termdock 1.4.322 → 1.4.324

package/dist/server/federation/runtime.js

@@ -24,12 +24,14 @@ class LogicalSocket extends EventEmitter {
     canRead;
     OPEN = 1;
     readyState = 1;
-    bufferedAmount = 0;
-    constructor(channel, id, canRead) {
+    get bufferedAmount() { return this.channel.queuedBytesFor(this.id); }
+    maxQueuedBytes;
+    constructor(channel, id, canRead, maxQueuedBytes = 4 * 1024 * 1024) {
         super();
         this.channel = channel;
         this.id = id;
         this.canRead = canRead;
+        this.maxQueuedBytes = maxQueuedBytes;
     }
     send(data) {
         if (this.readyState !== 1)
@@ -38,12 +40,18 @@ class LogicalSocket extends EventEmitter {
             this.close(4003, 'Authorization revoked');
             return;
         }
+        // Apply the terminal backlog threshold to bytes already queued, leaving a
+        // single protocol-valid record (up to MAX_PACKET) intact. Other logical
+        // streams retain the shared channel budget and its own backpressure guard.
+        if (this.channel.queuedBytesFor(this.id) > this.maxQueuedBytes) {
+            this.close(1013, 'Output consumer is too slow');
+            return;
+        }
         try {
             this.channel.send({ type: 'ws-data', id: this.id, data });
         }
-        catch (error) {
-            this.channel.close(error instanceof Error ? error : new Error('Output transport failed'));
-            this.close();
+        catch {
+            this.close(1013, 'Output consumer is too slow');
         }
     }
     close(code = 1000, reason = '') {
@@ -100,7 +108,9 @@ export async function createFederationRuntime(app, directory, handlers, options
         delete request.headers['x-termdock-inner'];
         const subject = request.headers['x-termdock-device'];
         delete request.headers['x-termdock-device'];
-        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined);
+        const fullService = request.headers['x-termdock-full-service'] === '1';
+        delete request.headers['x-termdock-full-service'];
+        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined, fullService);
         app(request, response);
     });
     await new Promise((resolve, reject) => { internal.once('error', reject); internal.listen(0, '127.0.0.1', resolve); });
@@ -177,7 +187,8 @@ export async function createFederationRuntime(app, directory, handlers, options
                 };
                 try {
                     httpAllowed(operation.head);
-                    const headers = new Headers({ 'x-termdock-inner': internalToken, 'x-termdock-device': subjectId });
+                    const headers = new Headers({ 'x-termdock-inner': internalToken, 'x-termdock-device': subjectId,
+                        'x-termdock-full-service': full(subjectId) ? '1' : '0' });
                     const supplied = operation.head.headers;
                     if (supplied && typeof supplied === 'object')
                         for (const [name, value] of Object.entries(supplied)) {
@@ -580,7 +591,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                         }
                         else
                             throw new Error('API_NOT_ALLOWED');
-                        const logical = new LogicalSocket(channel, packet.id, () => (androidMatch || computer) ? full(subjectId) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]));
+                        const logical = new LogicalSocket(channel, packet.id, () => (androidMatch || computer) ? full(subjectId) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]), match ? 1024 * 1024 : undefined);
                         sockets.set(packet.id, { socket: logical, sessionId: match?.[1], android: Boolean(androidMatch), computer,
                             computerProtocol: computer ? url.searchParams.get('protocol') ?? 'vnc' : undefined });
                         logical.once('close', () => sockets.delete(packet.id));

package/dist/server/routes/terminal.js

@@ -1,3 +1,5 @@
+import { copyTmuxSelection } from '../utils/tmuxCopySelection.js';
+import { isConfirmedEmptyTmuxServer } from '../utils/tmuxEmptyServerProbe.js';
 import { collaborationSessionDisplayName } from '../utils/sessionDisplayName.js';
 import { integrationError } from '../agent/integrationStore.js';
 import { assertNativeResumeAvailable, collectNativeResumeOwnerCandidates } from '../agent/nativeResumeOwner.js';
@@ -14,6 +16,7 @@ import { ensureNodePty } from '../utils/ensureNodePty.js';
 import { PtySpawnBackoff, PtySpawnDeferredError } from '../utils/ptySpawnBackoff.js';
 import { collaborationGroupRoutes } from '../agent/collaborationGroupRoutes.js';
 import { TerminalClientAttachment } from '../utils/terminalClientAttachment.js';
+import { TerminalPasteBuffer } from '../utils/terminalPasteBuffer.js';
 import { SharedSessionSampler, SharedSnapshotCache } from '../utils/sharedSampling.js';
 import { batchTmuxOptions, TmuxMetadataWriter } from '../utils/tmuxMetadataWriter.js';
 import { redrawTmuxClient } from '../utils/tmuxClientRedraw.js';
@@ -2522,10 +2525,10 @@ function getTmuxBinary() {
     }
     return 'tmux'; // fallback to PATH
 }
-async function runTmux(args) {
+async function runTmux(args, options) {
     const { stdout } = await execFileAsync(getTmuxBinary(), args, {
         timeout: 5000,
-        maxBuffer: 2 * 1024 * 1024,
+        maxBuffer: options?.maxBuffer ?? 2 * 1024 * 1024,
         env: buildInteractiveColorEnvironment(process.env),
     });
     return stdout;
@@ -4684,19 +4687,26 @@ async function resolveTmuxClientTty(sessionName, preferredClientPid) {
 }
 async function ensureTmuxSessionExists(sessionName, cwd) {
     let serverWasMissing = false;
+    let serverIsEmpty = false;
+    let sessionExists = false;
     try {
         await runTmux(['has-session', '-t', sessionName]);
-        await ensureTmuxColorEnvironment(sessionName);
-        return;
+        sessionExists = true;
     }
     catch (error) {
         const errorMessage = getErrorMessage(error);
         serverWasMissing = isTmuxServerMissingMessage(errorMessage);
         if (!isTmuxSessionMissingMessage(errorMessage)) {
-            throw error;
+            serverIsEmpty = await isConfirmedEmptyTmuxServer(error, sessionName, runTmux);
+            if (!serverIsEmpty)
+                throw error;
         }
     }
-    if (!serverWasMissing) {
+    if (sessionExists) {
+        await ensureTmuxColorEnvironment(sessionName);
+        return;
+    }
+    if (!serverWasMissing && !serverIsEmpty) {
         await ensureTmuxColorEnvironment();
     }
     const innerTerm = await resolveTmuxInnerTerm();
@@ -8306,7 +8316,10 @@ router.post('/:sessionId/input', express.text({ type: '*/*' }), (req, res) => {
     }
     const data = typeof req.body === 'string' ? req.body : '';
     try {
-        session.ptyProcess.write(data);
+        const paste = new TerminalPasteBuffer(() => { });
+        const parts = paste.complete(data);
+        for (const part of parts)
+            session.ptyProcess.write(part);
         session.lastActivity = Date.now();
         res.json({ success: true });
     }
@@ -8475,7 +8488,7 @@ router.post('/:sessionId/tmux', async (req, res) => {
             broadcastEvent(sessionId, { type: 'tmux-layout', layout });
             return res.json({ success: true, layout });
         }
-        return res.json({ success: true });
+        return res.json({ success: true, ...(result.selection ? { selection: result.selection } : {}) });
     }
     catch (error) {
         const errorMessage = getErrorMessage(error);
@@ -8570,6 +8583,10 @@ router.post('/force-kill', (req, res) => {
 async function executeTmuxAction(tmuxTarget, action, body, control) {
     let shouldBroadcastLayout = true;
     switch (action) {
+        case 'copy-selection': {
+            const selection = await copyTmuxSelection(tmuxTarget, runTmux);
+            return { shouldBroadcastLayout: false, selection };
+        }
         case 'select-pane': {
             const paneId = typeof body.paneId === 'string' ? body.paneId : '';
             if (!paneId)
@@ -8960,6 +8977,12 @@ export function handleTerminalWebSocket(ws, sessionId, clientId, options = {}, i
         if (ws.readyState === ws.OPEN)
             ws.send(JSON.stringify(event));
     });
+    const pasteInput = new TerminalPasteBuffer(error => {
+        if (ws.readyState === ws.OPEN) {
+            ws.send(JSON.stringify({ type: 'error', error }));
+            ws.close(1008, 'Incomplete terminal paste');
+        }
+    });
     // Handle client → server messages
     ws.on('message', async (raw) => {
         const messageReceivedAt = performance.now();
@@ -8974,20 +8997,30 @@ export function handleTerminalWebSocket(ws, sessionId, clientId, options = {}, i
             switch (msg.type) {
                 case 'input': {
                     if (typeof msg.data === 'string' && msg.data.length > 0) {
-                        const data = msg.data;
-                        if (attachment) {
-                            session.lastActivity = Date.now();
-                            attachment.write(data);
+                        let parts;
+                        try {
+                            parts = pasteInput.push(msg.data);
+                        }
+                        catch (error) {
+                            ws.send(JSON.stringify({ type: 'error', error: getErrorMessage(error) }));
+                            ws.close(1008, 'Invalid terminal paste');
+                            return;
                         }
-                        else if (session.mode === 'tmux') {
-                            await enqueueTmuxIo(session, async () => {
+                        for (const data of parts) {
+                            if (attachment) {
+                                session.lastActivity = Date.now();
+                                attachment.write(data);
+                            }
+                            else if (session.mode === 'tmux') {
+                                await enqueueTmuxIo(session, async () => {
+                                    session.lastActivity = Date.now();
+                                    session.ptyProcess.write(data);
+                                });
+                            }
+                            else {
                                 session.lastActivity = Date.now();
                                 session.ptyProcess.write(data);
-                            });
-                        }
-                        else {
-                            session.lastActivity = Date.now();
-                            session.ptyProcess.write(data);
+                            }
                         }
                     }
                     break;
@@ -9055,8 +9088,14 @@ export function handleTerminalWebSocket(ws, sessionId, clientId, options = {}, i
                     }
                     const result = await enqueueTmuxIo(session, async () => {
                         return executeTmuxAction(session.tmuxSessionName, msg.action, msg, session.tmuxControl);
+                    }).catch((error) => {
+                        // A correlated copy failure must settle this socket's request, not
+                        // become an unrelated terminal error followed by a 30-second wait.
+                        if (msg.action !== 'copy-selection')
+                            throw error;
+                        return { shouldBroadcastLayout: false, error: getErrorMessage(error) || 'Tmux selection copy failed' };
                     });
-                    ws.send(JSON.stringify({ type: 'tmux-result', reqId, success: !result.error, error: result.error }));
+                    ws.send(JSON.stringify({ type: 'tmux-result', reqId, success: !result.error, error: result.error, ...(result.selection ? { selection: result.selection } : {}) }));
                     if (result.shouldBroadcastLayout && session.tmuxSessionName) {
                         try {
                             const layout = await getTmuxLayout(session.tmuxSessionName);
@@ -9154,6 +9193,7 @@ export function handleTerminalWebSocket(ws, sessionId, clientId, options = {}, i
     });
     // Cleanup on close
     ws.on('close', () => {
+        pasteInput.clear();
         initialScreen?.cancel();
         initialScreen = null;
         attachment?.close();

package/dist/server/utils/autoUpdate.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { compareVersions, updateTermdockFromOfficialRegistry, } from './npmUpdate.js';
+import { compareVersions, verifyRunningTermdockInstallation, updateTermdockFromOfficialRegistry, } from './npmUpdate.js';
 export const AUTO_UPDATE_INITIAL_DELAY_MS = 15_000;
 export const AUTO_UPDATE_INTERVAL_MS = 6 * 60 * 60 * 1_000;
 function initialState(currentVersion) {
@@ -44,11 +44,11 @@ export class TermdockAutoUpdateManager {
             return;
         this.initialTimer = setTimeout(() => {
             this.initialTimer = null;
-            void this.checkNow();
+            void this.checkNow(false);
         }, AUTO_UPDATE_INITIAL_DELAY_MS);
         this.initialTimer.unref?.();
         this.intervalTimer = setInterval(() => {
-            void this.checkNow();
+            void this.checkNow(false);
         }, AUTO_UPDATE_INTERVAL_MS);
         this.intervalTimer.unref?.();
     }
@@ -60,12 +60,24 @@ export class TermdockAutoUpdateManager {
         this.initialTimer = null;
         this.intervalTimer = null;
     }
-    checkNow() {
+    checkNow(explicit = true) {
+        // Failed installation validation requires a user-requested check, not a timer retry.
+        if (!explicit && this.state.status === 'error' && hasPendingTermdockUpdate(this.state))
+            return Promise.resolve(this.getState());
         // Once an installed update is waiting for explicit confirmation, periodic
         // checks must never turn any external state change into implicit consent.
         // Keep the reminder until the user confirms or restarts manually.
         if (this.state.status === 'ready' && hasPendingTermdockUpdate(this.state)) {
-            return Promise.resolve(this.getState());
+            try {
+                this.verifyInstalled(this.state.latestVersion);
+                return Promise.resolve(this.getState());
+            }
+            catch (error) {
+                this.installationError(error);
+                if (!explicit)
+                    return Promise.resolve(this.getState());
+            }
+            // Only the explicit check repairs an invalid pending installation; never restart here.
         }
         if (this.checkPromise)
             return this.checkPromise;
@@ -78,10 +90,33 @@ export class TermdockAutoUpdateManager {
         if (this.state.status !== 'ready' || !hasPendingTermdockUpdate(this.state)) {
             throw new Error('No installed Termdock update is waiting for restart.');
         }
+        try {
+            this.verifyInstalled(this.state.latestVersion);
+            if (process.env.TERMDOCK_SUPERVISED !== '1' || !process.connected)
+                throw new Error('Automatic restart requires the verified supervised Termdock entry; restart manually.');
+            this.dependencies.verifyRestartEntry?.();
+        }
+        catch (error) {
+            this.installationError(error);
+            throw error;
+        }
         this.setState({ ...this.state, status: 'restarting', error: null });
-        this.dependencies.requestRestart();
+        try {
+            this.dependencies.requestRestart();
+        }
+        catch (error) {
+            this.installationError(error);
+            throw error;
+        }
         return this.getState();
     }
+    verifyInstalled(version) {
+        (this.dependencies.verifyInstalled ?? verifyRunningTermdockInstallation)(version);
+    }
+    installationError(error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        this.setState({ ...this.state, status: 'error', error: detail });
+    }
     async runCheck() {
         this.setState({ ...this.state, status: 'checking', checkedAt: Date.now(), error: null });
         try {
@@ -110,6 +145,7 @@ export class TermdockAutoUpdateManager {
                 });
                 return this.getState();
             }
+            this.verifyInstalled(result.latestVersion);
             this.setState({
                 status: 'ready',
                 currentVersion: result.currentVersion,
@@ -145,13 +181,24 @@ export class TermdockAutoUpdateManager {
                 return fallback;
             if (value.status !== 'ready' && value.status !== 'restarting' && value.status !== 'error')
                 return fallback;
+            let restoredStatus = value.status === 'restarting' ? 'ready' : value.status;
+            let restoredError = typeof value.error === 'string' ? value.error : null;
+            if (restoredStatus === 'ready') {
+                try {
+                    this.verifyInstalled(value.latestVersion);
+                }
+                catch (error) {
+                    restoredStatus = 'error';
+                    restoredError = error instanceof Error ? error.message : String(error);
+                }
+            }
             return {
-                status: value.status === 'restarting' ? 'ready' : value.status,
+                status: restoredStatus,
                 currentVersion: this.dependencies.currentVersion,
                 latestVersion: value.latestVersion,
                 source: value.source === 'configured' ? 'configured' : 'official',
                 checkedAt: typeof value.checkedAt === 'number' ? value.checkedAt : null,
-                error: typeof value.error === 'string' ? value.error : null,
+                error: restoredError,
             };
         }
         catch {

package/dist/server/utils/npmUpdate.js

@@ -1,5 +1,8 @@
 import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 const execFileAsync = promisify(execFile);
 export const OFFICIAL_NPM_REGISTRY = 'https://registry.npmjs.org';
 const TERMDOCK_PACKAGE = 'termdock';
@@ -41,7 +44,7 @@ export function buildNpmViewArgs(registry = OFFICIAL_NPM_REGISTRY) {
         args.push('--registry', registry);
     return args;
 }
-export function buildNpmInstallArgs(version, registry = OFFICIAL_NPM_REGISTRY) {
+export function buildNpmInstallArgs(version, registry = OFFICIAL_NPM_REGISTRY, prefix) {
     if (!parseVersion(version))
         throw new Error(`Invalid Termdock version from npm: ${version}`);
     const args = [
@@ -49,11 +52,56 @@ export function buildNpmInstallArgs(version, registry = OFFICIAL_NPM_REGISTRY) {
         '--global',
         `${TERMDOCK_PACKAGE}@${version}`,
     ];
+    if (prefix)
+        args.push('--prefix', prefix);
     if (registry)
         args.push('--registry', registry);
     args.push('--foreground-scripts');
     return args;
 }
+function installedVersion(installation) {
+    // Fresh filesystem reads: npm replaces this package while this process keeps
+    // running old JS. Neither require/import caches nor TERMDOCK_VERSION attest it.
+    if (fs.realpathSync(installation.packageRoot) !== installation.packageRoot) {
+        throw new Error('Running Termdock installation changed location; check for updates again.');
+    }
+    const value = JSON.parse(fs.readFileSync(path.join(installation.packageRoot, 'package.json'), 'utf8'));
+    if (!value || typeof value !== 'object' || !('name' in value) || value.name !== TERMDOCK_PACKAGE
+        || !('version' in value) || typeof value.version !== 'string' || !parseVersion(value.version)) {
+        throw new Error('Running Termdock installation has invalid package metadata.');
+    }
+    return value.version;
+}
+/** Resolve the module which is actually running, never PATH's unrelated npm root. */
+export function resolveRunningTermdockInstallation(moduleUrl = import.meta.url, runningEntry = process.argv[1]) {
+    const moduleFile = fs.realpathSync(fileURLToPath(moduleUrl));
+    const packageRoot = path.resolve(path.dirname(moduleFile), '../../..');
+    const nodeModules = path.dirname(packageRoot);
+    if (path.basename(packageRoot) !== TERMDOCK_PACKAGE || path.basename(nodeModules) !== 'node_modules') {
+        throw new Error('Automatic updates require a supported global Termdock installation.');
+    }
+    const parent = path.dirname(nodeModules);
+    let prefix;
+    if (process.platform === 'win32')
+        prefix = parent;
+    else if (path.basename(parent) === 'lib')
+        prefix = path.dirname(parent);
+    else
+        throw new Error('Automatic updates require a supported global Termdock installation.');
+    const installation = { packageRoot, prefix };
+    // supervisor resolves and reuses this child's argv entry. A module loaded
+    // from another installation must never approve that different restart root.
+    if (!runningEntry || fs.realpathSync(runningEntry) !== path.join(packageRoot, 'dist/server/cli.js')) {
+        throw new Error('Running Termdock entry does not match its update installation.');
+    }
+    installedVersion(installation);
+    return installation;
+}
+export function verifyRunningTermdockInstallation(version, installation = resolveRunningTermdockInstallation()) {
+    if (compareVersions(installedVersion(installation), version) < 0) {
+        throw new Error('Running Termdock installation has not completed this update; check for updates again.');
+    }
+}
 export function parseNpmVersionOutput(output) {
     let value;
     try {
@@ -67,6 +115,26 @@ export function parseNpmVersionOutput(output) {
     }
     return value;
 }
+export function npmRuntimeEnvironment(execPath = process.execPath, env = process.env, platform = process.platform) {
+    const systemBins = platform === 'darwin' ? ['/opt/homebrew/bin', '/usr/local/bin'] : [];
+    return { ...env, PATH: [path.dirname(execPath), ...systemBins, env.PATH].filter(Boolean).join(path.delimiter) };
+}
+async function installEnvironment() {
+    const env = npmRuntimeEnvironment();
+    if (process.platform === 'darwin') {
+        // New CLT releases can leave node-gyp's implicit libc++ search path stale.
+        // Use the SDK selected by xcrun without changing the user's global setup.
+        const { stdout } = await execFileAsync('/usr/bin/xcrun', ['--show-sdk-path'], { timeout: 5000, env });
+        const sdk = stdout.trim();
+        const headers = path.join(sdk, 'usr/include/c++/v1');
+        if (!path.isAbsolute(sdk) || !fs.existsSync(path.join(headers, 'functional'))) {
+            throw new Error('macOS C++ SDK headers are unavailable. Install or repair Command Line Tools, then retry.');
+        }
+        env.SDKROOT = sdk;
+        env.CPLUS_INCLUDE_PATH = [headers, env.CPLUS_INCLUDE_PATH].filter(Boolean).join(path.delimiter);
+    }
+    return env;
+}
 function npmExecutable() {
     return process.platform === 'win32' ? 'npm.cmd' : 'npm';
 }
@@ -76,7 +144,7 @@ async function fetchLatestVersion(registry) {
         const result = await execFileAsync(npmExecutable(), buildNpmViewArgs(registry), {
             timeout: NPM_QUERY_TIMEOUT_MS,
             maxBuffer: 256 * 1024,
-            env: process.env,
+            env: npmRuntimeEnvironment(),
         });
         stdout = result.stdout;
     }
@@ -87,11 +155,15 @@ async function fetchLatestVersion(registry) {
     }
     return parseNpmVersionOutput(stdout);
 }
-function installVersion(version, registry) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(npmExecutable(), buildNpmInstallArgs(version, registry), {
+export async function installTermdockVersion(version, registry, installation, executable = npmExecutable()) {
+    if (compareVersions(installedVersion(installation), version) > 0) {
+        throw new Error('Running Termdock location already contains a newer version; restart that installation manually.');
+    }
+    const env = await installEnvironment();
+    await new Promise((resolve, reject) => {
+        const child = spawn(executable, buildNpmInstallArgs(version, registry, installation.prefix), {
             stdio: 'inherit',
-            env: process.env,
+            env,
         });
         child.once('error', reject);
         child.once('exit', (code, signal) => {
@@ -103,6 +175,9 @@ function installVersion(version, registry) {
             reject(new Error(`npm failed to install Termdock (${reason}).`));
         });
     });
+    if (installedVersion(installation) !== version) {
+        throw new Error('npm did not install the requested version at the running Termdock location.');
+    }
 }
 export async function updateTermdockFromOfficialRegistry(currentVersion, onFallback, onLatest) {
     if (!parseVersion(currentVersion))
@@ -124,8 +199,9 @@ export async function updateTermdockFromOfficialRegistry(currentVersion, onFallb
         return { status: 'current', currentVersion, latestVersion, source };
     if (comparison > 0)
         return { status: 'newer-than-registry', currentVersion, latestVersion, source };
+    const installation = resolveRunningTermdockInstallation();
     try {
-        await installVersion(latestVersion, source === 'official' ? OFFICIAL_NPM_REGISTRY : null);
+        await installTermdockVersion(latestVersion, source === 'official' ? OFFICIAL_NPM_REGISTRY : null, installation);
     }
     catch (error) {
         if (source === 'configured')
@@ -133,7 +209,7 @@ export async function updateTermdockFromOfficialRegistry(currentVersion, onFallb
         const cause = error instanceof Error ? error : new Error(String(error));
         onFallback?.('install', cause);
         source = 'configured';
-        await installVersion(latestVersion, null);
+        await installTermdockVersion(latestVersion, null, installation);
     }
     return { status: 'updated', currentVersion, latestVersion, source };
 }

package/dist/server/utils/terminalPasteBuffer.js

@@ -0,0 +1,66 @@
+const START = '\x1b[200~';
+const END = '\x1b[201~';
+const MAX_BYTES = 1024 * 1024;
+const TIMEOUT_MS = 10_000;
+const INCOMPLETE = '粘贴内容未完整送达，已取消，请重新粘贴。';
+/** A socket owns its pending paste. Never expose its opening delimiter to the
+ * PTY until the closing delimiter has arrived, even across input records.
+ * Ordinary keyboard/mouse records remain synchronous and unbuffered. */
+export class TerminalPasteBuffer {
+    onTimeout;
+    pending = '';
+    startedAt = 0;
+    timer;
+    constructor(onTimeout) {
+        this.onTimeout = onTimeout;
+    }
+    push(data) {
+        const previousStart = this.startedAt;
+        const continuing = this.pending.length > 0;
+        const input = this.pending + data;
+        const output = [];
+        this.clear();
+        let offset = 0;
+        while (offset < input.length) {
+            const start = input.indexOf(START, offset);
+            if (start < 0) {
+                output.push(input.slice(offset));
+                break;
+            }
+            if (start > offset)
+                output.push(input.slice(offset, start));
+            const end = input.indexOf(END, start + START.length);
+            const nested = input.indexOf(START, start + START.length);
+            if (nested >= 0 && (end < 0 || nested < end))
+                throw new Error(INCOMPLETE);
+            const paste = input.slice(start, end < 0 ? undefined : end + END.length);
+            if (Buffer.byteLength(paste) > MAX_BYTES)
+                throw new Error('粘贴内容超过 1 MiB，请分段粘贴。');
+            if (end < 0) {
+                this.pending = paste;
+                this.startedAt = continuing && start === 0 ? previousStart : Date.now();
+                this.timer = setTimeout(() => { this.clear(); this.onTimeout(INCOMPLETE); }, Math.max(0, this.startedAt + TIMEOUT_MS - Date.now()));
+                this.timer.unref();
+                break;
+            }
+            output.push(paste);
+            offset = end + END.length;
+        }
+        return output;
+    }
+    /** HTTP input has no continuation stream. Reject its entire body on failure. */
+    complete(data) {
+        const output = this.push(data);
+        if (this.pending) {
+            this.clear();
+            throw new Error(INCOMPLETE);
+        }
+        return output;
+    }
+    clear() {
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        this.pending = '';
+        this.startedAt = 0;
+    }
+}

package/dist/server/utils/tmuxClientCapabilities.js

@@ -15,6 +15,10 @@ export async function supportsTmuxClientFeatures(binary) {
 }
 export function buildTmuxAttachArgs(sessionName, supportsFeatures) {
     return [
+        // The Web/native terminal consumes UTF-8 regardless of the server launcher's
+        // locale. GUI-launched services may inherit C; tmux otherwise emits _ for
+        // non-ASCII cells before the encrypted output ever reaches the renderer.
+        '-u',
         ...(supportsFeatures ? ['-T', 'RGB,sync'] : []),
         'attach-session', '-t', sessionName,
     ];