create-walle 0.9.26 → 0.9.28

package/template/claude-task-manager/public/index.html

@@ -802,6 +802,115 @@
     color: var(--fg);
     background: color-mix(in srgb, var(--danger) 18%, var(--bg-light));
   }
+  .setup-phone-url-card {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+    margin: 0 0 14px;
+    padding: 12px 12px 12px 14px;
+    border: 1px solid color-mix(in srgb, var(--accent) 22%, var(--border));
+    border-radius: 12px;
+    background:
+      linear-gradient(135deg, color-mix(in srgb, var(--accent) 10%, transparent), transparent 58%),
+      color-mix(in srgb, var(--bg-light) 88%, #000 12%);
+    box-shadow: inset 0 1px 0 rgba(255,255,255,0.04);
+  }
+  .setup-phone-url-copy {
+    display: flex;
+    align-items: center;
+    flex-wrap: wrap;
+    gap: 8px;
+    min-width: 0;
+    color: var(--fg-dim);
+    font-size: 13px;
+    line-height: 1.4;
+  }
+  .setup-phone-url-label {
+    color: color-mix(in srgb, var(--fg) 70%, var(--fg-dim));
+    font-weight: 800;
+  }
+  .setup-phone-url-value {
+    max-width: min(100%, 720px);
+    padding: 4px 8px;
+    border: 1px solid color-mix(in srgb, var(--accent) 18%, var(--border));
+    border-radius: 8px;
+    background: color-mix(in srgb, var(--bg) 86%, #000 14%);
+    color: var(--fg);
+    font-size: 12px;
+    line-height: 1.35;
+    word-break: break-all;
+  }
+  .setup-copy-chip {
+    flex: 0 0 auto;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 7px;
+    min-height: 32px;
+    padding: 7px 12px;
+    border: 1px solid color-mix(in srgb, var(--accent) 38%, var(--border));
+    border-radius: 999px;
+    background:
+      linear-gradient(180deg, color-mix(in srgb, var(--accent) 14%, transparent), transparent),
+      color-mix(in srgb, var(--bg-light) 88%, #000 12%);
+    color: color-mix(in srgb, var(--accent) 72%, var(--fg));
+    cursor: pointer;
+    font-size: 12px;
+    font-weight: 850;
+    letter-spacing: 0.01em;
+    transition: border-color 140ms ease, background-color 140ms ease, color 140ms ease, opacity 140ms ease, transform 140ms ease;
+  }
+  .setup-copy-chip:not(:disabled):hover {
+    border-color: color-mix(in srgb, var(--accent) 62%, var(--border));
+    background: color-mix(in srgb, var(--accent) 15%, var(--bg-light));
+    color: var(--fg);
+    transform: translateY(-1px);
+  }
+  .setup-copy-chip:disabled {
+    opacity: 0.45;
+    cursor: not-allowed;
+    transform: none;
+  }
+  .setup-copy-chip.is-copied {
+    border-color: color-mix(in srgb, var(--success) 55%, var(--border));
+    background: color-mix(in srgb, var(--success) 15%, var(--bg-light));
+    color: color-mix(in srgb, var(--success) 72%, var(--fg));
+  }
+  .setup-copy-glyph {
+    position: relative;
+    width: 13px;
+    height: 13px;
+    display: inline-block;
+  }
+  .setup-copy-glyph::before,
+  .setup-copy-glyph::after {
+    content: "";
+    position: absolute;
+    width: 8px;
+    height: 8px;
+    border: 1.5px solid currentColor;
+    border-radius: 3px;
+  }
+  .setup-copy-glyph::before {
+    left: 1px;
+    top: 4px;
+    opacity: 0.72;
+  }
+  .setup-copy-glyph::after {
+    right: 1px;
+    top: 1px;
+    background: color-mix(in srgb, var(--bg-light) 75%, transparent);
+  }
+  @media (max-width: 760px) {
+    .setup-phone-url-card {
+      align-items: stretch;
+      flex-direction: column;
+    }
+    .setup-copy-chip {
+      width: 100%;
+    }
+  }
   .backup-db-grid {
     display: grid;
     grid-template-columns: repeat(2, minmax(0, 1fr));
@@ -6254,6 +6363,27 @@
     background: none; color: var(--fg-dim); cursor: pointer;
   }
   .session-esc-x:hover { color: var(--fg); }
+  /* App-level Full Disk Access banner — fixed top bar. Shown only when macOS FDA is
+     missing AND there is at least one network/Dropbox-backed session (so it never nags
+     users who don't need it). One grant stops the repeating "network volume" prompt. */
+  .fda-capability-banner {
+    position: fixed; left: 0; right: 0; bottom: 0; z-index: 4100;
+    display: flex; align-items: center; gap: 10px;
+    padding: 8px 14px; font-size: 12.5px; color: var(--fg);
+    background: rgba(45,37,15,0.97); backdrop-filter: blur(3px);
+    border-top: 1px solid var(--yellow);
+    box-shadow: 0 -2px 12px rgba(0,0,0,0.4);
+  }
+  .fda-banner-icon { font-size: 15px; }
+  .fda-banner-text { flex: 1; }
+  .fda-banner-text strong { font-family: var(--mono, monospace); }
+  .fda-capability-banner button { font-size: 11px; padding: 4px 11px; border-radius: 5px; white-space: nowrap; cursor: pointer; border: 1px solid transparent; }
+  .fda-banner-grant { border-color: rgba(158,206,106,0.6); background: rgba(158,206,106,0.2); color: var(--fg); }
+  .fda-banner-grant:hover { background: rgba(158,206,106,0.34); }
+  .fda-banner-later { border-color: rgba(122,162,247,0.5); background: rgba(122,162,247,0.14); color: var(--fg); }
+  .fda-banner-later:hover { background: rgba(122,162,247,0.28); }
+  .fda-banner-never { border: none; background: none; color: var(--fg-dim); }
+  .fda-banner-never:hover { color: var(--fg); text-decoration: underline; }
   /* Pending-approval banner: real permission approvals only. Normal terminal
      choices (AskUserQuestion) stay in the terminal/choice flow and must not use
      approval wording or Approve/Deny actions. */
@@ -7723,8 +7853,15 @@ url = "http://localhost:<span id="setup-mcp-port-display-toml">3457</span>/mcp"<
                     <div class="setup-phone-guidance-title" id="setup-phone-guidance-title">Phone setup</div>
                     <div class="setup-phone-guidance-body" id="setup-phone-guidance-body">Choose an access method above to see the phone steps.</div>
                   </div>
-                  <div id="setup-phone-recommended" class="setup-access-status" style="margin-bottom:10px;color:var(--fg-dim);">
-                    <span id="setup-phone-best-label">Recommended phone URL</span>: <code id="setup-phone-best-url" style="font-size:11px;background:var(--bg);padding:1px 5px;border-radius:4px;word-break:break-all;">Resolving…</code>
+                  <div id="setup-phone-recommended" class="setup-phone-url-card" aria-live="polite">
+                    <div class="setup-phone-url-copy">
+                      <span id="setup-phone-best-label" class="setup-phone-url-label">Recommended phone URL</span>
+                      <code id="setup-phone-best-url" class="setup-phone-url-value">Resolving…</code>
+                    </div>
+                    <button class="setup-copy-chip" id="setup-phone-best-copy" type="button" onclick="SETUP.copyRecommendedPhoneUrl()" disabled aria-label="Copy recommended phone URL">
+                      <span class="setup-copy-glyph" aria-hidden="true"></span>
+                      <span id="setup-phone-best-copy-label">Copy</span>
+                    </button>
                   </div>
                   <div class="input-row">
                     <label>New Phone Label</label>
@@ -8700,6 +8837,7 @@ url = "http://localhost:<span id="setup-mcp-port-display-toml">3457</span>/mcp"<
 <script src="js/session-search-utils.js"></script>
 <script src="js/session-activity-utils.js"></script>
 <script src="js/session-status-precedence.js"></script>
+<script src="js/session-phase.js"></script>
 <script src="js/terminal-restore-state.js"></script>
 <script src="js/terminal-reconciler.js"></script>
 <script src="js/stream-resize-policy.js"></script>
@@ -9394,6 +9532,14 @@ function broadcastInstalledUpdateReload(server, reason) {
 
 function handleServerHello(msg) {
   if (msg && msg.clientId) state._clientId = msg.clientId;
+  // Option A "keyframe on every boundary": the server is the source of truth for whether
+  // keyframe-sync is on (CTM_KEYFRAME_SYNC). Mirror it into the client flag so _keyframeSyncEnabled()
+  // gates the boundary-render path + retires the heal overlay. Set before any heartbeat/snapshot
+  // is processed (hello is the first message on the connection).
+  if (msg && typeof msg.keyframeSync === 'boolean') window.CTM_KEYFRAME_SYNC = msg.keyframeSync;
+  // Option A.5 "streaming keyframe heartbeat": mirror whether the server pushes keyframes
+  // mid-stream (CTM_STREAM_KEYFRAME) so _streamKeyframeEnabled() gates the mid-stream apply.
+  if (msg && typeof msg.streamKeyframe === 'boolean') window.CTM_STREAM_KEYFRAME = msg.streamKeyframe;
   const server = normalizeAppVersionInfo(msg && msg.appVersion);
   if (!server) return;
   if (!state.appRuntime.loaded) {
@@ -9631,6 +9777,8 @@ function _markTerminalLayoutChanged(s, reason) {
 function _markTerminalContentChanged(s, reason) {
   const v = _bumpTerminalViewEpoch(s, 'contentEpoch', reason || 'content');
   if (v) _setTerminalViewPhase(s, _terminalRestorePhases().PAINT_SETTLING, reason || 'content');
+  // Content changed = the previously validated render frame is no longer authoritative.
+  if (typeof _markRenderUnstable === 'function') _markRenderUnstable(s, reason || 'content');
 }
 
 function _updateTerminalVisibilityState(id, reason) {
@@ -9689,6 +9837,7 @@ function _markTerminalRestoreRequest(s, source, extra) {
     if (nextPhase) _setTerminalViewPhase(s, nextPhase, 'restore-request:' + type);
   }
   _terminalRenderMarkDirty(s, 'restore-request:' + s._snapshotRequestSource);
+  if (typeof _markRenderUnstable === 'function') _markRenderUnstable(s, 'restore-request:' + s._snapshotRequestSource);
   _maybeDismissRestartOverlay('restore-request');
   return now;
 }
@@ -10186,6 +10335,8 @@ function connect() {
       _sendQueue = [];
       if (_sendRetryTimer) { clearTimeout(_sendRetryTimer); _sendRetryTimer = null; }
     }
+    // One-shot Full Disk Access check after boot settles (off the critical attach path).
+    if (!_fdaCapabilityChecked) { _fdaCapabilityChecked = true; setTimeout(checkFdaCapability, 4000); }
   };
 
   ws.onmessage = (e) => {
@@ -10998,6 +11149,82 @@ function formatUptime(seconds) {
   return h + 'h ' + m + 'm';
 }
 
+// ── Full Disk Access capability banner ─────────────────────────────────────
+// Many sessions live under ~/Library/CloudStorage/Dropbox (a File Provider = "network volume"
+// to macOS) or NFS mounts, so macOS re-prompts for file access on every restart. Full Disk
+// Access is a superset that, under the stable Dev-ID identity, persists — one grant ends it.
+// We can only detect + guide; Apple forbids granting FDA programmatically.
+let _fdaCapabilityChecked = false;
+const FDA_BANNER_DISMISS_KEY = 'ctm_fda_banner_dismissed_v1';
+
+async function checkFdaCapability() {
+  try {
+    if (localStorage.getItem(FDA_BANNER_DISMISS_KEY) === '1') return;
+    const r = await fetch(`/api/capabilities?token=${state.token}`);
+    if (!r.ok) return;
+    const cap = await r.json();
+    if (cap && cap.needsAttention) showFdaBanner(cap);
+    else hideFdaBanner();
+  } catch { /* best-effort — never block the UI on this */ }
+}
+
+function hideFdaBanner() {
+  const b = document.getElementById('fda-capability-banner');
+  if (b) b.remove();
+}
+
+function showFdaBanner(cap) {
+  if (document.getElementById('fda-capability-banner')) return;
+  const count = Number(cap.networkSessionCount) || 0;
+  const denials = Array.isArray(cap.accessDenials) ? cap.accessDenials : [];
+  // Prefer the specific, observed cause (e.g. Codex couldn't read ~/.codex) over the generic
+  // count — it's actionable and explains why a session just failed to load.
+  let message;
+  if (denials.length) {
+    const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
+      { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+    const d = denials[0];
+    const who = d.provider ? d.provider.charAt(0).toUpperCase() + d.provider.slice(1) : 'An agent';
+    const where = (d.path || '').replace(/\/config\.toml$/, '') || d.path || 'a file';
+    message = `${esc(who)} couldn't read <code>${esc(where)}</code> (it's on Dropbox/iCloud or a network volume), so the session failed to load. <strong>Grant Full Disk Access once</strong> to fix it.`;
+  } else {
+    message = `CTM has ${count} session${count === 1 ? '' : 's'} on a network/Dropbox volume, so macOS keeps asking for file access on every restart. <strong>Grant Full Disk Access once</strong> to stop it.`;
+  }
+  const banner = document.createElement('div');
+  banner.id = 'fda-capability-banner';
+  banner.className = 'fda-capability-banner';
+  banner.innerHTML = `
+    <span class="fda-banner-icon">&#128274;</span>
+    <span class="fda-banner-text">${message}</span>
+    <button class="fda-banner-grant" type="button">Grant Full Disk Access</button>
+    <button class="fda-banner-later" type="button">Later</button>
+    <button class="fda-banner-never" type="button" title="Don't show again">Don't show again</button>`;
+  document.body.appendChild(banner);
+  banner.querySelector('.fda-banner-grant').addEventListener('click', () => grantFdaAccess(cap));
+  banner.querySelector('.fda-banner-later').addEventListener('click', hideFdaBanner);
+  banner.querySelector('.fda-banner-never').addEventListener('click', () => {
+    try { localStorage.setItem(FDA_BANNER_DISMISS_KEY, '1'); } catch {}
+    hideFdaBanner();
+  });
+}
+
+async function grantFdaAccess(cap) {
+  const fallbackHint = (cap && cap.hint) ||
+    'Open System Settings → Privacy & Security → Full Disk Access and add "Coding Task Manager".';
+  try {
+    const r = await fetch(`/api/capabilities/open-fda?token=${state.token}`, { method: 'POST' });
+    const d = await r.json().catch(() => ({}));
+    if (d && d.ok) {
+      toast('Add "Coding Task Manager" to the opened Full Disk Access list, then restart CTM once — macOS will stop asking.', { type: 'info', title: 'Full Disk Access', duration: 12000 });
+    } else {
+      toast(fallbackHint, { type: 'warning', title: 'Grant Full Disk Access', duration: 14000 });
+    }
+  } catch {
+    toast(fallbackHint, { type: 'warning', title: 'Grant Full Disk Access', duration: 14000 });
+  }
+  hideFdaBanner();
+}
+
 async function pollServiceStatus() {
   try {
     const r = await fetch(`/api/services/status?token=${state.token}`);
@@ -12327,6 +12554,15 @@ const _CODEX_BUSY_STATUS_LINE_RE = /^(?:(?:waiting\s+for\s+background\s+terminal
 const _CODEX_BUSY_COMPACT_STATUS_LINE_RE = /^working\s+(?:\d+(?::\d+){0,2}|\d+(?:\.\d+)?\s*(?:ms|s|sec|secs|m|min|mins|h|hr|hrs))$/iu;
 const _CODEX_BUSY_WORD = 'working';
 const _CODEX_BUSY_HINT_RE = /esc\s+to\s+interrupt/i;
+// A width-reflow strand can paint the Codex "Working (12s • esc to interrupt)"
+// status line over trailing scrollback content, leaving a merged line such as
+// "Working RSA-1ES046-SHA256:DHE-RSA-AES256-SHA256:HIGH:!aNULL:!…". The strict
+// anchored REs above miss it, so a genuinely-running turn whose PTY has gone
+// briefly quiet gets demoted to Idle. Recognize the surviving "Working" prefix
+// when the trailing remainder is clearly NOT prose (code/cipher-like garble),
+// and never for ordinary "Working <word>" output ("working tree", "working on").
+const _CODEX_BUSY_GARBLE_PROSE_RE = /^working\s+(?:tree|dir|directory|copy|set|version|branch|on|in|with|through|from|for|as|at|to|and|but|so|the|a|an|my|your|our|this|that|it|now|here|hard|fine|well|great|correctly|properly)\b/i;
+const _CODEX_BUSY_GARBLE_SIGNAL_RE = /[:!]|[A-Z0-9]{3,}[-:]|\besc\b/;
 const _CODEX_SKILL_WARNING_RE = /^(?:⚠\s*)?Skipped loading\s+\d+\s+skill\(s\)\s+due to invalid SKILL\.md files\./i;
 const _CODEX_SKILL_DESCRIPTION_RE = /^\/.*\/SKILL\.md:\s+invalid description:\s+exceeds maximum length of\s+\d+\s+characters$/i;
 const _GEMINI_STATUS_FRAGMENT_RE = /^(?:[\s\d•◦·∙●○✦✧◆◇◐◓◑◒|\/\\-]+|Thinking\.{0,3}|Working\.{0,3}|Running\.{0,3}|Responding\.{0,3}|Loading\.{0,3}|esc\s+to\s+(?:cancel|interrupt)|ctrl\+c\s+to\s+(?:quit|cancel)|press\s+enter\s+to\s+send|shift\+enter\s+for\s+newline)$/i;
@@ -12357,11 +12593,18 @@ function _normalizeCodexStatusLineText(text) {
     .replace(/^[\s•◦·∙●○]+\s*/, '');
 }
 
+function _isGarbledCodexBusyStatusLine(line) {
+  if (!/^working\b/i.test(line)) return false;
+  if (_CODEX_BUSY_GARBLE_PROSE_RE.test(line)) return false;
+  return _CODEX_BUSY_GARBLE_SIGNAL_RE.test(line.slice(_CODEX_BUSY_WORD.length));
+}
+
 function _isCodexBusyStatusLineText(text) {
   const line = _normalizeCodexStatusLineText(text);
   if (!line || line.length > 240) return false;
   return _CODEX_BUSY_STATUS_LINE_RE.test(line) ||
-    _CODEX_BUSY_COMPACT_STATUS_LINE_RE.test(line);
+    _CODEX_BUSY_COMPACT_STATUS_LINE_RE.test(line) ||
+    _isGarbledCodexBusyStatusLine(line);
 }
 
 function _inputMayResolveWaiting(data, session) {
@@ -16491,6 +16734,8 @@ function _confirmClaudePersistentViewportGarble(s, now) {
 }
 
 function _maybeRecoverClaudeStaleWidthRender(id, reason) {
+  // Option A: keyframes replace the stale-width garble heals (typeof-guarded for source-slice tests).
+  if (typeof _keyframeSyncEnabled === 'function' && _keyframeSyncEnabled()) return false;
   const s = state.sessions.get(id);
   if (!s || !s.term) return false;
   // Width arbitration: a SECONDARY viewer must never drive a redraw-reflow — it
@@ -19841,6 +20086,10 @@ function createTerminal(id, opts) {
     if (s && s._suppressResize) return; // Skip during font metric refresh
     _markTerminalLayoutChanged(s, 'xterm-resize');
     _sendTerminalResizeIfChanged(s, id, 'xterm-resize', { cols, rows });
+    // Option A: a resize is a render boundary — xterm reflows locally (can shear an idle
+    // frame), so PULL an authoritative keyframe at the new dims (debounced to coalesce a
+    // drag). No-op unless keyframe-sync is on.
+    _requestKeyframeDebounced(s, id, 'resize');
   });
 
   // Alt screen buffer switch listener — when Claude Code's TUI (Ink) exits,
@@ -21066,9 +21315,14 @@ window._ctmEnsureTerminalRestoreForVisibleView = _ensureTerminalRestoreForVisibl
 
 function _markTerminalActivationRestoreScheduled(s, id, source) {
   if (!s) return;
-  s._activationRestoreScheduledAt = Date.now();
+  const now = Date.now();
+  s._activationRestoreScheduledAt = now;
   s._activationRestoreScheduledId = id || s._id || '';
   s._activationRestoreScheduledSource = source || 'activation';
+  s._terminalActivationSeq = Number(s._terminalActivationSeq || 0) + 1;
+  s._activatedAt = now;
+  s._reconciledSinceActivation = false;
+  if (typeof _markRenderUnstable === 'function') _markRenderUnstable(s, 'activation:' + s._activationRestoreScheduledSource);
 }
 
 function _clearTerminalActivationRestoreScheduled(s) {
@@ -21751,6 +22005,11 @@ function activateTab(id) {
         // INSIDE the activation grace so a malformed switch heals in <1s instead of
         // 5-10s. No-op when the session is already latched stable (nothing changed).
         _scheduleActivationRenderCheck(sReal, id);
+        // Option A: tab activation is a render boundary — PULL an authoritative keyframe at
+        // our current dims so the frame is correct-by-construction (no divergence-detect heal
+        // needed). No-op unless keyframe-sync is on. This is the structural fix for the
+        // "switch to an idle tab → stale/stranded frame" bug.
+        _requestKeyframe(sReal, id, 'activation');
         if (!_sessionConversationViewActive(id)) focusTerminalIfSafe(id);
       }));
       // Final safety net — regardless of which restore path fired, make sure
@@ -28524,6 +28783,248 @@ function _modelsProviderEditPayload(type, options) {
   return body;
 }
 
+// Ollama-only "Manage models" dialog: browse the ollama.com library, download
+// (pull) models with live progress, and uninstall local models from disk. All
+// requests go through CTM's /api/models/* proxy to Wall-E (which owns the model
+// registry and the Ollama client). On any install/remove, the parent Edit
+// dialog's DEFAULT MODEL dropdown is refreshed via the registry.
+function showOllamaManageModelsDialog(providerType, baseUrl) {
+  providerType = String(providerType || 'ollama').trim().toLowerCase();
+  var existing = document.getElementById('ollama-manage-dialog');
+  if (existing) existing.remove();
+
+  var SANITIZE_OPTS = { ADD_ATTR: ['style', 'id', 'type', 'placeholder', 'value', 'title', 'data-action', 'data-model'] };
+  function fmtSize(b) {
+    b = Number(b) || 0;
+    if (!b) return '';
+    var u = ['B', 'KB', 'MB', 'GB', 'TB'], i = 0;
+    while (b >= 1024 && i < u.length - 1) { b /= 1024; i++; }
+    return (b >= 10 || i === 0 ? Math.round(b) : b.toFixed(1)) + ' ' + u[i];
+  }
+
+  var dialog = document.createElement('div');
+  dialog.id = 'ollama-manage-dialog';
+  dialog.style.cssText = 'position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.62);display:flex;align-items:center;justify-content:center;z-index:10000;padding:18px;';
+  var inner = document.createElement('div');
+  inner.style.cssText = 'background:#24283b;border:1px solid #414868;border-radius:10px;width:640px;max-width:96vw;max-height:88vh;overflow:auto;box-shadow:0 24px 80px rgba(0,0,0,0.35);padding:20px;';
+  inner.innerHTML = DOMPurify.sanitize(
+    '<div style="display:flex;justify-content:space-between;align-items:flex-start;margin-bottom:6px;">' +
+      '<div><div style="font-size:17px;font-weight:700;color:#c0caf5;">Manage Ollama models</div>' +
+      '<div style="font-size:12px;color:#565f89;margin-top:2px;">Download models from the Ollama library or uninstall local ones.</div></div>' +
+      '<button type="button" id="btn-close-ollama-manage" style="padding:5px 10px;border-radius:6px;border:1px solid #414868;background:#1a1b26;color:#c0caf5;cursor:pointer;">✕</button>' +
+    '</div>' +
+    '<input id="ollama-manage-filter" type="search" placeholder="Filter models..." autocomplete="off" spellcheck="false" style="width:100%;box-sizing:border-box;margin:8px 0;background:#1a1b26;color:#c0caf5;border:1px solid #414868;border-radius:6px;padding:7px 9px;font-size:12px;">' +
+    '<div id="ollama-manage-status" style="min-height:16px;font-size:12px;color:#565f89;margin-bottom:6px;"></div>' +
+    '<div id="ollama-manage-body"><div style="color:#565f89;font-size:12px;padding:10px 0;">Loading…</div></div>' +
+    '<div style="border-top:1px solid #2a2e44;margin-top:12px;padding-top:12px;">' +
+      '<div style="font-size:11px;color:#565f89;text-transform:uppercase;letter-spacing:0.4px;margin-bottom:5px;">Pull by name</div>' +
+      '<div style="display:flex;gap:8px;">' +
+        '<input id="ollama-pull-name" type="text" placeholder="e.g. llama3.2:3b" autocomplete="off" spellcheck="false" style="flex:1;box-sizing:border-box;background:#1a1b26;color:#c0caf5;border:1px solid #414868;border-radius:6px;padding:7px 9px;font-size:12px;">' +
+        '<button type="button" id="ollama-pull-name-btn" style="padding:7px 14px;border-radius:6px;background:#7aa2f7;color:#1a1b26;border:none;cursor:pointer;font-weight:700;">Pull</button>' +
+      '</div>' +
+    '</div>',
+    SANITIZE_OPTS
+  );
+  dialog.appendChild(inner);
+  document.body.appendChild(dialog);
+
+  var bodyEl = inner.querySelector('#ollama-manage-body');
+  var statusEl = inner.querySelector('#ollama-manage-status');
+  var filterEl = inner.querySelector('#ollama-manage-filter');
+  var dirty = false;     // set when something was installed/removed → refresh registry on close
+  var pullCount = 0;     // in-flight downloads; auto-reload only when idle
+  var lastInstalled = [];
+  var lastLibrary = { models: [], degraded: false };
+
+  function setStatus(msg, kind) {
+    statusEl.textContent = msg || '';
+    statusEl.style.color = kind === 'error' ? '#f7768e' : (kind === 'success' ? '#9ece6a' : '#565f89');
+  }
+
+  function close() {
+    dialog.remove();
+    if (dirty) {
+      // Refresh the registry so the parent Edit dialog's model dropdown updates.
+      _modelsRegistryLoaded = false;
+      _ensureModelsRegistryLoaded(_modelsLoadSeq).then(function() {
+        if (document.getElementById('edit-provider-dialog')) showModelProviderEditDialog(providerType);
+      });
+    }
+  }
+
+  function familyInstalled(family, installedIds) {
+    var f = String(family).toLowerCase();
+    return installedIds.some(function(id) {
+      id = String(id).toLowerCase();
+      return id === f || id.indexOf(f + ':') === 0;
+    });
+  }
+
+  function render() {
+    var q = String(filterEl.value || '').trim().toLowerCase();
+    var installed = lastInstalled || [];
+    var installedIds = installed.map(function(m) { return m.id || m.name; });
+    var available = (lastLibrary.models || []).filter(function(m) { return !familyInstalled(m.name, installedIds); });
+    var instShown = installed.filter(function(m) { return !q || String(m.id || m.name).toLowerCase().indexOf(q) >= 0; });
+    var availShown = available.filter(function(m) {
+      return !q || String(m.name).toLowerCase().indexOf(q) >= 0 || String(m.description || '').toLowerCase().indexOf(q) >= 0;
+    });
+
+    var h = '';
+    h += '<div style="font-size:11px;color:#565f89;text-transform:uppercase;letter-spacing:0.4px;margin:4px 0 6px;">Installed (' + installed.length + ')</div>';
+    if (!instShown.length) {
+      h += '<div style="color:#565f89;font-size:12px;padding:2px 0 8px;">' + (installed.length ? 'No matches.' : 'No models installed locally.') + '</div>';
+    } else {
+      instShown.forEach(function(m) {
+        var id = m.id || m.name;
+        h += '<div class="ollama-row" style="display:flex;align-items:center;justify-content:space-between;gap:10px;padding:7px 0;border-bottom:1px solid #2a2e44;">' +
+          '<div style="min-width:0;"><span style="color:#c0caf5;font-size:13px;">' + escHtml(id) + '</span>' +
+          (m.size ? ' <span style="color:#565f89;font-size:11px;">' + escHtml(fmtSize(m.size)) + '</span>' : '') + '</div>' +
+          '<div class="ollama-row-action" style="flex:none;">' +
+            '<button type="button" data-action="remove" data-model="' + escHtml(id) + '" style="padding:4px 10px;border-radius:5px;border:1px solid #f7768e;background:transparent;color:#f7768e;cursor:pointer;font-size:11px;">Remove</button>' +
+          '</div></div>';
+      });
+    }
+
+    h += '<div style="font-size:11px;color:#565f89;text-transform:uppercase;letter-spacing:0.4px;margin:14px 0 6px;">Available to download</div>';
+    if (lastLibrary.degraded) {
+      h += '<div style="color:#e0af68;font-size:12px;padding:2px 0 8px;">Catalog unavailable right now — use “Pull by name” below to download a specific tag.</div>';
+    }
+    if (!availShown.length && !lastLibrary.degraded) {
+      h += '<div style="color:#565f89;font-size:12px;padding:2px 0 8px;">' + ((lastLibrary.models || []).length ? 'No matches.' : 'No catalog models available.') + '</div>';
+    } else {
+      availShown.slice(0, 200).forEach(function(m) {
+        var sizes = Array.isArray(m.sizes) ? m.sizes : [];
+        var chips = sizes.length
+          ? sizes.map(function(s) {
+              var tag = m.name + ':' + s;
+              return '<button type="button" data-action="pull" data-model="' + escHtml(tag) + '" style="padding:3px 9px;border-radius:5px;border:1px solid #414868;background:#1a1b26;color:#7aa2f7;cursor:pointer;font-size:11px;">' + escHtml(s) + ' ↓</button>';
+            }).join(' ')
+          : '<button type="button" data-action="pull" data-model="' + escHtml(m.name) + '" style="padding:4px 10px;border-radius:5px;border:1px solid #7aa2f7;background:transparent;color:#7aa2f7;cursor:pointer;font-size:11px;">Download</button>';
+        h += '<div class="ollama-row" style="padding:8px 0;border-bottom:1px solid #2a2e44;">' +
+          '<div style="display:flex;align-items:baseline;justify-content:space-between;gap:10px;">' +
+            '<span style="color:#c0caf5;font-size:13px;font-weight:600;">' + escHtml(m.name) + '</span>' +
+            '<span style="color:#565f89;font-size:11px;flex:none;">' + escHtml(m.pulls ? m.pulls + ' pulls' : '') + '</span>' +
+          '</div>' +
+          (m.description ? '<div style="color:#787c99;font-size:11px;margin:3px 0 6px;">' + escHtml(m.description) + '</div>' : '') +
+          '<div class="ollama-row-action" style="display:flex;flex-wrap:wrap;gap:6px;align-items:center;">' + chips + '</div>' +
+        '</div>';
+      });
+      if (availShown.length > 200) {
+        h += '<div style="color:#565f89;font-size:11px;padding:6px 0;">Showing first 200 of ' + availShown.length + ' — filter to narrow.</div>';
+      }
+    }
+    bodyEl.innerHTML = DOMPurify.sanitize(h, SANITIZE_OPTS);
+  }
+
+  function reload(force) {
+    var instUrl = _modelsApiUrl('/api/models/ollama/models');
+    var libUrl = _modelsApiUrl('/api/models/ollama/library' + (force ? '?force=1' : ''));
+    return Promise.all([
+      fetch(instUrl).then(function(r) { return r.json(); }).catch(function() { return { models: [] }; }),
+      fetch(libUrl).then(function(r) { return r.json(); }).catch(function() { return { models: [], degraded: true }; }),
+    ]).then(function(res) {
+      lastInstalled = (res[0] && res[0].models) || [];
+      lastLibrary = res[1] || { models: [], degraded: true };
+      render();
+    });
+  }
+
+  function pull(model, actionCell) {
+    model = String(model || '').trim();
+    if (!model) return;
+    var report = function(txt) { if (actionCell) actionCell.textContent = txt; else setStatus(txt, 'info'); };
+    pullCount++;
+    report('Starting…');
+    fetch(_modelsApiUrl('/api/models/ollama/pull'), {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ model: model, baseUrl: baseUrl || undefined }),
+    }).then(function(resp) {
+      if (!resp.ok || !resp.body) throw new Error('Download failed (' + resp.status + ')');
+      var reader = resp.body.getReader();
+      var dec = new TextDecoder();
+      var buf = '';
+      var lastErr = null;
+      function pump() {
+        return reader.read().then(function(r) {
+          if (r.done) return;
+          buf += dec.decode(r.value, { stream: true });
+          var lines = buf.split('\n');
+          buf = lines.pop();
+          lines.forEach(function(ln) {
+            ln = ln.trim();
+            if (!ln) return;
+            var j; try { j = JSON.parse(ln); } catch (e) { return; }
+            if (j.status === 'error' || j.error) { lastErr = j.error || j.message || 'Download error'; }
+            else if (typeof j.progress === 'number') { report('Downloading ' + j.progress + '%'); }
+            else if (j.message) { report(j.message); }
+          });
+          return pump();
+        });
+      }
+      return pump().then(function() { if (lastErr) throw new Error(lastErr); });
+    }).then(function() {
+      dirty = true;
+      report('Installed ✓');
+      setStatus(model + ' downloaded.', 'success');
+    }).catch(function(e) {
+      setStatus(e && e.message ? e.message : 'Download failed', 'error');
+      if (actionCell) actionCell.textContent = 'Failed';
+    }).then(function() {
+      pullCount--;
+      if (pullCount === 0) reload(false);
+    });
+  }
+
+  function remove(model) {
+    model = String(model || '').trim();
+    if (!model) return;
+    if (!window.confirm('Uninstall ' + model + ' from disk? This frees space and removes it from CTM.')) return;
+    setStatus('Removing ' + model + '…', 'info');
+    fetch(_modelsApiUrl('/api/models/ollama/delete'), {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ model: model, baseUrl: baseUrl || undefined }),
+    }).then(function(resp) {
+      return resp.json().catch(function() { return {}; }).then(function(d) {
+        if (!resp.ok || d.error) throw new Error(d.error || 'Remove failed (' + resp.status + ')');
+        return d;
+      });
+    }).then(function() {
+      dirty = true;
+      setStatus(model + ' removed.', 'success');
+      return reload(false);
+    }).catch(function(e) {
+      setStatus(e && e.message ? e.message : 'Remove failed', 'error');
+    });
+  }
+
+  bodyEl.addEventListener('click', function(e) {
+    var btn = e.target.closest('button[data-action]');
+    if (!btn) return;
+    var action = btn.getAttribute('data-action');
+    var model = btn.getAttribute('data-model');
+    if (action === 'pull') {
+      var cell = btn.closest('.ollama-row') ? btn.closest('.ollama-row').querySelector('.ollama-row-action') : null;
+      pull(model, cell);
+    } else if (action === 'remove') {
+      remove(model);
+    }
+  });
+  filterEl.addEventListener('input', render);
+  inner.querySelector('#ollama-pull-name-btn').addEventListener('click', function() {
+    var nameInput = inner.querySelector('#ollama-pull-name');
+    var val = String(nameInput.value || '').trim();
+    if (val) { pull(val, null); nameInput.value = ''; }
+  });
+  inner.querySelector('#ollama-pull-name').addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') { e.preventDefault(); inner.querySelector('#ollama-pull-name-btn').click(); }
+  });
+  inner.querySelector('#btn-close-ollama-manage').addEventListener('click', close);
+  dialog.addEventListener('click', function(e) { if (e.target === dialog) close(); });
+
+  reload(false);
+}
+
 function showModelProviderEditDialog(type) {
   type = String(type || '').trim().toLowerCase();
   if (!type) return;
@@ -28663,7 +29164,10 @@ function showModelProviderEditDialog(type) {
         '<select id="edit-provider-default-model"' + defaultDisabledAttr + ' style="width:100%;box-sizing:border-box;background:#24283b;color:#c0caf5;border:1px solid #414868;border-radius:7px;padding:8px 10px;font-size:13px;"></select>' +
         '<div style="display:flex;justify-content:space-between;gap:8px;align-items:center;flex-wrap:wrap;margin-top:7px;">' +
           '<div style="font-size:11px;color:#565f89;">' + escHtml(modelHelp) + '</div>' +
-          '<button type="button" id="btn-refresh-provider-models" style="padding:4px 8px;border-radius:5px;border:1px solid #414868;background:transparent;color:#7aa2f7;cursor:pointer;font-size:11px;">Refresh models</button>' +
+          '<div style="display:flex;gap:6px;align-items:center;">' +
+            (type === 'ollama' ? '<button type="button" id="btn-manage-ollama-models" style="padding:4px 8px;border-radius:5px;border:1px solid #414868;background:transparent;color:#9ece6a;cursor:pointer;font-size:11px;">Manage models →</button>' : '') +
+            '<button type="button" id="btn-refresh-provider-models" style="padding:4px 8px;border-radius:5px;border:1px solid #414868;background:transparent;color:#7aa2f7;cursor:pointer;font-size:11px;">Refresh models</button>' +
+          '</div>' +
         '</div>' +
         unsupportedNote +
       '</div>' +
@@ -28772,6 +29276,12 @@ function showModelProviderEditDialog(type) {
       if (document.getElementById('edit-provider-dialog')) showModelProviderEditDialog(type);
     });
   });
+  var manageOllamaBtn = document.getElementById('btn-manage-ollama-models');
+  if (manageOllamaBtn) {
+    manageOllamaBtn.addEventListener('click', function() {
+      showOllamaManageModelsDialog(type, baseUrl);
+    });
+  }
   var detectButton = document.getElementById('btn-detect-edit-provider');
   var maybeDetectGeminiCli = async function() {
     if (type !== 'google' || !authSelect || authSelect.value !== 'gemini_cli' || (keyInput && keyInput.value.trim())) return null;
@@ -33154,6 +33664,11 @@ function onHeartbeat(msg) {
   s._serverSeq = msg.seq;
   s._serverFpCols = msg.cols;
   s._serverFpRows = msg.rows;
+  // Option A: the heartbeat fingerprint exists only to drive the divergence-detect heal
+  // overlay. With keyframe-sync on, correctness comes from authoritative keyframe pushes
+  // (output-quiet / activation / resize), so we record the fp for status/diagnostics but
+  // skip the dims-reassert + reconcile + settle-recheck heal cascade entirely.
+  if (_keyframeSyncEnabled()) return;
   // Adopt a pure-lifecycle-bump heartbeat into our localSeq. A status change
   // (idle / waiting-for-input) bumps the server's terminal lifecycle and emits this
   // heartbeat at the new lifecycle, but carries NO new output bytes — and localSeq
@@ -33227,6 +33742,9 @@ function _reconcileConfirmAction(divergedSince, now) {
   return 'fire';
 }
 function _maybeReconcile(s, id, reason, extra) {
+  // Option A: keyframes replace divergence-driven reconcile. typeof-guarded so the source-
+  // slice unit tests (which extract this fn standalone, without the helper) stay flag-off.
+  if (typeof _keyframeSyncEnabled === 'function' && _keyframeSyncEnabled()) return;
   if (!s || !s.term || !window.TerminalReconciler) return;
   // Width arbitration: a SECONDARY viewer is rendered from server-pushed reflowed
   // snapshots at its own width. The heartbeat fingerprint is measured at the
@@ -33241,7 +33759,32 @@ function _maybeReconcile(s, id, reason, extra) {
   // Only compare when the server measured at the client's CURRENT dims; otherwise
   // the fingerprints legitimately differ on dims and a resize/reconcile is already
   // in flight elsewhere. Comparing across dims would cause a reconcile loop.
-  if (s._serverFpCols != null && s._serverFpRows != null && (s.term.cols !== s._serverFpCols || s.term.rows !== s._serverFpRows)) return;
+  if (s._serverFpCols != null && s._serverFpRows != null && (s.term.cols !== s._serverFpCols || s.term.rows !== s._serverFpRows)) {
+    // The server's fingerprint was measured at a DIFFERENT width than our grid now
+    // holds — e.g. a background-tab pane-resize refit the grid on switch but no fresh
+    // heartbeat has arrived at the new width. We still skip the cross-dims compare
+    // (it would loop), but a plain skip here leaves an idle session you just switched
+    // to STUCK forever: no output ⇒ no heartbeat ⇒ the onHeartbeat dims-reassert never
+    // runs, so the server keeps serializing its stale-wide frame and the stranded
+    // composer / branch chip never heals (the on-switch "check + redraw" the user
+    // expects). Re-assert our dims ONCE here too (rate-limited via the SAME
+    // _dimsReassertAt the heartbeat path uses) so the PTY resizes, the agent repaints
+    // clean at our width, and the next heartbeat is comparable. Skipped while streaming
+    // (force bypasses the SIGWINCH-during-stream deferral → duplicate scrollback); the
+    // heartbeat reassert covers that case once output quiesces. Uniform for every
+    // provider — unlike the claude-only stale-width detector, this needs no agent type
+    // or stranded-fragment shape, so it also unsticks an idle Codex frame.
+    const nowTs = Date.now();
+    if (!_isSessionStreaming(s)
+        && (!s._dimsReassertAt || nowTs - s._dimsReassertAt > 2000)
+        && Number.isFinite(s.term.cols) && Number.isFinite(s.term.rows)) {
+      s._dimsReassertAt = nowTs;
+      try { _sendTerminalResizeIfChanged(s, id, 'reconcile-dims-reassert', { force: true, cols: s.term.cols, rows: s.term.rows }); } catch {}
+      _markRenderUnstable(s, 'reconcile-dims-reassert');
+      _scheduleDimsReassertRecheck(s, id);
+    }
+    return;
+  }
   let clientFp;
   try { clientFp = window.TerminalReconciler.clientFingerprint(s.term); } catch { return; }
   const focusHelper = (typeof _activeTerminalHasFocus === 'function') ? _activeTerminalHasFocus(s) : (document.hasFocus() && state.activeTab === id);
@@ -33286,7 +33829,7 @@ function _maybeReconcile(s, id, reason, extra) {
     s._benignDivergeFp = null; // frame converged — drop any benign-divergence give-up memo
     s._claudeStableDivergeFp = null; // frame converged — drop any stable-divergence redraw arm
     s._activationHealPending = 0; // converged — drop the one-shot on-switch heal marker
-    _markRenderStable(s); // confirmed good — latch so the proactive on-switch check skips redundant work
+    _markRenderStable(s, id); // confirmed good — latch this exact activation/render state
     return;
   }
   if (verdict === 'reconcile') {
@@ -33422,6 +33965,8 @@ window._ctmMaybeReconcile = _maybeReconcile;
 // idle safety net; the 4s in-flight debounce + flash-loop backoff bound any churn.
 const SETTLE_RECHECK_DELAY_MS = RECONCILE_DIVERGENCE_CONFIRM_MS + 150;
 function _scheduleSettleRecheck(s, id) {
+  // Option A: no divergence confirm/heal under keyframe-sync (typeof-guarded for source-slice tests).
+  if (typeof _keyframeSyncEnabled === 'function' && _keyframeSyncEnabled()) return;
   if (!s || s._exited) return;
   // A reconcile/redraw is already in flight — its result will re-settle the frame; a
   // re-check now would only no-op against the in-flight debounce. Skip to stay quiet.
@@ -33440,6 +33985,24 @@ function _scheduleSettleRecheck(s, id) {
 // matching window._ctmMaybeReconcile / window._ctmMaybeRecoverClaudeStaleWidth.
 window._ctmScheduleSettleRecheck = _scheduleSettleRecheck;
 
+const DIMS_REASSERT_RECHECK_MS = 350;
+function _scheduleDimsReassertRecheck(s, id) {
+  if (!s || s._exited || !id) return;
+  if (!_activationRenderCheckEnabled()) return;
+  if (s._dimsReassertRecheckTimer) clearTimeout(s._dimsReassertRecheckTimer);
+  s._dimsReassertRecheckTimer = setTimeout(() => {
+    s._dimsReassertRecheckTimer = null;
+    if (!_activationRenderCheckEnabled()) return;
+    if (s._exited) return;
+    if (state.activeTab !== id && !isSessionVisibleInSplit(id)) return;
+    try { _maybeReconcile(s, id, 'dims-reassert-recheck'); } catch {}
+    try { _maybeRecoverClaudeStaleWidthRender(id, 'dims-reassert-recheck'); } catch {}
+    if (s._reconcileDivergedSince || s._claudeViewportGarbleSince) _scheduleSettleRecheck(s, id);
+  }, DIMS_REASSERT_RECHECK_MS);
+  if (s._dimsReassertRecheckTimer && s._dimsReassertRecheckTimer.unref) s._dimsReassertRecheckTimer.unref();
+}
+window._ctmScheduleDimsReassertRecheck = _scheduleDimsReassertRecheck;
+
 // --- Input-settle re-check (heal promptly after the user stops typing) ---
 // While the user types, the editing-defer keeps _maybeReconcile from healing a diverged
 // frame (so a reconcile can't paint over the live composer). After they stop, the next heal
@@ -33494,35 +34057,152 @@ const CTM_ACTIVATION_RENDER_CHECK_MS = 200;
 // cleared on convergence, and self-expires so it can never bypass the cooldown later.
 const ACTIVATION_HEAL_PENDING_MAX_MS = 3500;
 function _activationRenderCheckEnabled() {
+  // Option A retires the activation-render-check (and the rest of the heal overlay) when
+  // keyframe-sync is on — the server pushes ground truth on every boundary instead.
+  // typeof-guarded so source-slice unit tests that extract this fn stay flag-off.
+  if (typeof _keyframeSyncEnabled === 'function' && _keyframeSyncEnabled()) return false;
   return typeof window === 'undefined' || window.CTM_ACTIVATION_RENDER_CHECK !== false;
 }
+// Option A — "keyframe on every boundary". When ON (server sets it via hello), the client
+// renders the server's authoritative keyframe on activation/resize/quiet and SKIPS the
+// ~13-path divergence-detect heal overlay (which only existed to repair byte-stream drift).
+// Default OFF — keyframe-off is byte-for-byte the legacy render path.
+function _keyframeSyncEnabled() {
+  return typeof window !== 'undefined' && window.CTM_KEYFRAME_SYNC === true;
+}
+// Option A.5 — "streaming keyframe heartbeat". The server pushes authoritative keyframes
+// (restoreReason 'stream-keyframe') at a controlled frame rate DURING sustained output, so a
+// mid-turn byte-stream shear self-corrects within one interval rather than persisting until the
+// turn quiets. Requires keyframe-sync; default OFF.
+function _streamKeyframeEnabled() {
+  return _keyframeSyncEnabled() && typeof window !== 'undefined' && window.CTM_STREAM_KEYFRAME === true;
+}
+// Pure decision core (unit-testable without the DOM): given the safety signals, return what to
+// do with a streaming keyframe. PAINT only when the client frame is SETTLED (write queue drained
+// — so its fingerprint is a reliable divergence signal), the user is NOT mid-input (so we never
+// clobber an un-acked composer/draft), the keyframe is not behind what we've applied, and its
+// grid matches ours. Anything else defers to the next keyframe (or the final output-quiet one),
+// so this can only make an inevitable correction land sooner — never paint something unsafe.
+function _streamKeyframeActionCore(f) {
+  if (!f || !f.enabled) return 'skip-disabled';
+  if (!f.hasData) return 'skip-no-data';
+  if (!f.visible) return 'skip-hidden';
+  if (f.typing) return 'skip-typing';
+  if (f.busy) return 'skip-busy';        // writer still applying bytes → fp compare unreliable
+  if (f.behind) return 'skip-stale';     // marker older than what we've already applied
+  if (f.dimsMismatch) return 'skip-dims'; // a resize keyframe / boundary path owns dim fixes
+  return 'paint';
+}
+function _streamKeyframeAction(s, msg) {
+  if (!s || !msg) return 'skip-no-data';
+  const id = msg.id;
+  const incomingMarker = msg.snapshotCurrentMarker != null ? msg.snapshotCurrentMarker : msg.snapshotMarker;
+  const localCols = s.term ? s.term.cols : 0;
+  const localRows = s.term ? s.term.rows : 0;
+  const ptyCols = msg.ptyCols || msg.cols || localCols;
+  const ptyRows = msg.ptyRows || msg.rows || localRows;
+  let behind = false;
+  try {
+    behind = incomingMarker != null && s._localSeq != null && window.TerminalReconciler
+      && typeof window.TerminalReconciler.seqLess === 'function'
+      && window.TerminalReconciler.seqLess(incomingMarker, s._localSeq);
+  } catch {}
+  return _streamKeyframeActionCore({
+    enabled: _streamKeyframeEnabled() && !!s.term,
+    hasData: !!msg.data,
+    visible: state.activeTab === id || isSessionVisibleInSplit(id),
+    typing: _terminalRecentUserInputActive(s) || _terminalInputDisplayHoldActive(s),
+    busy: !!(s.writer && (s.writer.scheduled || s.writer._chunking || s.writer.queue)),
+    behind: !!behind,
+    dimsMismatch: Math.abs(localCols - ptyCols) > 0 || Math.abs(localRows - ptyRows) > 0,
+  });
+}
+window._ctmStreamKeyframeAction = _streamKeyframeAction;
+// Option A: PULL an authoritative keyframe at the client's CURRENT dims on a render
+// boundary (activation / resize). Reuses the 'reconcile' request — the server serializes
+// the headless mirror at our dims and returns a snapshot (sent even if output lands
+// mid-serialize). This is the deterministic on-boundary I-frame that replaces the
+// fingerprint-divergence heal paths; the live byte stream still applies between keyframes.
+function _requestKeyframe(s, id, reason) {
+  if (!_keyframeSyncEnabled() || !s || !s.term || s._exited) return;
+  if (!Number.isFinite(s.term.cols) || !Number.isFinite(s.term.rows)) return;
+  if (state.activeTab !== id && !isSessionVisibleInSplit(id)) return;
+  try { _sendTerminalRestoreRequest(id, 'reconcile', { cols: s.term.cols, rows: s.term.rows }); } catch {}
+}
+const KEYFRAME_REQUEST_DEBOUNCE_MS = 160;
+function _requestKeyframeDebounced(s, id, reason) {
+  if (!_keyframeSyncEnabled() || !s || s._exited) return;
+  if (s._keyframeReqTimer) clearTimeout(s._keyframeReqTimer);
+  s._keyframeReqTimer = setTimeout(() => {
+    s._keyframeReqTimer = null;
+    _requestKeyframe(s, id, reason);
+  }, KEYFRAME_REQUEST_DEBOUNCE_MS);
+  if (s._keyframeReqTimer && s._keyframeReqTimer.unref) s._keyframeReqTimer.unref();
+}
+window._ctmRequestKeyframe = _requestKeyframe;
 // Stable latch: set on convergence (_maybeReconcile verdict 'ok'); cleared by
 // _markRenderUnstable on the situation-changed triggers (output / resize / reflow /
 // reconnect). Sole consumer is _scheduleActivationRenderCheck.
-function _markRenderStable(s) {
+function _terminalActivationStableKey(s, id) {
+  if (!s) return null;
+  const sid = id || s._id || '';
+  const v = _sessionViewState(s, sid);
+  const tuple = _terminalEpochTuple(v || {});
+  return {
+    id: sid,
+    visibility: _sessionVisibility(sid),
+    activationSeq: Number(s._terminalActivationSeq || 0),
+    mutationSeq: Number(s._terminalMutationSeq || 0),
+    localSeq: s._localSeq == null ? null : String(s._localSeq),
+    serverSeq: s._serverSeq == null ? null : String(s._serverSeq),
+    serverFp: s._serverFp || null,
+    serverCols: Number(s._serverFpCols || 0),
+    serverRows: Number(s._serverFpRows || 0),
+    cols: Number(s.term?.cols || 0),
+    rows: Number(s.term?.rows || 0),
+    viewerRole: s._viewerRole || 'primary',
+    contentEpoch: Number(tuple.contentEpoch || 0),
+    layoutEpoch: Number(tuple.layoutEpoch || 0),
+    rendererEpoch: Number(tuple.rendererEpoch || 0),
+    attachEpoch: Number(tuple.attachEpoch || 0),
+    restoreEpoch: Number(tuple.restoreEpoch || 0),
+    restoreRequestSeq: Number(s._terminalRestoreRequestSeq || 0),
+  };
+}
+function _markRenderStable(s, id) {
   if (!s) return;
+  const key = _terminalActivationStableKey(s, id || s._id || '');
   s._renderStableSince = window.ActivationRenderCheck
     ? window.ActivationRenderCheck.markStable(Date.now())
     : Date.now();
+  s._renderStableKey = window.ActivationRenderCheck && window.ActivationRenderCheck.markStableKey
+    ? window.ActivationRenderCheck.markStableKey(key)
+    : key;
 }
-function _markRenderUnstable(s) {
+function _markRenderUnstable(s, reason) {
   if (!s) return;
   s._renderStableSince = window.ActivationRenderCheck
     ? window.ActivationRenderCheck.markUnstable()
     : 0;
+  s._renderStableKey = null;
+  s._renderUnstableReason = reason || '';
 }
 function _scheduleActivationRenderCheck(s, id) {
   if (!s || s._exited) return;
+  const currentKey = _terminalActivationStableKey(s, id || s._id || '');
   const should = window.ActivationRenderCheck
     ? window.ActivationRenderCheck.shouldScheduleCheck({
         enabled: _activationRenderCheckEnabled(),
         renderStableSince: s._renderStableSince,
+        stableKey: s._renderStableKey,
+        currentKey,
         timerPending: !!s._activationRenderCheckTimer,
       })
     : (_activationRenderCheckEnabled() && !s._renderStableSince && !s._activationRenderCheckTimer);
   if (!should) return;
   s._activationRenderCheckTimer = setTimeout(() => {
     s._activationRenderCheckTimer = null;
+    if (!_activationRenderCheckEnabled()) return;
     if (s._exited) return;
     if (state.activeTab !== id && !isSessionVisibleInSplit(id)) return;
     // Run both validators (same ones the loop uses). The FIRST sighting only ARMS a
@@ -35568,6 +36248,20 @@ function _needsAuthoritativeSnapshotRecovery(s) {
   ));
 }
 
+// Reflow stale-skip backoff: a reflow can come back {stale:true} (output arrived after the
+// request) or time out. The post-/compact burst case wants a FAST retry (~900ms) so the
+// render converges as soon as output quiets. But a pathologically large, continuously-
+// repainting Codex session (12k+ history lines, ~800KB/serialize) NEVER goes quiet — every
+// retry re-serializes ~800KB, saturating the single worker so a clean frame can never land
+// (the "fixes then reverts, stays bad" loop). So we back the retry off exponentially per
+// consecutive non-convergence and RESET the moment a fresh frame lands — fast when it can
+// converge, patient (giving the worker a quiet window) when it can't.
+const REFLOW_STALE_BACKOFF_BASE_MS = 900;
+const REFLOW_STALE_BACKOFF_CAP_MS = 15000;
+function _reflowStaleBackoffMs(s) {
+  const streak = Math.max(1, Number(s && s._reflowStaleStreak) || 1);
+  return Math.min(REFLOW_STALE_BACKOFF_BASE_MS * Math.pow(2, Math.min(streak - 1, 5)), REFLOW_STALE_BACKOFF_CAP_MS);
+}
 function _scheduleAuthoritativeSnapshotRecovery(s, id, reason, opts) {
   opts = opts || {};
   if (!s || !id || !s.term) return false;
@@ -35682,6 +36376,18 @@ function _snapshotClientRestoreSeq(msg) {
   return Number.isFinite(seq) && seq > 0 ? seq : 0;
 }
 
+function _snapshotAuthoritativeMarker(msg) {
+  if (!msg) return null;
+  if (msg.snapshotCurrentMarker != null) return msg.snapshotCurrentMarker;
+  if (msg.snapshotMarker != null) return msg.snapshotMarker;
+  return null;
+}
+
+function _snapshotPositiveDimension(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 0;
+}
+
 function _snapshotRestoreSource(s, msg) {
   const explicit = String((msg && (msg.restoreSource || msg.source)) || '');
   if (explicit) return explicit;
@@ -35749,6 +36455,22 @@ function _recordSnapshotRestoreApplied(s, msg, source) {
   const seq = _snapshotClientRestoreSeq(msg);
   if (seq) s._terminalRestoreAppliedSeq = Math.max(Number(s._terminalRestoreAppliedSeq || 0), seq);
   const restoreSource = source || _snapshotRestoreSource(s, msg);
+  // A non-interim snapshot/reflow is authoritative for the client grid it paints.
+  // Keep the reconciler's server-side fingerprint/seq aligned with that accepted
+  // frame; otherwise the 3s self-check can compare the just-fixed terminal against
+  // a stale heartbeat and request a reconcile that reverts the render a few seconds
+  // after a successful reflow.
+  if (msg.fp) {
+    s._serverFp = String(msg.fp);
+    const cols = _snapshotPositiveDimension(msg.ptyCols) || _snapshotPositiveDimension(msg.cols) || _snapshotPositiveDimension(s.term && s.term.cols);
+    const rows = _snapshotPositiveDimension(msg.ptyRows) || _snapshotPositiveDimension(msg.rows) || _snapshotPositiveDimension(s.term && s.term.rows);
+    if (cols) s._serverFpCols = cols;
+    if (rows) s._serverFpRows = rows;
+    const marker = _snapshotAuthoritativeMarker(msg);
+    if (marker != null) s._serverSeq = marker;
+    s._snapshotAdoptedFpAt = Date.now();
+    s._snapshotAdoptedFpSource = restoreSource;
+  }
   if (restoreSource === 'reflow') {
     s._lastReflowSnapshotAppliedAt = Date.now();
     s._lastReflowSnapshotSeq = seq || Number(s._terminalRestoreRequestSeq || 0);
@@ -35758,6 +36480,7 @@ function _recordSnapshotRestoreApplied(s, msg, source) {
     s._terminalFinalSnapshotProtectedSource = restoreSource;
   }
 }
+window._ctmRecordSnapshotRestoreApplied = _recordSnapshotRestoreApplied;
 
 function _snapshotRestoreReason(msg) {
   return String((msg && (msg.restoreReason || msg.reason || msg.snapshotReason)) || '');
@@ -35904,6 +36627,58 @@ function onSnapshot(msg) {
     }
   }
   const earlyRestoreSource = _snapshotRestoreSource(s, msg);
+  // Option A idempotency: an authoritative keyframe that already matches the on-screen
+  // frame needs no repaint — skip it so the PRIMARY viewer (which rendered the same output
+  // via the live byte stream) doesn't flash on every output-quiet boundary. fp parity is
+  // guaranteed (terminal-reconciler ↔ terminal-fingerprint). Only when output is quiet
+  // (no pending writes), so we never compare against a mid-stream frame.
+  if (_keyframeSyncEnabled() && (earlyRestoreSource === 'keyframe' || earlyRestoreSource === 'reconcile')
+      && msg.fp && s.term && window.TerminalReconciler && typeof window.TerminalReconciler.clientFingerprint === 'function'
+      && !(s.writer && (s.writer.scheduled || s.writer._chunking || s.writer.queue))) {
+    let clientFp = null;
+    try { clientFp = window.TerminalReconciler.clientFingerprint(s.term); } catch {}
+    if (clientFp && clientFp === msg.fp) {
+      s._keyframeIdempotentSkipAt = Date.now();
+      _terminalRenderCheckFullyRendered(s, 'keyframe-idempotent-skip');
+      _dismissLoadingOverlay(s);
+      return;
+    }
+  }
+  // Option A.5: a streaming keyframe (pushed mid-turn at a controlled frame rate). It must
+  // NOT fall into the late-snapshot rejection gates below (clobber/stale/hot-activation) —
+  // those assume a cold restore and would drop every mid-stream frame. Route it through a
+  // narrow, settled-frame-only apply: paint ONLY when the client frame is quiescent and its
+  // fingerprint has actually diverged (a confirmed byte-stream shear); otherwise defer.
+  // _restoreSnapshotData's own fp-match guard makes the converged case a hard no-op, so this
+  // never flickers a correct frame. Boundary keyframes (activation/resize/quiet) are unchanged.
+  if (msg.restoreReason === 'stream-keyframe') {
+    const action = _streamKeyframeAction(s, msg);
+    s._streamKeyframeLastAction = action;
+    s._streamKeyframeLastActionAt = Date.now();
+    if (action === 'paint') {
+      const intent = _captureTerminalViewportIntent(s);
+      const incomingMarker = msg.snapshotCurrentMarker != null ? msg.snapshotCurrentMarker : msg.snapshotMarker;
+      _restoreSnapshotData(s, msg.data, (info) => {
+        if (!(info && info.skipped)) {
+          if (!_restoreTerminalViewportIntent(s, intent)) { _ensureScrolledToBottom(s); }
+          s._streamKeyframeAppliedAt = Date.now();
+        }
+        // Advance our applied-marker so a later stale frame can't revert this correction.
+        try {
+          if (incomingMarker != null && window.TerminalReconciler
+              && !window.TerminalReconciler.seqLess(incomingMarker, s._localSeq || 0)) {
+            s._localSeq = incomingMarker;
+          }
+        } catch {}
+        _terminalRenderCheckFullyRendered(s, 'stream-keyframe');
+      }, { fp: msg.fp, cols: msg.ptyCols || msg.cols, rows: msg.ptyRows || msg.rows, source: 'stream-keyframe' });
+    } else {
+      _terminalRenderCheckFullyRendered(s, 'stream-keyframe-' + action);
+    }
+    _dismissLoadingOverlay(s);
+    _primeLatestAnswerForTerminalView(msg.id);
+    return;
+  }
   if (_snapshotShouldRejectStaleData(s, msg, earlyRestoreSource)) {
     _dismissLoadingOverlay(s);
     _rememberSkippedSnapshot(s, 'stale-snapshot-data', _snapshotRestoreReason(msg) || earlyRestoreSource);
@@ -35986,6 +36761,20 @@ function onSnapshot(msg) {
     _terminalRenderCheckFullyRendered(s, 'snapshot-stale-no-data-skip');
     if (state.activeTab === msg.id) focusTerminalIfSafe(msg.id);
     _primeLatestAnswerForTerminalView(msg.id);
+    // The server skipped this reflow because output arrived after the request — the agent is
+    // still emitting (e.g. a post-/compact burst). Nothing else re-requests promptly, so the
+    // render (and the user's typed-input echo) can lag until the 3s self-check. Schedule an
+    // authoritative recovery so a fresh reflow lands soon after the output quiets; it
+    // rate-limits itself, defers while typing, and — because each retry that ALSO stale-skips
+    // re-enters this branch — forms a retry-until-settle loop that self-terminates when a fresh
+    // frame lands (snapshot-done clears _needsAuthoritativeSnapshot at ~36319, and resets the
+    // streak below). The retry interval BACKS OFF exponentially per consecutive stale-skip so a
+    // never-quiet giant Codex session stops re-serializing ~800KB every ~900ms (worker
+    // saturation = the frame can never converge); the FIRST stale-skip still retries fast.
+    s._needsAuthoritativeSnapshot = true;
+    s._reflowStaleStreak = (Number(s._reflowStaleStreak) || 0) + 1;
+    const reflowBackoff = _reflowStaleBackoffMs(s);
+    _scheduleAuthoritativeSnapshotRecovery(s, msg.id, 'reflow-stale-skip', { delayMs: reflowBackoff, minGapMs: reflowBackoff });
     return;
   }
   // A hot terminal that already has healthy buffer content does not need a
@@ -36062,6 +36851,10 @@ function onSnapshot(msg) {
   }
   // Reset auto-reflow flag on successful snapshot
   s._autoReflowAttempted = false;
+  // A fresh AUTHORITATIVE (non-interim) frame converged → clear the reflow stale-skip
+  // backoff streak so the next stall retries fast again (interim/cache bridges are stale,
+  // so they must NOT reset it).
+  if (msg.data && !msg.interim) s._reflowStaleStreak = 0;
   const restoreSource = _snapshotRestoreSource(s, msg);
 
   // Sequence guard: never apply a snapshot that is strictly BEHIND what we've
@@ -36277,6 +37070,14 @@ function onSnapshot(msg) {
   const snapshotDone = (info) => {
     _setTerminalViewPhase(s, _terminalRestorePhases().PAINT_SETTLING, 'snapshot-done');
     if (info && info.skipped) {
+      if (info.fpMatch) {
+        _recordSnapshotRestoreApplied(s, msg, restoreSource);
+        const marker = _snapshotAuthoritativeMarker(msg);
+        if (marker != null) s._localSeq = marker;
+        if (msg.restoreReason === 'reconcile' || msg.restoreSource === 'reconcile') {
+          s._reconcileInFlightUntil = 0;
+        }
+      }
       if (snapshotIncludesExitBanner) _markExitBannerRendered(s, msg.exitCode);
       if (state.activeTab === msg.id) focusTerminalIfSafe(msg.id);
       scanPromptLines(msg.id);
@@ -36303,8 +37104,8 @@ function onSnapshot(msg) {
     // Advance the reconciler's local seq to the server's snapshot marker so we
     // don't immediately re-detect divergence against pre-snapshot seq. Prefer the
     // server's current marker; fall back to the request-time marker.
-    if (msg.snapshotCurrentMarker != null) s._localSeq = msg.snapshotCurrentMarker;
-    else if (msg.snapshotMarker != null) s._localSeq = msg.snapshotMarker;
+    const marker = _snapshotAuthoritativeMarker(msg);
+    if (marker != null) s._localSeq = marker;
     // A reconcile-sourced snapshot is the resolution of an in-flight reconcile;
     // release the guard so future divergence can trigger a fresh request.
     if (msg.restoreReason === 'reconcile' || msg.restoreSource === 'reconcile') {
@@ -36912,6 +37713,14 @@ async function onSessionsList(msg) {
         existing._serverLiveStatusAt = _clientTimeMs(sess.liveStatusAt) || Date.now();
         existing._serverLiveStatusEventAt = liveStatusEventAt;
       }
+      // P2: server-derived phase is the single source of truth (stored unconditionally).
+      if (sess.phase) {
+        existing._serverPhase = sess.phase;
+        existing._serverPhaseCls = sess.phaseCls || '';
+        existing._serverPhaseSource = sess.phaseSource || '';
+        existing._serverPhaseReason = sess.phaseReason || '';
+        existing._serverPhaseAt = _clientTimeMs(sess.phaseAt) || Date.now();
+      }
       existing._restoreResuming = !!(sess.restoreResuming || sess.restore_resuming);
       existing._restoreStarting = !!(sess.restoreStarting || sess.restore_starting);
       existing._restoreStatus = sess.restoreStatus || sess.restore_status || '';
@@ -38755,7 +39564,65 @@ function _walleSessionHasRunningWork(s) {
   return active.some(t => String(t && t.status || '').toLowerCase() === 'running');
 }
 
+// P2 (redesign — docs/session-status-redesign.html): the server's derived phase is
+// the single source of truth. The client renders it directly and may apply ONLY an
+// optimistic, escalate-only overlay (idle→running for instant local feedback). It
+// NEVER demotes or second-guesses the server. This supersedes both the keyframe
+// liveStatus shortcut and the precedence ladder below, which remain as the degraded
+// fallback for when no fresh server phase is available (just-opened tab, dropped ws).
+const SERVER_PHASE_TTL_MS = 15000;
+
+// Escalate-only: a fresh keystroke or local PTY byte may lift a server idle to
+// running until the next server push reconciles it. Never the reverse.
+function _clientHasFreshOptimisticRunning(s, now) {
+  now = now || Date.now();
+  const lastInput = s._lastStatusInputAt || 0;
+  const lastOut = Math.max(s._lastOutputAt || 0, s.meta?.lastPtyActivity || 0);
+  return (lastInput && (now - lastInput) < 3000) || (lastOut && (now - lastOut) < 5000);
+}
+
+function _clientServerPhaseStatus(s) {
+  if (typeof SessionPhase === 'undefined' || !s || !s._serverPhase || !s._serverPhaseAt) return null;
+  const now = Date.now();
+  if ((now - s._serverPhaseAt) >= SERVER_PHASE_TTL_MS) return null; // stale → fall back
+  let phase = s._serverPhase;
+  if (phase === 'idle' && _clientHasFreshOptimisticRunning(s, now)) phase = 'running';
+  const cls = SessionPhase.phaseToCls(phase);
+  if (!cls) return null;
+  return {
+    cls,
+    text: SessionPhase.PHASE_TEXT[phase] || 'Idle',
+    source: 'server-phase:' + (s._serverPhaseSource || phase),
+    phase,
+  };
+}
+
 function getSessionStatus(s) {
+  // Single source of truth: render the server's derived phase when fresh.
+  if (s && !(s._exited || s.meta?.liveStatus === 'exited' || s.meta?.status === 'exited')) {
+    const serverPhase = _clientServerPhaseStatus(s);
+    if (serverPhase) return statusAfterAttentionDismissal(s, serverPhase);
+  }
+  // Phase 4 (Option C): ONE status owner. With keyframe-sync on, trust the server's
+  // authoritative liveStatus directly when fresh — skipping the client-side busy-line /
+  // running-hold inference ladder (the "second state machine"). The server already computes
+  // a complete status (_standupLiveStatusWithReasonForSession). Exited + Wall-E special
+  // cases still apply; an explicit server-flagged waiting prompt still wins over a generic
+  // idle heartbeat; and if the server status is missing/stale we fall through to the
+  // existing resolver as a safety net. Flag-off keeps the legacy precedence machine.
+  if (_keyframeSyncEnabled() && s
+      && !(s._exited || s.meta?.liveStatus === 'exited' || s.meta?.status === 'exited')
+      && s.meta?.type !== 'walle') {
+    const now = Date.now();
+    const live = liveStatusResult(s._serverLiveStatus);
+    if (live && s._serverLiveStatusAt && (now - s._serverLiveStatusAt) < SERVER_LIVE_STATUS_TTL_MS) {
+      if (live.cls === 'idle' && s._waitingForInput) {
+        return statusAfterAttentionDismissal(s, { cls: 'waiting', text: 'Needs You' });
+      }
+      return statusAfterAttentionDismissal(s, live);
+    }
+    // else: server status silent/stale → fall through to the full resolver below.
+  }
   if (typeof SessionStatusPrecedence !== 'undefined' && SessionStatusPrecedence.resolveSessionStatus) {
     const now = Date.now();
     const codexRunningHold = _clientCodexRunningHoldResult(s, now);
@@ -48514,12 +49381,26 @@ function onSessionActivity(msg) {
     waitingForInput,
     waitingForInputAt,
     waitingReason,
+    phase,
+    phaseCls,
+    phaseSource,
+    phaseReason,
     tokens,
   } of msg.sessions) {
     const s = state.sessions.get(id);
     if (!s) continue;
     if (tokens !== undefined) _applySessionTokens(s, tokens);
     s._serverLiveStatusReason = statusReason || status_reason || '';
+    // P2: the server's derived phase is the single source of truth. Store it
+    // unconditionally — the server already did all staleness/authority reasoning,
+    // so the client must NOT re-gate or second-guess it here.
+    if (phase) {
+      s._serverPhase = phase;
+      s._serverPhaseCls = phaseCls || '';
+      s._serverPhaseSource = phaseSource || '';
+      s._serverPhaseReason = phaseReason || '';
+      s._serverPhaseAt = Date.now();
+    }
     const oldBucket = activeActivityBucket(s);
     const oldStatus = getSessionStatus(s).cls;
     const hasServerTs = ts !== null && ts !== undefined && ts !== '';