEN.has(backend));
+  const logLink = logLinkFor(name, backend, signedIn);
+  const noteTimer = useRef(null);
+  const setHistoryNote = (note, brief = false) => {
+    lease.clear(noteTimer.current); noteTimer.current = null;
+    setHistoryNoteState(note);
+    if (note && brief) noteTimer.current = lease.timeout(() => setHistoryNoteState(null), NOTE_MS);
+  };
+  // `reading`: the text shown while reading (the scrollback, or the screen as it was when the person left the bottom);
+  // `latest`: the newest screen read; `history`: whether what is shown has the scrollback in it.
+  // `drawn` (#2969 review P3): the text actually on the page now — what reading starts from, never a newer read not drawn.
+  const screenAt = useRef({ reading: null, latest: null, history: false, drawn: null });
+  // #2969 review (Prism P2): when the person last moved the terminal themselves (wheel, touch, key, pointer).
+  const gestureAt = useRef(-Infinity);
+  const recentGesture = () => performance.now() - gestureAt.current < GESTURE_MS;
   // #1674: the text size as of this render. The pane refresh and the resize handlers below are set up once per mount
   // and keep the fit() of that render; reading the size here, not from that render's props, keeps them on the current
   // choice (they used to put the mount-time size back within one 800 ms refresh).
@@ -245,7 +307,27 @@ function Terminal({ name, lease, density, every = 800 }) {
     g.applied = size;
     p.style.fontSize = `${size.toFixed(2)}px`;          // CSSOM, never a style attribute (#1300)
   };
+  /** Keep a following view on the newest line (a grid taller than the box at the larger sizes scrolls). */
+  const toBottom = () => { const box = term.current; if (box) box.scrollTop = box.scrollHeight; };
+  const draw = (text) => {
+    pre.current.innerHTML = ansiToHtml(text);           // escaped by construction: markup only from ansiToHtml's own spans
+    paintAnsi(pre.current);
+    screenAt.current.drawn = text;
+  };
   useEffect(() => { grid.current.key = ""; fit(); }, [density]);
+  const atBottom = () => { const box = term.current; return !box || box.scrollHeight - box.scrollTop - box.clientHeight <= 2; };
+  /** Reading what is shown now (`text`, with or without the scrollback): the refresh only says whether there is more. */
+  const startReading = (text, history) => {
+    screenAt.current.reading = text; screenAt.current.history = history;
+    setNewBelow(false); setMode("reading");
+  };
+  const grid1 = (r) => {
+    const c = Number(r.headers.get("X-Pane-Cols")), rw = Number(r.headers.get("X-Pane-Rows"));
+    if (c >= 1 && rw >= 1 && (c !== grid.current.cols || rw !== grid.current.rows)) { grid.current.cols = c; grid.current.rows = rw; grid.current.key = ""; }
+  };
+  // The person asked for what scrolled off: one bounded read, then reading (or why there is nothing to read).
+  const loadEarlier = useRef(null);
+  const follow = useRef(null);
   useEffect(() => {
     const reads = readStream(lease);
     const refresh = async () => {
@@ -263,15 +345,72 @@ function Terminal({ name, lease, density, every = 800 }) {
         if (!r.ok) { setProblem(r.status === 404 ? tn("paneUnavailable") : r.status === 403 && guestPage() ? tn("guestNeedsTrusted") : tn("paneFailed", { name, status: r.status })); return; }
         const text = await r.text();
         if (!reads.live(token) || !pre.current) return;
-        const c = Number(r.headers.get("X-Pane-Cols")), rw = Number(r.headers.get("X-Pane-Rows"));
-        if (c >= 1 && rw >= 1 && (c !== grid.current.cols || rw !== grid.current.rows)) { grid.current.cols = c; grid.current.rows = rw; grid.current.key = ""; }
         setProblem(null);
-        pre.current.innerHTML = ansiToHtml(text);         // escaped by construction: markup only from ansiToHtml's own spans
-        paintAnsi(pre.current);
+        screenAt.current.latest = text;
+        // Reading earlier output: nothing is redrawn under the person — the read only says whether there is more.
+        if (modeRef.current !== "follow") { if (modeRef.current === "reading") setNewBelow(!sameScreen(screenAt.current.reading, text)); return; }
+        // #2969 review (Prism P2): the person is moving a screen taller than its box away from the bottom right now —
+        // this is them leaving it, not the latest to follow: read on, nothing redrawn.
+        // Reading starts from what is drawn; this newer read (not drawn) is then the new output below.
+        if (recentGesture() && !atBottom()) { startReading(screenAt.current.drawn, false); setNewBelow(!sameScreen(screenAt.current.drawn, text)); return; }
+        grid1(r);
+        draw(text);
         fit();
+        toBottom();
       } catch { /* a transient error keeps the last frame */ }
       finally { reads.end(token); }
     };
+    loadEarlier.current = async () => {
+      // From following, or from reading what was on the screen (the person reached its top): never twice, never over it.
+      const from = modeRef.current;
+      if (from !== "follow" && !(from === "reading" && !screenAt.current.history)) return;
+      if (noScrollbackRef.current) { setHistoryNote(tn("noEarlier"), true); return; }   // known: nothing to read
+      const box0 = term.current;
+      // Where the person is, measured from the end: the screen's lines stay where they are under the scrollback added.
+      const fromEnd = box0 ? box0.scrollHeight - box0.scrollTop : 0;
+      const back = () => { setMode(from); if (from === "follow") toBottom(); };
+      setMode("loading"); setHistoryNote(tn("loadingEarlier"));
+      try {
+        const r = await lease.fetch(`/api/pane/${encodeURIComponent(name)}?history=1`);
+        if (!lease.current() || modeRef.current !== "loading") return;
+        // #2969 review (Prism P2): a scrollback read that failed — or answered without its facts — changes nothing shown.
+        if (!r.ok || r.headers.get("X-Pane-History-Lines") == null) { back(); setHistoryNote(r.status === 429 ? null : tn("earlierFailed"), true); return; }
+        const text = await r.text();
+        if (!lease.current() || modeRef.current !== "loading" || !pre.current) return;
+        // A full-screen CLI (the alternate screen, or one that redraws its whole window) leaves nothing above its screen;
+        // any other with no history yet has simply not scrolled: say which, keep following.
+        if (r.headers.get("X-Pane-Alternate") === "1" || REDRAWS_IN_PLACE.has(backend)) {
+          noScrollbackRef.current = true; setNoScrollback(true);
+          back(); setHistoryNote(tn("noEarlier"), true); return;
+        }
+        if (r.headers.get("X-Pane-History-Lines") === "0") { back(); setHistoryNote(tn("nothingEarlier"), true); return; }
+        grid1(r);
+        const lines = text.split("\n").length, rows = grid.current.rows || 0;
+        // #2969 review (Prism P3): new output is judged against what is shown — the scrollback's own last screen — and
+        // a screen read while this one was out already counts.
+        screenAt.current.reading = text; screenAt.current.history = true;
+        setNewBelow(screenAt.current.latest != null && !sameScreen(text, screenAt.current.latest));
+        setMode("reading"); setHistoryNote(null);
+        draw(text);
+        fit();
+        const box = term.current;
+        if (box) {
+          const lineH = lines > 0 ? pre.current.scrollHeight / lines : 16;
+          // From following (at the bottom): a few lines up — the earlier output right above. From reading: the same lines.
+          box.scrollTop = from === "follow"
+            ? Math.max(0, box.scrollHeight - box.clientHeight - lineH * Math.min(3, Math.max(1, lines - rows)))
+            : Math.max(0, box.scrollHeight - fromEnd);
+        }
+      } catch { if (lease.current()) { back(); setHistoryNote(tn("earlierFailed"), true); } }
+    };
+    follow.current = () => {
+      if (modeRef.current === "follow") return;
+      setMode("follow"); setNewBelow(false); setHistoryNote(null); screenAt.current.history = false;
+      const latest = screenAt.current.latest;
+      if (latest != null && pre.current) { draw(latest); fit(); }
+      toBottom();
+      refresh();
+    };
     refresh();
     lease.interval(refresh, every);
     let timer = null;
@@ -282,8 +421,44 @@ function Terminal({ name, lease, density, every = 800 }) {
       ro.observe(term.current);
       lease.hold(() => ro.disconnect());
     }
+    // Scrolling up asks for the earlier output; reaching the bottom while reading follows again.
+    const box = term.current;
+    if (box) {
+      // Asking for the earlier output: from following, or from reading the screen as it was — at the top.
+      const mayLoad = () => (modeRef.current === "follow" || (modeRef.current === "reading" && !screenAt.current.history)) && box.scrollTop <= 0;
+      const gesture = () => { gestureAt.current = performance.now(); };
+      lease.on(box, "wheel", (e) => { gesture(); if (e.deltaY < 0 && mayLoad()) loadEarlier.current(); }, { passive: true });
+      let touchY = null;
+      lease.on(box, "touchstart", (e) => { gesture(); touchY = e.touches && e.touches[0] ? e.touches[0].clientY : null; }, { passive: true });
+      lease.on(box, "touchmove", (e) => {
+        gesture();
+        const y = e.touches && e.touches[0] ? e.touches[0].clientY : null;
+        if (touchY == null || y == null) return;
+        if (y - touchY > 24 && mayLoad()) { touchY = null; loadEarlier.current(); }
+      }, { passive: true });
+      lease.on(box, "pointerdown", gesture, { passive: true });             // the scrollbar, dragged
+      lease.on(box, "keydown", (e) => {
+        gesture();
+        if ((e.key === "PageUp" || e.key === "ArrowUp" || e.key === "Home") && mayLoad()) { e.preventDefault(); loadEarlier.current(); }
+        else if (modeRef.current === "reading" && e.key === "End") { e.preventDefault(); follow.current(); }
+      });
+      lease.on(box, "scroll", () => {
+        if (modeRef.current === "reading") { if (atBottom()) follow.current(); return; }
+        // #2969 review (Prism P2): a screen taller than its box (a larger Aa), moved up from the bottom by the person:
+        // reading what is on it — the refresh no longer pulls them back down.
+        if (modeRef.current === "follow" && recentGesture() && !atBottom()) startReading(screenAt.current.drawn, false);
+      }, { passive: true });
+    }
   }, [lease, name]);
-  return html`<div data-trust="panel-content" class="v-term" ref=${term}>${problem ? html`<p class="v-term-note" role="status">${problem}</p>` : null}<pre ref=${pre} class="v-pre"></pre></div>`;
+  const reading = mode === "reading";
+  // A full-screen CLI's Log link is a bar above the terminal, not over it: its first row is never covered.
+  return html`<div class="v-term-box">
+    ${noScrollback && logLink ? html`<p class="v-term-logbar"><a class="v-term-log" href=${logLink.href}>${logLink.text}<${Icon} name="forward" size=${14} /></a></p>` : null}
+    <div data-trust="panel-content" class=${`v-term${reading ? " is-reading" : ""}`} ref=${term} tabindex="0" aria-label=${tn(reading ? "readingEarlier" : "earlierHint")}>${problem ? html`<p class="v-term-note" role="status">${problem}</p>` : null}<pre ref=${pre} class="v-pre"></pre></div>
+    ${historyNote ? html`<p class="v-term-history-note" role="status">${historyNote}</p>` : null}
+    ${mode === "follow" && !noScrollback ? html`<button type="button" class="v-term-earlier btn btn-sm" title=${tn("earlierHint")} onClick=${() => loadEarlier.current && loadEarlier.current()}><${Icon} name="up" size=${14} />${tn("earlier")}</button>` : null}
+    ${reading ? html`<button type="button" class=${`v-term-latest btn btn-sm${newBelow ? " has-new" : ""}`} onClick=${() => follow.current && follow.current()}>${newBelow ? html`<span class="v-term-new">${tn("newBelow")} · </span>` : null}${tn("jumpLatest")}<${Icon} name="down" size=${14} /></button>` : null}
+  </div>`;
 }
 
 // The advance of one monospace cell as a fraction of font-size, measured once on this page.

package/dist/ui/shared/view-strings.js

@@ -215,6 +215,18 @@ register("view", {
   "guestNeedsTrustedHint": "Your host gave you chat access to this agent. Ask them to make you Trusted in Settings → Guests.",
   "noInstances": "No instances yet",
   "paneUnavailable": "This instance's terminal is not available (is it stopped?)",
+  // M-2262: the terminal's scrollback.
+  "earlier": "Earlier output",
+  "earlierHint": "Scroll up to read what has scrolled off. Live output keeps coming in below.",
+  "loadingEarlier": "Loading earlier output…",
+  "earlierFailed": "Could not load earlier output.",
+  "noEarlier": "This CLI redraws its whole screen, so the terminal keeps no earlier output to scroll back to.",
+  "nothingEarlier": "Nothing has scrolled off the screen yet.",
+  "earlierInLog": "Earlier output is in the Log tab",
+  "logTabOff": "Earlier output: the Log tab is off. Turn it on in Settings",
+  "readingEarlier": "Reading earlier output. Live output continues; scroll to the bottom to follow it again.",
+  "jumpLatest": "Jump to latest",
+  "newBelow": "New output below",
   "rosterFailedShort": "The instance list could not be loaded.",
   "collapseGroup": "Fold {group}",
   "expandGroup": "Open {group}",
@@ -461,6 +473,17 @@ register("view", {
   "guestNeedsTrustedHint": "主人給你的是這個 agent 的聊天權限。請他在設定 → 訪客把你改成「信任」。",
   "noInstances": "還沒有 instance",
   "paneUnavailable": "無法取得這個 instance 的終端畫面（它是否已停止？）",
+  "earlier": "較早的輸出",
+  "earlierHint": "往上捲動可以看到已經捲走的內容，新的輸出會繼續出現在下方。",
+  "loadingEarlier": "正在載入較早的輸出…",
+  "earlierFailed": "無法載入較早的輸出。",
+  "noEarlier": "這個 CLI 會重繪整個畫面，終端沒有保留可以往上捲動的較早輸出。",
+  "nothingEarlier": "還沒有內容捲出畫面。",
+  "earlierInLog": "較早的輸出在「紀錄」分頁",
+  "logTabOff": "較早的輸出：「紀錄」分頁目前關閉，請到設定開啟",
+  "readingEarlier": "正在看較早的輸出。新的輸出仍會繼續；捲到最下面即可再次跟著最新內容。",
+  "jumpLatest": "跳到最新",
+  "newBelow": "下方有新的輸出",
   "rosterFailedShort": "無法載入 instance 清單。",
   "collapseGroup": "收合 {group}",
   "expandGroup": "展開 {group}",

package/dist/unattended-install.d.ts

@@ -0,0 +1,6 @@
+/** Runs `$1` detached from any terminal, at low priority; HUP/INT/TERM on this shell reach its whole process group. */
+export declare const UNATTENDED_INSTALL_SCRIPT: string;
+/** The account's login shell, when it is an absolute path to an executable; else undefined (keep the inherited one). */
+export declare function loginShell(read?: () => string | null | undefined): string | undefined;
+/** The window's command for an install command. `shell`: the $SHELL to give it; null keeps the inherited one. */
+export declare function unattendedInstallCommand(command: string, shell?: string | null): string;

package/dist/unattended-install.js

@@ -0,0 +1,65 @@
+/**
+ * M-2281 (#2980): how `/login` runs a CLI's installer in its window — nobody types there, so nothing may wait for
+ * an answer, and the install must not starve the fleet that is still serving every chat.
+ *
+ * - **No terminal to ask on.** `setsid -w` gives the install a session of its own with no controlling terminal, so
+ *   `/dev/tty` cannot be opened, and stdin is `/dev/null`. A prompt that asks there (codex's "Start Codex now?",
+ *   kiro's "replace it?", sudo's password) fails at once instead of waiting out the session timeout. Without
+ *   `setsid` (macOS has none), stdin is still `/dev/null`. The same wrapper install-agend.ps1 uses (#2583).
+ * - **Low priority.** `nice -n 10`, plus `ionice -c2 -n7` where it exists and is permitted: a ~0.5 GB download and
+ *   unpack (codex 0.166) yields CPU and disk to the fleet and its CLIs.
+ * - **Stoppable.** The install's own session is not the window's, so closing the window (cancel, timeout, fleet
+ *   stop) would not reach it: the window's shell forwards HUP/INT/TERM to the install's whole process group.
+ * - **The user's shell.** Installers pick the rc file for their PATH line from `$SHELL`; the window inherits the
+ *   tmux server's environment, where it may be missing (a service). The account's login shell is passed, so the
+ *   line lands in the file the user's own terminals read.
+ *
+ * - **Its verdict is kept.** In a tmux pane it starts once remain-on-exit is on (see the script): an install that ends
+ *   at once still leaves a dead pane with its exit code and output for the session to judge.
+ *
+ * The exit code is the install's own: the session judges success by it.
+ */
+import { accessSync, constants as fsConstants } from "node:fs";
+import { userInfo } from "node:os";
+import { isAbsolute } from "node:path";
+import { shellQuote } from "./backend/types.js";
+/** Runs `$1` detached from any terminal, at low priority; HUP/INT/TERM on this shell reach its whole process group. */
+export const UNATTENDED_INSTALL_SCRIPT = [
+    // In a tmux pane, start only once AgEnD has set remain-on-exit on the window (at most ~10 s): an install that fails
+    // at once — a prompt with no terminal does — would otherwise close the window before it is set, taking its exit code
+    // and output with it. Outside tmux ($TMUX_PANE unset) there is nothing to wait for.
+    'if [ -n "${TMUX_PANE:-}" ] && command -v tmux >/dev/null 2>&1; then i=0; while [ "$(tmux show-options -wqv -t "$TMUX_PANE" remain-on-exit 2>/dev/null)" != on ] && [ $i -lt 100 ]; do sleep 0.1; i=$((i+1)); done; fi',
+    'P=""',
+    'if command -v ionice >/dev/null 2>&1 && ionice -c2 -n7 true >/dev/null 2>&1; then P="ionice -c2 -n7"; fi',
+    'if command -v setsid >/dev/null 2>&1; then setsid -w nice -n 10 $P sh -c "$1" </dev/null & else nice -n 10 $P sh -c "$1" </dev/null & fi',
+    "pid=$!",
+    // `kill -TERM -$pid`, not `kill -- -$pid`: dash's kill refuses `--` ("Illegal number"). Before setsid has run there is
+    // no such group yet, and the plain pid is what exists.
+    "trap 'kill -TERM -$pid 2>/dev/null || kill -TERM $pid 2>/dev/null; exit 129' HUP INT TERM",
+    'wait "$pid"',
+].join("\n");
+/** The account's login shell, when it is an absolute path to an executable; else undefined (keep the inherited one). */
+export function loginShell(read = () => userInfo().shell) {
+    let shell;
+    try {
+        shell = read();
+    }
+    catch {
+        return undefined;
+    }
+    if (!shell || !isAbsolute(shell))
+        return undefined;
+    try {
+        accessSync(shell, fsConstants.X_OK);
+        return shell;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The window's command for an install command. `shell`: the $SHELL to give it; null keeps the inherited one. */
+export function unattendedInstallCommand(command, shell = loginShell() ?? null) {
+    const env = shell ? `SHELL=${shellQuote(shell)} ` : "";
+    return `${env}sh -c ${shellQuote(UNATTENDED_INSTALL_SCRIPT)} agend-install ${shellQuote(command)}`;
+}
+//# sourceMappingURL=unattended-install.js.map

package/dist/unattended-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unattended-install.js","sourceRoot":"","sources":["../src/unattended-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,uHAAuH;AACvH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,oHAAoH;IACpH,qHAAqH;IACrH,oFAAoF;IACpF,uNAAuN;IACvN,MAAM;IACN,0GAA0G;IAC1G,0IAA0I;IAC1I,QAAQ;IACR,uHAAuH;IACvH,uDAAuD;IACvD,2FAA2F;IAC3F,aAAa;CACd,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,wHAAwH;AACxH,MAAM,UAAU,UAAU,CAAC,IAAI,GAAoC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK;IACvF,IAAI,KAAgC,CAAC;IACrC,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACxF,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,KAAK,GAAkB,UAAU,EAAE,IAAI,IAAI;IACnG,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,OAAO,GAAG,GAAG,SAAS,UAAU,CAAC,yBAAyB,CAAC,kBAAkB,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;AACrG,CAAC"}

package/dist/view-api.d.ts

@@ -137,11 +137,26 @@ export declare function cardPicture(ctx: {
 export declare function humanCards(dataDir: string): ReturnType<typeof HumanCardStore.all>;
 /** For tests: forget the guests' read counts and shared captures. */
 export declare function resetGuestPanes(): void;
+/**
+ * M-2262 (the user, hmsg-435f6df6): the View's scrollback — the pane's history above its screen, read only when the
+ * person scrolls up (never on the 800 ms refresh), at most `lines` lines (tmux's own default history-limit) and at most
+ * `maxBytes` (its end, from a whole line). A viewer's tabs asking at once share one read.
+ */
+export declare const VIEW_HISTORY: {
+    readonly lines: 2000;
+    readonly maxBytes: number;
+};
 /** A pane's logical grid size in cells, as tmux sees it. */
 export interface PaneSize {
     cols: number;
     rows: number;
 }
+/** M-2262: whether the pane shows its alternate screen, and how many lines tmux keeps above it. */
+export interface PaneScrollback {
+    alternate: boolean;
+    lines: number;
+}
+export declare function parsePaneScrollback(alternate: string | undefined, lines: string | undefined): PaneScrollback | null;
 /** Parse `display-message`'s `<cols>x<rows>` output. Returns null if unusable. */
 export declare function parsePaneSize(out: string): PaneSize | null;
 /** True if the path belongs to the view feature (so the caller can skip the

package/dist/view-api.js

@@ -7,7 +7,8 @@ import { gatewayRequestContext } from "./web-request-context.js";
  *
  *   GET  /view                 → static page
  *   GET  /api/pane/:instance    → `tmux capture-pane -ep` output (ANSI text),
- *                                plus X-Pane-Cols / X-Pane-Rows response headers
+ *                                plus X-Pane-Cols / X-Pane-Rows response headers;
+ *                                `?history=1`: the scrollback above it too, on demand (VIEW_HISTORY)
  *   GET  /api/profiles          → merged roster (live status + config + profile)
  *   GET  /api/profile/:instance → one profile row
  *   POST /api/profile/:instance → upsert profile              (signed in)
@@ -241,7 +242,7 @@ const guestPaneAgents = new Map(); // account → agent → when it was last rea
 const sharedCaptures = new Map();
 /** For tests: forget the guests' read counts and shared captures. */
 export function resetGuestPanes() { guestPaneReads = paneReadLimiter(); guestPaneAgents.clear(); sharedCaptures.clear(); }
-function guestPane(ctx, name, guest, res) {
+function guestPane(ctx, name, guest, res, history = false) {
     if (!guest.trusted?.()) {
         json(res, 403, { error: "guest_not_trusted" });
         return;
@@ -264,6 +265,11 @@ function guestPane(ctx, name, guest, res) {
     guestPaneReads.record(account);
     agents.set(name, now);
     guestPaneAgents.set(account, agents);
+    // The scrollback (a person scrolled up): one read within the same limits, at most the same bytes (its end).
+    if (history) {
+        historyCapture(ctx, name).then((c) => sendHistory(res, c, GUEST_PANE_MAX_BYTES, { "Cache-Control": "private, no-store" }), (err) => historyFailed(ctx, res, name, err));
+        return;
+    }
     let shared = sharedCaptures.get(name);
     if (!shared || now - shared.at >= GUEST_PANE_SHARE_MS) {
         shared = { at: now, capture: capturePane(ctx, name) };
@@ -271,19 +277,68 @@ function guestPane(ctx, name, guest, res) {
         shared.capture.catch(() => { if (sharedCaptures.get(name) === shared)
             sharedCaptures.delete(name); });
     }
-    shared.capture.then(({ text, size }) => {
-        const headers = { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "private, no-store" };
-        if (size) {
-            headers["X-Pane-Cols"] = String(size.cols);
-            headers["X-Pane-Rows"] = String(size.rows);
-        }
-        const bytes = Buffer.from(text, "utf8");
-        res.writeHead(200, headers);
-        // Over the cap: its end, from the first whole line in it (never mid-character or mid-escape sequence).
-        const tail = bytes.length > GUEST_PANE_MAX_BYTES ? bytes.subarray(bytes.length - GUEST_PANE_MAX_BYTES) : bytes;
-        const line = tail === bytes ? -1 : tail.indexOf(0x0a);
-        res.end(line >= 0 ? tail.subarray(line + 1) : tail);
-    }, (err) => { ctx.logger.debug({ err, name }, "capture-pane failed (guest)"); res.writeHead(200, { "Content-Type": "text/plain" }); res.end(""); });
+    shared.capture.then((c) => sendPane(res, c, GUEST_PANE_MAX_BYTES, { "Cache-Control": "private, no-store" }), (err) => paneFailed(ctx, res, name, err));
+}
+/**
+ * M-2262 (the user, hmsg-435f6df6): the View's scrollback — the pane's history above its screen, read only when the
+ * person scrolls up (never on the 800 ms refresh), at most `lines` lines (tmux's own default history-limit) and at most
+ * `maxBytes` (its end, from a whole line). A viewer's tabs asking at once share one read.
+ */
+export const VIEW_HISTORY = { lines: 2000, maxBytes: 1024 * 1024 };
+const historyCaptures = new Map();
+function historyCapture(ctx, name) {
+    let capture = historyCaptures.get(name);
+    if (!capture) {
+        capture = capturePane(ctx, name, VIEW_HISTORY.lines);
+        historyCaptures.set(name, capture);
+        const done = () => { if (historyCaptures.get(name) === capture)
+            historyCaptures.delete(name); };
+        capture.then(done, done);
+    }
+    return capture;
+}
+/** A capture as the answer: the pane's grid in X-Pane-Cols / X-Pane-Rows; over `maxBytes`, its end from a whole line. */
+function sendPane(res, { text, size, scrollback }, maxBytes, extra = {}) {
+    const headers = { "Content-Type": "text/plain; charset=utf-8", ...extra };
+    if (size) {
+        headers["X-Pane-Cols"] = String(size.cols);
+        headers["X-Pane-Rows"] = String(size.rows);
+    }
+    // M-2262: the scrollback's own facts (the page says when a CLI keeps none).
+    if (scrollback) {
+        headers["X-Pane-Alternate"] = scrollback.alternate ? "1" : "0";
+        headers["X-Pane-History-Lines"] = String(scrollback.lines);
+    }
+    const bytes = Buffer.from(text, "utf8");
+    res.writeHead(200, headers);
+    // Over the cap: its end, from the first whole line in it (never mid-character or mid-escape sequence).
+    if (bytes.length <= maxBytes) {
+        res.end(text);
+        return;
+    } // whole: the text, as before
+    const tail = bytes.subarray(bytes.length - maxBytes);
+    const line = tail.indexOf(0x0a);
+    res.end(line >= 0 ? tail.subarray(line + 1) : tail);
+}
+/**
+ * #2969 review (Prism P2): the scrollback says so when it is not there — never the plain read's empty 200, which the
+ * page would draw as the earlier output (blanking the screen it had). No pane yet, or no scrollback facts: 503.
+ */
+function sendHistory(res, c, maxBytes, extra = {}) {
+    if (!c.scrollback) {
+        json(res, 503, { error: "scrollback_unavailable" });
+        return;
+    }
+    sendPane(res, c, maxBytes, extra);
+}
+function historyFailed(ctx, res, name, err) {
+    ctx.logger.debug({ err, name }, "capture-pane (scrollback) failed");
+    json(res, 503, { error: "scrollback_unavailable" });
+}
+function paneFailed(ctx, res, name, err) {
+    ctx.logger.debug({ err, name }, "capture-pane failed");
+    res.writeHead(200, { "Content-Type": "text/plain" });
+    res.end("");
 }
 /**
  * Capture a pane's contents (with ANSI escapes) **and** its logical grid size.
@@ -293,22 +348,33 @@ function guestPane(ctx, name, guest, res) {
  * sparse frame (a freshly-started CLI printing three short lines) would
  * otherwise fit to ~3 columns and blow the font up to the 48px ceiling.
  */
-async function capturePane(ctx, name) {
+async function capturePane(ctx, name, historyLines = 0) {
     const target = paneTarget(ctx, name);
     if (!target)
         return { text: "", size: null };
+    // M-2262: with the scrollback, whether the CLI keeps any (a full-screen one — the alternate screen, or one that redraws
+    // the whole window — leaves tmux nothing above the screen), from the same one display-message.
+    const format = historyLines > 0 ? "#{pane_width}x#{pane_height} #{alternate_on} #{history_size}" : "#{pane_width}x#{pane_height}";
+    // M-2262: with `historyLines`, from that many lines above the screen (tmux stops at what it kept) to the screen's end.
+    const capture = ["capture-pane", "-p", "-e", ...(historyLines > 0 ? ["-S", `-${Math.floor(historyLines)}`] : []), "-t", target];
     const [text, size] = await Promise.all([
         // #1956: through the fleet's spawn helper when it runs (a viewer polls this every 800 ms).
-        tmuxExecHelper.exec("tmux", tmuxArgs(["capture-pane", "-p", "-e", "-t", target]), { maxBuffer: 8 * 1024 * 1024 }, () => execFileP("tmux", tmuxArgs(["capture-pane", "-p", "-e", "-t", target]), { maxBuffer: 8 * 1024 * 1024 }))
+        tmuxExecHelper.exec("tmux", tmuxArgs(capture), { maxBuffer: 8 * 1024 * 1024 }, () => execFileP("tmux", tmuxArgs(capture), { maxBuffer: 8 * 1024 * 1024 }))
             .then(r => r.stdout),
         // display-message resolves the window's *active* pane, matching capture-pane.
-        tmuxExecHelper.exec("tmux", tmuxArgs(["display-message", "-p", "-t", target, "#{pane_width}x#{pane_height}"]), {}, () => execFileP("tmux", tmuxArgs(["display-message", "-p", "-t", target, "#{pane_width}x#{pane_height}"])))
-            .then(r => parsePaneSize(r.stdout))
+        tmuxExecHelper.exec("tmux", tmuxArgs(["display-message", "-p", "-t", target, format]), {}, () => execFileP("tmux", tmuxArgs(["display-message", "-p", "-t", target, format])))
+            .then(r => r.stdout)
             // A missing size must not fail the whole capture — the client falls back
             // to its last known size (or skips refitting) when the headers are absent.
-            .catch(() => null),
+            .catch(() => ""),
     ]);
-    return { text, size };
+    const [grid = "", alternate, kept] = size.trim().split(/\s+/);
+    return { text, size: parsePaneSize(grid), ...(historyLines > 0 ? { scrollback: parsePaneScrollback(alternate, kept) } : {}) };
+}
+export function parsePaneScrollback(alternate, lines) {
+    if ((alternate !== "0" && alternate !== "1") || !/^\d+$/.test(lines ?? ""))
+        return null;
+    return { alternate: alternate === "1", lines: Number(lines) };
 }
 /** Parse `display-message`'s `<cols>x<rows>` output. Returns null if unusable. */
 export function parsePaneSize(out) {
@@ -389,22 +455,17 @@ export function handleViewRequest(req, res, url, ctx) {
         }
         // #2855: a guest (the gate bound it, and checked the agent is in its scope) — Trusted only, within its limits, and
         // reading the capture every guest viewer of this agent shares.
+        // M-2262: `?history=1` — the scrollback too (on demand: the person scrolled up). Any other query is the screen.
+        const history = url.searchParams.get("history") === "1";
         const guest = guestRequestOf(req);
         if (guest) {
-            guestPane(ctx, name, guest, res);
+            guestPane(ctx, name, guest, res, history);
             return true;
         }
-        capturePane(ctx, name)
-            .then(({ text, size }) => {
-            const headers = { "Content-Type": "text/plain; charset=utf-8" };
-            if (size) {
-                headers["X-Pane-Cols"] = String(size.cols);
-                headers["X-Pane-Rows"] = String(size.rows);
-            }
-            res.writeHead(200, headers);
-            res.end(text);
-        })
-            .catch(err => { ctx.logger.debug({ err, name }, "capture-pane failed"); res.writeHead(200, { "Content-Type": "text/plain" }); res.end(""); });
+        if (history)
+            historyCapture(ctx, name).then((c) => sendHistory(res, c, VIEW_HISTORY.maxBytes), (err) => historyFailed(ctx, res, name, err));
+        else
+            capturePane(ctx, name).then((c) => sendPane(res, c, Number.MAX_SAFE_INTEGER), (err) => paneFailed(ctx, res, name, err));
         return true;
     }
     // ── GET /api/profiles — merged roster ──