neural-loom 0.2.69 → 0.3.0

package/src/app/api/git/route.ts

@@ -1,10 +1,22 @@
 import { NextResponse } from "next/server";
 import { promisify } from "util";
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import fs from "fs";
 import path from "path";
+import { isValidBranchName } from "@/lib/gitSafe";
 
-const execPromise = promisify(exec);
+const execFilePromise = promisify(execFile);
+
+// Run git without a shell. Arguments are passed as an array, so values like file
+// names, branch names and commit messages cannot break out into shell commands.
+async function git(args: string[], cwd: string): Promise<{ stdout: string; stderr: string }> {
+  const { stdout, stderr } = await execFilePromise("git", args, {
+    cwd,
+    maxBuffer: 1024 * 1024 * 20,
+    windowsHide: true,
+  });
+  return { stdout: stdout.toString(), stderr: stderr.toString() };
+}
 
 export async function GET(request: Request) {
   try {
@@ -17,13 +29,13 @@ export async function GET(request: Request) {
 
     // Check if it's a git repo
     try {
-      await execPromise("git rev-parse --is-inside-work-tree", { cwd: targetRoot });
+      await git(["rev-parse", "--is-inside-work-tree"], targetRoot);
     } catch {
       return NextResponse.json({ success: true, isGit: false, files: [] });
     }
 
     if (action === "status") {
-      const { stdout } = await execPromise("git status --porcelain", { cwd: targetRoot });
+      const { stdout } = await git(["status", "--porcelain"], targetRoot);
       const lines = stdout.split(/\r?\n/).filter(Boolean);
       const files = lines.map(line => {
         // porcelain format: XY path or XY "path"
@@ -49,7 +61,7 @@ export async function GET(request: Request) {
       // Get branch name
       let branch = "";
       try {
-        const { stdout: branchOut } = await execPromise("git rev-parse --abbrev-ref HEAD", { cwd: targetRoot });
+        const { stdout: branchOut } = await git(["rev-parse", "--abbrev-ref", "HEAD"], targetRoot);
         branch = branchOut.trim();
       } catch {}
 
@@ -57,7 +69,7 @@ export async function GET(request: Request) {
       let ahead = 0;
       let behind = 0;
       try {
-        const { stdout: syncOut } = await execPromise("git rev-list --left-right --count HEAD...@{u}", { cwd: targetRoot });
+        const { stdout: syncOut } = await git(["rev-list", "--left-right", "--count", "HEAD...@{u}"], targetRoot);
         const parts = syncOut.trim().split(/\s+/);
         if (parts.length === 2) {
           ahead = parseInt(parts[0], 10) || 0;
@@ -79,7 +91,7 @@ export async function GET(request: Request) {
       }
 
       // Check status to see if it is untracked
-      const { stdout: statusOut } = await execPromise("git status --porcelain -- " + JSON.stringify(file), { cwd: targetRoot });
+      const { stdout: statusOut } = await git(["status", "--porcelain", "--", file], targetRoot);
       const isUntracked = statusOut.startsWith("??");
 
       if (isUntracked) {
@@ -88,7 +100,7 @@ export async function GET(request: Request) {
         return NextResponse.json({ success: true, diff: diffLines });
       } else {
         try {
-          const { stdout: diffOut } = await execPromise(`git diff --no-color -- ${JSON.stringify(file)}`, { cwd: targetRoot });
+          const { stdout: diffOut } = await git(["diff", "--no-color", "--", file], targetRoot);
           return NextResponse.json({ success: true, diff: diffOut });
         } catch {
           return NextResponse.json({ success: true, diff: `Binary file or diff unavailable.` });
@@ -97,7 +109,7 @@ export async function GET(request: Request) {
     }
 
     if (action === "branches") {
-      const { stdout } = await execPromise("git branch --format=\"%(refname:short)|%(HEAD)\"", { cwd: targetRoot });
+      const { stdout } = await git(["branch", "--format=%(refname:short)|%(HEAD)"], targetRoot);
       const branches = stdout.split(/\r?\n/).filter(Boolean).map(line => {
         const [name, active] = line.split("|");
         return {
@@ -110,7 +122,10 @@ export async function GET(request: Request) {
 
     if (action === "log") {
       try {
-        const { stdout } = await execPromise("git log --graph --abbrev-commit --decorate --format=format:\"%h||%p||%s||%an||%ar\" --all -n 100", { cwd: targetRoot });
+        const { stdout } = await git(
+          ["log", "--graph", "--abbrev-commit", "--decorate", "--format=format:%h||%p||%s||%an||%ar", "--all", "-n", "100"],
+          targetRoot
+        );
         const lines = stdout.split(/\r?\n/);
         const logItems = lines.map(line => {
           const parts = line.split("||");
@@ -119,7 +134,7 @@ export async function GET(request: Request) {
             const hashMatch = firstPart.match(/([0-9a-f]{7,40})$/);
             const hash = hashMatch ? hashMatch[1] : "";
             const graph = firstPart.substring(0, firstPart.length - hash.length);
-            
+
             return {
               isCommit: true,
               graph,
@@ -142,7 +157,7 @@ export async function GET(request: Request) {
           }
         });
         return NextResponse.json({ success: true, log: logItems });
-      } catch (err) {
+      } catch {
         return NextResponse.json({ success: true, log: [] });
       }
     }
@@ -163,25 +178,25 @@ export async function POST(request: Request) {
 
     // Check if it's a git repo
     try {
-      await execPromise("git rev-parse --is-inside-work-tree", { cwd: targetRoot });
+      await git(["rev-parse", "--is-inside-work-tree"], targetRoot);
     } catch {
       return NextResponse.json({ error: "Not a git repository" }, { status: 400 });
     }
 
     if (action === "stage") {
       if (file) {
-        await execPromise(`git add ${JSON.stringify(file)}`, { cwd: targetRoot });
+        await git(["add", "--", file], targetRoot);
       } else {
-        await execPromise("git add -A", { cwd: targetRoot });
+        await git(["add", "-A"], targetRoot);
       }
       return NextResponse.json({ success: true });
     }
 
     if (action === "unstage") {
       if (file) {
-        await execPromise(`git reset HEAD -- ${JSON.stringify(file)}`, { cwd: targetRoot });
+        await git(["reset", "HEAD", "--", file], targetRoot);
       } else {
-        await execPromise("git reset HEAD -- .", { cwd: targetRoot });
+        await git(["reset", "HEAD", "--", "."], targetRoot);
       }
       return NextResponse.json({ success: true });
     }
@@ -192,7 +207,7 @@ export async function POST(request: Request) {
       }
       const absolutePath = path.resolve(targetRoot, file).replace(/\\/g, "/");
       // Check status to see if it is untracked
-      const { stdout: statusOut } = await execPromise("git status --porcelain -- " + JSON.stringify(file), { cwd: targetRoot });
+      const { stdout: statusOut } = await git(["status", "--porcelain", "--", file], targetRoot);
       const isUntracked = statusOut.startsWith("??");
 
       if (isUntracked) {
@@ -200,7 +215,7 @@ export async function POST(request: Request) {
           fs.unlinkSync(absolutePath);
         }
       } else {
-        await execPromise(`git checkout -- ${JSON.stringify(file)}`, { cwd: targetRoot });
+        await git(["checkout", "--", file], targetRoot);
       }
       return NextResponse.json({ success: true });
     }
@@ -209,7 +224,7 @@ export async function POST(request: Request) {
       if (!message || !message.trim()) {
         return NextResponse.json({ error: "Commit message cannot be empty" }, { status: 400 });
       }
-      const { stdout } = await execPromise(`git commit -m ${JSON.stringify(message.trim())}`, { cwd: targetRoot });
+      const { stdout } = await git(["commit", "-m", message.trim()], targetRoot);
       return NextResponse.json({ success: true, output: stdout });
     }
 
@@ -231,40 +246,40 @@ export async function POST(request: Request) {
     }
 
     if (action === "pull") {
-      const { stdout, stderr } = await execPromise("git pull", { cwd: targetRoot });
+      const { stdout, stderr } = await git(["pull"], targetRoot);
       return NextResponse.json({ success: true, output: stdout + stderr });
     }
 
     if (action === "push") {
-      const { stdout, stderr } = await execPromise("git push", { cwd: targetRoot });
+      const { stdout, stderr } = await git(["push"], targetRoot);
       return NextResponse.json({ success: true, output: stdout + stderr });
     }
 
     if (action === "checkout") {
       const { branchName } = body;
-      if (!branchName) {
-        return NextResponse.json({ error: "Missing branchName parameter" }, { status: 400 });
+      if (!isValidBranchName(branchName)) {
+        return NextResponse.json({ error: "Missing or invalid branchName parameter" }, { status: 400 });
       }
-      const { stdout, stderr } = await execPromise(`git checkout ${JSON.stringify(branchName)}`, { cwd: targetRoot });
+      const { stdout, stderr } = await git(["checkout", branchName], targetRoot);
       return NextResponse.json({ success: true, output: stdout + stderr });
     }
 
     if (action === "create_branch") {
       const { branchName } = body;
-      if (!branchName) {
-        return NextResponse.json({ error: "Missing branchName parameter" }, { status: 400 });
+      if (!isValidBranchName(branchName)) {
+        return NextResponse.json({ error: "Missing or invalid branchName parameter" }, { status: 400 });
       }
-      const { stdout, stderr } = await execPromise(`git checkout -b ${JSON.stringify(branchName)}`, { cwd: targetRoot });
+      const { stdout, stderr } = await git(["checkout", "-b", branchName], targetRoot);
       return NextResponse.json({ success: true, output: stdout + stderr });
     }
 
     if (action === "delete_branch") {
       const { branchName, force } = body;
-      if (!branchName) {
-        return NextResponse.json({ error: "Missing branchName parameter" }, { status: 400 });
+      if (!isValidBranchName(branchName)) {
+        return NextResponse.json({ error: "Missing or invalid branchName parameter" }, { status: 400 });
       }
       const flag = force ? "-D" : "-d";
-      const { stdout, stderr } = await execPromise(`git branch ${flag} ${JSON.stringify(branchName)}`, { cwd: targetRoot });
+      const { stdout, stderr } = await git(["branch", flag, branchName], targetRoot);
       return NextResponse.json({ success: true, output: stdout + stderr });
     }
 

package/src/app/api/sessions/stats/route.ts

@@ -1,10 +1,24 @@
 import { NextResponse } from "next/server";
 import { SessionManager } from "@/lib/agents/SessionManager";
 import { promisify } from "util";
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import os from "os";
 
-const execPromise = promisify(exec);
+const execFilePromise = promisify(execFile);
+
+// Real per-process stats for the PTY. Returns null when unavailable (pidusage
+// not installed, or no live pid) so callers report honestly instead of faking it.
+async function getProcessStats(pid: number | undefined): Promise<{ cpu: number; memory: number } | null> {
+  if (!pid) return null;
+  try {
+    /* eslint-disable @typescript-eslint/no-require-imports */
+    const pidusage = eval("require")("pidusage");
+    const stat = await pidusage(pid);
+    return { cpu: stat.cpu, memory: stat.memory };
+  } catch {
+    return null;
+  }
+}
 
 export async function GET(request: Request) {
   try {
@@ -21,42 +35,45 @@ export async function GET(request: Request) {
       return NextResponse.json({ error: "Session not found" }, { status: 404 });
     }
 
-    // Default response metrics
+    // Default response metrics. `available` reports whether these are real
+    // measurements (vs. a placeholder when telemetry can't be collected).
     let cpu = "0.0%";
     let memory = "0.0MiB";
     let memoryPercent = "0.0%";
+    let available = false;
 
     if (session.status === "running") {
       const isDocker = session.type === "claude-docker" || session.type === "aider-docker";
       if (isDocker) {
         try {
-          // Query docker stats
+          // Real container stats from the Docker daemon.
           const containerName = `neural-loom-session-${id}`;
-          const { stdout } = await execPromise(`docker stats ${containerName} --no-stream --format "{{.CPUPerc}},{{.MemUsage}},{{.MemPerc}}"`);
-          const parts = stdout.trim().split(",");
+          const { stdout } = await execFilePromise("docker", [
+            "stats",
+            containerName,
+            "--no-stream",
+            "--format",
+            "{{.CPUPerc}},{{.MemUsage}},{{.MemPerc}}",
+          ]);
+          const parts = stdout.toString().trim().split(",");
           if (parts.length >= 3) {
             cpu = parts[0].trim();
-            memory = parts[1].trim().split(" / ")[0]; // get the used part, e.g. "142.2MiB"
+            memory = parts[1].trim().split(" / ")[0]; // used part, e.g. "142.2MiB"
             memoryPercent = parts[2].trim();
+            available = true;
           }
         } catch {
-          // Docker stats not available/running, fallback to simulated telemetry
-          const simulatedCpu = (Math.random() * 3 + 1).toFixed(1) + "%";
-          const simulatedMem = (130 + Math.random() * 20).toFixed(1) + "MiB";
-          const simulatedMemPerc = (1.5 + Math.random() * 0.5).toFixed(2) + "%";
-          cpu = simulatedCpu;
-          memory = simulatedMem;
-          memoryPercent = simulatedMemPerc;
+          // Docker daemon/container not reachable — leave defaults, available=false.
         }
       } else {
-        // Local runner telemetry fallback
-        const simulatedCpu = (Math.random() * 5 + 2).toFixed(1) + "%";
-        const memBytes = process.memoryUsage().rss;
-        const simulatedMem = (memBytes / (1024 * 1024)).toFixed(1) + "MiB";
-        const simulatedMemPerc = ((memBytes / os.totalmem()) * 100).toFixed(2) + "%";
-        cpu = simulatedCpu;
-        memory = simulatedMem;
-        memoryPercent = simulatedMemPerc;
+        // Real per-process stats for the local/SSH PTY process.
+        const stats = await getProcessStats(session.getPid());
+        if (stats) {
+          cpu = stats.cpu.toFixed(1) + "%";
+          memory = (stats.memory / (1024 * 1024)).toFixed(1) + "MiB";
+          memoryPercent = ((stats.memory / os.totalmem()) * 100).toFixed(2) + "%";
+          available = true;
+        }
       }
     }
 
@@ -68,6 +85,7 @@ export async function GET(request: Request) {
       cpu,
       memory,
       memoryPercent,
+      available,
     });
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : "Unknown error";

package/src/app/api/sql/query/route.ts

@@ -1,19 +1,6 @@
 import { NextResponse } from "next/server";
 import { ConnectionManager } from "@/lib/sql/ConnectionManager";
-
-const isMutation = (sql: string): boolean => {
-  const clean = sql.trim().toLowerCase();
-  return (
-    clean.startsWith("insert") ||
-    clean.startsWith("update") ||
-    clean.startsWith("delete") ||
-    clean.startsWith("drop") ||
-    clean.startsWith("alter") ||
-    clean.startsWith("create") ||
-    clean.startsWith("truncate") ||
-    clean.startsWith("replace")
-  );
-};
+import { isReadOnlyViolation } from "@/lib/sql/sqlGuard";
 
 export async function POST(request: Request) {
   try {
@@ -33,7 +20,7 @@ export async function POST(request: Request) {
 
     const { adapter, profile } = active;
 
-    if (profile.readOnly && isMutation(sql)) {
+    if (profile.readOnly && isReadOnlyViolation(sql)) {
       return NextResponse.json({ 
         error: "This connection profile is configured as Read-Only. Modifications are disabled." 
       }, { status: 403 });

package/src/app/api/telemetry/route.ts

@@ -1,10 +1,11 @@
 import { NextResponse } from "next/server";
 import fs from "fs";
 import path from "path";
+import { getConfigDir } from "@/lib/config";
 
 export async function GET() {
   try {
-    const historyFile = path.join(process.cwd(), ".ai", "neural-loom", "token-history.json");
+    const historyFile = path.join(getConfigDir(), "token-history.json");
     if (!fs.existsSync(historyFile)) {
       return NextResponse.json({ success: true, history: [] });
     }

package/src/app/components/MarkdownPreview.tsx

@@ -322,12 +322,8 @@ export default function MarkdownPreview({ content }: MarkdownPreviewProps) {
 
 function copyTextToClipboard(text: string): boolean {
   if (typeof window === "undefined") return false;
-  if (navigator.clipboard && navigator.clipboard.writeText) {
-    navigator.clipboard.writeText(text).catch((err) => {
-      console.error("Failed to copy using clipboard API:", err);
-    });
-    return true;
-  }
+  
+  let successful = false;
   try {
     const textArea = document.createElement("textarea");
     textArea.value = text;
@@ -338,13 +334,24 @@ function copyTextToClipboard(text: string): boolean {
     document.body.appendChild(textArea);
     textArea.focus();
     textArea.select();
-    const successful = document.execCommand("copy");
+    successful = document.execCommand("copy");
     document.body.removeChild(textArea);
-    return successful;
   } catch (err) {
-    console.error("Fallback copy failed:", err);
-    return false;
+    console.warn("Fallback execCommand copy failed:", err);
+  }
+  
+  if (successful) {
+    return true;
+  }
+  
+  if (navigator.clipboard && navigator.clipboard.writeText) {
+    navigator.clipboard.writeText(text).catch((err) => {
+      console.error("Failed to copy using clipboard API:", err);
+    });
+    return true;
   }
+  
+  return false;
 }
 
 function CodeBlock({ code, language }: { code: string; language: string }) {

package/src/app/components/TerminalConsole.tsx

@@ -1,7 +1,7 @@
 "use client";
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
-import { useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { Terminal } from "xterm";
 import { FitAddon } from "xterm-addon-fit";
 import { SearchAddon } from "@xterm/addon-search";
@@ -19,14 +19,22 @@ interface LogBufferItem {
   message?: string;
 }
 
-function copyTextToClipboard(text: string): boolean {
-  if (typeof window === "undefined") return false;
-  if (navigator.clipboard && navigator.clipboard.writeText) {
-    navigator.clipboard.writeText(text).catch((err) => {
-      console.error("Failed to copy using clipboard API:", err);
-    });
-    return true;
+async function copyTextToClipboard(text: string): Promise<boolean> {
+  if (typeof window === "undefined" || !text) return false;
+
+  // Preferred path: async Clipboard API. Reliable in a secure context, which
+  // includes localhost (NeuralLoom's default bind).
+  if (window.isSecureContext && navigator.clipboard?.writeText) {
+    try {
+      await navigator.clipboard.writeText(text);
+      return true;
+    } catch {
+      // Fall through to the execCommand fallback (e.g. permission denied).
+    }
   }
+
+  // Fallback: hidden textarea + execCommand("copy") for non-secure contexts
+  // (e.g. accessed over a plain-HTTP LAN address).
   try {
     const textArea = document.createElement("textarea");
     textArea.value = text;
@@ -41,7 +49,7 @@ function copyTextToClipboard(text: string): boolean {
     document.body.removeChild(textArea);
     return successful;
   } catch (err) {
-    console.error("Fallback copy failed:", err);
+    console.warn("Clipboard copy failed:", err);
     return false;
   }
 }
@@ -64,6 +72,31 @@ export default function TerminalConsole({ sessionId, height = "400px", wsPort =
   const [caseSensitive, setCaseSensitive] = useState(false);
   const searchAddonRef = useRef<SearchAddon | null>(null);
 
+  // Copy feedback ("Copied!" indicator)
+  const [copied, setCopied] = useState(false);
+  const copiedTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  // Copy the given text (or the current terminal selection) to the clipboard.
+  // Stable identity so the terminal effect can use it without re-initializing.
+  const copySelection = useCallback((text?: string): void => {
+    const term = xtermRef.current;
+    const selection = (text ?? term?.getSelection() ?? "").trim();
+    if (!selection) return;
+    copyTextToClipboard(selection).then((ok) => {
+      if (!ok) return;
+      setCopied(true);
+      if (copiedTimerRef.current) clearTimeout(copiedTimerRef.current);
+      copiedTimerRef.current = setTimeout(() => setCopied(false), 1200);
+    });
+  }, []);
+
+  // Clear the copy-feedback timer on unmount
+  useEffect(() => {
+    return () => {
+      if (copiedTimerRef.current) clearTimeout(copiedTimerRef.current);
+    };
+  }, []);
+
   // Focus search input when opened
   useEffect(() => {
     if (searchOpen && searchInputRef.current) {
@@ -182,20 +215,18 @@ export default function TerminalConsole({ sessionId, height = "400px", wsPort =
     term.focus();
 
     const container = terminalRef.current;
+    // Keep right-click from clearing an active selection so the context-menu
+    // copy can read it.
     const handleMouseDown = (e: MouseEvent) => {
-      if (e.button === 2 && term.hasSelection()) {
-        e.stopPropagation();
-      }
+      if (e.button === 2 && term.hasSelection()) e.stopPropagation();
     };
     const handleMouseUp = (e: MouseEvent) => {
-      if (e.button === 2 && term.hasSelection()) {
-        e.stopPropagation();
-      }
+      if (e.button === 2 && term.hasSelection()) e.stopPropagation();
     };
     const handleContextMenu = (e: MouseEvent) => {
       if (term.hasSelection()) {
         e.preventDefault();
-        copyTextToClipboard(term.getSelection());
+        copySelection(term.getSelection());
         term.clearSelection();
       }
     };
@@ -205,6 +236,17 @@ export default function TerminalConsole({ sessionId, height = "400px", wsPort =
       container.addEventListener("contextmenu", handleContextMenu);
     }
 
+    // Copy-on-select: capture the selection the moment it is made. Claude Code's
+    // TUI redraws constantly, which clears the xterm selection — so we copy
+    // immediately (debounced) rather than waiting for a later Ctrl+C/right-click.
+    let selTimer: ReturnType<typeof setTimeout> | null = null;
+    const selDisposable = term.onSelectionChange(() => {
+      const sel = term.getSelection();
+      if (!sel || !sel.trim()) return;
+      if (selTimer) clearTimeout(selTimer);
+      selTimer = setTimeout(() => copySelection(sel), 150);
+    });
+
     // Attach search key handler and clipboard copy handler
     term.attachCustomKeyEventHandler((e) => {
       // Search: Ctrl+F
@@ -213,11 +255,20 @@ export default function TerminalConsole({ sessionId, height = "400px", wsPort =
         setSearchOpen(true);
         return false;
       }
-      
-      // Copy: Ctrl+C or Cmd+C (when selection is active)
-      if ((e.ctrlKey || e.metaKey) && e.key === "c" && e.type === "keydown") {
+
+      // Explicit copy: Ctrl+Shift+C / Cmd+Shift+C (always, when a selection exists)
+      if ((e.ctrlKey || e.metaKey) && e.shiftKey && (e.key === "c" || e.key === "C") && e.type === "keydown") {
+        if (term.hasSelection()) {
+          copySelection(term.getSelection());
+          return false;
+        }
+      }
+
+      // Copy: Ctrl+C / Cmd+C only when a selection is active (otherwise let it
+      // pass through to the PTY as an interrupt).
+      if ((e.ctrlKey || e.metaKey) && !e.shiftKey && e.key === "c" && e.type === "keydown") {
         if (term.hasSelection()) {
-          copyTextToClipboard(term.getSelection());
+          copySelection(term.getSelection());
           return false; // Prevent sending interrupt to PTY
         }
       }
@@ -400,6 +451,8 @@ export default function TerminalConsole({ sessionId, height = "400px", wsPort =
     return () => {
       isDisposed = true;
       clearTimeout(fitTimeout);
+      if (selTimer) clearTimeout(selTimer);
+      selDisposable.dispose();
       resizeObserver.disconnect();
       ws.close();
       if (container) {
@@ -414,7 +467,7 @@ export default function TerminalConsole({ sessionId, height = "400px", wsPort =
         console.warn("Error disposing terminal:", e);
       }
     };
-  }, [sessionId, wsPort]);
+  }, [sessionId, wsPort, copySelection]);
   const handlePaste = async (e: React.ClipboardEvent<HTMLDivElement>) => {
     const items = e.clipboardData?.items;
     if (!items) return;
@@ -516,6 +569,31 @@ export default function TerminalConsole({ sessionId, height = "400px", wsPort =
           )}
         </div>
         <div style={{ display: "flex", gap: "0.35rem", alignItems: "center" }}>
+          {copied && (
+            <span style={{
+              color: "#50fa7b",
+              fontSize: "0.65rem",
+              fontWeight: 600,
+            }}>
+              ✓ Copied
+            </span>
+          )}
+          <button
+            onClick={() => copySelection()}
+            style={{
+              padding: "2px 6px",
+              borderRadius: "3px",
+              border: "1px solid var(--border)",
+              backgroundColor: "transparent",
+              color: "var(--muted)",
+              fontSize: "0.65rem",
+              fontWeight: 600,
+              cursor: "pointer",
+            }}
+            title="Copy selected terminal text (also auto-copies on selection)"
+          >
+            📋 Copy
+          </button>
           <button
             onClick={togglePause}
             style={{