nterminal 1.2.0

package/docs/configuration.md

@@ -0,0 +1,97 @@
+# Configuration
+
+Configuration comes from `.env` or process environment variables.
+
+## `.env.example`
+
+`.env.example` is the local runtime template. Keep it in source control, but never commit the copied `.env` file.
+
+The template intentionally contains only the core values needed for a manual local start. Add advanced settings from the table below only when you need to override the defaults.
+
+Source checkouts read `.env` from the repository root. npm package installs launched through `nterminal` read the runtime env file from `~/.nterminal/.env`.
+
+For manual local setup:
+
+```bash
+cp .env.example .env
+npm run generate:secrets
+```
+
+Paste the generated `NTERMINAL_SESSION_SECRET=...` value into `.env`.
+
+For normal installs, prefer:
+
+```bash
+npm run onboarding
+```
+
+Onboarding writes `.env` for you.
+
+## Settings
+
+| Setting | Default | Purpose |
+| --- | --- | --- |
+| `NTERMINAL_HOST` | `127.0.0.1` | Bind host. Keep the main server local unless a separate access boundary is in front. |
+| `NTERMINAL_PORT` | `3107` | HTTP server port. |
+| `NTERMINAL_WORKSPACE_ROOT` | launch directory | Startup directory for new terminal tabs. |
+| `NTERMINAL_SHELL` | `$SHELL`, then `/bin/bash` | Shell path for new PTYs. |
+| `NTERMINAL_STATE_PATH` | `.nterminal/state.json` | Local state file for password and layout data. |
+| `NTERMINAL_SESSION_SECRET` | required | Server secret for password hashing and session cookies. |
+| `NTERMINAL_SESSION_TTL_SECONDS` | `43200` | Session lifetime in seconds. |
+| `NTERMINAL_COOKIE_SECURE` | `false` locally | Set `true` when serving through HTTPS. |
+| `NTERMINAL_ALLOWED_ORIGINS` | local origins | Comma-separated browser origins allowed for mutating requests. |
+| `NTERMINAL_TRUST_PROXY` | `false` | Trust `X-Forwarded-For` for session IP binding. Use only behind a reverse proxy you control. |
+| `NTERMINAL_AGENT_TOKEN` | empty | Shared token used by the main server to reach a secondary server. Generated by secondary onboarding. |
+| `NTERMINAL_UPLOAD_MAX_FILES` | `1024` | Maximum files accepted in one drag-and-drop upload. |
+| `NTERMINAL_UPLOAD_MAX_FILE_BYTES` | `536870912` | Maximum bytes accepted for one uploaded file. |
+| `NTERMINAL_UPLOAD_MAX_BATCH_BYTES` | `2147483648` | Maximum total bytes accepted for one upload batch. |
+| `NTERMINAL_FILE_LIST_MAX_ENTRIES` | `2000` | Maximum entries returned in one file explorer directory listing. |
+| `NTERMINAL_FILE_TEXT_MAX_BYTES` | `1048576` | Maximum bytes loaded for text or Markdown view/edit. |
+| `NTERMINAL_FILE_PREVIEW_MAX_BYTES` | `52428800` | Maximum bytes served for browser file previews. |
+| `NTERMINAL_PID_PATH` | `.nterminal/nterminal.pid` | PID file for the control script. |
+| `NTERMINAL_LOG_PATH` | `.nterminal/nterminal.log` | Log file for the control script. |
+| `NTERMINAL_HEALTH_TIMEOUT_SECONDS` | `15` | Startup health-check timeout for the control script. |
+| `NTERMINAL_STOP_TIMEOUT_SECONDS` | `20` | Graceful stop timeout for the control script. |
+
+## Localhost Only
+
+```env
+NTERMINAL_HOST=127.0.0.1
+NTERMINAL_PORT=3107
+NTERMINAL_ALLOWED_ORIGINS=http://127.0.0.1:3107,http://localhost:3107
+NTERMINAL_COOKIE_SECURE=false
+```
+
+## Private VPN
+
+Run NTerminal on the private interface or behind a proxy reachable only over VPN. Keep `NTERMINAL_ALLOWED_ORIGINS` aligned with the exact browser URL.
+
+```text
+iPad or laptop
+  -> private VPN address
+  -> NTerminal or reverse proxy
+  -> host shell PTY
+```
+
+## HTTPS Reverse Proxy
+
+Terminate HTTPS in a reverse proxy and forward to NTerminal on localhost:
+
+```text
+Browser
+  -> https://terminal.example.internal
+  -> reverse proxy with access control
+  -> http://127.0.0.1:3107
+```
+
+Use:
+
+```env
+NTERMINAL_HOST=127.0.0.1
+NTERMINAL_PORT=3107
+NTERMINAL_COOKIE_SECURE=true
+NTERMINAL_ALLOWED_ORIGINS=https://terminal.example.internal
+NTERMINAL_TRUST_PROXY=true
+```
+
+Only set `NTERMINAL_TRUST_PROXY` when the proxy is controlled by you and NTerminal is not directly reachable by clients that can spoof `X-Forwarded-For`.

package/docs/features.md

@@ -0,0 +1,126 @@
+# Features
+
+## Terminal Workspace
+
+- Tabs and split panes for real host PTYs.
+- Per-server workspace state.
+- Refresh and temporary WebSocket reconnects reattach to active PTYs.
+- Soft close detaches terminals into restorable pills.
+- Tab rename, drag reorder, and drag-to-split controls.
+- Activity dots and completion badges show whether a tab is running, idle, exited, or finished in the background.
+- Detached terminal destroy uses a themed confirmation modal.
+- Tab titles sync with tmux window names when tmux persistence is active.
+
+## Server Management
+
+- One browser UI can manage the main server and multiple secondary servers.
+- Each server keeps its own terminal layout, tabs, split panes, detached terminals, and file context.
+- The sidebar switches servers without tearing down the inactive server workspaces.
+- Settings includes an Updates section for checking git status and updating each server.
+- Update all runs secondary server updates in parallel first, then updates the main server last.
+
+## Security And Access
+
+- Password plus TOTP two-factor authentication.
+- Single active session: a new login or re-auth revokes the previous browser session.
+- Session IP binding rejects cookies presented from an unexpected client IP.
+- Trusted devices can re-authenticate with a TOTP code only for 30 days.
+- Trusted networks can be added by exact IP or CIDR to skip the re-auth prompt.
+- Security settings can revoke trusted devices, remove trusted networks, and disable TOTP.
+
+## Terminal Appearance And Settings
+
+- Settings is organized into Terminal, Shortcuts, Notifications, Security, and Updates sections.
+- The settings sidebar highlights the visible section and jumps directly to that section.
+- Terminal font size is adjustable with a slider, stepper, numeric input, and reset button.
+- Terminal font family can switch between MesloLGS NF, JetBrains Mono, and system monospace stacks.
+- Scroll progress indicators can be shown or hidden.
+- Accent themes update UI accents and terminal selection colors, including Signal Red.
+
+## Terminal History And Scrollback
+
+- Mouse wheel scrolling is captured for terminal output history instead of Codex/Claude prompt history.
+- tmux-backed panes load older scrollback incrementally when the viewport reaches the top.
+- Scroll progress indicators, jump-to-bottom controls, and follow-tail behavior keep large outputs usable.
+- Supported Codex/Claude panes show a `JSONL` header indicator and can continue into archived transcript history.
+- JSONL transcript history is loaded by cursor only when NTerminal can determine the session source unambiguously.
+
+## Files
+
+The sidebar `files` tab browses the selected pane's current working directory. It is scoped to that directory tree and does not browse above the pane cwd.
+
+Supported operations:
+
+- directory listing
+- text and Markdown view/edit
+- image/PDF/browser-supported preview within configured limits
+- create, rename, save, and delete with confirmation
+- stale editor save rejection when the file changed after opening
+
+The file explorer pins to the terminal that was active when Files opened. Switching pane focus does not reload it; the pinned pane cwd, server switch, or explicit Refresh button controls reloads.
+
+## Drag And Drop Uploads
+
+Drop files or folders onto the terminal workspace to upload them into the active pane cwd.
+
+- Folder drops keep the dropped folder name and preserve internal paths.
+- Existing files are not overwritten; NTerminal writes a renamed copy such as `name 2.ext`.
+- Upload progress and partial failures appear in the bottom-right terminal popup.
+- Unsupported folder drops fail visibly instead of flattening the folder.
+
+## Completion Notifications
+
+NTerminal can show completion notifications when a background command transitions from busy to idle.
+
+Controls in Settings:
+
+- toast duration
+- persistent-until-dismissed mode
+- system notifications while the page is hidden
+- built-in notification video previews
+- MP4/WebM upload up to 5 MB
+- enable/disable videos with checkboxes
+- random selection from enabled videos
+
+Clicking a completion toast switches back to the server and pane that finished.
+
+## Compose Drawer And Clipboard
+
+- Compose drawer keeps drafts per pane.
+- Sending from compose writes carriage returns so multiline commands execute instead of only inserting visual newlines.
+- Ctrl+C copies selected terminal text and falls through to SIGINT when nothing is selected.
+- Ctrl+V pastes text through the browser Clipboard API.
+
+## Mobile Controls
+
+- Mobile key bar is hidden by default and can expose Ctrl, Esc, Tab, and arrows.
+- The bar floats above the soft keyboard where keyboard-inset detection is available.
+- Touch-specific button states avoid sticky hover/focus artifacts.
+- Scroll handles are easier to drag on mobile.
+
+## Keyboard Shortcuts
+
+NTerminal uses Control-based workspace shortcuts so browser-reserved Command shortcuts stay available.
+
+| Action | Shortcut |
+| --- | --- |
+| Previous / next server | `Ctrl+Up` / `Ctrl+Down` |
+| Previous / next tab | `Ctrl+Left` / `Ctrl+Right` |
+| Select tab by order | `Ctrl+Alt+1` through `Ctrl+Alt+9` |
+| Select pane by screen order | `Ctrl+Alt+Shift+1` through `Ctrl+Alt+Shift+9` |
+| Split right | `Ctrl+Alt+Shift+Right` |
+| Split down | `Ctrl+Alt+Shift+Down` |
+
+Shortcuts can be customized in Settings. If the browser, operating system, or focused editable control claims a key combination first, that handler wins before NTerminal can receive it.
+
+## iPad Home Screen
+
+NTerminal includes PWA metadata and Apple icons:
+
+- `public/apple-touch-icon.png`
+- `public/icons/app-icon-384.png`
+- `public/icons/app-icon-1024.png`
+- `public/icons/favicon.svg`
+- `public/manifest.webmanifest`
+
+After opening NTerminal in Safari on iPad, use Share -> Add to Home Screen.

package/docs/onboarding.md

@@ -0,0 +1,122 @@
+# Onboarding
+
+NTerminal uses one interactive command for both the main server and secondary servers:
+
+```bash
+npm run onboarding
+```
+
+`npm install` runs automatically as the `preonboarding` hook, so a fresh checkout does not need a separate install step.
+
+After npm publication, package installs use the CLI directly:
+
+```bash
+npm install -g nterminal
+nterminal onboarding
+```
+
+CLI package installs store `.env`, state, pid, and log files under `~/.nterminal`. Install with a user-writable npm global prefix so in-app updates can run `npm install -g nterminal@latest` without sudo.
+
+## Main Server
+
+Run onboarding on the machine that should serve the browser UI:
+
+```bash
+npm run onboarding
+```
+
+Choose `main`.
+
+The main setup flow:
+
+1. Picks a bind address and port. The default main bind is `127.0.0.1`, so public traffic goes through the configured reverse proxy instead of bypassing TLS.
+2. Requires a public `https://<domain>` URL for the proxy setup path. Raw IPs, `http://`, `localhost`, and `.local` URLs are rejected in that path.
+3. Writes `.env`, including a generated `NTERMINAL_SESSION_SECRET`.
+4. Sets the login password and enables TOTP headlessly. The CLI prints a terminal QR code, base32 secret, and `otpauth://` URI, then verifies the 6-digit code.
+5. Optionally builds and starts the server with `scripts/nterminalctl deploy`.
+6. Optionally provisions nginx, DNS verification, firewall rules, and Let's Encrypt TLS.
+
+The final summary prints the public URL, internal bind, and next steps.
+
+## Secondary Server
+
+Run onboarding on each additional machine that should appear in the main UI:
+
+```bash
+npm run onboarding
+```
+
+Choose `secondary`.
+
+The secondary setup flow:
+
+1. Binds to `0.0.0.0` and picks a free port, preferring `3107`.
+2. Asks for the URL the main server should use to reach this machine.
+3. Asks for a display name.
+4. Generates a session secret and `NTERMINAL_AGENT_TOKEN`, then writes `.env`.
+5. Prompts for the main server URL, password, and authenticator code.
+6. Registers this secondary server with the main server automatically.
+7. Optionally builds and starts the server.
+
+Onboard the main server first. The main must already have password and TOTP configured before a secondary server can register itself.
+
+Logging into the main server from the secondary CLI counts as a login, so the single-active-session policy may revoke an open browser session. Log in again in the browser afterward.
+
+## Proxy Setup
+
+When main onboarding configures a public URL, it verifies and provisions:
+
+- public IP detection through `1.1.1.1`
+- DNS A record match
+- nginx installation when missing
+- nginx site config
+- nginx reload and local proxy verification
+- `ufw` or `firewalld` rules for HTTP/HTTPS
+- `certbot --nginx` certificate issuance
+- real HTTPS verification against the final domain
+
+Privileged work uses one of two modes:
+
+- **auto-sudo**: if `sudo -n true` works, onboarding runs the needed commands directly with sudo.
+- **manual**: onboarding prints the exact command, explains it, waits, and re-verifies before continuing.
+
+The "Main is ready" summary is printed only after the selected setup path has completed its checks.
+
+## Local-Only Start
+
+For a localhost-only development run without nginx/TLS onboarding:
+
+```bash
+npm install
+cp .env.example .env
+npm run generate:secrets
+```
+
+Paste the generated value into `.env`:
+
+```env
+NTERMINAL_SESSION_SECRET=replace-with-generate-secrets-output
+```
+
+Then build and start:
+
+```bash
+npm run build
+npm start
+```
+
+Open:
+
+```text
+http://127.0.0.1:3107
+```
+
+On the first visit, set the local NTerminal password and configure TOTP.
+
+## Re-Running Onboarding
+
+You can re-run onboarding to refresh generated config or register a secondary server again.
+
+Existing `NTERMINAL_HOST`, `NTERMINAL_PORT`, `NTERMINAL_SESSION_SECRET`, and `NTERMINAL_AGENT_TOKEN` values are preserved on re-run, so onboarding does not silently change the bind address, kick live sessions, or rotate a secondary server identity.
+
+Registering the same secondary server URL again replaces the previous entry for that URL.

package/docs/operations.md

@@ -0,0 +1,112 @@
+# Operations
+
+## Local Service Management
+
+For production-style local operation, use the bundled control script through npm.
+
+```bash
+npm run ctl -- doctor
+npm run ctl -- build
+npm run ctl -- start
+npm run ctl -- status
+npm run ctl -- logs
+npm run ctl -- restart
+npm run ctl -- stop
+```
+
+The script starts the built server in the background, writes a PID file, appends logs, waits for the local health endpoint, and stops the real Node PID so PTY cleanup can run.
+
+Source checkouts keep runtime files in the repository's `.nterminal/` directory by default. npm package installs launched through `nterminal` keep runtime files under `~/.nterminal`.
+
+One-command local deploy:
+
+```bash
+npm run deploy:local
+```
+
+Short aliases:
+
+```bash
+npm run service:status
+npm run service:start
+npm run service:stop
+npm run service:restart
+npm run service:logs
+```
+
+## Updates
+
+Each server updates itself with the method used to install it.
+
+The **updates** panel in the main server sidebar footer can manage the fleet:
+
+- **Check for updates** runs `git fetch` for git checkouts, or checks the npm registry for package installs.
+- **Update** runs `git pull --ff-only` plus rebuild/restart for git checkouts, or `npm install -g nterminal@latest` plus restart for package installs.
+- **Update all** updates secondary servers in parallel first and the main server last.
+
+Notes:
+
+- `--ff-only` stops and reports an error when a checkout has local commits or a diverged branch.
+- npm package updates run as the same user that owns the running server process. Use a user-writable npm prefix, not a root-owned global install, if you want UI updates to work without sudo.
+- A git checkout with no upstream branch, or an npm registry/permission error, is reported as an explanatory status.
+- Update endpoints require the same auth boundary as the rest of NTerminal.
+
+## Clean Local State
+
+To clean a local install before reinstalling:
+
+```bash
+scripts/nterminalctl clean --force --env
+```
+
+This stops the managed server, kills NTerminal tmux sessions, removes `.nterminal/`, and removes `.env`.
+
+Options:
+
+- omit `--env` to keep `.env`
+- add `--keep-tmux` to preserve live tmux-backed panes
+
+## Verification
+
+Run the standard checks before publishing or deploying:
+
+```bash
+npm run typecheck
+npm test
+npm run build
+git diff --check
+```
+
+For a full browser smoke test:
+
+```bash
+npm run test:e2e
+```
+
+Manual smoke test:
+
+1. Start the built server.
+2. Set the initial password in the browser.
+3. Create a terminal.
+4. Run `printf nterminal-ok`.
+5. Split the terminal.
+6. Refresh the browser and confirm the terminal reconnects.
+7. Close a pane and confirm it detaches as a pill.
+8. Destroy the pill and confirm the PTY exits.
+
+## Troubleshooting
+
+If native PTY install or startup fails:
+
+```bash
+npm rebuild node-pty --build-from-source
+```
+
+If the service script will not start:
+
+```bash
+npm run ctl -- doctor
+npm run ctl -- logs
+```
+
+If you lose the local NTerminal password, stop the server and remove the local state file at `NTERMINAL_STATE_PATH`. The next browser visit will show the first-run password setup screen again.

package/docs/terminal-history.md

@@ -0,0 +1,54 @@
+# Terminal History
+
+NTerminal is tuned for terminal-first work in TUIs such as Codex and Claude, where mouse wheel behavior and long output history matter.
+
+## Mouse Wheel Behavior
+
+Wheel events are captured at the pane level and applied to xterm scrollback. This keeps the wheel focused on terminal output history instead of Codex/Claude prompt history.
+
+If a pane is in the alternate screen, NTerminal exits the alternate buffer before scrolling so the scrollback can be shown.
+
+## Incremental tmux Scrollback
+
+When tmux-backed persistence is available, NTerminal loads older scrollback on demand:
+
+- older lines are requested only when the viewport reaches the top
+- each page is capped to avoid large one-shot payloads
+- a spinner appears while older history is loading
+- the visible position is preserved when lines are prepended
+
+This avoids sending an entire long terminal history to the browser during tab or server switches.
+
+## Scroll Progress And Bottom Controls
+
+Panes can show:
+
+- a faint `current/total` progress indicator before scrolling
+- a stronger progress indicator while actively scrolling
+- a bottom-right jump-to-bottom button when the operator is away from the tail
+- larger mobile drag handles for touch scrolling
+
+Live output follows the tail unless the operator intentionally scrolls away.
+
+## Codex / Claude JSONL History
+
+After tmux scrollback is exhausted, supported Codex and Claude panes can continue into archived JSONL transcript history.
+
+Supported panes show a `JSONL` indicator in the pane header.
+
+Sources:
+
+- Codex: `~/.codex/sessions`
+- Claude: `~/.claude/projects`
+
+NTerminal attaches JSONL history only when it can determine the session source unambiguously. It does not guess by fuzzy scoring.
+
+JSONL records are loaded by cursor and rendered into readable user, assistant, and tool blocks. NTerminal does not send the full archive to the browser at once.
+
+## Persistence Boundaries
+
+- Refreshing the browser or temporarily losing the WebSocket should reconnect to active PTYs while the Node process is still running.
+- Restarting the NTerminal Node server preserves active shells when `tmux` is installed and `NTERMINAL_PTY_PERSIST` is not disabled.
+- Without tmux, Node restarts kill direct PTYs.
+- An OS reboot terminates NTerminal, tmux, and all live shells.
+- Codex/Claude JSONL transcript files are managed by those tools and are not stored in NTerminal state.

package/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "nterminal",
+  "version": "1.2.0",
+  "license": "GPL-3.0-only",
+  "type": "module",
+  "packageManager": "npm@10.9.7",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "bin": {
+    "nterminal": "bin/nterminal.js"
+  },
+  "files": [
+    ".env.example",
+    "LICENSE",
+    "README.md",
+    "assets/",
+    "bin/",
+    "dist/",
+    "docs/",
+    "public/",
+    "scripts/nterminalctl"
+  ],
+  "scripts": {
+    "dev": "tsx watch src/server/index.ts",
+    "build": "rm -rf dist/server dist/shared dist/scripts dist/src && tsc -p tsconfig.server.json && tsc -p tsconfig.scripts.json && vite build",
+    "start": "node dist/server/index.js",
+    "typecheck": "tsc -p tsconfig.server.json --noEmit && tsc -p tsconfig.client.json --noEmit",
+    "test": "vitest run",
+    "test:e2e": "npm run build && playwright test",
+    "generate:secrets": "tsx scripts/generate-secrets.ts",
+    "preonboarding": "npm install",
+    "onboarding": "node bin/nterminal.js onboarding",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run pack:check",
+    "pack:check": "node scripts/check-npm-package.js",
+    "ctl": "bash scripts/nterminalctl",
+    "deploy:local": "bash scripts/nterminalctl deploy",
+    "service:status": "bash scripts/nterminalctl status",
+    "service:start": "bash scripts/nterminalctl start",
+    "service:stop": "bash scripts/nterminalctl stop",
+    "service:restart": "bash scripts/nterminalctl restart",
+    "service:logs": "bash scripts/nterminalctl logs"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/utilities": "^3.2.2",
+    "@fastify/cookie": "^11.0.2",
+    "@fastify/multipart": "^10.0.0",
+    "@fastify/static": "^9.1.3",
+    "@fastify/websocket": "^11.2.0",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/xterm": "^6.0.0",
+    "fastify": "^5.6.2",
+    "ipaddr.js": "^2.4.0",
+    "node-pty": "^1.1.0",
+    "otpauth": "^9.5.1",
+    "qrcode": "^1.5.4",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "react-markdown": "^10.1.0",
+    "remark-gfm": "^4.0.1",
+    "ws": "^8.18.3"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.57.0",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.0",
+    "@types/node": "^24.10.1",
+    "@types/qrcode": "^1.5.6",
+    "@types/react": "^19.2.6",
+    "@types/react-dom": "^19.2.3",
+    "@types/ws": "^8.18.1",
+    "@vitejs/plugin-react": "^5.1.1",
+    "jsdom": "^27.2.0",
+    "tsx": "^4.20.6",
+    "typescript": "^5.9.3",
+    "vite": "^7.2.4",
+    "vitest": "^4.0.14"
+  }
+}

package/public/brand/nterminal-mark.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" width="32" height="32">
+  <rect width="32" height="32" rx="6" ry="6" fill="#0A0A0B"/>
+  <text font-family="'JetBrains Mono', ui-monospace, monospace" font-weight="700" font-size="25" dominant-baseline="middle"><tspan x="-6.50" y="17.28" fill="#FF2A3D">{</tspan><tspan x="8.50" y="17.28" fill="#fff">n</tspan><tspan x="23.50" y="17.28" fill="#FF2A3D">}</tspan></text>
+</svg>

package/public/brand/nterminal-wordmark.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 243 34" width="243" height="34">
+  <text font-family="'JetBrains Mono', ui-monospace, monospace" font-weight="700" font-size="33"><tspan x="0.00" y="28.00" fill="#FF2A3D">{</tspan><tspan x="22.16" y="28.00" fill="#fff">n</tspan><tspan x="41.96" y="28.00" fill="#FF2A3D">·</tspan><tspan x="61.76" y="28.00" fill="#fff">terminal</tspan><tspan x="222.51" y="28.00" fill="#FF2A3D">}</tspan></text>
+</svg>

package/public/icons/favicon.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="12" ry="12" fill="#0A0A0B"/>
+  <text font-family="'JetBrains Mono', ui-monospace, monospace" font-weight="700" font-size="50" dominant-baseline="middle"><tspan x="-13.00" y="34.56" fill="#FF2A3D">{</tspan><tspan x="17.00" y="34.56" fill="#fff">n</tspan><tspan x="47.00" y="34.56" fill="#FF2A3D">}</tspan></text>
+</svg>

package/public/manifest.webmanifest

@@ -0,0 +1,24 @@
+{
+  "name": "NTerminal",
+  "short_name": "NTerminal",
+  "description": "A touch-friendly terminal workspace.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#071113",
+  "theme_color": "#071113",
+  "icons": [
+    {
+      "src": "/icons/app-icon-384.png",
+      "sizes": "384x384",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icons/app-icon-1024.png",
+      "sizes": "1024x1024",
+      "type": "image/png",
+      "purpose": "any maskable"
+    }
+  ]
+}