arkaos 3.68.0 → 3.70.0

package/VERSION

@@ -1 +1 @@
-3.68.0
+3.70.0

package/dashboard/app/components/Terminal.vue

@@ -1,47 +1,35 @@
 <script setup lang="ts">
 // PR99b v3.68.0 — xterm.js terminal mount.
-//
-// Glues @xterm/xterm to a single PTY session from useTerminalSession.
-// One terminal per component instance; the multi-tab page in PR99c
-// will spawn N of these.
+// PR99c v3.69.0 — accepts an external session via prop so the tab
+// manager in /terminal can mount N instances, each bound to its own
+// PTY session.
 
 import { Terminal as XTerm } from '@xterm/xterm'
 import { FitAddon } from '@xterm/addon-fit'
 import { WebLinksAddon } from '@xterm/addon-web-links'
 import { SearchAddon } from '@xterm/addon-search'
 import '@xterm/xterm/css/xterm.css'
+import type { XtermTheme } from '~/composables/useTerminalThemes'
+
+interface Props {
+  session?: ReturnType<typeof useTerminalSession>
+  onInputLine?: (line: string) => void
+  theme?: XtermTheme
+}
+const props = defineProps<Props>()
 
 const container = ref<HTMLDivElement | null>(null)
-const session = useTerminalSession()
+const session = props.session ?? useTerminalSession()
 const term = shallowRef<XTerm | null>(null)
 const fit = shallowRef<FitAddon | null>(null)
 const search = shallowRef<SearchAddon | null>(null)
 
 const decoder = new TextDecoder('utf-8', { fatal: false })
 
-const themeArkaOSDark = {
-  background: '#0a0a0f',
-  foreground: '#e6e6f0',
-  cursor: '#7dd3fc',
-  cursorAccent: '#0a0a0f',
-  selectionBackground: '#1e3a5f',
-  black: '#0a0a0f',
-  red: '#f87171',
-  green: '#86efac',
-  yellow: '#fde68a',
-  blue: '#7dd3fc',
-  magenta: '#f0abfc',
-  cyan: '#67e8f9',
-  white: '#e6e6f0',
-  brightBlack: '#3f3f46',
-  brightRed: '#fca5a5',
-  brightGreen: '#bbf7d0',
-  brightYellow: '#fef3c7',
-  brightBlue: '#bae6fd',
-  brightMagenta: '#f5d0fe',
-  brightCyan: '#a5f3fc',
-  brightWhite: '#fafafa',
-}
+// PR99d v3.70.0 — theme comes from prop or from the composable
+// default (operator's choice stored in localStorage).
+const { activeTheme } = useTerminalThemes()
+const effectiveTheme = computed(() => props.theme ?? activeTheme.value)
 
 let unsubscribeOutput: (() => void) | null = null
 let resizeObserver: ResizeObserver | null = null
@@ -55,9 +43,14 @@ onMounted(async () => {
     fontSize: 13,
     lineHeight: 1.2,
     scrollback: 5000,
-    theme: themeArkaOSDark,
+    theme: effectiveTheme.value,
     allowProposedApi: true,
   })
+
+  // React to theme switches without remounting.
+  watch(effectiveTheme, (next) => {
+    if (term.value) term.value.options.theme = next
+  }, { deep: true })
   const fitAddon = new FitAddon()
   const searchAddon = new SearchAddon()
   t.loadAddon(fitAddon)
@@ -77,7 +70,22 @@ onMounted(async () => {
     t.write(text)
   })
 
+  // PR99c v3.69.0 — line-buffer for command history without server-
+  // side audit. Captures only printable chars up to Enter; ignores
+  // arrow keys, ctrl combos, escape sequences.
+  let lineBuf = ''
   t.onData((data) => {
+    for (const ch of data) {
+      if (ch === '\r' || ch === '\n') {
+        const cmd = lineBuf.trim()
+        if (cmd) props.onInputLine?.(cmd)
+        lineBuf = ''
+      } else if (ch === '\x7f' || ch === '\b') {
+        lineBuf = lineBuf.slice(0, -1)
+      } else if (ch >= ' ' && ch < '\x7f') {
+        lineBuf += ch
+      }
+    }
     session.sendInput(data)
   })
 
@@ -103,7 +111,11 @@ onMounted(async () => {
 onBeforeUnmount(async () => {
   unsubscribeOutput?.()
   resizeObserver?.disconnect()
-  await session.close()
+  // PR99c: only close the session if we created it. When the parent
+  // owns the session (props.session), parent is responsible for close.
+  if (!props.session) {
+    await session.close()
+  }
   term.value?.dispose()
 })
 

package/dashboard/app/composables/useTerminalSession.ts

@@ -26,8 +26,13 @@ export interface TerminalSessionHandle {
   onOutput: (cb: (chunk: Uint8Array) => void) => () => void
 }
 
-export function useTerminalSession(): TerminalSessionHandle {
-  const { apiBase } = useApi()
+export function useTerminalSession(
+  apiBaseOverride?: string,
+): TerminalSessionHandle {
+  // PR99c v3.69.0 — apiBaseOverride lets useTerminalTabs construct
+  // sessions from user-event handlers without re-entering Nuxt's
+  // composable context.
+  const apiBase = apiBaseOverride ?? useApi().apiBase
   const meta = ref<TerminalSessionMeta | null>(null)
   const status = ref<'idle' | 'connecting' | 'open' | 'closed' | 'error'>('idle')
   const error = ref<string | null>(null)

package/dashboard/app/composables/useTerminalTabs.ts

@@ -0,0 +1,130 @@
+// PR99c v3.69.0 — multi-session tab manager for /terminal.
+//
+// Owns an array of `useTerminalSession()` handles plus the active tab
+// id. Persists tab titles (not PTYs — those are re-created fresh on
+// reload) to localStorage. Enforces an 8-tab cap (matching the backend
+// default).
+
+export interface TerminalTab {
+  id: string
+  title: string
+  session: ReturnType<typeof useTerminalSession>
+  createdAt: number
+  hasActivity: boolean
+}
+
+const STORAGE_KEY = 'arka-terminal-tab-titles'
+const MAX_TABS = 8
+
+interface PersistedTitle {
+  id: string
+  title: string
+}
+
+function loadPersistedTitles(): Record<string, string> {
+  if (typeof localStorage === 'undefined') return {}
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY)
+    if (!raw) return {}
+    const parsed = JSON.parse(raw) as PersistedTitle[]
+    return Object.fromEntries(parsed.map(p => [p.id, p.title]))
+  } catch {
+    return {}
+  }
+}
+
+function persistTitles(tabs: TerminalTab[]) {
+  if (typeof localStorage === 'undefined') return
+  try {
+    const payload: PersistedTitle[] = tabs.map(t => ({ id: t.id, title: t.title }))
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(payload))
+  } catch {
+    // quota / private mode — swallow
+  }
+}
+
+export function useTerminalTabs() {
+  const { apiBase } = useApi()
+  const tabs = ref<TerminalTab[]>([])
+  const activeId = ref<string | null>(null)
+  const capReached = computed(() => tabs.value.length >= MAX_TABS)
+
+  function makeId(): string {
+    return Math.random().toString(36).slice(2, 10)
+  }
+
+  function newTab(): TerminalTab | null {
+    if (tabs.value.length >= MAX_TABS) return null
+    const id = makeId()
+    const persistedTitles = loadPersistedTitles()
+    const titleFromStorage = persistedTitles[id]
+    const tab: TerminalTab = {
+      id,
+      title: titleFromStorage || `Session ${tabs.value.length + 1}`,
+      session: useTerminalSession(apiBase),
+      createdAt: Date.now(),
+      hasActivity: false,
+    }
+    tabs.value.push(tab)
+    activeId.value = id
+    persistTitles(tabs.value)
+    return tab
+  }
+
+  async function closeTab(id: string) {
+    const idx = tabs.value.findIndex(t => t.id === id)
+    if (idx < 0) return
+    const tab = tabs.value[idx]
+    if (!tab) return
+    await tab.session.close()
+    tabs.value.splice(idx, 1)
+    if (activeId.value === id) {
+      const next = tabs.value[Math.min(idx, tabs.value.length - 1)]
+      activeId.value = next ? next.id : null
+    }
+    persistTitles(tabs.value)
+  }
+
+  function switchTab(id: string) {
+    const t = tabs.value.find(t => t.id === id)
+    if (!t) return
+    activeId.value = id
+    t.hasActivity = false
+  }
+
+  function renameTab(id: string, title: string) {
+    const t = tabs.value.find(t => t.id === id)
+    if (!t) return
+    t.title = title.trim() || t.title
+    persistTitles(tabs.value)
+  }
+
+  function markActivity(id: string) {
+    if (activeId.value === id) return
+    const t = tabs.value.find(t => t.id === id)
+    if (t) t.hasActivity = true
+  }
+
+  async function closeAll() {
+    await Promise.all(tabs.value.map(t => t.session.close()))
+    tabs.value = []
+    activeId.value = null
+    persistTitles([])
+  }
+
+  const activeTab = computed(() => tabs.value.find(t => t.id === activeId.value) ?? null)
+
+  return {
+    tabs,
+    activeId,
+    activeTab,
+    capReached,
+    maxTabs: MAX_TABS,
+    newTab,
+    closeTab,
+    switchTab,
+    renameTab,
+    markActivity,
+    closeAll,
+  }
+}

package/dashboard/app/composables/useTerminalThemes.ts

@@ -0,0 +1,190 @@
+// PR99d v3.70.0 — theme presets for xterm.js.
+//
+// Stored as plain xterm.js ITheme objects. The active theme name lives
+// in localStorage so it survives reloads. ArkaOS Dark is the default
+// and is tuned to the dashboard's primary color.
+
+export interface XtermTheme {
+  background: string
+  foreground: string
+  cursor: string
+  cursorAccent: string
+  selectionBackground: string
+  black: string
+  red: string
+  green: string
+  yellow: string
+  blue: string
+  magenta: string
+  cyan: string
+  white: string
+  brightBlack: string
+  brightRed: string
+  brightGreen: string
+  brightYellow: string
+  brightBlue: string
+  brightMagenta: string
+  brightCyan: string
+  brightWhite: string
+}
+
+export const TERMINAL_THEMES: Record<string, XtermTheme> = {
+  'arkaos-dark': {
+    background: '#0a0a0f',
+    foreground: '#e6e6f0',
+    cursor: '#7dd3fc',
+    cursorAccent: '#0a0a0f',
+    selectionBackground: '#1e3a5f',
+    black: '#0a0a0f',
+    red: '#f87171',
+    green: '#86efac',
+    yellow: '#fde68a',
+    blue: '#7dd3fc',
+    magenta: '#f0abfc',
+    cyan: '#67e8f9',
+    white: '#e6e6f0',
+    brightBlack: '#3f3f46',
+    brightRed: '#fca5a5',
+    brightGreen: '#bbf7d0',
+    brightYellow: '#fef3c7',
+    brightBlue: '#bae6fd',
+    brightMagenta: '#f5d0fe',
+    brightCyan: '#a5f3fc',
+    brightWhite: '#fafafa',
+  },
+  dracula: {
+    background: '#282a36',
+    foreground: '#f8f8f2',
+    cursor: '#f8f8f2',
+    cursorAccent: '#282a36',
+    selectionBackground: '#44475a',
+    black: '#21222c',
+    red: '#ff5555',
+    green: '#50fa7b',
+    yellow: '#f1fa8c',
+    blue: '#bd93f9',
+    magenta: '#ff79c6',
+    cyan: '#8be9fd',
+    white: '#f8f8f2',
+    brightBlack: '#6272a4',
+    brightRed: '#ff6e6e',
+    brightGreen: '#69ff94',
+    brightYellow: '#ffffa5',
+    brightBlue: '#d6acff',
+    brightMagenta: '#ff92df',
+    brightCyan: '#a4ffff',
+    brightWhite: '#ffffff',
+  },
+  'solarized-dark': {
+    background: '#002b36',
+    foreground: '#839496',
+    cursor: '#93a1a1',
+    cursorAccent: '#002b36',
+    selectionBackground: '#073642',
+    black: '#073642',
+    red: '#dc322f',
+    green: '#859900',
+    yellow: '#b58900',
+    blue: '#268bd2',
+    magenta: '#d33682',
+    cyan: '#2aa198',
+    white: '#eee8d5',
+    brightBlack: '#586e75',
+    brightRed: '#cb4b16',
+    brightGreen: '#586e75',
+    brightYellow: '#657b83',
+    brightBlue: '#839496',
+    brightMagenta: '#6c71c4',
+    brightCyan: '#93a1a1',
+    brightWhite: '#fdf6e3',
+  },
+  'solarized-light': {
+    background: '#fdf6e3',
+    foreground: '#657b83',
+    cursor: '#586e75',
+    cursorAccent: '#fdf6e3',
+    selectionBackground: '#eee8d5',
+    black: '#073642',
+    red: '#dc322f',
+    green: '#859900',
+    yellow: '#b58900',
+    blue: '#268bd2',
+    magenta: '#d33682',
+    cyan: '#2aa198',
+    white: '#eee8d5',
+    brightBlack: '#002b36',
+    brightRed: '#cb4b16',
+    brightGreen: '#586e75',
+    brightYellow: '#657b83',
+    brightBlue: '#839496',
+    brightMagenta: '#6c71c4',
+    brightCyan: '#93a1a1',
+    brightWhite: '#fdf6e3',
+  },
+  nord: {
+    background: '#2e3440',
+    foreground: '#d8dee9',
+    cursor: '#d8dee9',
+    cursorAccent: '#2e3440',
+    selectionBackground: '#434c5e',
+    black: '#3b4252',
+    red: '#bf616a',
+    green: '#a3be8c',
+    yellow: '#ebcb8b',
+    blue: '#81a1c1',
+    magenta: '#b48ead',
+    cyan: '#88c0d0',
+    white: '#e5e9f0',
+    brightBlack: '#4c566a',
+    brightRed: '#bf616a',
+    brightGreen: '#a3be8c',
+    brightYellow: '#ebcb8b',
+    brightBlue: '#81a1c1',
+    brightMagenta: '#b48ead',
+    brightCyan: '#8fbcbb',
+    brightWhite: '#eceff4',
+  },
+}
+
+export const THEME_LABELS: Record<string, string> = {
+  'arkaos-dark': 'ArkaOS Dark',
+  dracula: 'Dracula',
+  'solarized-dark': 'Solarized Dark',
+  'solarized-light': 'Solarized Light',
+  nord: 'Nord',
+}
+
+const STORAGE_KEY = 'arka-terminal-theme'
+const DEFAULT_THEME = 'arkaos-dark'
+
+export function useTerminalThemes() {
+  const themeName = useState<string>('terminal-theme', () => {
+    if (typeof localStorage === 'undefined') return DEFAULT_THEME
+    return localStorage.getItem(STORAGE_KEY) || DEFAULT_THEME
+  })
+
+  function setTheme(name: string) {
+    if (!TERMINAL_THEMES[name]) return
+    themeName.value = name
+    try {
+      localStorage.setItem(STORAGE_KEY, name)
+    } catch {
+      // ignore quota
+    }
+  }
+
+  const activeTheme = computed<XtermTheme>(
+    () => TERMINAL_THEMES[themeName.value] ?? TERMINAL_THEMES[DEFAULT_THEME]!,
+  )
+
+  const options = computed(() =>
+    Object.entries(THEME_LABELS).map(([value, label]) => ({ value, label })),
+  )
+
+  return {
+    themeName,
+    activeTheme,
+    setTheme,
+    options,
+  }
+}

package/dashboard/app/pages/terminal.vue

@@ -1,25 +1,159 @@
 <script setup lang="ts">
 // PR99b v3.68.0 — Real-shell terminal (single session).
+// PR99c v3.69.0 — Multi-session tabs + browser-local command history.
 //
-// Replaces the v3.51.0 allowlist UI. Each visit spawns a fresh PTY
-// session on the backend, wired to xterm.js. Multi-session tabs and
-// history land in PR99c. The old allowlist endpoints stay in parallel
-// until PR99d, but the UI is gone as of this release.
+// Each tab owns its own PTY session. PTYs are NOT persisted across
+// reloads (they're per-process); only tab titles are. The 8-tab cap
+// matches the backend default.
 
 definePageMeta({ layout: 'default' })
 
-const terminalRef = ref<InstanceType<typeof import('~/components/Terminal.vue').default> | null>(null)
-const expanded = ref(false)
+const {
+  tabs,
+  activeId,
+  activeTab,
+  capReached,
+  maxTabs,
+  newTab,
+  closeTab,
+  switchTab,
+  renameTab,
+} = useTerminalTabs()
+
+const HISTORY_KEY = 'arka-terminal-command-history'
+const HISTORY_MAX = 500
+
+interface HistoryEntry {
+  ts: number
+  cmd: string
+}
+
+function loadHistory(): HistoryEntry[] {
+  if (typeof localStorage === 'undefined') return []
+  try {
+    const raw = localStorage.getItem(HISTORY_KEY)
+    return raw ? (JSON.parse(raw) as HistoryEntry[]) : []
+  } catch {
+    return []
+  }
+}
+
+const history = ref<HistoryEntry[]>(loadHistory())
+
+function recordCommand(cmd: string) {
+  const trimmed = cmd.trim()
+  if (!trimmed || trimmed.length < 2) return
+  history.value.unshift({ ts: Date.now(), cmd: trimmed })
+  if (history.value.length > HISTORY_MAX) {
+    history.value = history.value.slice(0, HISTORY_MAX)
+  }
+  try {
+    localStorage.setItem(HISTORY_KEY, JSON.stringify(history.value))
+  } catch {
+    // quota — silently truncate further
+    history.value = history.value.slice(0, 200)
+  }
+}
+
+// PR99d v3.70.0 — theme picker + Ctrl+R history search.
+const { themeName, setTheme, options: themeOptions } = useTerminalThemes()
+const searchOpen = ref(false)
+const searchQuery = ref('')
+
+const searchResults = computed(() => {
+  const q = searchQuery.value.trim().toLowerCase()
+  if (!q) return history.value.slice(0, 30)
+  return history.value
+    .filter((h) => h.cmd.toLowerCase().includes(q))
+    .slice(0, 30)
+})
+
+function openSearch() {
+  searchOpen.value = true
+  searchQuery.value = ''
+}
+
+function pickFromSearch(cmd: string) {
+  activeTab.value?.session.sendInput(cmd)
+  searchOpen.value = false
+}
+
+const editingTabId = ref<string | null>(null)
+const renameDraft = ref('')
+
+function startRename(tabId: string, currentTitle: string) {
+  editingTabId.value = tabId
+  renameDraft.value = currentTitle
+}
+
+function commitRename() {
+  if (editingTabId.value) {
+    renameTab(editingTabId.value, renameDraft.value)
+  }
+  editingTabId.value = null
+}
+
+const toast = useToast()
+
+function tryNewTab() {
+  if (capReached.value) {
+    toast.add({
+      title: 'Maximum sessions reached',
+      description: `You can have up to ${maxTabs} sessions open at once. Close one to open a new one.`,
+      color: 'warning',
+      icon: 'i-lucide-alert-triangle',
+    })
+    return
+  }
+  newTab()
+}
+
+// Keyboard shortcuts.
+defineShortcuts({
+  meta_t: { handler: tryNewTab, usingInput: false },
+  meta_w: {
+    handler: () => {
+      if (activeId.value) closeTab(activeId.value)
+    },
+    usingInput: false,
+  },
+  ctrl_r: { handler: openSearch, usingInput: false },
+  meta_1: { handler: () => switchByIndex(0), usingInput: false },
+  meta_2: { handler: () => switchByIndex(1), usingInput: false },
+  meta_3: { handler: () => switchByIndex(2), usingInput: false },
+  meta_4: { handler: () => switchByIndex(3), usingInput: false },
+  meta_5: { handler: () => switchByIndex(4), usingInput: false },
+  meta_6: { handler: () => switchByIndex(5), usingInput: false },
+  meta_7: { handler: () => switchByIndex(6), usingInput: false },
+  meta_8: { handler: () => switchByIndex(7), usingInput: false },
+})
+
+function switchByIndex(idx: number) {
+  const t = tabs.value[idx]
+  if (t) switchTab(t.id)
+}
+
+// First-visit: open one tab automatically.
+onMounted(() => {
+  if (tabs.value.length === 0) newTab()
+})
+
+onBeforeUnmount(async () => {
+  // Don't proactively close tabs — operator may navigate back. Backend
+  // reaper will GC after the idle timeout (30 min).
+})
+
+const showHistory = ref(false)
 </script>
 
 <template>
   <div class="flex flex-col gap-3 h-full">
-    <header class="flex items-center justify-between">
+    <header class="flex items-center justify-between gap-3 flex-wrap">
       <div>
         <h1 class="text-2xl font-semibold">Terminal</h1>
         <p class="text-sm text-muted">
-          Real shell, PTY-backed. Runs the same commands as your local zsh —
-          claude, codex, git, anything. Session ends when you leave this page.
+          Real PTY shell — run claude, codex, git, anything. ⌘T new ·
+          ⌘W close · ⌘1–8 switch.
         </p>
       </div>
       <div class="flex items-center gap-2">
@@ -27,25 +161,155 @@ const expanded = ref(false)
           <UIcon name="i-lucide-shield" class="size-3 mr-1" />
           localhost only
         </UBadge>
+        <USelect
+          :model-value="themeName"
+          :items="themeOptions"
+          size="xs"
+          class="w-44"
+          @update:model-value="setTheme($event as string)"
+        />
+        <UButton
+          size="xs"
+          variant="ghost"
+          icon="i-lucide-search"
+          title="Ctrl+R — search history"
+          @click="openSearch"
+        >
+          ⌃R
+        </UButton>
         <UButton
           size="xs"
           variant="ghost"
-          :icon="expanded ? 'i-lucide-minimize-2' : 'i-lucide-maximize-2'"
-          @click="expanded = !expanded"
+          :icon="showHistory ? 'i-lucide-x' : 'i-lucide-history'"
+          @click="showHistory = !showHistory"
         >
-          {{ expanded ? 'Restore' : 'Expand' }}
+          History ({{ history.length }})
         </UButton>
       </div>
     </header>
 
-    <Terminal
-      ref="terminalRef"
-      :class="expanded ? 'fixed inset-4 z-40' : 'flex-1 min-h-[520px]'"
-    />
+    <div class="flex items-center gap-1 border-b border-default pb-2 overflow-x-auto">
+      <div
+        v-for="(tab, idx) in tabs"
+        :key="tab.id"
+        :class="[
+          'group flex items-center gap-1 px-3 py-1.5 rounded-t-md cursor-pointer text-sm shrink-0 border-b-2 transition-colors',
+          activeId === tab.id
+            ? 'bg-elevated/60 border-primary text-default'
+            : 'border-transparent text-muted hover:text-default hover:bg-elevated/30',
+        ]"
+        @click="switchTab(tab.id)"
+        @dblclick="startRename(tab.id, tab.title)"
+      >
+        <span class="text-xs text-muted">{{ idx + 1 }}</span>
+        <UInput
+          v-if="editingTabId === tab.id"
+          v-model="renameDraft"
+          size="xs"
+          autofocus
+          @keydown.enter="commitRename"
+          @keydown.esc="editingTabId = null"
+          @blur="commitRename"
+        />
+        <span v-else>{{ tab.title }}</span>
+        <UIcon
+          v-if="tab.hasActivity && activeId !== tab.id"
+          name="i-lucide-circle"
+          class="size-2 text-amber-400 fill-current"
+        />
+        <button
+          class="ml-1 size-4 grid place-items-center rounded text-muted hover:bg-default/50 hover:text-default opacity-0 group-hover:opacity-100"
+          @click.stop="closeTab(tab.id)"
+        >
+          <UIcon name="i-lucide-x" class="size-3" />
+        </button>
+      </div>
+      <UButton
+        size="xs"
+        variant="ghost"
+        icon="i-lucide-plus"
+        :disabled="capReached"
+        :title="capReached ? `Max ${maxTabs} sessions` : 'New session'"
+        @click="tryNewTab"
+      >
+        New
+      </UButton>
+    </div>
+
+    <div class="flex-1 min-h-[480px] flex gap-3">
+      <div class="flex-1 relative">
+        <template v-for="tab in tabs" :key="tab.id">
+          <Terminal
+            v-show="activeId === tab.id"
+            :session="tab.session"
+            :on-input-line="recordCommand"
+            class="absolute inset-0"
+          />
+        </template>
+        <div
+          v-if="tabs.length === 0"
+          class="absolute inset-0 grid place-items-center text-muted text-sm"
+        >
+          No active sessions. Press ⌘T or click "+ New" to open one.
+        </div>
+      </div>
+      <aside
+        v-if="showHistory"
+        class="w-72 shrink-0 rounded-lg border border-default bg-elevated/10 overflow-hidden flex flex-col"
+      >
+        <div class="px-3 py-2 border-b border-default text-xs uppercase tracking-wide text-muted">
+          Command history
+        </div>
+        <div class="flex-1 overflow-auto text-xs font-mono">
+          <button
+            v-for="(entry, i) in history"
+            :key="i"
+            class="w-full text-left px-3 py-1.5 hover:bg-default/40 truncate"
+            :title="entry.cmd"
+            @click="activeTab?.session.sendInput(entry.cmd)"
+          >
+            {{ entry.cmd }}
+          </button>
+          <div v-if="history.length === 0" class="px-3 py-4 text-muted text-center">
+            No commands yet
+          </div>
+        </div>
+      </aside>
+    </div>
 
     <footer class="text-xs text-muted">
-      Multi-session tabs, command history search and theme picker arrive in
-      PR99c / PR99d. PR99a (backend PTY) is live.
+      Sessions live on the backend until you close them or 30 min idle.
+      History stays in this browser only. Ctrl+R to search history.
     </footer>
+
+    <UModal v-model:open="searchOpen" :title="`Search history (${history.length})`">
+      <template #body>
+        <div class="space-y-2">
+          <UInput
+            v-model="searchQuery"
+            placeholder="type to filter…"
+            autofocus
+            icon="i-lucide-search"
+            @keydown.enter="searchResults[0] && pickFromSearch(searchResults[0].cmd)"
+          />
+          <div class="max-h-80 overflow-y-auto rounded-md border border-default divide-y divide-default">
+            <button
+              v-for="(entry, i) in searchResults"
+              :key="i"
+              class="w-full text-left px-3 py-2 text-sm font-mono hover:bg-elevated/40 truncate"
+              @click="pickFromSearch(entry.cmd)"
+            >
+              {{ entry.cmd }}
+            </button>
+            <div v-if="searchResults.length === 0" class="px-3 py-4 text-muted text-center text-sm">
+              No matches
+            </div>
+          </div>
+          <p class="text-xs text-muted">
+            Enter sends the top match to the active session.
+          </p>
+        </div>
+      </template>
+    </UModal>
   </div>
 </template>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "3.68.0",
+  "version": "3.70.0",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "3.68.0"
+version = "3.70.0"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}

package/scripts/dashboard-api.py

@@ -2221,216 +2221,8 @@ def _iso_duration_s(start_iso: str, end_iso: str) -> Optional[int]:
         return None
 
 
-# --- Terminal command runner (PR95a v3.51.0) ---
-
-# Allowlist of commands the dashboard terminal can run. Each entry is
-# {id, label, cmd, description}. Server-side enforcement: any request
-# whose `command_id` isn't in this list is rejected. No shell expansion,
-# no globbing, no pipes — subprocess.run with explicit argv only.
-TERMINAL_ALLOWLIST: list[dict] = [
-    {
-        "id": "arka-status",
-        "label": "ArkaOS status",
-        "cmd": ["arkaos", "status"],
-        "description": "System status (version, departments, agents, projects).",
-    },
-    {
-        "id": "git-status",
-        "label": "git status",
-        "cmd": ["git", "status", "--short"],
-        "description": "Working tree status in short form.",
-    },
-    {
-        "id": "git-log",
-        "label": "git log",
-        "cmd_template": ["git", "log", "-{count}", "--oneline"],
-        "args": [
-            {
-                "name": "count",
-                "label": "Commits to show",
-                "choices": ["5", "10", "20", "50"],
-                "default": "10",
-            },
-        ],
-        "description": "Most recent N commits (operator picks N).",
-    },
-    {
-        "id": "npm-version",
-        "label": "npm view arkaos version",
-        "cmd": ["npm", "view", "arkaos", "version"],
-        "description": "Latest published ArkaOS version on npm.",
-    },
-    {
-        "id": "pytest-collect",
-        "label": "pytest --collect-only",
-        "cmd": ["python3", "-m", "pytest", "--collect-only", "-q", "tests/python/"],
-        "description": "List every Python test without running.",
-    },
-    {
-        "id": "ls",
-        "label": "ls",
-        "cmd": ["ls", "-la"],
-        "description": "List files in the project root.",
-    },
-    {
-        "id": "arka-costs",
-        "label": "ArkaOS costs",
-        "cmd_template": ["python3", "-m", "core.runtime.llm_cost_telemetry_cli", "{period}"],
-        "args": [
-            {
-                "name": "period",
-                "label": "Period",
-                "choices": ["today", "week", "month", "all"],
-                "default": "today",
-            },
-        ],
-        "description": "LLM cost summary for the selected period.",
-    },
-]
-
-_TERMINAL_TIMEOUT_S = 15
-_TERMINAL_MAX_OUTPUT = 20_000  # chars — both stdout and stderr capped
-
-
-@app.get("/api/terminal/commands")
-def terminal_commands():
-    """List allowlisted commands the dashboard terminal may run.
-
-    PR96b v3.56.0 — includes the `args` schema (label / choices /
-    default) when an entry has parameters. The raw cmd / cmd_template
-    is NEVER returned — defence in depth.
-    """
-    out: list[dict] = []
-    for c in TERMINAL_ALLOWLIST:
-        out.append({
-            "id": c["id"],
-            "label": c["label"],
-            "description": c["description"],
-            "args": _safe_args_schema(c.get("args")),
-        })
-    return {"commands": out, "total": len(out)}
-
-
-def _safe_args_schema(args) -> list[dict]:
-    """Sanitised arg schema for the public API — never leaks cmd/template."""
-    if not isinstance(args, list):
-        return []
-    out: list[dict] = []
-    for a in args:
-        if not isinstance(a, dict):
-            continue
-        choices = a.get("choices")
-        if not isinstance(choices, list) or not choices:
-            continue
-        out.append({
-            "name": str(a.get("name") or ""),
-            "label": str(a.get("label") or a.get("name") or ""),
-            "choices": [str(x) for x in choices],
-            "default": str(a.get("default") or choices[0]),
-        })
-    return out
-
-
-@app.post("/api/terminal/exec")
-def terminal_exec(body: dict):
-    """PR95a v3.51.0 — run an allowlisted command and return the output.
-
-    Body: ``{"command_id": "<id>"}``. Unknown ids are rejected.
-    Returns ``{stdout, stderr, exit_code, duration_ms, command}``.
-    Output is capped at ``_TERMINAL_MAX_OUTPUT`` chars per stream.
-    """
-    if not isinstance(body, dict):
-        return {"error": "body must be an object"}
-    cid = (body.get("command_id") or "").strip()
-    if not cid:
-        return {"error": "command_id is required"}
-    entry = next((c for c in TERMINAL_ALLOWLIST if c["id"] == cid), None)
-    if entry is None:
-        return {"error": f"command '{cid}' is not on the allowlist"}
-
-    # PR96b v3.56.0 — resolve template + args, or fall back to fixed cmd.
-    if "cmd_template" in entry:
-        argv, err = _resolve_cmd_template(entry, body.get("args") or {})
-        if err:
-            return {"error": err}
-    else:
-        argv = entry["cmd"]
-
-    import time
-    started = time.monotonic()
-    try:
-        result = subprocess.run(
-            argv,
-            cwd=str(ARKAOS_ROOT),
-            capture_output=True,
-            text=True,
-            timeout=_TERMINAL_TIMEOUT_S,
-            shell=False,
-        )
-    except subprocess.TimeoutExpired:
-        return {
-            "stdout": "",
-            "stderr": f"command timed out after {_TERMINAL_TIMEOUT_S}s",
-            "exit_code": -1,
-            "duration_ms": int(_TERMINAL_TIMEOUT_S * 1000),
-            "command": " ".join(argv),
-        }
-    except OSError as exc:
-        return {
-            "stdout": "",
-            "stderr": f"command failed to launch: {exc}",
-            "exit_code": -1,
-            "duration_ms": int((time.monotonic() - started) * 1000),
-            "command": " ".join(argv),
-        }
-    duration_ms = int((time.monotonic() - started) * 1000)
-    return {
-        "stdout": (result.stdout or "")[:_TERMINAL_MAX_OUTPUT],
-        "stderr": (result.stderr or "")[:_TERMINAL_MAX_OUTPUT],
-        "exit_code": result.returncode,
-        "duration_ms": duration_ms,
-        "command": " ".join(argv),
-    }
-
-
-def _resolve_cmd_template(entry: dict, supplied: dict) -> tuple[list[str], "str | None"]:
-    """Substitute `{name}` placeholders in cmd_template with validated args.
-
-    Returns (argv, None) on success, ([], error_msg) on validation failure.
-    Anything supplied that isn't in the schema's choices is rejected.
-    Unknown arg names are also rejected — no silent passthrough.
-    """
-    schema = entry.get("args") or []
-    if not isinstance(schema, list):
-        return [], "command has invalid args schema"
-    by_name: dict[str, dict] = {a["name"]: a for a in schema if isinstance(a, dict)}
-    chosen: dict[str, str] = {}
-    for arg_def in schema:
-        name = arg_def["name"]
-        s = supplied.get(name)
-        if s is None:
-            chosen[name] = str(arg_def.get("default") or arg_def["choices"][0])
-            continue
-        s_str = str(s)
-        if s_str not in arg_def["choices"]:
-            return [], (
-                f"arg '{name}'='{s_str}' is not in the allowed choices "
-                f"({', '.join(arg_def['choices'])})"
-            )
-        chosen[name] = s_str
-    for k in supplied:
-        if k not in by_name:
-            return [], f"unknown arg '{k}'"
-    argv: list[str] = []
-    for tok in entry["cmd_template"]:
-        if not isinstance(tok, str):
-            continue
-        out_tok = tok
-        for name, val in chosen.items():
-            out_tok = out_tok.replace(f"{{{name}}}", val)
-        argv.append(out_tok)
-    return argv, None
-
+# Allowlist runner (PR95a v3.51.0) removed in PR99d v3.70.0 —
+# replaced by PTY WebSocket from PR99a/b/c.
 
 @app.put("/api/workflows/{workflow_id}/yaml")
 def workflow_update_yaml(workflow_id: str, body: dict):