termdock 1.4.322 → 1.4.325

package/dist/server/routes/terminal.js

@@ -1,3 +1,5 @@
+import { copyTmuxSelection } from '../utils/tmuxCopySelection.js';
+import { isConfirmedEmptyTmuxServer } from '../utils/tmuxEmptyServerProbe.js';
 import { collaborationSessionDisplayName } from '../utils/sessionDisplayName.js';
 import { integrationError } from '../agent/integrationStore.js';
 import { assertNativeResumeAvailable, collectNativeResumeOwnerCandidates } from '../agent/nativeResumeOwner.js';
@@ -14,6 +16,7 @@ import { ensureNodePty } from '../utils/ensureNodePty.js';
 import { PtySpawnBackoff, PtySpawnDeferredError } from '../utils/ptySpawnBackoff.js';
 import { collaborationGroupRoutes } from '../agent/collaborationGroupRoutes.js';
 import { TerminalClientAttachment } from '../utils/terminalClientAttachment.js';
+import { TerminalPasteBuffer } from '../utils/terminalPasteBuffer.js';
 import { SharedSessionSampler, SharedSnapshotCache } from '../utils/sharedSampling.js';
 import { batchTmuxOptions, TmuxMetadataWriter } from '../utils/tmuxMetadataWriter.js';
 import { redrawTmuxClient } from '../utils/tmuxClientRedraw.js';
@@ -49,6 +52,8 @@ import { AgentResumeHistoryStore } from '../agent/resumeHistory.js';
 import { completedExecution, ExecutionArchiveStore } from '../agent/executionArchives.js';
 import { archiveTaskWorkspace, restoreTaskWorkspace, snapshotTaskWorkspace } from '../agent/collaborationTaskWorkspace.js';
 import { isTmuxRecoveryCandidate } from '../utils/tmuxRecoveryCandidate.js';
+import { configuredTmuxRecoveryConcurrency, TmuxRecoveryOperationStore } from '../utils/tmuxRecoveryOperations.js';
+import { assessAgentResourceBudget, collectHostResourceSnapshot, configuredAgentResourceBudget } from '../utils/hostResources.js';
 import { AutomationStore, normalizeAutomationSchedule } from '../agent/automationStore.js';
 import { writeBracketedPrompt, canDeliverPromptToAgent } from '../agent/promptDelivery.js';
 import { captureTerminalInputGuard, captureRuntimeInputGuard, waitAndWriteTerminalInput } from '../agent/terminalInput.js';
@@ -201,7 +206,11 @@ const agentResumeHistory = new AgentResumeHistoryStore(`${TERMDOCK_DIR}/agent-re
 const executionArchives = new ExecutionArchiveStore(`${TERMDOCK_DIR}/execution-archives.json`);
 let executionArchiveMutation = Promise.resolve();
 const TMUX_RECOVERY_STATE_FILE = `${TERMDOCK_DIR}/tmux-recovery-state.json`;
+const TMUX_RECOVERY_OPERATIONS_FILE = `${TERMDOCK_DIR}/tmux-recovery-operations.json`;
 const tmuxLifecycle = new TmuxLifecycleCoordinator();
+const tmuxRecoveryConcurrencyLimit = configuredTmuxRecoveryConcurrency();
+const tmuxRecoveryOperations = new TmuxRecoveryOperationStore(TMUX_RECOVERY_OPERATIONS_FILE, tmuxRecoveryConcurrencyLimit, (error) => console.error('[tmux-recovery] operation worker error:', getErrorMessage(error)));
+let tmuxRecoveryHealthTimer = null;
 const intentionallyDeletingTmuxSessions = new Set();
 let tmuxRecoveryState = { lastServerPid: null, incident: null, dismissedSessionIds: [] };
 let persistGlobalStateTimer = null;
@@ -212,6 +221,10 @@ let globalSessionStateReloadTimer = null;
 // receives deltas on every mutation (PUT/DELETE client-state, dead-session
 // reconciliation, etc.). Replaces the 5-second poll on the front-end. ──
 const controlClients = new Map();
+tmuxRecoveryOperations.subscribe(() => {
+    latestSessionInventoryAt = 0;
+    broadcastClientState();
+});
 let latestSessionInventory = null;
 // Only authoritative observations may remove persisted tmux sessions.
 const inventoryTmuxLiveness = new WeakMap();
@@ -540,8 +553,10 @@ async function loadGlobalSessionStateFromDisk() {
 async function loadTmuxRecoveryStateFromDisk() {
     try {
         const data = await readJsonFileIfExists(TMUX_RECOVERY_STATE_FILE);
-        if (!data)
+        if (!data) {
+            await tmuxRecoveryOperations.load();
             return;
+        }
         tmuxRecoveryState = {
             lastServerPid: typeof data.lastServerPid === 'number' && Number.isInteger(data.lastServerPid)
                 ? data.lastServerPid
@@ -551,6 +566,7 @@ async function loadTmuxRecoveryStateFromDisk() {
                 ? data.dismissedSessionIds.filter((id) => typeof id === 'string')
                 : [],
         };
+        await tmuxRecoveryOperations.load();
     }
     catch (error) {
         console.warn('[tmux-recovery] Failed to load recovery state:', getErrorMessage(error));
@@ -663,6 +679,8 @@ const shutdownWithRecordings = async () => {
     if (shuttingDown)
         return;
     shuttingDown = true;
+    if (tmuxRecoveryHealthTimer)
+        clearInterval(tmuxRecoveryHealthTimer);
     flushPersistAndExit();
     void persistToolbarPresetsNow();
     caffeinateManager.shutdown();
@@ -679,6 +697,9 @@ process.on('SIGINT', () => { void shutdownWithRecordings(); });
 // 服务启动时从磁盘加载（带去重，防止历史累积的重复条目复活）
 void (async () => {
     await Promise.all([loadGlobalSessionStateFromDisk(), loadTmuxRecoveryStateFromDisk()]);
+    await sampleTmuxRecoveryHealth();
+    tmuxRecoveryHealthTimer = setInterval(() => void sampleTmuxRecoveryHealth(), 15_000);
+    tmuxRecoveryHealthTimer.unref?.();
     // Delivery needs the loaded inventory, not optional PTY adoption/metadata backfill.
     // Those steps must not leave durable messages without a background scheduler.
     collaborationDeliveryWorker.start();
@@ -691,6 +712,7 @@ void (async () => {
     });
     pruneOrphanSessions();
     await backfillPersistedTmuxMetadata();
+    await tmuxRecoveryOperations.resumePending();
 })();
 caffeinateManager.startNetworkMonitor();
 // 清理磁盘恢复后后端已不存在的 session 引用。
@@ -2522,10 +2544,10 @@ function getTmuxBinary() {
     }
     return 'tmux'; // fallback to PATH
 }
-async function runTmux(args) {
+async function runTmux(args, options) {
     const { stdout } = await execFileAsync(getTmuxBinary(), args, {
         timeout: 5000,
-        maxBuffer: 2 * 1024 * 1024,
+        maxBuffer: options?.maxBuffer ?? 2 * 1024 * 1024,
         env: buildInteractiveColorEnvironment(process.env),
     });
     return stdout;
@@ -3006,8 +3028,21 @@ async function getTmuxServerPid() {
 }
 function getTmuxRecoveryView() {
     const incident = tmuxRecoveryState.incident;
-    if (!incident)
-        return null;
+    const latestOperation = tmuxRecoveryOperations.latest();
+    if (!incident) {
+        if (!latestOperation || ['succeeded', 'partial_failure'].includes(latestOperation.state))
+            return null;
+        const sessions = latestOperation.items.flatMap(item => {
+            const record = globalSessionState.sessions.find(candidate => candidate.sessionId === item.sessionId);
+            const agent = record?.agentResume ? agentBySlug(record.agentResume.slug) : null;
+            if (!record?.tmuxSessionName || !record.cwd || !agent || !record.agentResume?.sessionId)
+                return [];
+            return [{ sessionId: record.sessionId, name: record.name, tmuxSessionName: record.tmuxSessionName,
+                    cwd: record.cwd, agentSlug: agent.slug, agentDisplayName: agent.displayName }];
+        });
+        return { id: latestOperation.incidentId, detectedAt: latestOperation.createdAt, operation: latestOperation, sessions };
+    }
+    const operation = latestOperation?.incidentId === incident.id ? latestOperation : null;
     const affected = new Set(incident.affectedSessionIds);
     const sessions = globalSessionState.sessions.flatMap((record) => {
         if (!affected.has(record.sessionId) || record.mode !== 'tmux' || !record.tmuxSessionName
@@ -3026,7 +3061,7 @@ function getTmuxRecoveryView() {
             }];
     });
     return sessions.length > 0
-        ? { id: incident.id, detectedAt: incident.detectedAt, sessions }
+        ? { id: incident.id, detectedAt: incident.detectedAt, operation, sessions }
         : null;
 }
 async function observeTmuxServerGeneration(liveTmuxSessions) {
@@ -4684,19 +4719,26 @@ async function resolveTmuxClientTty(sessionName, preferredClientPid) {
 }
 async function ensureTmuxSessionExists(sessionName, cwd) {
     let serverWasMissing = false;
+    let serverIsEmpty = false;
+    let sessionExists = false;
     try {
         await runTmux(['has-session', '-t', sessionName]);
-        await ensureTmuxColorEnvironment(sessionName);
-        return;
+        sessionExists = true;
     }
     catch (error) {
         const errorMessage = getErrorMessage(error);
         serverWasMissing = isTmuxServerMissingMessage(errorMessage);
         if (!isTmuxSessionMissingMessage(errorMessage)) {
-            throw error;
+            serverIsEmpty = await isConfirmedEmptyTmuxServer(error, sessionName, runTmux);
+            if (!serverIsEmpty)
+                throw error;
         }
     }
-    if (!serverWasMissing) {
+    if (sessionExists) {
+        await ensureTmuxColorEnvironment(sessionName);
+        return;
+    }
+    if (!serverWasMissing && !serverIsEmpty) {
         await ensureTmuxColorEnvironment();
     }
     const innerTerm = await resolveTmuxInnerTerm();
@@ -5928,7 +5970,7 @@ async function resolveShellIntegrationDir() {
 /**
  * Inject termdock shell integration via environment variables.
  *
- * This replaces the old injectShellTitleHooks with a full Ghostty-style
+ * This replaces the old injectShellTitleHooks with full shell
  * integration that emits OSC 133 (prompt marks), OSC 2 (title), and OSC 7 (cwd).
  *
  * Works for both shell mode (env passed to PTY spawn) and tmux mode
@@ -5948,7 +5990,7 @@ async function injectShellIntegration(shellPath, baseEnv) {
     }
     if (shellType === 'zsh') {
         // Create a temporary ZDOTDIR that sources user's zshenv/zshrc then
-        // sources our integration script. Same approach as Ghostty.
+        // sources our integration script. This preserves the user shell configuration.
         const zdotdir = '/tmp/termdock-zsh-' + String(process.pid);
         try {
             await fs.promises.mkdir(zdotdir, { recursive: true });
@@ -6112,74 +6154,202 @@ router.get('/tmux/status', async (_req, res) => {
     const status = await getTmuxStatus();
     res.json(status);
 });
-router.post('/tmux/recovery/restore-all', async (_req, res) => {
-    const incident = tmuxRecoveryState.incident;
-    if (!incident)
-        return res.status(404).json({ error: 'no tmux recovery is pending' });
-    const outcomes = [];
-    for (const frontendSessionId of incident.affectedSessionIds) {
-        const record = globalSessionState.sessions.find((session) => session.sessionId === frontendSessionId);
-        if (!record || record.mode !== 'tmux' || !record.tmuxSessionName || !record.cwd
-            || !record.agentResume?.sessionId) {
-            outcomes.push({ sessionId: frontendSessionId, restored: false, error: 'recovery metadata is incomplete' });
-            continue;
-        }
-        const agent = agentBySlug(record.agentResume.slug);
-        const command = agent
-            ? buildResumeCommand(agent, record.agentResume.sessionId, record.agentResume.launchArgv)
-            : null;
-        if (!agent || !command) {
-            outcomes.push({ sessionId: frontendSessionId, restored: false, error: 'Agent does not support resume' });
-            continue;
-        }
-        const target = {
-            slug: agent.slug,
-            nativeSessionId: record.agentResume.sessionId,
-            command,
-        };
-        const activeBackend = findActiveAgentResumeOwner('', target);
-        const activeWriterPid = activeBackend ? null : await findExternalCodexWriter(target);
-        if (activeBackend || activeWriterPid) {
-            outcomes.push({ sessionId: frontendSessionId, restored: true });
-            continue;
+async function restoreTmuxRecoverySession(operationId, frontendSessionId, reportPhase) {
+    const record = globalSessionState.sessions.find((session) => session.sessionId === frontendSessionId);
+    if (!record || record.mode !== 'tmux' || !record.tmuxSessionName || !record.cwd || !record.agentResume?.sessionId) {
+        throw Object.assign(new Error('Recovery metadata is incomplete'), { code: 'RECOVERY_METADATA_INCOMPLETE' });
+    }
+    const agent = agentBySlug(record.agentResume.slug);
+    const command = agent ? buildResumeCommand(agent, record.agentResume.sessionId, record.agentResume.launchArgv) : null;
+    if (!agent || !command)
+        throw Object.assign(new Error('Agent does not support exact resume'), { code: 'EXACT_RESUME_UNSUPPORTED' });
+    const target = { slug: agent.slug, nativeSessionId: record.agentResume.sessionId, command };
+    const activeBackend = findActiveAgentResumeOwner('', target);
+    const activeWriterPid = activeBackend ? null : await findExternalCodexWriter(target);
+    if (activeBackend || activeWriterPid)
+        return {};
+    await collaborationDeliveryWorker.reconfigure(frontendSessionId, () => tmuxLifecycle.run(`restore:${record.tmuxSessionName}`, async () => {
+        // Reconcile ownership again inside the per-terminal serialization fence.
+        if (findActiveAgentResumeOwner('', target) || await findExternalCodexWriter(target))
+            return;
+        reportPhase('runtime_resolving');
+        await prepareManagedTmuxSessionUnlocked(record.tmuxSessionName, record.cwd);
+        const metadata = await resolveLiveTmuxMetadata(record.tmuxSessionName);
+        const foreground = metadata?.program?.toLowerCase() ?? null;
+        if (foreground && !shellNamesBackend.has(foreground)) {
+            throw Object.assign(new Error(`pane is busy with ${foreground}`), { code: 'RECOVERY_TARGET_BUSY' });
         }
+        const previous = collaborationRouting.get(frontendSessionId);
+        if (previous)
+            collaborationRouting.bind({ ...previous, pane: null });
+        reportPhase('guard_captured');
+        const launchGuard = await beginAgentLaunchCheck(frontendSessionId, agent.slug, target.nativeSessionId);
         try {
-            await collaborationDeliveryWorker.reconfigure(frontendSessionId, () => tmuxLifecycle.run(`restore:${record.tmuxSessionName}`, async () => {
-                await prepareManagedTmuxSessionUnlocked(record.tmuxSessionName, record.cwd);
-                const metadata = await resolveLiveTmuxMetadata(record.tmuxSessionName);
-                const foreground = metadata?.program?.toLowerCase() ?? null;
-                if (foreground && !shellNamesBackend.has(foreground)) {
-                    throw new Error(`pane is busy with ${foreground}`);
-                }
-                // Explicit recovery may replace the vanished tmux pane. A pending
-                // message alone must never replace that binding.
-                const previous = collaborationRouting.get(frontendSessionId);
-                if (previous)
-                    collaborationRouting.bind({ ...previous, pane: null });
-                const launchGuard = await beginAgentLaunchCheck(frontendSessionId, agent.slug, target.nativeSessionId);
-                await writeAutomaticTerminalPrompt(frontendSessionId, command, undefined, launchGuard);
-            }));
-            outcomes.push({ sessionId: frontendSessionId, restored: true });
+            reportPhase('paste_submit');
+            await writeAutomaticTerminalPrompt(frontendSessionId, command, stage => reportPhase(stage), launchGuard);
         }
         catch (error) {
-            outcomes.push({ sessionId: frontendSessionId, restored: false, error: getErrorMessage(error) });
+            const message = getErrorMessage(error);
+            const reportedCode = error?.code;
+            const code = reportedCode === 'TERMINAL_INPUT_TARGET_CHANGED' || message.includes('TERMINAL_INPUT_TARGET_CHANGED')
+                ? 'TERMINAL_INPUT_TARGET_CHANGED' : 'RECOVERY_LAUNCH_FAILED';
+            throw Object.assign(new Error(message), { code, operationId, sessionId: frontendSessionId });
         }
+    }));
+    const incident = tmuxRecoveryState.incident;
+    if (incident?.affectedSessionIds.includes(frontendSessionId)) {
+        const remaining = incident.affectedSessionIds.filter(id => id !== frontendSessionId);
+        tmuxRecoveryState.incident = remaining.length ? { ...incident, affectedSessionIds: remaining } : null;
+        await persistTmuxRecoveryState();
     }
-    const restoredIds = new Set(outcomes.filter((outcome) => outcome.restored).map((outcome) => outcome.sessionId));
-    const remaining = incident.affectedSessionIds.filter((sessionId) => !restoredIds.has(sessionId));
-    tmuxRecoveryState.incident = remaining.length > 0
-        ? { ...incident, affectedSessionIds: remaining }
-        : null;
-    await persistTmuxRecoveryState();
-    latestSessionInventoryAt = 0;
-    broadcastClientState();
-    res.status(remaining.length > 0 ? 207 : 200).json({
-        restored: restoredIds.size,
-        failed: remaining.length,
-        outcomes,
+    const paneTty = await runTmux(['display-message', '-p', '-t', record.tmuxSessionName, '#{pane_tty}']).catch(() => '');
+    const normalizedTty = paneTty.trim().replace(/^\/dev\//, '');
+    if (normalizedTty) {
+        const resources = await collectHostResourceSnapshot();
+        const rows = resources.processRows.filter(row => row.tty === normalizedTty);
+        if (rows.some(row => row.agent))
+            return { actualRssBytes: rows.reduce((sum, row) => sum + row.rssBytes, 0) };
+    }
+    return {};
+}
+async function resolveTmuxRecoveryScope(scope, incident) {
+    const candidates = incident.affectedSessionIds;
+    if (scope.kind === 'incident')
+        return candidates;
+    if (scope.kind === 'sessions') {
+        if (!Array.isArray(scope.sessionIds) || scope.sessionIds.length === 0)
+            throw Object.assign(new Error('sessionIds must be a non-empty array'), { code: 'INVALID_RECOVERY_SCOPE' });
+        if (scope.sessionIds.some(id => !candidates.includes(id)))
+            throw Object.assign(new Error('Explicit scope may only include sessions in the current recovery incident'), { code: 'RECOVERY_SCOPE_OUTSIDE_INCIDENT' });
+        return [...new Set(scope.sessionIds)];
+    }
+    if (!scope.id)
+        throw Object.assign(new Error('scope id is required'), { code: 'INVALID_RECOVERY_SCOPE' });
+    if (scope.kind === 'group') {
+        const group = collaborationStore.getGroup(scope.id);
+        if (!group || group.deleted)
+            throw Object.assign(new Error('Collaboration group was not found'), { code: 'RECOVERY_GROUP_NOT_FOUND' });
+        return candidates.filter(id => group.sessionIds.includes(id));
+    }
+    const integrationRoot = `${TERMDOCK_DIR}/integration-state`;
+    const portDirectories = await fs.promises.readdir(integrationRoot, { withFileTypes: true }).catch(() => []);
+    const memberIds = new Set();
+    for (const directory of portDirectories.filter(item => item.isDirectory())) {
+        const state = await readJsonFileIfExists(path.join(integrationRoot, directory.name, 'integration-sessions.json'));
+        for (const item of state?.sessions ?? [])
+            if (item.principal_id === scope.id && typeof item.session_id === 'string')
+                memberIds.add(item.session_id);
+    }
+    return candidates.filter(id => memberIds.has(id));
+}
+tmuxRecoveryOperations.setRunner(restoreTmuxRecoverySession);
+const tmuxAgentResourceBudget = configuredAgentResourceBudget();
+tmuxRecoveryOperations.setAdmission(async (_operationId, sessionId) => {
+    try {
+        const snapshot = await collectHostResourceSnapshot();
+        const group = collaborationStore.list().find(item => item.sessionIds.includes(sessionId));
+        let residentAgentsInGroup = 0;
+        if (group) {
+            const rows = globalSessionState.sessions.filter(item => group.sessionIds.includes(item.sessionId) && item.agentResume && item.tmuxSessionName);
+            const liveSessions = await listLiveTmuxInventorySessions();
+            const liveAgents = new Set(liveSessions.filter(item => item.program && agentBySlug(item.program) !== null).map(item => item.name));
+            residentAgentsInGroup = rows.filter(item => liveAgents.has(item.tmuxSessionName)).length;
+            const memberIds = new Set(group.sessionIds);
+            residentAgentsInGroup += tmuxRecoveryOperations.all().flatMap(operation => operation.items)
+                .filter(item => item.state === 'running' && memberIds.has(item.sessionId)).length;
+        }
+        const result = assessAgentResourceBudget({ snapshot: { ...snapshot, residentAgentCount: snapshot.residentAgentCount + tmuxRecoveryOperations.stats().activeLaunches }, budget: tmuxAgentResourceBudget, residentAgentsInGroup });
+        return { ...result, memAvailableBytes: snapshot.memoryAvailableBytes, estimatedRssBytes: tmuxAgentResourceBudget.estimatedRssBytes };
+    }
+    catch {
+        return { admitted: false, reason: 'RESOURCE_SNAPSHOT_UNAVAILABLE', estimatedRssBytes: tmuxAgentResourceBudget.estimatedRssBytes };
+    }
+});
+const TMUX_RECOVERY_HEALTH_FILE = `${TERMDOCK_DIR}/tmux-recovery-health.json`;
+let latestTmuxRecoveryHealth = null;
+let tmuxRecoveryHealthSampling = false;
+async function sampleTmuxRecoveryHealth() {
+    if (tmuxRecoveryHealthSampling)
+        return;
+    tmuxRecoveryHealthSampling = true;
+    try {
+        const snapshot = await collectHostResourceSnapshot();
+        const diagnostics = {
+            sampledAt: snapshot.sampledAt,
+            platform: snapshot.platform,
+            memoryAvailableBytes: snapshot.memoryAvailableBytes,
+            memoryTotalBytes: snapshot.memoryTotalBytes,
+            memorySnapshotAvailable: snapshot.memorySnapshotAvailable,
+            processSnapshotAvailable: snapshot.processSnapshotAvailable,
+            memoryPressure: snapshot.memoryPressure,
+            kswapd: snapshot.kswapd,
+            dStateProcessCount: snapshot.dStateProcessCount,
+            residentAgentCount: snapshot.residentAgentCount,
+            residentAgentRssBytes: snapshot.residentAgentRssBytes,
+            browserProcessCount: snapshot.browserProcessCount,
+            recovery: tmuxRecoveryOperations.stats(),
+            resourceBudget: tmuxAgentResourceBudget,
+        };
+        latestTmuxRecoveryHealth = diagnostics;
+        const temporaryPath = `${TMUX_RECOVERY_HEALTH_FILE}.${process.pid}.tmp`;
+        await fs.promises.writeFile(temporaryPath, JSON.stringify(diagnostics, null, 2), { mode: 0o600 });
+        await fs.promises.rename(temporaryPath, TMUX_RECOVERY_HEALTH_FILE);
+    }
+    catch (error) {
+        console.warn('[tmux-recovery] resource health sample failed:', getErrorMessage(error));
+    }
+    finally {
+        tmuxRecoveryHealthSampling = false;
+    }
+}
+router.get('/tmux/recovery/diagnostics', async (_req, res) => {
+    await sampleTmuxRecoveryHealth();
+    return res.json({ health: latestTmuxRecoveryHealth, operation: tmuxRecoveryOperations.latest(), concurrencyLimit: tmuxRecoveryConcurrencyLimit });
+});
+router.post('/tmux/recovery/restore-all', async (req, res) => {
+    const incident = tmuxRecoveryState.incident;
+    if (!incident)
+        return res.status(404).json({ error: 'no tmux recovery is pending' });
+    const rawScope = req.body?.scope;
+    let scope = { kind: 'incident' };
+    if (rawScope !== undefined) {
+        if (!rawScope || !['incident', 'group', 'principal', 'sessions'].includes(rawScope.kind))
+            return res.status(400).json({ error: 'invalid recovery scope' });
+        scope = rawScope;
+    }
+    const sessionIds = await resolveTmuxRecoveryScope(scope, incident).catch(error => {
+        res.status(400).json({ error: getErrorMessage(error), code: error.code ?? 'INVALID_RECOVERY_SCOPE' });
+        return null;
     });
+    if (!sessionIds)
+        return;
+    try {
+        const operation = await tmuxRecoveryOperations.create({ incidentId: incident.id, sessionIds, scope,
+            idempotencyKey: String(req.body?.idempotencyKey ?? req.headers['idempotency-key'] ?? ''),
+            ...(req.body?.concurrency !== undefined ? { concurrency: Number(req.body.concurrency) } : {}) });
+        res.status(202).json({ accepted: true, operation_id: operation.id, operation: tmuxRecoveryOperations.get(operation.id) });
+    }
+    catch (error) {
+        res.status(409).json({ error: getErrorMessage(error), code: error.code ?? 'RECOVERY_OPERATION_FAILED', operation_id: error.operationId });
+    }
+});
+router.get('/tmux/recovery/operations', (_req, res) => res.json({ operations: tmuxRecoveryOperations.all().slice(-50) }));
+router.get('/tmux/recovery/operations/:id', (req, res) => {
+    const operation = tmuxRecoveryOperations.get(req.params.id);
+    return operation ? res.json({ operation }) : res.status(404).json({ error: 'recovery operation not found' });
+});
+router.post('/tmux/recovery/operations/:id/pause', async (req, res) => {
+    const operation = await tmuxRecoveryOperations.pause(req.params.id);
+    return operation ? res.json({ operation }) : res.status(404).json({ error: 'recovery operation not found' });
+});
+router.post('/tmux/recovery/operations/:id/resume', async (req, res) => {
+    const operation = await tmuxRecoveryOperations.resume(req.params.id);
+    return operation ? res.json({ operation }) : res.status(404).json({ error: 'recovery operation not found' });
 });
 router.delete('/tmux/recovery', async (_req, res) => {
+    if (tmuxRecoveryOperations.all().some(operation => !['succeeded', 'partial_failure'].includes(operation.state))) {
+        return res.status(409).json({ error: 'a recovery operation is active; pause or finish it before dismissing the incident', code: 'RECOVERY_OPERATION_ACTIVE' });
+    }
     tmuxRecoveryState.dismissedSessionIds = Array.from(new Set([
         ...tmuxRecoveryState.dismissedSessionIds,
         ...(tmuxRecoveryState.incident?.affectedSessionIds ?? []),
@@ -8306,7 +8476,10 @@ router.post('/:sessionId/input', express.text({ type: '*/*' }), (req, res) => {
     }
     const data = typeof req.body === 'string' ? req.body : '';
     try {
-        session.ptyProcess.write(data);
+        const paste = new TerminalPasteBuffer(() => { });
+        const parts = paste.complete(data);
+        for (const part of parts)
+            session.ptyProcess.write(part);
         session.lastActivity = Date.now();
         res.json({ success: true });
     }
@@ -8475,7 +8648,7 @@ router.post('/:sessionId/tmux', async (req, res) => {
             broadcastEvent(sessionId, { type: 'tmux-layout', layout });
             return res.json({ success: true, layout });
         }
-        return res.json({ success: true });
+        return res.json({ success: true, ...(result.selection ? { selection: result.selection } : {}) });
     }
     catch (error) {
         const errorMessage = getErrorMessage(error);
@@ -8570,6 +8743,10 @@ router.post('/force-kill', (req, res) => {
 async function executeTmuxAction(tmuxTarget, action, body, control) {
     let shouldBroadcastLayout = true;
     switch (action) {
+        case 'copy-selection': {
+            const selection = await copyTmuxSelection(tmuxTarget, runTmux);
+            return { shouldBroadcastLayout: false, selection };
+        }
         case 'select-pane': {
             const paneId = typeof body.paneId === 'string' ? body.paneId : '';
             if (!paneId)
@@ -8960,6 +9137,12 @@ export function handleTerminalWebSocket(ws, sessionId, clientId, options = {}, i
         if (ws.readyState === ws.OPEN)
             ws.send(JSON.stringify(event));
     });
+    const pasteInput = new TerminalPasteBuffer(error => {
+        if (ws.readyState === ws.OPEN) {
+            ws.send(JSON.stringify({ type: 'error', error }));
+            ws.close(1008, 'Incomplete terminal paste');
+        }
+    });
     // Handle client → server messages
     ws.on('message', async (raw) => {
         const messageReceivedAt = performance.now();
@@ -8974,20 +9157,30 @@ export function handleTerminalWebSocket(ws, sessionId, clientId, options = {}, i
             switch (msg.type) {
                 case 'input': {
                     if (typeof msg.data === 'string' && msg.data.length > 0) {
-                        const data = msg.data;
-                        if (attachment) {
-                            session.lastActivity = Date.now();
-                            attachment.write(data);
+                        let parts;
+                        try {
+                            parts = pasteInput.push(msg.data);
+                        }
+                        catch (error) {
+                            ws.send(JSON.stringify({ type: 'error', error: getErrorMessage(error) }));
+                            ws.close(1008, 'Invalid terminal paste');
+                            return;
                         }
-                        else if (session.mode === 'tmux') {
-                            await enqueueTmuxIo(session, async () => {
+                        for (const data of parts) {
+                            if (attachment) {
+                                session.lastActivity = Date.now();
+                                attachment.write(data);
+                            }
+                            else if (session.mode === 'tmux') {
+                                await enqueueTmuxIo(session, async () => {
+                                    session.lastActivity = Date.now();
+                                    session.ptyProcess.write(data);
+                                });
+                            }
+                            else {
                                 session.lastActivity = Date.now();
                                 session.ptyProcess.write(data);
-                            });
-                        }
-                        else {
-                            session.lastActivity = Date.now();
-                            session.ptyProcess.write(data);
+                            }
                         }
                     }
                     break;
@@ -9055,8 +9248,14 @@ export function handleTerminalWebSocket(ws, sessionId, clientId, options = {}, i
                     }
                     const result = await enqueueTmuxIo(session, async () => {
                         return executeTmuxAction(session.tmuxSessionName, msg.action, msg, session.tmuxControl);
+                    }).catch((error) => {
+                        // A correlated copy failure must settle this socket's request, not
+                        // become an unrelated terminal error followed by a 30-second wait.
+                        if (msg.action !== 'copy-selection')
+                            throw error;
+                        return { shouldBroadcastLayout: false, error: getErrorMessage(error) || 'Tmux selection copy failed' };
                     });
-                    ws.send(JSON.stringify({ type: 'tmux-result', reqId, success: !result.error, error: result.error }));
+                    ws.send(JSON.stringify({ type: 'tmux-result', reqId, success: !result.error, error: result.error, ...(result.selection ? { selection: result.selection } : {}) }));
                     if (result.shouldBroadcastLayout && session.tmuxSessionName) {
                         try {
                             const layout = await getTmuxLayout(session.tmuxSessionName);
@@ -9154,6 +9353,7 @@ export function handleTerminalWebSocket(ws, sessionId, clientId, options = {}, i
     });
     // Cleanup on close
     ws.on('close', () => {
+        pasteInput.clear();
         initialScreen?.cancel();
         initialScreen = null;
         attachment?.close();