aicodeman 1.2.1 → 1.3.0

package/dist/tmux-manager.d.ts

@@ -21,8 +21,8 @@
  * @module tmux-manager
  */
 import { EventEmitter } from 'node:events';
-import { ProcessStats, PersistedRespawnConfig, type PaneInfo, type CodexConfig } from './types.js';
-import type { TerminalMultiplexer, MuxSession, MuxSessionWithStats, CreateSessionOptions, RespawnPaneOptions } from './mux-interface.js';
+import { ProcessStats, PersistedRespawnConfig, type PaneInfo, type SessionMode, type CodexConfig, type SessionRemote } from './types.js';
+import type { TerminalMultiplexer, MuxSession, MuxSessionWithStats, CreateSessionOptions, RespawnPaneOptions, PaneCaptureOptions } from './mux-interface.js';
 /** Claude Code native macOS recommendation for avoiding low nofile startup failures. */
 export declare const CLAUDE_CODE_NOFILE_LIMIT = 2147483646;
 /**
@@ -52,6 +52,23 @@ export declare function resolveTmuxPaneTarget(muxName: string, paneTarget?: stri
  * output (lines like `%0:1`). Returns the pane id whose active flag is 1.
  */
 export declare function resolveActivePaneTarget(output: string): string | null;
+/**
+ * Normalize scrollback line endings to `\r\n` so a fresh xterm replays each line
+ * at column 0 (COD-138).
+ *
+ * `capture-pane -p -e -S -` (full-history capture) joins scrollback rows with a
+ * BARE `\n`. The browser xterm is created with the default `convertEol: false`
+ * (correct for the live PTY stream, which already carries real `\r\n`), so a bare
+ * `\n` drops a row without returning the cursor to column 0. Replaying that raw
+ * buffer on a full page reload makes every line start one column further right —
+ * the diagonal "staircase". The visible/tab-switch path avoids this by repainting
+ * each row with an absolute cursor CSI (`formatPaneSnapshot`); the full-history
+ * path returns raw scrollback, so it must be CRLF-normalized here.
+ *
+ * `\r?\n → \r\n` is idempotent on already-CRLF input and leaves a lone `\r` (an
+ * intentional in-line column reset / overwrite) untouched.
+ */
+export declare function normalizeScrollbackEol(buffer: string): string;
 export declare function formatPaneSnapshot(lines: string[], geometry: {
     cols: number;
     rows: number;
@@ -65,6 +82,66 @@ export declare function formatPaneSnapshot(lines: string[], geometry: {
  * stripping destructive terminal sequences before xterm.js sees them.
  */
 export declare function buildCodexCommand(config?: CodexConfig): string;
+/**
+ * Deterministic, reattach-stable remote tmux session name for a Codeman session.
+ *
+ * Derived from the same stable field the LOCAL muxName uses (the first 8 chars of
+ * the sessionId), so reconnecting (which re-issues the exact same
+ * `ssh … new-session -A`) lands back in the SAME remote session. Must NOT be
+ * random/time-based — it has to be stable across reconnects.
+ *
+ * The `codeman-ssh-` prefix is deliberately chosen to FAIL a remote Codeman's
+ * `SAFE_MUX_NAME_PATTERN` (`^codeman-[a-f0-9-]+$`) — the `s`/`h` letters mean a
+ * remote instance's discovery never treats this as one of its own sessions (belt
+ * to the dedicated-socket suspenders above).
+ */
+export declare function remoteTmuxSessionName(sessionId: string): string;
+/**
+ * COD-104 — build the SSH command that launches (or reattaches) a remote
+ * session INSIDE a tmux server on the remote host, so the remote agent survives
+ * an SSH drop.
+ *
+ * Emits:
+ *   ssh -o BatchMode=yes -t [<COD-107 connection opts>] user@host \
+ *     'tmux -L codeman-remote new-session -A -s codeman-ssh-<id> -c <path> "cd <path> && exec <cli>" \
+ *        \; set -t codeman-ssh-<id> status off \; set -t codeman-ssh-<id> mouse off \
+ *        \; set -t codeman-ssh-<id> prefix C-q \; set -s escape-time 0'
+ *
+ * COD-107 — the connection options (`-p`, `-i`, `-J`, SOCKS `-o ProxyCommand`,
+ * arbitrary `-o`) come from the shared `buildSshConnectionArgs(remote)`, so the
+ * prereq tmux probe and this launch connect with identical options.
+ *
+ * - `new-session -A -s codeman-ssh-<id>` = attach-if-exists-else-create
+ *   (idempotent), so reconnect re-runs the same command and reattaches the
+ *   still-running agent.
+ * - `-L codeman-remote` = a DEDICATED socket, NOT the canonical `-L codeman` a
+ *   remote Codeman would use, so our session never collides with / gets adopted by
+ *   an instance running on the remote host.
+ * - The `set` options are scoped per-session (`set -t <name>` / server-level
+ *   `set -s`), never `-g`, so they never mutate other sessions' prefix/mouse.
+ * - The whole tmux invocation is a SINGLE ssh argument (the remote login shell
+ *   runs it), so it is shell-quoted as one unit; the `cd && exec` command is in
+ *   turn a single tmux argument (tmux runs it via `/bin/sh -c`), so the path is
+ *   shell-quoted inside it too. This keeps escaping correct through every layer
+ *   even when the remote path contains spaces.
+ */
+export declare function buildRemoteLaunchCommand(options: {
+    mode: SessionMode;
+    remote: SessionRemote;
+    sessionId: string;
+}): string;
+/**
+ * Build the SSH command that kills the durable remote tmux session created by
+ * `buildRemoteLaunchCommand`. Because that session lives on a private socket
+ * (`-L codeman-remote`) under a stable name, killing the LOCAL ssh wrapper alone
+ * would orphan the remote agent forever (invisible to Codeman, still burning plan
+ * quota). This is fired best-effort on session kill; the shared connection args
+ * carry the default `-o ConnectTimeout=10` so an unreachable host fails fast.
+ */
+export declare function buildRemoteKillCommand(options: {
+    remote: SessionRemote;
+    sessionId: string;
+}): string;
 /**
  * Manages tmux sessions that wrap Claude CLI or shell processes.
  *
@@ -207,6 +284,12 @@ export declare class TmuxManager extends EventEmitter implements TerminalMultipl
     updateRespawnConfig(sessionId: string, config: PersistedRespawnConfig | undefined): void;
     clearRespawnConfig(sessionId: string): void;
     updateRalphEnabled(sessionId: string, enabled: boolean): void;
+    /**
+     * Apply a tmux history-limit to all tracked sessions (e.g. when the user
+     * changes the terminal-history setting). Invalid limits fall back to the
+     * default. Best-effort per session.
+     */
+    setHistoryLimit(limit: number): Promise<void>;
     /**
      * Send input directly to a tmux session using `send-keys`.
      *
@@ -244,20 +327,29 @@ export declare class TmuxManager extends EventEmitter implements TerminalMultipl
      */
     sendInputToPane(muxName: string, paneTarget: string, input: string): boolean;
     /**
-     * Capture the current visible text and SGR styles of a specific pane.
+     * Capture a pane's text and SGR styles.
      *
-     * `capture-pane -e` is sanitized by `formatPaneSnapshot`: SGR color/style
-     * codes are preserved, while cursor/erase/scroll-region controls are stripped
-     * before rows are repainted at absolute positions in browser xterm.
+     * Two modes:
+     * - Visible (default): `capture-pane -p -e` grabs only the on-screen frame,
+     *   then `formatPaneSnapshot` repaints each row at its absolute position so
+     *   the browser xterm reproduces the live frame. Used for fast tab switches.
+     * - Full history (`opts.fullHistory`): `capture-pane -p -e -J -S -<N>` grabs
+     *   the tmux scrollback (COD-47, bounded to the configured history limit),
+     *   returned as linear scrollback text with SGR codes preserved (NOT
+     *   repositioned — a multi-screen history can't be painted into a single
+     *   visible frame, so the snapshot repaint is skipped). `-J` re-joins lines
+     *   hard-wrapped at the pane width so they reflow in the browser xterm.
+     *   Used for full page reloads so the user gets back their scroll history.
+     *   Caveat: lines tmux has already evicted past its history-limit are gone.
      */
-    capturePaneBuffer(muxName: string, paneTarget: string): string | null;
+    capturePaneBuffer(muxName: string, paneTarget?: string, opts?: PaneCaptureOptions): string | null;
     /**
      * Capture the active pane for a tmux session.
      *
      * Pane ids are not stable across respawns or restores, so callers should not
      * assume the first pane remains `%0`.
      */
-    captureActivePaneBuffer(muxName: string): string | null;
+    captureActivePaneBuffer(muxName: string, opts?: PaneCaptureOptions): string | null;
     /**
      * Start piping pane output to a file using tmux pipe-pane.
      * Only pipes output direction (-O) to avoid echoing input.

package/dist/tmux-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tmux-manager.d.ts","sourceRoot":"","sources":["../src/tmux-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,OAAO,EACL,YAAY,EACZ,sBAAsB,EAGtB,KAAK,QAAQ,EAIb,KAAK,WAAW,EAGjB,MAAM,YAAY,CAAC;AAUpB,OAAO,KAAK,EACV,mBAAmB,EACnB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,oBAAoB,CAAC;AA2B5B,wFAAwF;AACxF,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAoDnD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,SAA2B,GAAG,MAAM,CAGtF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAajE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWzF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASrE;AAkOD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzE,MAAM,CAkBR;AAuGD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAkB9D;AAwND;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,WAAY,SAAQ,YAAa,YAAW,mBAAmB;IAC1E,QAAQ,CAAC,OAAO,EAAG,MAAM,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,aAAa,CAA+B;IACpD,OAAO,CAAC,iBAAiB,CAA+B;IACxD,yFAAyF;IACzF,OAAO,CAAC,aAAa,CAAkC;IAEvD,OAAO,CAAC,mBAAmB,CAAS;;IAUpC,0GAA0G;IAC1G,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,OAAO,CAAC,IAAI;IAKZ,OAAO,CAAC,YAAY;IAkDpB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAsBpB;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAmBvB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAgCzB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAoBvB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAIvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC;IAuNvE;;OAEG;IACH,OAAO,CAAC,UAAU;IAoBlB;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI1C;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAcpC;;;;OAIG;IACG,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4EtE,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,YAAY;IAuBpB,OAAO,CAAC,cAAc;YAUR,mBAAmB;IAmBjC;;;;OAIG;IACG,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwGtD,WAAW,IAAI,UAAU,EAAE;IAI3B,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIrD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAU3D;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAwFvF,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA0ChE,oBAAoB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAiH5D,oBAAoB,CAAC,UAAU,GAAE,MAAkC,GAAG,IAAI;IAe1E,mBAAmB,IAAI,IAAI;IAO3B;;;;;OAKG;IACH,kBAAkB,CAAC,UAAU,GAAE,MAAa,GAAG,IAAI;IA+BnD,iBAAiB,IAAI,IAAI;IAQzB,OAAO,IAAI,IAAI;IAKf,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI;IAK1C,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IAQvD,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI;IAQxF,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAQ3C,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IAQ7D;;;;;;;OAOG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4DnE;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBxD;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzD;;;;OAIG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUtD;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAiCrD;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IA+C5E;;;;;;OAMG;IACH,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiDrE;;;;;OAKG;IACH,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoBvD;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IA6B/E;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAyB1D,gBAAgB,IAAI,MAAM;IAI1B,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAkB7C,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAyBlE,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,MAAM,CAAC,eAAe,IAAI,OAAO;CAQlC"}
+{"version":3,"file":"tmux-manager.d.ts","sourceRoot":"","sources":["../src/tmux-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,OAAO,EACL,YAAY,EACZ,sBAAsB,EAGtB,KAAK,QAAQ,EAEb,KAAK,WAAW,EAEhB,KAAK,WAAW,EAGhB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAWpB,OAAO,KAAK,EACV,mBAAmB,EACnB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,oBAAoB,CAAC;AAoC5B,wFAAwF;AACxF,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAoDnD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,SAA2B,GAAG,MAAM,CAGtF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAajE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWzF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASrE;AAkOD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzE,MAAM,CAkBR;AAuGD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAkB9D;AAsGD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAiCT;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAMpG;AA+HD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,WAAY,SAAQ,YAAa,YAAW,mBAAmB;IAC1E,QAAQ,CAAC,OAAO,EAAG,MAAM,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,aAAa,CAA+B;IACpD,OAAO,CAAC,iBAAiB,CAA+B;IACxD,yFAAyF;IACzF,OAAO,CAAC,aAAa,CAAkC;IAEvD,OAAO,CAAC,mBAAmB,CAAS;;IAUpC,0GAA0G;IAC1G,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,OAAO,CAAC,IAAI;IAKZ,OAAO,CAAC,YAAY;IAkDpB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAsBpB;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAgCzB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAoBvB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAIvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC;IA+NvE;;OAEG;IACH,OAAO,CAAC,UAAU;IAoBlB;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI1C;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAcpC;;;;OAIG;IACG,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0FtE,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,YAAY;IAuBpB,OAAO,CAAC,cAAc;YAUR,mBAAmB;IAmBjC;;;;OAIG;IACG,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsHtD,WAAW,IAAI,UAAU,EAAE;IAI3B,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIrD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAU3D;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAwFvF,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA0ChE,oBAAoB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAiH5D,oBAAoB,CAAC,UAAU,GAAE,MAAkC,GAAG,IAAI;IAe1E,mBAAmB,IAAI,IAAI;IAO3B;;;;;OAKG;IACH,kBAAkB,CAAC,UAAU,GAAE,MAAa,GAAG,IAAI;IA+BnD,iBAAiB,IAAI,IAAI;IAQzB,OAAO,IAAI,IAAI;IAKf,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI;IAK1C,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IAQvD,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI;IAQxF,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAQ3C,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IAQ7D;;;;OAIG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAenD;;;;;;;OAOG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4DnE;;;;OAIG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBxD;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzD;;;;OAIG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUtD;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAiCrD;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IA+C5E;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI;IAqFjG;;;;;OAKG;IACH,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI;IAoBlF;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IA6B/E;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAyB1D,gBAAgB,IAAI,MAAM;IAI1B,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAIxC,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAkB7C,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAyBlE,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,MAAM,CAAC,eAAe,IAAI,OAAO;CAQlC"}

package/dist/tmux-manager.js

@@ -30,11 +30,20 @@ import { dirname } from 'node:path';
 import { dataPath, DEFAULT_TMUX_SOCKET } from './config/instance.js';
 import { getErrorMessage, DEFAULT_NICE_CONFIG, } from './types.js';
 import { buildEffortCliArgs } from './session-cli-builder.js';
+import { buildSshConnectionArgs, defaultRemoteCommandForMode, remoteSshTarget } from './remote-hosts.js';
 import { wrapWithNice, SAFE_PATH_PATTERN, findClaudeDir, resolveOpenCodeDir, resolveCodexDir, resolveGeminiDir, } from './utils/index.js';
 // ============================================================================
 // Timing Constants
 // ============================================================================
 import { EXEC_TIMEOUT_MS } from './config/exec-timeout.js';
+import { DEFAULT_TMUX_HISTORY_LIMIT, DEFAULT_TERMINAL_BUFFER_MAX_BYTES } from './config/terminal-history.js';
+/**
+ * Extra stdout headroom for the full-history `capture-pane` child process on
+ * top of the consumer's byte cap: raw scrollback carries per-line SGR/ANSI
+ * overhead that the route pipeline strips before applying its cap, so the
+ * capture must be allowed to exceed the final payload size.
+ */
+const FULL_HISTORY_CAPTURE_SLACK_BYTES = 8 * 1024 * 1024;
 /** Delay after tmux session creation — enough for detached tmux to be queryable */
 const TMUX_CREATION_WAIT_MS = 100;
 /** Max retries for getPanePid — tmux server cold-start (e.g. macOS) may need extra time */
@@ -365,6 +374,25 @@ function truncatePaneLineByVisibleColumns(line, maxColumns) {
     }
     return result;
 }
+/**
+ * Normalize scrollback line endings to `\r\n` so a fresh xterm replays each line
+ * at column 0 (COD-138).
+ *
+ * `capture-pane -p -e -S -` (full-history capture) joins scrollback rows with a
+ * BARE `\n`. The browser xterm is created with the default `convertEol: false`
+ * (correct for the live PTY stream, which already carries real `\r\n`), so a bare
+ * `\n` drops a row without returning the cursor to column 0. Replaying that raw
+ * buffer on a full page reload makes every line start one column further right —
+ * the diagonal "staircase". The visible/tab-switch path avoids this by repainting
+ * each row with an absolute cursor CSI (`formatPaneSnapshot`); the full-history
+ * path returns raw scrollback, so it must be CRLF-normalized here.
+ *
+ * `\r?\n → \r\n` is idempotent on already-CRLF input and leaves a lone `\r` (an
+ * intentional in-line column reset / overwrite) untouched.
+ */
+export function normalizeScrollbackEol(buffer) {
+    return buffer.replace(/\r?\n/g, '\r\n');
+}
 export function formatPaneSnapshot(lines, geometry) {
     const cols = Math.max(1, geometry.cols);
     // Paint the full pane width. Earlier this dropped the rightmost column
@@ -571,6 +599,107 @@ function buildSpawnCommand(options) {
     }
     return '$SHELL';
 }
+/**
+ * Dedicated socket for Codeman-launched REMOTE tmux servers, distinct from the
+ * canonical local `-L codeman` socket. A remote host that runs its OWN Codeman
+ * would otherwise share the `-L codeman` socket AND the `codeman-<hex>` discovery
+ * name, so its `reconcileSessions()` would ADOPT our session (attach a PTY,
+ * resize, respawn-pane it locally) — the cross-machine form of the "2nd instance
+ * attaches live sessions" hazard. A private socket keeps our remote sessions off
+ * that instance's radar entirely.
+ */
+const REMOTE_TMUX_SOCKET = 'codeman-remote';
+/**
+ * Deterministic, reattach-stable remote tmux session name for a Codeman session.
+ *
+ * Derived from the same stable field the LOCAL muxName uses (the first 8 chars of
+ * the sessionId), so reconnecting (which re-issues the exact same
+ * `ssh … new-session -A`) lands back in the SAME remote session. Must NOT be
+ * random/time-based — it has to be stable across reconnects.
+ *
+ * The `codeman-ssh-` prefix is deliberately chosen to FAIL a remote Codeman's
+ * `SAFE_MUX_NAME_PATTERN` (`^codeman-[a-f0-9-]+$`) — the `s`/`h` letters mean a
+ * remote instance's discovery never treats this as one of its own sessions (belt
+ * to the dedicated-socket suspenders above).
+ */
+export function remoteTmuxSessionName(sessionId) {
+    return `codeman-ssh-${sessionId.slice(0, 8)}`;
+}
+/**
+ * COD-104 — build the SSH command that launches (or reattaches) a remote
+ * session INSIDE a tmux server on the remote host, so the remote agent survives
+ * an SSH drop.
+ *
+ * Emits:
+ *   ssh -o BatchMode=yes -t [<COD-107 connection opts>] user@host \
+ *     'tmux -L codeman-remote new-session -A -s codeman-ssh-<id> -c <path> "cd <path> && exec <cli>" \
+ *        \; set -t codeman-ssh-<id> status off \; set -t codeman-ssh-<id> mouse off \
+ *        \; set -t codeman-ssh-<id> prefix C-q \; set -s escape-time 0'
+ *
+ * COD-107 — the connection options (`-p`, `-i`, `-J`, SOCKS `-o ProxyCommand`,
+ * arbitrary `-o`) come from the shared `buildSshConnectionArgs(remote)`, so the
+ * prereq tmux probe and this launch connect with identical options.
+ *
+ * - `new-session -A -s codeman-ssh-<id>` = attach-if-exists-else-create
+ *   (idempotent), so reconnect re-runs the same command and reattaches the
+ *   still-running agent.
+ * - `-L codeman-remote` = a DEDICATED socket, NOT the canonical `-L codeman` a
+ *   remote Codeman would use, so our session never collides with / gets adopted by
+ *   an instance running on the remote host.
+ * - The `set` options are scoped per-session (`set -t <name>` / server-level
+ *   `set -s`), never `-g`, so they never mutate other sessions' prefix/mouse.
+ * - The whole tmux invocation is a SINGLE ssh argument (the remote login shell
+ *   runs it), so it is shell-quoted as one unit; the `cd && exec` command is in
+ *   turn a single tmux argument (tmux runs it via `/bin/sh -c`), so the path is
+ *   shell-quoted inside it too. This keeps escaping correct through every layer
+ *   even when the remote path contains spaces.
+ */
+export function buildRemoteLaunchCommand(options) {
+    const { mode, remote, sessionId } = options;
+    const modeCommand = remote.commands?.[mode] || defaultRemoteCommandForMode(mode);
+    const remoteName = remoteTmuxSessionName(sessionId);
+    // Innermost: the command tmux runs in the new pane. Run via `/bin/sh -c` by
+    // tmux, so the path needs shell-quoting here. `exec` replaces the shell with
+    // the CLI so the pane PID is the agent itself.
+    const paneCommand = `cd ${shellescape(remote.remotePath)} && ${modeCommand}`;
+    // The tmux command line, with `\;` separating commands so the config `set`s
+    // apply on the SAME connection (and are idempotent on reattach). Options are
+    // scoped per-session (`set -t <name>` / server `set -s`), NEVER `-g`, so a
+    // shared remote tmux server's other sessions keep their own prefix/mouse.
+    const tmuxInvocation = [
+        `tmux -L ${REMOTE_TMUX_SOCKET} new-session -A -s ${remoteName} -c ${shellescape(remote.remotePath)} ${shellescape(paneCommand)}`,
+        `set -t ${remoteName} status off`,
+        `set -t ${remoteName} mouse off`,
+        `set -t ${remoteName} prefix C-q`,
+        'set -s escape-time 0',
+    ].join(' \\; ');
+    // ssh runs its trailing args through the remote login shell, so the entire
+    // tmux invocation is passed as one shell-quoted argument.
+    //
+    // COD-107 — connection options (port, identity, SOCKS ProxyCommand, jump host,
+    // arbitrary -o) come from the shared `buildSshConnectionArgs` so the launch and
+    // the tmux-prereq probe connect IDENTICALLY. `-t` is inserted right after
+    // `ssh -o BatchMode=yes` (preserving the historical token order), then the rest
+    // of the connection args, then the target and the quoted tmux invocation.
+    const [ssh, batchMode, ...connectionArgs] = buildSshConnectionArgs(remote);
+    const sshParts = [ssh, batchMode, '-t', ...connectionArgs, remoteSshTarget(remote), shellescape(tmuxInvocation)];
+    return sshParts.join(' ');
+}
+/**
+ * Build the SSH command that kills the durable remote tmux session created by
+ * `buildRemoteLaunchCommand`. Because that session lives on a private socket
+ * (`-L codeman-remote`) under a stable name, killing the LOCAL ssh wrapper alone
+ * would orphan the remote agent forever (invisible to Codeman, still burning plan
+ * quota). This is fired best-effort on session kill; the shared connection args
+ * carry the default `-o ConnectTimeout=10` so an unreachable host fails fast.
+ */
+export function buildRemoteKillCommand(options) {
+    const { remote, sessionId } = options;
+    const remoteName = remoteTmuxSessionName(sessionId);
+    const killCmd = `tmux -L ${REMOTE_TMUX_SOCKET} kill-session -t ${shellescape(remoteName)}`;
+    const [ssh, ...connectionArgs] = buildSshConnectionArgs(remote);
+    return [ssh, ...connectionArgs, remoteSshTarget(remote), shellescape(killCmd)].join(' ');
+}
 /**
  * Set sensitive environment variables on a tmux session via setenv.
  * These are inherited by panes but not visible in ps output or tmux history.
@@ -830,6 +959,12 @@ export class TmuxManager extends EventEmitter {
             'export LC_ALL=en_US.UTF-8',
             mode === 'codex' || mode === 'gemini' ? 'export COLORTERM=truecolor' : 'unset COLORTERM',
             ...(mode === 'codex' || mode === 'gemini' ? ['unset NO_COLOR'] : []),
+            // Stamp each Codex pane with a unique originator so the response-viewer
+            // can locate THIS pane's rollout exactly — codex writes the value into
+            // session_meta.originator of every rollout it creates. Without it,
+            // rollouts are matched by cwd+mtime and two panes in the same directory
+            // bleed into each other.
+            ...(mode === 'codex' ? [`export CODEX_INTERNAL_ORIGINATOR_OVERRIDE=codeman_${sessionId}`] : []),
             'export CODEMAN_MUX=1',
             `export CODEMAN_SESSION_ID=${sessionId}`,
             `export CODEMAN_MUX_NAME=${muxName}`,
@@ -940,7 +1075,7 @@ export class TmuxManager extends EventEmitter {
      * In test mode: creates an in-memory session only (no real tmux session).
      */
     async createSession(options) {
-        const { sessionId, workingDir, mode, name, niceConfig, model, claudeMode, allowedTools, openCodeConfig, codexConfig, geminiConfig, resumeSessionId, envOverrides, effort, } = options;
+        const { sessionId, workingDir, mode, name, niceConfig, model, claudeMode, allowedTools, openCodeConfig, codexConfig, geminiConfig, resumeSessionId, envOverrides, effort, historyLimit = DEFAULT_TMUX_HISTORY_LIMIT, remote, } = options;
         const muxName = `codeman-${sessionId.slice(0, 8)}`;
         if (!isValidMuxName(muxName)) {
             throw new Error('Invalid session name: contains unsafe characters');
@@ -956,6 +1091,7 @@ export class TmuxManager extends EventEmitter {
                 pid: 99999,
                 createdAt: Date.now(),
                 workingDir,
+                remote,
                 mode,
                 attached: false,
                 name,
@@ -995,7 +1131,8 @@ export class TmuxManager extends EventEmitter {
         const cmd = wrapWithNice(baseCmd, config);
         try {
             // Build the full command to run inside tmux
-            const fullCmd = `${buildNofileLimitCommand()} && ${pathExport}${envExportsStr} && ${cmd}`;
+            const localFullCmd = `${buildNofileLimitCommand()} && ${pathExport}${envExportsStr} && ${cmd}`;
+            const fullCmd = remote ? buildRemoteLaunchCommand({ mode, remote, sessionId }) : localFullCmd;
             // Create tmux session in three steps to handle cold-start (no server running)
             // and avoid the race where the command exits before remain-on-exit is set:
             // 1. Create session with default shell (starts tmux server, stays alive)
@@ -1043,7 +1180,7 @@ export class TmuxManager extends EventEmitter {
             this.applyEnvOverrides(muxName, envOverrides);
             // Replace the shell with the actual command (no echo in terminal). Keep
             // pane launch in /tmp, then cd inside bash against the current mount table.
-            const launchCmd = `cd ${JSON.stringify(workingDir)} && ${fullCmd}`;
+            const launchCmd = remote ? fullCmd : `cd ${JSON.stringify(workingDir)} && ${fullCmd}`;
             execSync(`${this.tmux()} respawn-pane -k -c ${TMUX_LAUNCH_CWD} -t "${muxName}" bash -c ${JSON.stringify(launchCmd)}`, {
                 timeout: EXEC_TIMEOUT_MS,
                 stdio: 'ignore',
@@ -1068,8 +1205,11 @@ export class TmuxManager extends EventEmitter {
                     /* Already set globally as fallback */
                 }),
                 // Raise tmux scrollback from its 2000-line default so re-attach preserves
-                // more context. Matches the xterm-side default in constants.js.
-                execAsync(`${this.tmux()} set-option -t "${muxName}" history-limit 50000`, { timeout: EXEC_TIMEOUT_MS })
+                // more context. Intentionally exceeds the xterm-side DEFAULT_SCROLLBACK (50k
+                // in constants.js), which stays lower to protect browser/mobile memory.
+                execAsync(`${this.tmux()} set-option -t "${muxName}" history-limit ${historyLimit}`, {
+                    timeout: EXEC_TIMEOUT_MS,
+                })
                     .then(() => { })
                     .catch(() => {
                     /* Non-critical — falls back to tmux default */
@@ -1103,6 +1243,7 @@ export class TmuxManager extends EventEmitter {
                 pid,
                 createdAt: Date.now(),
                 workingDir,
+                remote,
                 mode,
                 attached: false,
                 name,
@@ -1170,13 +1311,22 @@ export class TmuxManager extends EventEmitter {
      * preserving the session and its scrollback buffer.
      */
     async respawnPane(options) {
-        const { sessionId, workingDir, mode, niceConfig, model, claudeMode, allowedTools, openCodeConfig, codexConfig, geminiConfig, resumeSessionId, envOverrides, effort, } = options;
+        const { sessionId, workingDir, mode, niceConfig, model, claudeMode, allowedTools, openCodeConfig, codexConfig, geminiConfig, resumeSessionId, envOverrides, effort, historyLimit = DEFAULT_TMUX_HISTORY_LIMIT, remote, } = options;
         const session = this.sessions.get(sessionId);
         if (!session)
             return null;
         const muxName = session.muxName;
         if (!isValidMuxName(muxName) || !isValidPath(workingDir))
             return null;
+        // Re-apply the configured tmux history-limit after respawn (kept in sync
+        // with the live setting via setHistoryLimit()).
+        if (!IS_TEST_MODE) {
+            await execAsync(`${this.tmux()} set-option -t ${shellescape(muxName)} history-limit ${historyLimit}`, {
+                timeout: EXEC_TIMEOUT_MS,
+            }).catch(() => {
+                /* Non-critical — keeps existing tmux history-limit */
+            });
+        }
         // Resolve CLI binary directory based on mode
         const { pathExport } = this.buildPathExport(mode);
         const envExportsStr = this.buildEnvExports(sessionId, muxName, mode).join(' && ');
@@ -1194,7 +1344,8 @@ export class TmuxManager extends EventEmitter {
         });
         const config = niceConfig || DEFAULT_NICE_CONFIG;
         const cmd = wrapWithNice(baseCmd, config);
-        const fullCmd = `${buildNofileLimitCommand()} && ${pathExport}${envExportsStr} && ${cmd}`;
+        const localFullCmd = `${buildNofileLimitCommand()} && ${pathExport}${envExportsStr} && ${cmd}`;
+        const fullCmd = remote ? buildRemoteLaunchCommand({ mode, remote, sessionId }) : localFullCmd;
         try {
             // For OpenCode: set sensitive env vars via tmux setenv before respawn
             if (mode === 'opencode') {
@@ -1209,7 +1360,8 @@ export class TmuxManager extends EventEmitter {
             }
             // Re-apply user env overrides before respawn so the new shell inherits them.
             this.applyEnvOverrides(muxName, envOverrides);
-            const launchCmd = `cd ${JSON.stringify(workingDir)} && ${fullCmd}`;
+            // -c /tmp + cd bounce — see createSession() for rationale (stale FUSE state).
+            const launchCmd = remote ? fullCmd : `cd ${JSON.stringify(workingDir)} && ${fullCmd}`;
             await execAsync(`${this.tmux()} respawn-pane -k -c ${TMUX_LAUNCH_CWD} -t "${muxName}" bash -c ${JSON.stringify(launchCmd)}`, {
                 timeout: EXEC_TIMEOUT_MS,
             });
@@ -1369,6 +1521,20 @@ export class TmuxManager extends EventEmitter {
                 // Session may already be dead
             }
         }
+        // Strategy 3b: Remote sessions run a DURABLE tmux server on the remote host
+        // (survives ssh drops), so killing only the local ssh wrapper above would
+        // orphan the remote agent forever. Fire a best-effort `ssh … tmux kill-session`
+        // — fire-and-forget so it NEVER blocks or throws the local kill (bounded by the
+        // shared ConnectTimeout on an unreachable host).
+        if (session.remote) {
+            try {
+                const remoteKillCmd = buildRemoteKillCommand({ remote: session.remote, sessionId });
+                exec(remoteKillCmd, { timeout: EXEC_TIMEOUT_MS }, () => { });
+            }
+            catch {
+                // Best-effort — a failure here must not affect the local kill result.
+            }
+        }
         // Strategy 4: Direct kill by PID as final fallback
         if (this.isProcessAlive(currentPid)) {
             try {
@@ -1718,6 +1884,21 @@ export class TmuxManager extends EventEmitter {
             this.saveSessions();
         }
     }
+    /**
+     * Apply a tmux history-limit to all tracked sessions (e.g. when the user
+     * changes the terminal-history setting). Invalid limits fall back to the
+     * default. Best-effort per session.
+     */
+    async setHistoryLimit(limit) {
+        const safeLimit = Number.isSafeInteger(limit) && limit > 0 ? Math.trunc(limit) : DEFAULT_TMUX_HISTORY_LIMIT;
+        if (IS_TEST_MODE) {
+            return;
+        }
+        const updates = Array.from(this.sessions.values()).map((session) => execAsync(`${this.tmux()} set-option -t ${shellescape(session.muxName)} history-limit ${safeLimit}`, {
+            timeout: EXEC_TIMEOUT_MS,
+        }));
+        await Promise.allSettled(updates);
+    }
     /**
      * Send input directly to a tmux session using `send-keys`.
      *
@@ -1924,29 +2105,60 @@ export class TmuxManager extends EventEmitter {
         }
     }
     /**
-     * Capture the current visible text and SGR styles of a specific pane.
+     * Capture a pane's text and SGR styles.
      *
-     * `capture-pane -e` is sanitized by `formatPaneSnapshot`: SGR color/style
-     * codes are preserved, while cursor/erase/scroll-region controls are stripped
-     * before rows are repainted at absolute positions in browser xterm.
+     * Two modes:
+     * - Visible (default): `capture-pane -p -e` grabs only the on-screen frame,
+     *   then `formatPaneSnapshot` repaints each row at its absolute position so
+     *   the browser xterm reproduces the live frame. Used for fast tab switches.
+     * - Full history (`opts.fullHistory`): `capture-pane -p -e -J -S -<N>` grabs
+     *   the tmux scrollback (COD-47, bounded to the configured history limit),
+     *   returned as linear scrollback text with SGR codes preserved (NOT
+     *   repositioned — a multi-screen history can't be painted into a single
+     *   visible frame, so the snapshot repaint is skipped). `-J` re-joins lines
+     *   hard-wrapped at the pane width so they reflow in the browser xterm.
+     *   Used for full page reloads so the user gets back their scroll history.
+     *   Caveat: lines tmux has already evicted past its history-limit are gone.
      */
-    capturePaneBuffer(muxName, paneTarget) {
+    capturePaneBuffer(muxName, paneTarget, opts) {
         if (IS_TEST_MODE)
             return '';
-        if (!isValidMuxName(muxName)) {
-            console.error('[TmuxManager] Invalid session name in capturePaneBuffer:', muxName);
+        const target = resolveTmuxPaneTarget(muxName, paneTarget);
+        if (!target) {
+            console.error('[TmuxManager] Invalid pane target in capturePaneBuffer:', { muxName, paneTarget });
             return null;
         }
-        if (!SAFE_PANE_TARGET_PATTERN.test(paneTarget)) {
-            console.error('[TmuxManager] Invalid pane target:', paneTarget);
-            return null;
-        }
-        const target = paneTarget.startsWith('%') ? `${muxName}.${paneTarget}` : `${muxName}.%${paneTarget}`;
+        const fullHistory = opts?.fullHistory === true;
         try {
-            const buffer = execSync(`${this.tmux()} capture-pane -p -e -t ${shellescape(target)}`, {
+            // `-S -<N>` starts the capture N lines above the visible frame (tmux
+            // clamps to the top of history), so tmux never serializes more scrollback
+            // than the configured history limit retains.
+            const requestedLines = opts?.historyLimitLines;
+            const historyLines = typeof requestedLines === 'number' && Number.isFinite(requestedLines) && requestedLines > 0
+                ? Math.trunc(requestedLines)
+                : DEFAULT_TMUX_HISTORY_LIMIT;
+            const captureFlags = fullHistory ? `capture-pane -p -e -J -S -${historyLines}` : 'capture-pane -p -e';
+            // execSync's default maxBuffer (1MB) kills multi-MB scrollback dumps
+            // (ENOBUFS) and would silently degrade full-history capture to the byte
+            // buffer for exactly the long sessions it exists for — size it from the
+            // consumer's byte cap plus ANSI-overhead slack instead.
+            const execOpts = {
                 encoding: 'utf-8',
                 timeout: EXEC_TIMEOUT_MS,
-            }).replace(/\n+$/g, '');
+            };
+            if (fullHistory) {
+                execOpts.maxBuffer =
+                    (opts?.maxCaptureBytes ?? DEFAULT_TERMINAL_BUFFER_MAX_BYTES) + FULL_HISTORY_CAPTURE_SLACK_BYTES;
+            }
+            const buffer = execSync(`${this.tmux()} ${captureFlags} -t ${shellescape(target)}`, execOpts).replace(/\n+$/g, '');
+            // Full-history spans many screens — return it as raw linear scrollback
+            // rather than repainting rows at single-screen absolute positions. tmux
+            // joins scrollback rows with a bare `\n`; normalize to `\r\n` so a fresh
+            // xterm (convertEol:false) starts each replayed line at column 0 instead
+            // of staircasing diagonally (COD-138).
+            if (fullHistory) {
+                return normalizeScrollbackEol(buffer);
+            }
             try {
                 const cursor = execSync(`${this.tmux()} display-message -p -t ${shellescape(target)} '#{cursor_x} #{cursor_y} #{pane_width} #{pane_height}'`, {
                     encoding: 'utf-8',
@@ -1967,10 +2179,21 @@ export class TmuxManager extends EventEmitter {
             catch (cursorErr) {
                 console.error('[TmuxManager] Failed to query pane cursor after capture:', cursorErr);
             }
-            return buffer;
+            // Cursor query failed or geometry was invalid, so we skip the absolute-
+            // positioned snapshot repaint and fall back to the raw capture. Normalize
+            // its bare `\n` line endings to `\r\n` so the replay doesn't staircase
+            // diagonally in a fresh xterm (COD-138, same reason as the fullHistory path).
+            return normalizeScrollbackEol(buffer);
         }
         catch (err) {
-            console.error('[TmuxManager] Failed to capture pane buffer:', err);
+            // ENOBUFS carries the truncated multi-MB stdout on the error object —
+            // log a concise line instead of dumping it into the journal.
+            if (err?.code === 'ENOBUFS') {
+                console.error('[TmuxManager] Pane capture exceeded maxBuffer (ENOBUFS); falling back to byte history');
+            }
+            else {
+                console.error('[TmuxManager] Failed to capture pane buffer:', err);
+            }
             return null;
         }
     }
@@ -1980,7 +2203,7 @@ export class TmuxManager extends EventEmitter {
      * Pane ids are not stable across respawns or restores, so callers should not
      * assume the first pane remains `%0`.
      */
-    captureActivePaneBuffer(muxName) {
+    captureActivePaneBuffer(muxName, opts) {
         if (IS_TEST_MODE)
             return '';
         if (!isValidMuxName(muxName)) {
@@ -1993,7 +2216,7 @@ export class TmuxManager extends EventEmitter {
                 timeout: EXEC_TIMEOUT_MS,
             }).trim();
             const target = resolveActivePaneTarget(output);
-            return target ? this.capturePaneBuffer(muxName, target) : null;
+            return target ? this.capturePaneBuffer(muxName, target, opts) : null;
         }
         catch (err) {
             console.error('[TmuxManager] Failed to resolve active pane for capture:', err);