ai-or-die 0.1.94 → 0.1.96

package/bin/ai-or-die.js

@@ -46,7 +46,8 @@ program
   .option('--sticky-notes-model <url>', 'override the sticky-note model GGUF download URL')
   .option('--sticky-notes-threads <number>', 'CPU threads for sticky-note inference (default: auto — three-quarters of the cores on CPU, gentle on GPU)')
   .option('--no-keepalive', 'disable keeping the machine awake while the server runs (Windows only; on by default)')
-  .option('--keepalive-display', 'also keep the display on (default keeps the system awake but lets the monitor sleep)');
+  .option('--keepalive-display', 'also keep the display on (default keeps the system awake but lets the monitor sleep)')
+  .option('--disable-hibernation', 'disable OS hibernation + set sleep/hibernate timeouts to Never via elevated powercfg (Windows only; off by default; prompts for UAC; needed to stop host-initiated hibernation on Hyper-V guests)');
 
 // Auto-open is OFF by default and opt-in via --open. Legacy callers may still pass
 // --no-open (the old opt-out flag); filter it out so it parses harmlessly as a no-op.
@@ -138,6 +139,10 @@ async function main() {
       // the display on.
       keepalive: options.keepalive !== false && process.env.AIORDIE_DISABLE_KEEPALIVE !== '1',
       keepaliveDisplay: options.keepaliveDisplay === true || process.env.AIORDIE_KEEPALIVE_DISPLAY === '1',
+      // Opt-in: disable OS hibernation (+ sleep/hibernate timeouts -> Never) via
+      // an elevated powercfg. Off by default. The wake assertion can't block a
+      // host-initiated hibernate (Hyper-V vmicshutdown); this removes the target.
+      disableHibernation: options.disableHibernation === true || process.env.AIORDIE_DISABLE_HIBERNATION === '1',
       // Mesh binds loopback-only always: the tailnet `serve` proxy reaches the
       // port, the LAN never does (even with --https). Other modes: all interfaces.
       bindHost: options.mesh ? '127.0.0.1' : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-or-die",
-  "version": "0.1.94",
+  "version": "0.1.96",
   "description": "Universal AI coding terminal — Claude, Copilot, Gemini & more in your browser",
   "main": "src/server.js",
   "bin": {

package/src/hibernation-guard.js

@@ -0,0 +1,202 @@
+'use strict';
+
+const childProcess = require('child_process');
+const KeepaliveManager = require('./keepalive-manager');
+
+// Opt-in remediation for HOST-INITIATED sleep on Windows (primarily Hyper-V
+// guests). The keepalive wake assertion (SetThreadExecutionState /
+// PowerRequestSystemRequired) only suppresses the IDLE timer; Windows documents
+// that it "cannot be used to prevent ... standby or hibernate" when the suspend
+// is requested programmatically. On a Hyper-V guest, the host's Guest Shutdown
+// Service (`vmicshutdown`) requests hibernation through the Application API,
+// which the assertion cannot block. The only reliable fix is to remove the sleep
+// target itself: `powercfg /hibernate off` (+ sleep/hibernate timeouts -> Never).
+// On a Hyper-V guest S3 standby is typically unavailable, so disabling S4
+// hibernate eliminates the vector entirely.
+//
+// That is a PRIVILEGED, PERSISTENT machine change (survives our process exit;
+// reversible with `powercfg /hibernate on`), so it is OFF by default and gated
+// behind --disable-hibernation / AIORDIE_DISABLE_HIBERNATION=1. When enabled, one
+// long-lived in-box `powershell.exe` (spawned like the keepalive helper) runs
+// ONCE at startup:
+//   1. Reads HKLM\...\Power\HibernateEnabled (non-privileged). If already 0 it
+//      prints SKIPPED and exits -- no UAC prompt, so a machine that is already
+//      configured never prompts again.
+//   2. Otherwise it launches an ELEVATED cmd.exe via `Start-Process -Verb RunAs`
+//      (UAC is the OS approve/deny; the flag is the user's pre-approval) that runs
+//      the powercfg remediation, then prints APPLIED / DENIED / ERROR.
+// Best-effort and non-fatal: a denied UAC prompt, a headless/remote session with
+// no interactive desktop, or any spawn failure logs a warning and the server
+// continues normally. Never throws into startup. Windows-only; instant no-op on
+// macOS/Linux. See docs/specs/keepalive.md and docs/adrs/0030-hibernation-guard.md.
+
+// The remediation, chained under ONE elevation (one UAC prompt) via `cmd /c a & b`.
+// All constants (no user input), so there is no command-injection surface. `& `
+// runs every command regardless of a prior one's exit; success is judged by
+// re-reading HibernateEnabled afterward (not the chain's exit code, which only
+// reflects the last command), so an early failure can't be masked.
+const REMEDIATION = [
+  'powercfg /hibernate off',
+  'powercfg /change standby-timeout-ac 0',
+  'powercfg /change standby-timeout-dc 0',
+  'powercfg /change hibernate-timeout-ac 0',
+  'powercfg /change hibernate-timeout-dc 0',
+];
+
+const READY_TIMEOUT_MS = 60000;
+
+class HibernationGuard {
+  constructor(options = {}) {
+    this._enabled = !!options.enabled;
+    this._platform = options.platform || process.platform;
+    this._spawn = options.spawn || childProcess.spawn;
+    this._logger = options.logger || console;
+    this._readyTimeoutMs = options.readyTimeoutMs || READY_TIMEOUT_MS;
+
+    this._ran = false;
+    this._child = null;
+  }
+
+  // ---- pure builders (static so tests assert them without spawning) ----
+
+  static buildScript(ppid = process.pid) {
+    const argline = '/c ' + REMEDIATION.join(' & ');
+    return [
+      // 'Stop' turns a blocked/failed cmdlet into a caught terminating error
+      // rather than a silent partial run.
+      `$ErrorActionPreference = 'Stop'`,
+      // Trusted-integer parent-PID tag for triage (never user input).
+      `# aod-hibernation ppid=${ppid}`,
+      // (1) Non-privileged detect. Skip (no UAC) when hibernate is already off.
+      `$he = $null`,
+      `try { $he = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Power' -Name 'HibernateEnabled' -ErrorAction Stop).HibernateEnabled } catch { $he = $null }`,
+      `if ($he -eq 0) { [Console]::Out.WriteLine('SKIPPED'); exit 0 }`,
+      // (2) One elevated cmd.exe runs the whole powercfg chain under a single UAC
+      // prompt. Absolute cmd path (PATH-hijack hardening). WaitForExit + ExitCode
+      // is more reliable than -Wait with -Verb RunAs for reading the result.
+      `$cmd = Join-Path $env:SystemRoot 'System32\\cmd.exe'`,
+      `$argline = '${argline}'`,
+      `try {`,
+      `  $p = Start-Process -FilePath $cmd -Verb RunAs -WindowStyle Hidden -PassThru -ArgumentList $argline`,
+      `  $p.WaitForExit()`,
+      // Verify the critical end-state directly rather than trusting the exit code:
+      // `cmd /c a & b & c` reports only the LAST command's exit, so an early
+      // failure could be masked. APPLIED iff hibernation is now actually off.
+      `  $after = $null`,
+      `  try { $after = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Power' -Name 'HibernateEnabled' -ErrorAction Stop).HibernateEnabled } catch { $after = $null }`,
+      `  if ($after -eq 0) { [Console]::Out.WriteLine('APPLIED') } else { [Console]::Out.WriteLine('ERROR'); [Console]::Error.WriteLine('hibernate still enabled after powercfg (exit=' + $p.ExitCode + ')') }`,
+      `} catch {`,
+      // Detect a declined UAC by the Win32 error code (1223 = ERROR_CANCELLED),
+      // locale-independent; walk the inner-exception chain, then fall back to text.
+      `  $cancelled = $false`,
+      `  $e = $_.Exception`,
+      `  while ($null -ne $e) { if (($e -is [System.ComponentModel.Win32Exception]) -and ($e.NativeErrorCode -eq 1223)) { $cancelled = $true; break }; $e = $e.InnerException }`,
+      `  if (-not $cancelled -and $_.Exception.Message -match 'cancel') { $cancelled = $true }`,
+      `  if ($cancelled) { [Console]::Out.WriteLine('DENIED') } else { [Console]::Out.WriteLine('ERROR'); [Console]::Error.WriteLine($_.Exception.Message) }`,
+      `}`,
+    ].join('\n');
+  }
+
+  static buildArgs(ppid = process.pid) {
+    return [
+      '-NoProfile',
+      '-NonInteractive',
+      '-ExecutionPolicy', 'Bypass',
+      '-Command', HibernationGuard.buildScript(ppid),
+    ];
+  }
+
+  // Attempt the remediation once. No-op unless enabled on win32. Idempotent.
+  // Fire-and-forget: the server never awaits this (the UAC prompt is interactive
+  // and may take a while). Never throws.
+  run() {
+    if (this._ran) return;
+    if (!this._enabled || this._platform !== 'win32') return;
+    this._ran = true;
+
+    try {
+      const ps = KeepaliveManager.powershellPath();
+      const args = HibernationGuard.buildArgs();
+      const child = this._spawn(ps, args, {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+        shell: false,
+      });
+      this._child = child;
+
+      // Never let the helper pin the parent's event loop.
+      this._safe(() => child.unref());
+      this._safe(() => child.stdout && child.stdout.unref && child.stdout.unref());
+      this._safe(() => child.stderr && child.stderr.unref && child.stderr.unref());
+
+      let out = '';
+      let err = '';
+      if (child.stdout) {
+        this._safe(() => child.stdout.setEncoding && child.stdout.setEncoding('utf8'));
+        child.stdout.on('data', (d) => { out += String(d); });
+        child.stdout.on('error', () => {});
+      }
+      if (child.stderr) {
+        this._safe(() => child.stderr.setEncoding && child.stderr.setEncoding('utf8'));
+        child.stderr.on('data', (d) => { err += String(d); });
+        child.stderr.on('error', () => {});
+      }
+
+      let settled = false;
+      const finish = (status, hint) => {
+        if (settled) return;
+        settled = true;
+        this._safe(() => clearTimeout(timer));
+        if (this._child === child) this._child = null;
+        this._logOutcome(status, hint);
+      };
+
+      // The UAC prompt blocks the helper until the user responds; only reap after
+      // a generous timeout so a genuinely stuck helper cannot linger forever.
+      const timer = setTimeout(() => {
+        finish('ERROR', 'timed out waiting for the elevation prompt');
+        this._safe(() => child.kill && child.kill());
+      }, this._readyTimeoutMs);
+      if (timer.unref) timer.unref();
+
+      child.on('error', (e) => finish('ERROR', (e && e.message) || 'spawn error'));
+      child.on('close', () => {
+        const m = out.match(/\b(APPLIED|SKIPPED|DENIED|ERROR)\b/);
+        finish(m ? m[1] : 'ERROR', err.trim());
+      });
+    } catch (err) {
+      this._child = null;
+      this._safe(() => this._logger.debug && this._logger.debug(
+        'hibernation-guard: failed to start (continuing):', err && err.message));
+    }
+  }
+
+  _logOutcome(status, hint) {
+    const L = this._logger;
+    switch (status) {
+      case 'APPLIED':
+        this._safe(() => L.log && L.log(
+          'hibernation guard: hibernation disabled + sleep/hibernate timeouts set to Never (host-initiated hibernation suppressed)'));
+        break;
+      case 'SKIPPED':
+        this._safe(() => L.log && L.log(
+          'hibernation guard: hibernation already disabled — nothing to do'));
+        break;
+      case 'DENIED':
+        this._safe(() => L.warn && L.warn(
+          '⚠  hibernation guard: elevation declined — hibernation left enabled. A Hyper-V host can still hibernate this machine. Run `powercfg /hibernate off` as admin, or relaunch without --disable-hibernation.'));
+        break;
+      default:
+        this._safe(() => L.warn && L.warn(
+          `⚠  hibernation guard: could not disable hibernation${hint ? ` (${hint})` : ''}; the host may still hibernate this machine. Run \`powercfg /hibernate off\` as admin.`));
+        break;
+    }
+  }
+
+  _safe(fn) {
+    try { return fn(); } catch (_) { /* the guard must never throw into the caller */ }
+  }
+}
+
+module.exports = HibernationGuard;
+module.exports.REMEDIATION = REMEDIATION;

package/src/keepalive-manager.js

@@ -6,15 +6,26 @@ const path = require('path');
 // Keep the host machine awake while the ai-or-die server runs (Windows 11).
 //
 // Mechanism: spawn ONE long-lived Windows PowerShell (5.1, in-box) helper that
-// P/Invokes SetThreadExecutionState from kernel32.dll to hold a power
-// assertion, then blocks on stdin. When the parent closes stdin (graceful
-// release) OR dies (the OS tears down the pipe -> ReadLine() returns null), the
-// helper clears the assertion and exits. Windows also drops a thread's
-// execution-state flags when the holding process dies, so even taskkill /F
-// cannot leak the assertion past reboot. No native deps, no powercfg.
+// holds TWO redundant kernel32 power assertions, then blocks on stdin:
+//   1. SetThreadExecutionState(ES_CONTINUOUS | ES_SYSTEM_REQUIRED) -- the legacy
+//      per-thread assertion (shows in `powercfg /requests` with no reason text).
+//   2. PowerCreateRequest + PowerSetRequest(PowerRequestSystemRequired) with a
+//      REASON_CONTEXT SimpleReasonString of "GitHub Copilot CLI session active".
+//      This is the exact API + reason string the GitHub Copilot CLI /keep-alive
+//      registers (its bundled cli-native.node calls the same kernel32 Power*
+//      functions with that wide string), so `powercfg /requests` shows a
+//      byte-identical "GitHub Copilot CLI session active" line.
+// Holding both is deliberate belt-and-suspenders (chosen over Power*-only): if
+// either API is refused at runtime the other still keeps the machine awake. The
+// helper prints OK once AT LEAST ONE assertion is held. When the parent closes
+// stdin (graceful release) OR dies (the OS tears down the pipe -> ReadLine()
+// returns null), the helper clears both and exits. Windows also drops a thread's
+// execution-state flags AND releases a process's power requests when the holding
+// process dies, so even taskkill /F cannot leak past reboot. No native deps.
 //
 // Windows-only by design; an instant no-op on macOS/Linux. See
-// docs/specs/keepalive.md and docs/adrs/0028-windows-keepalive.md.
+// docs/specs/keepalive.md and
+// docs/adrs/0029-windows-keepalive-power-request.md (supersedes ADR-0028).
 
 // SetThreadExecutionState flags as DECIMAL uint32 literals. PowerShell 5.1
 // parses 0x80000001 as a negative Int32 and the [uint32] cast then throws, so
@@ -26,6 +37,15 @@ const ES_CONTINUOUS = 2147483648;
 const ES_SYSTEM = 2147483649;
 const ES_SYSTEM_DISPLAY = 2147483651;
 
+// POWER_REQUEST_TYPE enum values passed to PowerSetRequest / PowerClearRequest.
+// Small ints, so no PS 5.1 hex/Int32 parsing hazard (unlike the ES_ flags).
+const PR_DISPLAY = 0; // PowerRequestDisplayRequired
+const PR_SYSTEM = 1;  // PowerRequestSystemRequired
+
+// REASON_CONTEXT.SimpleReasonString shown by `powercfg /requests`. Byte-for-byte
+// the string the GitHub Copilot CLI registers, so the entry is indistinguishable.
+const KEEPALIVE_REASON = 'GitHub Copilot CLI session active';
+
 const READY_TIMEOUT_MS = 5000;
 
 class KeepaliveManager {
@@ -52,7 +72,25 @@ class KeepaliveManager {
   // ---- pure builders (static so tests assert them without spawning) ----
 
   static buildScript(displayRequired, ppid = process.pid) {
-    const assert = displayRequired ? ES_SYSTEM_DISPLAY : ES_SYSTEM;
+    const stesAssert = displayRequired ? ES_SYSTEM_DISPLAY : ES_SYSTEM;
+    // One Add-Type carrying the REASON_CONTEXT struct (SIMPLE_STRING layout:
+    // Version + Flags + a single LPWStr) and the four kernel32 P/Invokes.
+    // Attributes are fully qualified so the compile never depends on Add-Type's
+    // default `using`s. The native REASON_CONTEXT is a union (SimpleReasonString
+    // XOR a larger Detailed struct); we only ever use SIMPLE_STRING, but two
+    // long pad fields make the marshalled struct >= the native union size
+    // (32 bytes x64 / 28 x86) so PowerCreateRequest can never read past the [In]
+    // buffer. Marshalling verified on a real Windows host.
+    const members = [
+      '[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential, CharSet = System.Runtime.InteropServices.CharSet.Unicode)]',
+      'public struct REASON_CONTEXT { public uint Version; public uint Flags; [System.Runtime.InteropServices.MarshalAs(System.Runtime.InteropServices.UnmanagedType.LPWStr)] public string Reason; public long Pad0; public long Pad1; }',
+      '[System.Runtime.InteropServices.DllImport("kernel32.dll")] public static extern uint SetThreadExecutionState(uint e);',
+      '[System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError = true)] public static extern System.IntPtr PowerCreateRequest(ref REASON_CONTEXT Context);',
+      '[System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError = true)] public static extern bool PowerSetRequest(System.IntPtr PowerRequest, int RequestType);',
+      '[System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError = true)] public static extern bool PowerClearRequest(System.IntPtr PowerRequest, int RequestType);',
+      '[System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError = true)] public static extern bool CloseHandle(System.IntPtr hObject);',
+    ].join('\n');
+
     return [
       // 'Stop' is load-bearing: under Constrained Language Mode / WDAC /
       // AppLocker / EDR, Add-Type (which writes a .cs to %TEMP% and shells to
@@ -65,13 +103,39 @@ class KeepaliveManager {
       // input) so a stale/orphaned helper is identifiable for triage:
       //   Get-CimInstance Win32_Process -Filter "Name='powershell.exe'"
       `# aod-keepalive ppid=${ppid}`,
-      `Add-Type -Name P -Namespace W -MemberDefinition '[System.Runtime.InteropServices.DllImport("kernel32.dll")] public static extern uint SetThreadExecutionState(uint e);'`,
-      // exit 1 when the assertion is refused so the helper never blocks on
-      // stdin WITHOUT actually holding the assertion (which would otherwise
-      // latch us "started" while the machine can still sleep).
-      `if ([W.P]::SetThreadExecutionState([uint32]${assert}) -ne 0) { [Console]::Out.WriteLine('OK'); [Console]::Out.Flush() } else { [Console]::Error.WriteLine('SetThreadExecutionState returned 0'); exit 1 }`,
+      `Add-Type -Name P -Namespace W -MemberDefinition '${members}'`,
+      `$held = $false`,
+      // (1) Legacy per-thread assertion. Redundant safety net; carries no name in
+      // `powercfg /requests`.
+      `if ([W.P]::SetThreadExecutionState([uint32]${stesAssert}) -ne 0) { $held = $true }`,
+      // (2) Named power request -- this is the "GitHub Copilot CLI session active"
+      // line. Flags=1 is POWER_REQUEST_CONTEXT_SIMPLE_STRING; Version=0.
+      `$ctx = New-Object 'W.P+REASON_CONTEXT'`,
+      `$ctx.Version = 0`,
+      `$ctx.Flags = 1`,
+      `$ctx.Reason = '${KEEPALIVE_REASON}'`,
+      `$h = [W.P]::PowerCreateRequest([ref]$ctx)`,
+      // PowerCreateRequest returns NULL or INVALID_HANDLE_VALUE (-1) on failure.
+      `$hv = $h.ToInt64()`,
+      `$powerSys = $false`,
+      ...(displayRequired ? [`$powerDisp = $false`] : []),
+      // Set each request type independently so "at least one held" counts a
+      // display-only success too, and each is cleared only if it was set.
+      `if ($hv -ne 0 -and $hv -ne -1) {`,
+      `  if ([W.P]::PowerSetRequest($h, ${PR_SYSTEM})) { $held = $true; $powerSys = $true }`,
+      ...(displayRequired ? [`  if ([W.P]::PowerSetRequest($h, ${PR_DISPLAY})) { $held = $true; $powerDisp = $true }`] : []),
+      `}`,
+      // Only latch "started" (block on stdin) when SOMETHING is actually held, so
+      // a total failure surfaces as ready=false instead of a silent awake-less
+      // block. Close a valid-but-unused handle before exiting so nothing lingers.
+      `if (-not $held) { if ($hv -ne 0 -and $hv -ne -1) { [void][W.P]::CloseHandle($h) } [Console]::Error.WriteLine('SetThreadExecutionState and PowerSetRequest both failed'); exit 1 }`,
+      `[Console]::Out.WriteLine('OK'); [Console]::Out.Flush()`,
       `while ($null -ne [Console]::In.ReadLine()) {}`,
+      // Release each held assertion on EOF; process death also drops all of them.
       `[void][W.P]::SetThreadExecutionState([uint32]${ES_CONTINUOUS})`,
+      `if ($powerSys) { [void][W.P]::PowerClearRequest($h, ${PR_SYSTEM}) }`,
+      ...(displayRequired ? [`if ($powerDisp) { [void][W.P]::PowerClearRequest($h, ${PR_DISPLAY}) }`] : []),
+      `if ($hv -ne 0 -and $hv -ne -1) { [void][W.P]::CloseHandle($h) }`,
     ].join('\n');
   }
 
@@ -206,8 +270,8 @@ class KeepaliveManager {
           const hint = firstErr || 'powershell.exe unavailable or blocked (Constrained Language Mode / WDAC / AV)';
           this._safe(() => this._logger.warn && this._logger.warn(
             `⚠  keepalive: could not hold the wake assertion; the machine may sleep (${hint}). Disable with --no-keepalive.`));
-          // Reap a helper that timed out without exiting (e.g. SetThreadExecutionState
-          // returned 0 and it is blocked on stdin) so it cannot leak.
+          // Reap a helper that timed out without exiting (e.g. both assertions were
+          // refused yet it is somehow blocked on stdin) so it cannot leak.
           if (this._child === child) this._safe(() => this.releaseSync());
         }
       }).catch(() => {});

package/src/public/app.js

@@ -692,7 +692,7 @@ class ClaudeCodeWebInterface {
                 foreground: '#f0f6fc',
                 cursor: '#ff6b00',
                 cursorAccent: '#0d1117',
-                selection: 'rgba(255, 107, 0, 0.2)',
+                selectionBackground: 'rgba(255, 107, 0, 0.2)',
                 black: '#484f58',
                 red: '#ff7b72',
                 green: '#7ee787',
@@ -741,6 +741,20 @@ class ClaudeCodeWebInterface {
 
         this.terminal.open(document.getElementById('terminal'));
 
+        // Trackpad/mouse-wheel policy: preempt xterm's alt-buffer wheel->arrow
+        // translation so scrolling doesn't hijack the Claude Code TUI. Reads the
+        // live setting via the cached `_wheelScrollMode` (default 'dontHijack').
+        if (typeof window.attachTerminalWheel === 'function') {
+            if (this._wheelHandler && this._wheelHandler.dispose) {
+                try { this._wheelHandler.dispose(); } catch (_) {}
+            }
+            this._wheelHandler = window.attachTerminalWheel(
+                this.terminal,
+                document.getElementById('terminal'),
+                () => this._wheelScrollMode || 'dontHijack'
+            );
+        }
+
         // Faithful per-tab snapshot cache for instant tab-switch repaint.
         // Guarded: if the serialize addon or the cache class failed to load
         // (e.g. CDN blocked), snapshotCache stays null and every call site is
@@ -2293,7 +2307,17 @@ class ClaudeCodeWebInterface {
                         if (restartGen !== this._socketGeneration) return;
                         this.reconnect();
                     }, restartBackoff);
-                } else if ((!event.wasClean || voiceClose.rejected) && this.reconnectAttempts < this.maxReconnectAttempts) {
+                // Reconnect decision extracted to WsReconnect.isReconnectableClose
+                // (unit-tested): abnormal close, our own heartbeat pong-timeout
+                // (code 4000 — a clean close that MUST still reconnect, or a single
+                // transient pong-timeout strands the client on "Disconnected"), or a
+                // server frame-rejection (1009/1003). Inline fallback keeps reconnect
+                // working even if the tiny module failed to load.
+                } else if (
+                    ((window.WsReconnect && window.WsReconnect.isReconnectableClose)
+                        ? window.WsReconnect.isReconnectableClose(event, voiceClose.rejected)
+                        : (!event.wasClean || event.code === 4000 || voiceClose.rejected))
+                    && this.reconnectAttempts < this.maxReconnectAttempts) {
                     this.updateStatus('Reconnecting (' + (this.reconnectAttempts + 1) + '/' + this.maxReconnectAttempts + ')...');
                     // First attempt is fast (250ms covers a server-process restart window);
                     // subsequent attempts use exponential backoff with jitter.
@@ -2315,7 +2339,11 @@ class ClaudeCodeWebInterface {
                     this.reconnectAttempts++;
                 } else {
                     this.updateStatus('Disconnected');
-                    this.showError(`Connection lost after ${this.maxReconnectAttempts} attempts.\n\nYour session data is preserved on the server.\n\u2022 Check your network connection\n\u2022 The server may have restarted \u2014 try refreshing the page`);
+                    const n = this.reconnectAttempts;
+                    const lead = n > 0
+                        ? `Connection lost after ${n} reconnect attempt${n === 1 ? '' : 's'}.`
+                        : 'Disconnected from the server.';
+                    this.showError(`${lead}\n\nYour session data is preserved on the server.\n\u2022 Check your network connection\n\u2022 The server may have restarted \u2014 try refreshing the page`);
                 }
             };
             
@@ -3573,40 +3601,30 @@ class ClaudeCodeWebInterface {
     }
 
     _loadGpuRenderer() {
+        // The Canvas renderer was removed in xterm 6.0. Mobile keeps using the
+        // reliable default DOM renderer (WebGL was historically avoided there for
+        // context-loss/memory reasons); desktop uses WebGL and falls back to the
+        // DOM renderer on failure or context loss.
         if (this.isMobile) {
-            console.log('[Renderer] Mobile detected, using Canvas renderer for reliability');
-            this._loadCanvasAddon();
+            console.log('[Renderer] Mobile detected, using DOM renderer for reliability');
             return;
         }
         if (typeof WebglAddon !== 'undefined') {
             try {
                 this.webglAddon = new WebglAddon.WebglAddon();
                 this.webglAddon.onContextLoss(() => {
-                    this.webglAddon.dispose();
+                    const addon = this.webglAddon;
                     this.webglAddon = null;
-                    this._loadCanvasAddon();
+                    try { if (addon) addon.dispose(); } catch (_) {}
+                    console.log('[Renderer] WebGL context lost, using DOM renderer');
                 });
                 this.terminal.loadAddon(this.webglAddon);
             } catch (e) {
-                console.log('[Renderer] WebGL unavailable, using Canvas renderer');
-                this._loadCanvasAddon();
-            }
-        } else {
-            console.log('[Renderer] WebGL unavailable, using Canvas renderer');
-            this._loadCanvasAddon();
-        }
-    }
-
-    _loadCanvasAddon() {
-        if (typeof CanvasAddon !== 'undefined') {
-            try {
-                this.canvasAddon = new CanvasAddon.CanvasAddon();
-                this.terminal.loadAddon(this.canvasAddon);
-            } catch (e) {
-                console.log('[Renderer] Canvas unavailable, using DOM renderer (slower)');
+                this.webglAddon = null;
+                console.log('[Renderer] WebGL unavailable, using DOM renderer');
             }
         } else {
-            console.log('[Renderer] Canvas unavailable, using DOM renderer (slower)');
+            console.log('[Renderer] WebGL unavailable, using DOM renderer');
         }
     }
 
@@ -4259,6 +4277,9 @@ class ClaudeCodeWebInterface {
         const enableSessionStickyNotes = document.getElementById('enableSessionStickyNotes');
         if (enableSessionStickyNotes) enableSessionStickyNotes.checked = settings.enableSessionStickyNotes ?? true;
 
+        const wheelScrollMode = document.getElementById('wheelScrollMode');
+        if (wheelScrollMode) wheelScrollMode.value = settings.wheelScrollMode || 'dontHijack';
+
         // Update install section
         this._updateInstallSection();
     }
@@ -4559,7 +4580,11 @@ class ClaudeCodeWebInterface {
             notifVolume: 30,
             notifDesktop: true,
             enableSessionStickyNotes: true,
-            tabSnapshotLines: 500
+            tabSnapshotLines: 500,
+            // Trackpad/mouse-wheel behaviour inside full-screen (alt-buffer) apps:
+            //   'dontHijack' - wheel does nothing there (no menu hijack in the Claude Code TUI)
+            //   'altScroll'  - wheel sends Up/Down arrows (pagers like `less` scroll)
+            wheelScrollMode: 'dontHijack'
         };
     }
 
@@ -4602,7 +4627,8 @@ class ClaudeCodeWebInterface {
             notifVolume: parseInt(document.getElementById('notifVolume')?.value || '30'),
             notifDesktop: document.getElementById('notifDesktop')?.checked ?? true,
             enableSessionStickyNotes: document.getElementById('enableSessionStickyNotes')?.checked ?? true,
-            tabSnapshotLines: parseInt(document.getElementById('tabSnapshotLines')?.value || '500', 10)
+            tabSnapshotLines: parseInt(document.getElementById('tabSnapshotLines')?.value || '500', 10),
+            wheelScrollMode: document.getElementById('wheelScrollMode')?.value || 'dontHijack'
         };
 
         try {
@@ -4651,6 +4677,10 @@ class ClaudeCodeWebInterface {
         this.terminal.options.cursorBlink = settings.cursorBlink ?? true;
         if (settings.scrollback) this.terminal.options.scrollback = settings.scrollback;
 
+        // Cache the wheel-scroll policy for the capture-phase wheel handler
+        // (read live per wheel event without touching localStorage each notch).
+        this._wheelScrollMode = settings.wheelScrollMode || 'dontHijack';
+
         // Push the instant-snapshot line cap to the cache (0 disables capture+paint).
         if (this.snapshotCache && settings.tabSnapshotLines !== undefined) {
             this.snapshotCache.setMaxLines(settings.tabSnapshotLines);

package/src/public/index.html

@@ -106,15 +106,19 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600&family=Inter:wght@400;500;600&display=swap" rel="stylesheet" media="print" onload="this.media='all'">
-    <script src="https://unpkg.com/xterm@5.3.0/lib/xterm.js"></script>
-    <script src="https://unpkg.com/xterm-addon-fit@0.8.0/lib/xterm-addon-fit.js"></script>
-    <script src="https://unpkg.com/xterm-addon-web-links@0.9.0/lib/xterm-addon-web-links.js"></script>
-    <script src="https://unpkg.com/xterm-addon-search@0.13.0/lib/xterm-addon-search.js"></script>
-    <script src="https://unpkg.com/xterm-addon-unicode11@0.6.0/lib/xterm-addon-unicode11.js"></script>
-    <script src="https://unpkg.com/xterm-addon-webgl@0.16.0/lib/xterm-addon-webgl.js"></script>
-    <script src="https://unpkg.com/xterm-addon-canvas@0.5.0/lib/xterm-addon-canvas.js"></script>
-    <script src="https://unpkg.com/xterm-addon-serialize@0.11.0/lib/xterm-addon-serialize.js"></script>
-    <link rel="stylesheet" href="https://unpkg.com/xterm@5.3.0/css/xterm.css" />
+    <!-- xterm.js self-hosted under vendor/xterm/ (not a CDN) for deterministic,
+         offline-capable, fast loads — same rationale as the self-hosted fonts.
+         Versions: xterm 6.0.0, addon-fit 0.11.0, addon-web-links 0.12.0,
+         addon-search 0.16.0, addon-unicode11 0.9.0, addon-webgl 0.19.0,
+         addon-serialize 0.14.0. -->
+    <script src="/vendor/xterm/xterm.js"></script>
+    <script src="/vendor/xterm/addon-fit.js"></script>
+    <script src="/vendor/xterm/addon-web-links.js"></script>
+    <script src="/vendor/xterm/addon-search.js"></script>
+    <script src="/vendor/xterm/addon-unicode11.js"></script>
+    <script src="/vendor/xterm/addon-webgl.js"></script>
+    <script src="/vendor/xterm/addon-serialize.js"></script>
+    <link rel="stylesheet" href="/vendor/xterm/xterm.css" />
     <!-- Monaco editor is loaded lazily on first file preview/editor open via
          file-viewer-monaco.js (see ADR-0016). Preconnect above warms the
          CDN handshake; we don't preload loader.js to avoid charging users
@@ -493,6 +497,14 @@
                                         <span class="range-value" id="terminalPaddingValue">8px</span>
                                     </span>
                                 </div>
+                                <div class="setting-group">
+                                    <label for="wheelScrollMode">Trackpad scroll in full-screen apps</label>
+                                    <select id="wheelScrollMode">
+                                        <option value="dontHijack">Don't hijack menus</option>
+                                        <option value="altScroll">Scroll (send arrows)</option>
+                                    </select>
+                                </div>
+                                <div class="setting-hint">Inside full-screen apps like the Claude Code TUI, the wheel can't both scroll and drive menus. &ldquo;Don't hijack&rdquo; stops it from jumping menus; &ldquo;Scroll&rdquo; makes it scroll pagers like <code>less</code>. Normal shell scrolling is unaffected.</div>
                             </section>
 
                             <section class="settings-pane" id="settingsPane-voice" role="tabpanel" aria-labelledby="settingsTab-voice" tabindex="0" hidden>
@@ -841,6 +853,7 @@
     <script src="clipboard-handler.js"></script>
     <script src="image-handler.js"></script>
     <script src="generic-drop-handler.js"></script>
+    <script src="terminal-wheel.js"></script>
     <script src="auth.js"></script>
     <script src="feedback-manager.js"></script>
     <!-- marked.min.js and purify.min.js lazy-loaded on first plan viewer open -->
@@ -849,6 +862,7 @@
     <script src="sticky-note-card.js"></script>
     <script src="artifact-panel.js"></script>
     <script src="heartbeat-watchdog.js"></script>
+    <script src="ws-reconnect.js"></script>
     <script src="splits.js"></script>
     <script src="icons.js"></script>
     <script src="file-viewer-monaco.js"></script>

package/src/public/service-worker.js

@@ -1,6 +1,6 @@
 // Bump this version when urlsToCache entries are added or removed.
 // Content changes to existing files are handled by the network-first fetch strategy.
-const CACHE_NAME = 'ai-or-die-v11';
+const CACHE_NAME = 'ai-or-die-v13';
 const urlsToCache = [
   '/',
   '/index.html',
@@ -49,7 +49,13 @@ const urlsToCache = [
   '/voice-handler.js',
   '/image-handler.js',
   '/input-overlay.js',
-  '/feedback-manager.js'
+  '/feedback-manager.js',
+  '/terminal-wheel.js'
+  // xterm.js is self-hosted under /vendor/xterm/ (served locally, fast) but is
+  // intentionally NOT precached on install: ~900KB of addons would bloat the
+  // install step (it churns on every fresh page load, and is pathologically slow
+  // under the WebKit-on-Windows CI runner). The runtime fetch handler caches it
+  // on first load, so offline still works after the first online visit.
 ];
 
 // Install event - cache resources