@vibelord/lanes 1.0.4 → 1.1.1

package/payload/lanes/web/README.md

@@ -18,8 +18,8 @@ undoes the client's per-load single-pane start once
 view's sidebar shows beside its lanes. `tests/web/activation.test.mjs` (`node --test`) pins the activation matrix,
 the picker model and that render preference; `tests/unit/test_web_view.py` pins the size budgets and runs that
 suite when node is installed. After an upgrade,
-check that `__zjMobileUi`, `__zjSendControl`, `__zjSoftKbdCapture`, `__zjSyncInactiveCursorStyle` and `window.term`
-still exist in the served `app.js`.
+check that `__zjMobileUi`, `__zjSendControl`, `__zjSoftKbdCapture` (with `sendFn` = `websockets.sendAnsiKey`),
+`__zjSyncInactiveCursorStyle` and `window.term` still exist in the served `app.js`.
 
 The phone keyboard opens through a native tap on an input field. The bottom **Type here** field contains
 Zellij's original capture input in its closed shadow root, preserving its keyboard/IME handling. The client
@@ -30,15 +30,25 @@ The guard is installed before Zellij's first terminal or login modal: otherwise
 touchstart, touchend, click and server `SetSoftKeyboard` messages. The **Type here** field keeps the original input
 and its event handlers inside the closed shadow root (including its protection from password-manager extensions) and
 makes it a real, tappable field instead of a 1 px invisible focus target; keystrokes appear in the terminal and its
-internal padding/history stays invisible. Upstream cancels `pointerdown` on the extra keys, which also suppresses
+internal padding/history stays invisible. Upstream creates that input as `type="password" autocomplete="new-password"`
+(to switch off prediction); shown to the user, that gave iOS a secure-entry keyboard and the strong-password bar
+(DEF-1734), so the shell makes it `type="text" autocomplete="off" autocapitalize="none"` and keeps upstream's
+`autocorrect="off"`, `spellcheck="false"`, `inputmode="text"` and the `data-*ignore` attributes. Upstream cancels
+`pointerdown` on the extra keys, which also suppresses
 their touch click in Safari, so the shell cancels `mousedown` instead: typing focus is kept while the native click
 still activates CTRL, the arrows and the other keys. The shell attaches only once server state has arrived — resizing
 before the control socket opens makes 0.45.1 throw `InvalidStateError` and leaves the server with the old size.
 
 `lanes-mobile.service` runs a separate, loopback-only Caddy on port 8083 with its admin API disabled.
 It does not change the system Caddy. Tailscale Serve forwards private HTTPS on 8443 to this frontend;
-the original Zellij service stays on 8082. Caddy must already be installed on the host.
-Run `sh install/enable-phone.sh --host lanes` from an installed client, or `--local` on the server.
+the original Zellij service stays on 8082. Caddy (2.5 or later) must already be installed on the host. `/enrol/*` is
+the one route that is neither these assets nor Zellij: `handle_path` strips `/enrol` and forwards to the enrolment
+service on 127.0.0.1:8184 (`lanes-enrold.service`, [runbook](../docs/RUNBOOK.md#enrolment-service-lanes-enrold-w8-a3));
+it must stay before the Zellij routes, and its `trusted_proxies 127.0.0.0/8` keeps the `X-Forwarded-For` Tailscale
+Serve sets (the client's tailnet address), so the redeem rate limit counts per device.
+Run `lanes web <device> --token` on the server (it also adds that Tailscale Serve mapping when it is missing),
+`lanes-launch web phone|laptop` from an installed client, or `sh install/enable-phone.sh --host lanes` (`--local` on
+the server).
 The [installation guide](../docs/INSTALL.md) covers Caddy, Tailscale operator permission and the selected SSH key.
 Service registration supplies `LANES_REPO` so Caddy serves the actual checkout from any installation path.
 
@@ -54,9 +64,94 @@ is stored locally. Minimum touch targets are 44 px (workspace cards are 74 px).
 `tests/mobile_view.py` verifies the touch-to-lane path with isolated holders; sidebar unit tests cover the
 complete touch target.
 
-Every byte the shell sends to a terminal goes through `__zjSendControl({type: 'Write', bytes})`
-(`sendToTerminal`); there is no focus-and-type fallback, since the focus guard above would make it type nowhere.
-The lane filter bar sends `Esc /` and the query as UTF-8 (`TextEncoder`), dropping control bytes and DEL.
+### Input, keys and clipboard (phone shell input v2, CAP-142)
+
+Every byte the shell sends to a terminal goes through `send()` to `__zjSoftKbdCapture.sendFn`, which is upstream's
+`websockets.sendAnsiKey`: a text frame on the terminal WebSocket, the path the client's own capture input, ESC/arrow
+bar and xterm `onData` use (an armed CTRL/ALT on the modifier bar therefore applies to a one-character key, through
+upstream's `__zjMobileMergeKey`). Until 2026-10-07 the shell posted `__zjSendControl({type: 'Write', bytes})` on the
+control socket, whose message enum has no `Write` variant: the server logged "Ignoring unknown control message type"
+and dropped every quick key and filter keystroke (DEF-1733). The quick keys send `\r`, `y`, `n`, `\x1b`, `\x03`,
+`\x1b[A`, `\x1b[B` — upstream's own arrow bytes (CSI, never SS3; Zellij re-encodes a key for its pane). With no
+`sendFn` the text is queued and sent by the next `refresh()` (no timer); the pinned client installs `sendFn` together
+with the capture element the shell waits for, so the queue only covers an upstream reordering. A key the socket
+refuses (it throws while not open) is dropped, never replayed later into whatever lane is focused then. There is no
+focus-and-type fallback: the focus guard above would make it type nowhere (DEF-1529).
+
+The lane filter bar never puts an Esc and other bytes in one frame. The server parses each text frame with termwiz,
+which holds a leading ESC while more bytes follow: `\x1b/abc` became one Alt-`/` key whose raw bytes are the whole
+frame, then `a`, `b`, `c` again as keys of their own, so the picker sidebar got `\x1b/abc` + `abc` and filtered on
+`abcabc` — on every keystroke, since the one-frame filter re-sent the whole query each time (DEF-1751, INFERRED from
+the independent review's reading of the Zellij 0.45.1 source; `tests/web/phone.test.mjs` models it). The filter now
+sends only what changed. When the field goes from empty to text: a lone `Esc` frame (it leaves whatever the sidebar is
+in — an open filter, a rename, a close prompt, the key sheet), then, no sooner than 60 ms later, `/` alone and the
+text. After that, one DEL (`\x7f`, which the sidebar's filter takes as backspace, as it does `\x08`) for each
+character of the old query after its common prefix with the new one, then the new query's characters after that
+prefix; an emptied field or the Esc key sends a lone `Esc`. The text is the `TextEncoder` bytes with control bytes and
+DEL dropped, decoded back to text. There is no `setTimeout`: `send()` keeps a pause marker in its queue after a lone
+`Esc` and re-arms the one interval, whose next tick sends what follows once 60 ms have passed. The phone keeps the
+last query it sent (`laneFilterPrev`); on any tab other than a picker it forgets it, empties the field and drops a
+filter tail still waiting in the queue, without sending anything — the lane now has the focus, and an `Esc` there
+can interrupt an agent (DEF-1752; the sidebar clears its own filter when it opens a lane). Limits: the deltas assume the
+sidebar holds what the phone sent, which each new query's leading `Esc` restores — another client typing into the same
+picker pane, or a character the sidebar does not print (a no-break space, a zero-width joiner), puts them out of step
+until the field is cleared; and an `Esc` while the sidebar's upload strip is armed (`U`) returns the focus to the
+lane, so the `/` and text after it could reach the lane unless the tab change arrives within the pause.
+
+Typing in **Type here**: one character at a time flows through upstream's `input` handler unchanged (a diff of the
+field against its no-break-space padding, with an 8 ms duplicate filter for the two `deleteContentBackward` events one
+backspace fires). A text field brings back QuickType, whose multi-character inserts would lose a repeated letter to
+that filter (`hello` → `helo`). The shell therefore cancels two cancelable `beforeinput` types and sends their text
+whole: `insertText` longer than one character, and `insertReplacementText` of any length. The text is `data`, or
+`dataTransfer.getData('text')` where an engine leaves `data` null. A replacement first sends one DEL per character it
+replaces: the length of `getTargetRanges()[0]` (its `endOffset − startOffset` in the field) — iOS accepts a QuickType
+suggestion over a partial word with a caret, not a selection, and names the replaced range there — else the field's
+selection, else nothing (DEF-1753; before, only the selection was read, so a caret replacement sent `hehello`). Every
+other type stays upstream's or another handler's: a composition (`insertCompositionText`, which the Input Events spec
+makes uncancelable, and `insertFromComposition`) is upstream's diff, a paste is the `paste` handler's, a delete is a
+key. Caveat, unverified on a device: an engine that names neither the range nor a selection gives the terminal the
+partial word and then the suggestion (`hehello`); delete by hand or type without the suggestion bar.
+
+Paste: a `paste` on the field is cancelled and its `text/plain` sent as ONE bracketed paste — `\x1b[200~`, the text
+with `\r?\n` as `\r` and every end marker neutralised, `\x1b[201~` — so upstream's per-character path, which collapsed
+`ll` to `l` and stripped the newlines (DEF-1735), never sees it. Only the end marker is touched: each run of ESCs
+directly before `[201~` is removed (a run, so `\x1b\x1b[201~` or `\x1b[20\x1b[201~1~` cannot reassemble one), so the
+clipboard cannot end the bracket early and run the rest as typed keys, while a deliberate ANSI paste keeps its other
+escape sequences (until DEF-1755 every ESC was removed). On a picker tab there is no paste: the picker sidebar turns
+on bracketed paste to take file drops and reads any paste as one (text says `that was not a file drop`; a pasted path
+becomes an upload attempt), so the header's **Paste** is hidden there and a paste into **Type here** is cancelled,
+sends nothing and says `Open a lane to paste` (DEF-1754). Explicit markers rather than xterm's `term.paste` (also
+reachable, as `window.term`): `term.paste` brackets only when the server has turned on xterm's bracketed-paste mode,
+which nothing in this tree shows; Zellij reads the markers as a paste and removes them for a pane that has not asked
+for bracketed paste.
+
+**Copy** and **Paste** sit in the header beside **More** (nine 44 px quick keys do not fit a 390 px phone, so the row
+keeps its seven). Copy writes the terminal's selection when xterm has one, else the visible rows of
+`window.term.buffer.active` (`translateToString(true)` per row, trailing blank rows dropped), with
+`navigator.clipboard.writeText` called inside the tap: Safari refuses a write outside a user gesture, which is why the
+client's clipboard add-on (OSC 52) and copy-on-select never reached the phone — upstream cancels `touchstart`, a drag
+scrolls and a long press is a right click (DEF-1736). The buffer is the only text source: `initTerminal` loads xterm's
+WebGL renderer (`addon-webgl`), so the DOM holds no row text. The copy is the whole visible screen, Zellij's frames
+and bars included. Paste calls `navigator.clipboard.readText()` inside the tap (iOS shows its own Paste confirmation)
+and sends the text through the bracketed path above; it is hidden on a picker tab. Both cancel `mousedown`, so an open
+keyboard stays open. The header subtitle says `Copied`, `Pasted` or `Clipboard blocked` (no clipboard API, or a
+refusal).
+
+Hints (`Hold to send` and the clipboard results) hold the header subtitle for eight ticks of the one 200 ms interval:
+`hint()` re-arms it, `tick()` counts down, restores the subtitle through `refresh()` and clears the interval again,
+and `refresh()` leaves the subtitle alone while a hint is up (before, the next `MobileState` refresh overwrote it at
+once, DEF-1739). **More** toggles: upstream's capture-phase `pointerdown` hook closes an open menu before the button's
+click, which then reopened it (DEF-1738), so a window capture-phase `pointerdown` listener records whether the menu was
+open and the click then leaves it closed. On a picker tab the dock shows the filter bar and hides **Panes** (a picker
+tab has one pane, and upstream's pane list duplicates the picker): four items for the four grid columns, where five
+wrapped **Type here** below the fixed-height dock (DEF-1737).
+
+The pinned `app.js` facts this section relies on (`sendFn` = `sendAnsiKey`, the capture input's attributes and
+handlers, the menu dismiss hook, `window.term`, the WebGL addon) were read on 2026-10-07 from the asset embedded in
+the zellij 0.45.1 release binary: the bytes between the `app.js` and `auth.js` names in its asset table hash to this
+`index.html`'s SRI pin (sha384 `zEYVY/2Dhk…`). `tests/web/phone.test.mjs` runs `mobile.js` against a fake page shaped
+on those facts (`node --test`, no jsdom).
+
 Attention counts come from the picker sidebar's pane title (`WS · ◆1 ◇2 ▸6`, written by the sidebar as OSC 2):
 `parseCounts` (also `window.__lanesParseCounts`) feeds the picker subtitle, `document.title`, the Lanes button's
 `data-count` and the workspace cards, inside the existing `refresh()` / `renderCards()` — no fetch, file or timer.
@@ -69,8 +164,10 @@ phone device keeps the old picker pane until `lanes rebuild <device>` (`upgrade-
 `panes[].title` is still unchecked in a browser (no WebKit pass has run; fallback: the counts stay in the
 sidebar header). The quick-key row (`⏎ y n Esc ^C ↑ ↓`, `.lanes-quick`) shows on view
 tabs only; `refresh()` sets `--lanes-quick` (48 px or 0), which the terminal height subtracts. `n` and `^C` send
-only when `pointerup.timeStamp − pointerdown.timeStamp ≥ 400` (no `setTimeout`); the buttons cancel `mousedown`
-so a tap never moves focus.
+only when `pointerup.timeStamp − pointerdown.timeStamp ≥ 400` (no `setTimeout`); `pointercancel` and `pointerleave`
+disarm a key, and a `pointerup` without the key's own `pointerdown` sends nothing (before, a cancelled hold stayed
+armed, so a pointer released over `^C` later sent it, DEF-1739). The buttons cancel `mousedown` so a tap never moves
+focus.
 
 Colour (spec §6.3; the operator legend, token table and phone mockup are in [`docs/DESIGN.md`](../docs/DESIGN.md)):
 `mobile.css` uses only the generated `--lanes-*` tokens (legacy names such as `--lanes-bg` stay
@@ -84,13 +181,21 @@ chaining `window.__zjSyncInactiveCursorStyle`, which the pinned `app.js` calls i
 assigning the server theme wholesale (`SetConfig` is sent on each config-file reload). The handler then runs
 `applyTerminalBackground`, which writes the dark background inline on `<body>` and `#terminal`; the stylesheet's
 `!important` `--lanes-surface` rule for those two elements outranks it in either variant. An SRI bump of `app.js`
-re-opens this contract: re-read `startWsControl` and `installSoftKeyboardCapture` before accepting it.
+re-opens this contract: re-read `startWsControl`, `installSoftKeyboardCapture`, `initWebSockets` (`sendAnsiKey`) and
+`installMenuDismissHook` before accepting it.
 `index.html` carries one `theme-color` per colour scheme. Bundle budget (spec §8, `test_web.test_bundle_growth`):
-`mobile.css` ≤ 18 982 B and `mobile.js` ≤ 22 174 B; the caps are never raised — the rules sit one per line and the
-explanations live here rather than in the shipped files. MEASURED 2026-10-04 with `wc -c` after LNS-31 (plan Task
-31) met Tasks 13/28: `mobile.js` 21 964 B (23 268 B before its comments moved to Code notes below) and `mobile.css`
-18 945 B. A laptop or tablet also fetches `browser.js` (3 641 B) and `browser.css` (1 947 B); `test_web_view` pins
-that download at `LAPTOP_TABLET_JS_RATCHET` and `LAPTOP_TABLET_CSS_CAP` (DEF-1569).
+`mobile.css` ≤ 18 982 B and `mobile.js` ≤ 24 258 B; the rules sit one per line and the explanations live here rather
+than in the shipped files. MEASURED 2026-10-04 with `wc -c` after LNS-31 (plan Task 31) met Tasks 13/28: `mobile.js`
+21 964 B (23 268 B before its comments moved to Code notes below) and `mobile.css` 18 945 B. The JS cap was spec §8's
+22 174 B until phone shell input v2 (2026-10-07, DEF-1733): the working send path, the text keyboard, paste, Copy and
+Paste, the dock, More and hint fixes grew `mobile.js` to 23 456 B MEASURED after the dead `Write` path, the redundant
+focus/blur `is-typing` listeners and the file's header comment were removed and the new code was written compactly
+(`kbd()`, `aria()`), so the cap rose by exactly 1 282 B to that size (`mobile.css` unchanged). The independent
+review's fixes the same day (the filter's Esc-free frames and deltas, replacement ranges, no paste on a picker, only
+the paste end marker neutralised; DEF-1751..DEF-1755) grew it to 24 258 B MEASURED, and the cap rose by exactly those
+802 B again. A laptop or tablet also fetches `browser.js` (3 641 B) and `browser.css` (1 947 B); `test_web_view` pins
+that download at `LAPTOP_TABLET_JS_RATCHET` (27 899 B: 25 605 B plus the same 1 492 + 802 B of `mobile.js` growth)
+and `LAPTOP_TABLET_CSS_CAP` (DEF-1569).
 
 ## Code notes
 
@@ -104,26 +209,50 @@ order.
   (`zellij:mobile-ui` set to `on`); a stored `off` stays.
 - The `HTMLElement.prototype.focus` guard: only a native tap on an input may open the keyboard; it is installed before
   upstream's first terminal or modal.
+- `kbd()` / `aria()`: `window.__zjSoftKbdCapture` and an `aria-label` setter, shared to keep the phone budget.
 - `viewport()`: browser toolbars alone must not mean keyboard mode (`occluded` needs more than 120 px hidden). Zellij's
   input is in a closed shadow root, so `document.activeElement` is its host; `__zjSoftKbdCapture.isFocused` is read
   first.
-- `buildTypingField()`: upstream's capture input stays in its closed shadow root and becomes the real, tappable field.
+- `setKeyboard()`: also the one place **Type here** gets `is-typing`, driven by upstream's own focus/blur listeners
+  (they set `isFocused` and fire `zellij:soft-keyboard-visibility`); the field's own focus/blur listeners were redundant.
+- `buildTypingField()`: upstream's capture input stays in its closed shadow root and becomes the real, tappable field:
+  a text input (DEF-1734); `beforeinput` sends a multi-character `insertText` or any `insertReplacementText` whole,
+  after one DEL per character of `getTargetRanges()[0]` or else the selection (DEF-1753); `paste` sends one bracketed
+  paste (DEF-1735). See Input, keys and clipboard above.
 - `GLYPHS` / `parseCounts()`: counts from the picker sidebar's OSC 2 pane title (spec §6.4).
+- `build()`, the header: the window capture-phase `pointerdown` listener records `menuWas` before upstream's dismiss
+  hook runs, so **More** closes an open menu instead of reopening it (DEF-1738); **Copy** and **Paste** (DEF-1736).
 - `build()`, the `.zj-mobile-modbar` keys: cancel `mousedown`, not `pointerdown` (upstream's `pointerdown` cancel kills
   Safari's touch click on the extra keys).
+- `send()`: the terminal socket through `sendFn` (DEF-1733); queued only while `sendFn` is absent, never after a throw.
+  A `null` in the queue is a pause: what follows waits until 60 ms after the last frame sent (`sentAt`), and `send()`
+  re-arms the one interval to come back (DEF-1751).
+- `paste`: the bracketed paste through `send()`, its end markers neutralised (DEF-1755); nothing on a picker tab, where
+  the sidebar reads a paste as a file drop (DEF-1754).
+- `applyLaneFilter()`: the filter's UTF-8 query as deltas against `laneFilterPrev` — a lone Esc, a pause, `/` and the
+  text for a new query; DELs and the added text for an edit; a lone Esc and a pause to clear (DEF-1751).
+- `clip()`: calls the clipboard API synchronously inside the tap (Safari's user-gesture rule) and hints the result.
+- `screen()`: xterm's selection, else the visible rows of `term.buffer.active` (the WebGL renderer leaves no DOM text).
+- `hint()`: holds the subtitle for eight ticks of the one interval (DEF-1739).
 - `buildQuickRow()` (spec §6.5): `n` and `^C` send after a 400 ms hold, measured from event timestamps with no timer;
-  nothing takes focus.
-- `clearLaneFilter()`: the lone `Esc` leaves the sidebar's filter mode.
+  a cancelled or left key is disarmed and a release needs the key's own press (DEF-1739); nothing takes focus.
+- `updateLaneFilterBar()`: off a picker tab, forgets the query and drops a filter tail still waiting in the queue,
+  sending nothing (the lane has the focus now, DEF-1752); the Esc key's lone `Esc` and pause leave the filter mode.
 - `lanesTheme()`: the shell's own terminal palette for both variants (spec §6.3, DEF-1413).
+- `refresh()`: leaves the subtitle to a live hint, hides **Panes** (and **Paste**, DEF-1754) on a picker tab so the
+  dock's four columns hold its four items (DEF-1737), and flushes the `send()` queue after `updateLaneFilterBar()`, so a
+  filter tail is dropped before it could reach a lane.
 - `connect()`: waits for server state, because an earlier resize throws `InvalidStateError` in 0.45.1. `applyTheme` is
   re-applied after every `SetConfig` (the client calls the chained `__zjSyncInactiveCursorStyle` hook) and on the theme
   toggle.
 - The `zellij:soft-keyboard-visibility` listener: rotation also shrinks the viewport, so the shell sends
   `SoftKeyboardVisibilityChanged` itself to correct upstream's height-only keyboard heuristic.
-- `awaitingClient` (the one `setInterval`, 200 ms, cleared once attached): upstream installs its window hooks just after
-  appending its mobile root.
+- `tick()` / `arm()` (the one `setInterval`, 200 ms): polls `connect()` until attached, because upstream installs its
+  window hooks just after appending its mobile root; `hint()` and a paused `send()` re-arm it; each tick flushes the
+  queue, and it clears itself once attached, with no hint up and no pause waiting.
 
 Validate on Safari/WebKit at 440 × 763 (iPhone 17 Pro Max with browser chrome), 440 × 956 (Home Screen),
 838 × 390 (landscape Safari), and smaller phone widths. Check login, workspace search and switching,
-lane selection, pane navigation, font controls, rotation and the visible viewport while the keyboard opens.
+lane selection, pane navigation, font controls, rotation and the visible viewport while the keyboard opens, and the
+input checklist in the [runbook](../docs/RUNBOOK.md) (text keyboard, quick keys, paste, Copy and Paste).
 Use disposable view sessions and revoke any temporary test token afterward.

package/payload/lanes/web/mobile.js

@@ -1,4 +1,3 @@
-/* Lanes browser shell; see web/README.md, Code notes */
 function laneShellMode({userAgent, coarse, width, height} = {}) {
   if (/iPhone|iPod|Android.*Mobile/i.test(userAgent) || (coarse && (width <= 600 || height <= 500))) return 'phone';
   return coarse ? 'tablet' : 'desktop';
@@ -49,6 +48,8 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     arrow: '<path d="m9 5 7 7-7 7"/>',
     check: '<path d="m5 12 4 4L19 6"/>',
     search: '<circle cx="10.5" cy="10.5" r="6.5"/><path d="m16 16 5 5"/>',
+    copy: '<rect x="9" y="9" width="11" height="11" rx="2"/><path d="M5 15V5h10"/>',
+    paste: '<rect x="5" y="5" width="14" height="16" rx="2"/><path d="M9 3h6v4H9z"/>',
   };
   const svg = name => `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">${icons[name]}</svg>`;
   const make = (tag, cls, text) => {
@@ -61,15 +62,16 @@ if (typeof module === 'object') module.exports = {laneShellMode};
   const button = (label, icon, action) => {
     const el = make('button', 'lanes-button');
     el.type = 'button';
-    el.setAttribute('aria-label', label);
+    aria(el, label);
     el.innerHTML = svg(icon);
     el.append(make('span', '', label));
     el.addEventListener('click', action);
     return el;
   };
-  let shell, heading, subtitle, dock, sheet, list, search, count, lanesButton, typingField, quickRow, quickOn;
-  let laneFilterBar, laneFilterInput, laneFilterPrev = '';
-  let api, term, previousCards = '', sheetOpen = false, returnFocus;
+  let shell, heading, subtitle, dock, sheet, list, search, count, lanesButton, panesButton, pasteKey, typingField, quickRow, quickOn;
+  let laneFilterBar, laneFilterInput, laneFilterPrev = '', sentAt = 0;
+  let api, term, previousCards = '', sheetOpen = false, returnFocus, menuWas, hintN = 0, timer;
+  const queue = [];
   let fontSize = 16;
   try {
     const stored = Number(localStorage.getItem('lanes:font-size'));
@@ -79,6 +81,7 @@ if (typeof module === 'object') module.exports = {laneShellMode};
   const data = () => state()?.data;
   const nativeClick = selector => document.querySelector(selector)?.click();
   const resize = () => window.dispatchEvent(new Event('zellij:rendering-resize'));
+  const kbd = () => window.__zjSoftKbdCapture, aria = (el, label) => el.setAttribute('aria-label', label);
 
   function viewport() {
     const vv = window.visualViewport;
@@ -87,7 +90,7 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     root.style.setProperty('--lanes-offset-top', `${vv?.offsetTop ?? 0}px`);
     root.style.setProperty('--lanes-offset-left', `${vv?.offsetLeft ?? 0}px`);
     const occluded = !!vv && innerHeight - vv.height - vv.offsetTop > 120;
-    const focused = window.__zjSoftKbdCapture?.isFocused || document.activeElement?.matches('input, textarea');
+    const focused = kbd()?.isFocused || document.activeElement?.matches('input, textarea');
     setKeyboard(occluded && focused);
   }
   function setKeyboard(visible) {
@@ -95,10 +98,10 @@ if (typeof module === 'object') module.exports = {laneShellMode};
       root.classList.toggle('lanes-keyboard', !!visible);
       resize();
     }
-    typingField?.classList.toggle('is-typing', !!window.__zjSoftKbdCapture?.isFocused);
+    typingField?.classList.toggle('is-typing', !!kbd()?.isFocused);
   }
   function buildTypingField() {
-    const capture = window.__zjSoftKbdCapture?.element;
+    const capture = kbd()?.element;
     const host = document.getElementById('zj-mobile-capture-host');
     if (!capture || !host) return null;
     const field = make('div', 'lanes-terminal-input');
@@ -109,14 +112,21 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     host.removeAttribute('aria-hidden');
     host.style.cssText = 'position:absolute;inset:0;width:100%;height:100%;opacity:1;pointer-events:auto;';
     capture.removeAttribute('aria-hidden');
-    capture.setAttribute('aria-label', 'Type in terminal');
+    aria(capture, 'Type in terminal');
+    for (const a of ['type text', 'autocomplete off', 'autocapitalize none']) capture.setAttribute(...a.split(' '));
     capture.tabIndex = 0;
     capture.style.cssText = 'position:absolute;inset:0;width:100%;height:100%;box-sizing:border-box;font-size:16px;' +
       'border:0;border-radius:12px;padding:0;margin:0;opacity:1;background:transparent;color:transparent;' +
       'caret-color:transparent;outline:none;pointer-events:auto;user-select:text;-webkit-user-select:text;';
     field.append(label, host);
-    capture.addEventListener('focus', () => field.classList.add('is-typing'));
-    capture.addEventListener('blur', () => field.classList.remove('is-typing'));
+    capture.addEventListener('beforeinput', ev => {
+      const t = ev.data ?? ev.dataTransfer?.getData('text'), r = ev.getTargetRanges?.()[0];
+      if (ev.cancelable && t && (ev.inputType == 'insertReplacementText' || ev.inputType == 'insertText' && t.length > 1)) {
+        ev.preventDefault();
+        send('\x7f'.repeat(r ? r.endOffset - r.startOffset : capture.selectionEnd - capture.selectionStart) + t);
+      }
+    });
+    capture.addEventListener('paste', ev => { ev.preventDefault(); paste(ev.clipboardData.getData('text')); });
     return field;
   }
   function focusTab(tab) {
@@ -153,7 +163,7 @@ if (typeof module === 'object') module.exports = {laneShellMode};
   }
   function openSheet() {
     returnFocus = document.activeElement;
-    window.__zjSoftKbdCapture?.element.blur();
+    kbd()?.element.blur();
     document.activeElement?.blur();
     sheetOpen = true;
     sheet.hidden = false;
@@ -188,7 +198,7 @@ if (typeof module === 'object') module.exports = {laneShellMode};
       const active = item.name === activeName;
       const card = make('button', `lanes-workspace${active ? ' is-current' : ''}`);
       card.type = 'button';
-      card.setAttribute('aria-label', `${item.name}${active ? ', current workspace' : ''}`);
+      aria(card, `${item.name}${active ? ', current workspace' : ''}`);
       if (active) card.setAttribute('aria-current', 'true');
       const monogram = make('span', 'lanes-monogram', Array.from(item.name)[0]?.toUpperCase() || 'L');
       const copy = make('span', 'lanes-workspace-copy');
@@ -211,22 +221,26 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     const brand = make('img', 'lanes-brand');
     brand.src = '/lanes-assets/icon.svg'; brand.alt = 'Lanes';
     const context = make('button', 'lanes-context');
-    context.type = 'button'; context.setAttribute('aria-label', 'Choose workspace');
+    context.type = 'button'; aria(context, 'Choose workspace');
     heading = make('strong', '', 'Lanes'); subtitle = make('span', '', 'Connecting…');
     context.append(heading, subtitle); context.addEventListener('click', openSheet);
-    const more = button('More options', 'more', () => nativeClick('.zj-hamburger'));
-    more.classList.add('lanes-more');
-    header.append(brand, context, more);
-    dock = make('nav', 'lanes-dock'); dock.setAttribute('aria-label', 'Workspace controls');
+    addEventListener('pointerdown', () => { menuWas = document.querySelector('.zj-mobile-menu.zj-open'); }, true);
+    const more = button('More options', 'more', () => menuWas ? menuWas = null : nativeClick('.zj-hamburger'));
+    const copyKey = button('Copy screen', 'copy', () => clip(c => c.writeText(screen()), () => hint('Copied')));
+    pasteKey = button('Paste', 'paste', () => clip(c => c.readText(), t => paste(t) && hint('Pasted')));
+    for (const b of [copyKey, pasteKey, more]) b.classList.add('lanes-more');
+    for (const b of [copyKey, pasteKey]) b.addEventListener('mousedown', ev => ev.preventDefault());
+    header.append(brand, context, copyKey, pasteKey, more);
+    dock = make('nav', 'lanes-dock'); aria(dock, 'Workspace controls');
     const spaces = button('Workspaces', 'workspaces', openSheet);
     lanesButton = button('Lanes', 'lanes', () => {
       const picker = pickerTab((currentTab()?.name || '').replace(/ ☰$/, ''));
       if (picker) focusTab(picker); else openSheet();
     });
-    const panes = button('Panes', 'panes', () => nativeClick('.zj-pane'));
+    panesButton = button('Panes', 'panes', () => nativeClick('.zj-pane'));
     typingField = buildTypingField();
     laneFilterBar = buildLaneFilterBar();
-    dock.append(spaces, lanesButton, panes, laneFilterBar, typingField);
+    dock.append(spaces, lanesButton, panesButton, laneFilterBar, typingField);
     sheet = make('div', 'lanes-sheet'); sheet.hidden = true;
     sheet.setAttribute('role', 'dialog'); sheet.setAttribute('aria-labelledby', 'lanes-sheet-title');
     const panel = make('section', 'lanes-sheet-panel');
@@ -240,7 +254,7 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     searchWrap.innerHTML = svg('search');
     search = make('input'); search.type = 'search'; search.placeholder = 'Find a workspace';
     search.autocomplete = 'off'; search.spellcheck = false;
-    search.setAttribute('aria-label', 'Find a workspace');
+    aria(search, 'Find a workspace');
     search.addEventListener('input', renderCards); searchWrap.append(search);
     list = make('div', 'lanes-workspaces');
     const sessionButton = make('button', 'lanes-session-link', 'Switch session');
@@ -266,51 +280,71 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     installFontControls();
     resize();
   }
-  function sendToTerminal(bytes) {
-    try { window.__zjSendControl?.({type: 'Write', bytes}); } catch (_) {}
+  function send(...frames) {
+    const f = kbd()?.sendFn;
+    queue.push(...frames);
+    if (f) try {
+      while (queue.length) {
+        if (queue[0] !== null) { f(queue.shift()); sentAt = Date.now(); }
+        else if (Date.now() - sentAt < 60) return arm();
+        else queue.shift();
+      }
+    } catch (_) { queue.length = 0; }
+  }
+  const paste = t => currentTab()?.name.endsWith(' ☰') ? hint('Open a lane to paste') :
+    (send('\x1b[200~' + t.replace(/\x1b+(?=\[201~)/g, '').replace(/\r?\n/g, '\r') + '\x1b[201~'), 1);
+  function applyLaneFilter(value) {
+    const q = [...new TextDecoder().decode(new TextEncoder().encode(value).filter(b => b > 31 && b != 127))];
+    const p = [...laneFilterPrev], s = q.join('');
+    if (s === laneFilterPrev) return;
+    let i = 0;
+    while (i < p.length && p[i] === q[i]) i++;
+    laneFilterPrev = s;
+    if (!s) send('\x1b', null);
+    else if (!p.length) send('\x1b', null, '/', s);
+    else send('\x7f'.repeat(p.length - i) + q.slice(i).join(''));
+  }
+  async function clip(f, ok) {
+    try { ok(await f(navigator.clipboard)); } catch (_) { hint('Clipboard blocked'); }
   }
-  function applyLaneFilter(query) {
-    const bytes = [...new TextEncoder().encode(query)].filter(b => b >= 0x20 && b !== 0x7f);
-    sendToTerminal([0x1b, 0x2f, ...bytes]);
+  function screen() {
+    if (term.hasSelection()) return term.getSelection();
+    const b = term.buffer.active, rows = [];
+    for (let i = 0; i < term.rows; i++) rows.push(b.getLine(b.viewportY + i)?.translateToString(true));
+    return rows.join('\n').trimEnd();
   }
+  function hint(s) { text(subtitle, s); hintN = 8; arm(); }
   function buildQuickRow() {
     const row = make('div', 'lanes-quick');
     row.hidden = true;
-    for (const [label, bytes, name, hold] of [['⏎', [13], 'Enter'], ['y', [121]], ['n', [110], 0, 1], ['Esc', [27]],
-      ['^C', [3], 'Control C', 1], ['↑', [27, 91, 65], 'Up'], ['↓', [27, 91, 66], 'Down']]) {
-      const key = make('button', hold ? 'is-destructive' : '', label);
+    for (const [label, key, name, hold] of [['⏎', '\r', 'Enter'], ['y'], ['n', 0, 0, 1], ['Esc', '\x1b'],
+      ['^C', '\x03', 'Control C', 1], ['↑', '\x1b[A', 'Up'], ['↓', '\x1b[B', 'Down']]) {
+      const b = make('button', hold ? 'is-destructive' : '', label);
       let down = -1;
-      key.type = 'button'; if (name) key.setAttribute('aria-label', name);
-      key.addEventListener('mousedown', ev => ev.preventDefault());
-      key.addEventListener('pointerdown', ev => { down = ev.timeStamp; });
-      key.addEventListener('pointerup', ev => {
-        if (!hold || (down >= 0 && ev.timeStamp - down >= 400)) sendToTerminal(bytes); else text(subtitle, 'Hold to send');
+      b.type = 'button'; if (name) aria(b, name);
+      b.addEventListener('mousedown', ev => ev.preventDefault());
+      b.addEventListener('pointerdown', ev => { down = ev.timeStamp; });
+      for (const t of ['pointercancel', 'pointerleave']) b.addEventListener(t, () => { down = -1; });
+      b.addEventListener('pointerup', ev => {
+        if (down >= 0) !hold || ev.timeStamp - down >= 400 ? send(key || label) : hint('Hold to send');
         down = -1;
       });
-      row.append(key);
+      row.append(b);
     }
     return row;
   }
-  function clearLaneFilter() {
-    sendToTerminal([0x1b]);
-    laneFilterPrev = '';
-    if (laneFilterInput) laneFilterInput.value = '';
-  }
   function buildLaneFilterBar() {
     const bar = make('div', 'lanes-filter-bar');
-    bar.setAttribute('aria-label', 'Filter lanes');
+    aria(bar, 'Filter lanes');
     bar.hidden = true;
     bar.innerHTML = svg('search');
     laneFilterInput = make('input');
     laneFilterInput.type = 'search'; laneFilterInput.placeholder = 'Filter lanes';
     laneFilterInput.autocomplete = 'off'; laneFilterInput.spellcheck = false;
-    laneFilterInput.setAttribute('aria-label', 'Filter lanes in this workspace');
-    laneFilterInput.addEventListener('input', () => {
-      const q = laneFilterInput.value;
-      if (q !== laneFilterPrev) { applyLaneFilter(q); laneFilterPrev = q; }
-    });
+    aria(laneFilterInput, 'Filter lanes in this workspace');
+    laneFilterInput.addEventListener('input', () => applyLaneFilter(laneFilterInput.value));
     laneFilterInput.addEventListener('keydown', ev => {
-      if (ev.key === 'Escape') { ev.preventDefault(); clearLaneFilter(); laneFilterInput.blur(); }
+      if (ev.key === 'Escape') { ev.preventDefault(); send('\x1b', null); laneFilterPrev = laneFilterInput.value = ''; laneFilterInput.blur(); }
       if (ev.key === 'Enter') { ev.preventDefault(); laneFilterInput.blur(); }
     });
     bar.append(laneFilterInput);
@@ -319,7 +353,10 @@ if (typeof module === 'object') module.exports = {laneShellMode};
   function updateLaneFilterBar(isPicker) {
     if (!laneFilterBar) return;
     laneFilterBar.hidden = !isPicker;
-    if (!isPicker && laneFilterPrev) clearLaneFilter();
+    if (isPicker) return;
+    const wait = queue.indexOf(null);
+    if (wait >= 0) queue.length = wait;
+    laneFilterPrev = laneFilterInput.value = '';
   }
   function applyFont() {
     term.options.fontSize = fontSize;
@@ -343,8 +380,8 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     const row = make('div', 'lanes-font-controls');
     row.append(make('span', '', 'Text size'));
     const smaller = make('button', '', 'A−'), larger = make('button', '', 'A+');
-    smaller.setAttribute('aria-label', 'Smaller terminal text');
-    larger.setAttribute('aria-label', 'Larger terminal text');
+    aria(smaller, 'Smaller terminal text');
+    aria(larger, 'Larger terminal text');
     const value = make('output', '', `${fontSize} px`); value.id = 'lanes-font-value';
     smaller.addEventListener('click', () => {fontSize = Math.max(14, fontSize - 1); applyFont();});
     larger.addEventListener('click', () => {fontSize = Math.min(24, fontSize + 1); applyFont();});
@@ -363,11 +400,13 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     const counts = parseCounts(pickerTitle(name));
     const chips = countParts(counts).map(([glyph, n]) => glyph + n).join(' ');
     text(heading, name);
-    text(subtitle, picker ? chips || 'Choose a lane to continue' : pane?.title || 'Your workspace');
+    if (!hintN) text(subtitle, picker ? chips || 'Choose a lane to continue' : pane?.title || 'Your workspace');
     lanesButton.setAttribute('aria-pressed', String(!!picker));
+    panesButton.hidden = pasteKey.hidden = !!picker;
     const needs = counts ? counts.approval + counts.input : 0;
     if (needs) lanesButton.dataset.count = String(needs); else delete lanesButton.dataset.count;
     updateLaneFilterBar(picker);
+    send();
     const quick = active && !picker;
     if (quick !== quickOn) {
       quickOn = quick;
@@ -379,7 +418,7 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     renderCards();
   }
   function connect() {
-    if (api || !window.__zjMobileUi || !window.term || !window.__zjSoftKbdCapture?.element) return;
+    if (api || !window.__zjMobileUi || !window.term || !kbd()?.element) return;
     if (!window.__zjMobileUi.getState()?.data?.tabs?.length) return;
     api = window.__zjMobileUi; term = window.term;
     build(); applyFont(); applyTheme();
@@ -396,7 +435,7 @@ if (typeof module === 'object') module.exports = {laneShellMode};
     const token = document.getElementById('token');
     if (!token || token.dataset.lanes) return;
     token.dataset.lanes = 'true';
-    token.autocomplete = 'current-password'; token.setAttribute('aria-label', 'Login token');
+    token.autocomplete = 'current-password'; aria(token, 'Login token');
     token.closest('.security-modal-content').querySelector('h3').textContent = 'Connect to Lanes';
     token.closest('.security-modal-content').querySelector('.submit-btn').textContent = 'Connect';
   }
@@ -412,6 +451,7 @@ if (typeof module === 'object') module.exports = {laneShellMode};
   });
   document.addEventListener('focusout', () => requestAnimationFrame(viewport));
   new MutationObserver(() => {styleLogin(); connect();}).observe(document.body, {childList: true});
-  const awaitingClient = setInterval(() => {connect(); if (api) clearInterval(awaitingClient);}, 200);
-  styleLogin(); connect();
+  function tick() { connect(); send(); if (hintN && !--hintN) refresh(); if (api && !hintN && queue[0] !== null) timer = clearInterval(timer); }
+  function arm() { timer ||= setInterval(tick, 200); }
+  arm(); styleLogin(); connect();
 })();

package/payload/lanes/workspaces.example/README.md

@@ -6,7 +6,12 @@ The server reads its boards from a **site directory**, not from the package:
 2. `~/.config/lanes/workspaces/` on the server, if it contains a `catalog.json`;
 3. `workspaces/` inside the checkout (what a single-site checkout uses).
 
-Copy this folder to `~/.config/lanes/workspaces/` and edit it.
+Copy this folder to `~/.config/lanes/workspaces/` and edit it, or let the server write a one-repository board for you:
+`lanes workspaces add <id> --container <name> --repo /home/coder/<repo> [--title T] [--write]` appends the board to
+`catalog.json` (keeping a `catalog.json.bak-<UTC>Z` copy on the first write) and creates its `workspaces.<id>.json`.
+It is a dry run until `--write`. An id that is already in the catalog is checked and never rewritten. A repository
+belongs to one board: one that another board already declares is refused, since `lanes cursor-sync` rewrites a
+repository's `terminals.json` (and a `cursor` file) for every board that names it. Keep that rule when editing by hand.
 
 | File | What it says |
 |---|---|

package/payload/manifest.json

@@ -1,8 +1,8 @@
 {
  "name": "@vibelord/lanes",
- "version": "1.0.4",
- "commit": "6b92bcb292e4123f2d723f0fe9da209642c2f2a2",
- "digest": "sha256:130e2da52ee8a4999a51e351c4bf3faef4a1d9e309ebd946e04c861742dfa719",
+ "version": "1.1.1",
+ "commit": "34ec2d7ba9a5f13e72c812d3e2fce116e170e260",
+ "digest": "sha256:c10719aaa2279205460136ed3589f349d1e22dce32ddfb77584586d68ae1b3a4",
  "executables": [
   "bin/lanes",
   "client/install.sh",
@@ -32,5 +32,8 @@
  ],
  "sites": [
   "beyondwork"
- ]
+ ],
+ "site_codes": {
+  "LN": "beyondwork"
+ }
 }