webtun 1.4.3 → 1.4.6

package/README.md

@@ -6,7 +6,7 @@
 ![Desktop](https://img.shields.io/badge/Desktop-Electron-47848F?style=for-the-badge)
 ![License](https://img.shields.io/badge/License-MIT-green?style=for-the-badge)
 
-**Access your Linux server from any browser — no VPN, no SSH client, no installing anything.**
+**Access your server from any browser — no VPN, no SSH client, no installing anything.**
 
 [![Quick Start](https://img.shields.io/badge/Quick_Start-One_Command-2D5B8E?style=for-the-badge&logo=gnu-bash)](install.sh)
 [![Download](https://img.shields.io/github/v/release/unn-known1/webtun?style=for-the-badge&logo=github)](https://github.com/unn-known1/webtun/releases/latest)
@@ -97,6 +97,17 @@ webtun
 | `--help` | Show help |
 | `--version` | Show version |
 
+**Environment Variables:**
+| Variable | Description |
+|----------|-------------|
+| `PORT` | Server port (default: 3000) |
+| `HOST` | Bind address (default: 0.0.0.0) |
+| `PIN` | Authentication PIN (empty = no auth) |
+| `SHELL` | Shell to use (default: PowerShell on Windows, bash/sh elsewhere) |
+| `WORKSPACE_ROOT` | Root directory for file operations (default: ~) |
+| `TRUST_PROXY` | Set to `true` if behind a reverse proxy (default: loopback only) |
+| `WEBTUN_SHELL` | Override shell on Windows (e.g., `/usr/bin/bash` for Git Bash) |
+
 **Examples:**
 ```bash
 npx webtun                        # Start on port 3000
@@ -148,35 +159,35 @@ npm start
 ## Architecture
 
 ```
-┌─────────────────────────────────────────────────────────────┐
-│                      Your Browser                           │
-│  ┌─────────┐  ┌──────────┐  ┌────────────┐  ┌────────────┐  │
-│  │Terminal │  │  File    │  │   Tunnel   │  │  Settings  │  │
-│  │ (xterm) │  │ Explorer │  │   Manager  │  │   Panel    │  │
-│  └────┬────┘  └────┬─────┘  └──────┬─────┘  └─────┬──────┘  │
-│       │            │               │              │         │
-└───────┼────────────┼───────────────┼──────────────┼─────────┘
-        │ WebSocket  │               │              │
-        ▼            ▼               ▼              │
-┌─────────────────────────────────────────────────────────────┐
-│                      Node.js Server                         │
-│  ┌────────────┐  ┌─────────────┐  ┌────────────────────┐    │
-│  │  WebSocket │  │   File API  │  │ Cloudflare Tunnel   │    │
-│  │  Handler   │  │ (read/write)│  │     Manager        │    │
-│  └─────┬──────┘  └──────┬──────┘  └─────────┬──────────┘    │
-│        │                │                   │               │
-│        ▼                ▼                   ▼               │
-│  ┌─────────┐  ┌────────────────┐  ┌──────────────────────┐  │
-│  │ node-pty│  │Local Filesystem│  │ cloudflared daemon    │  │
-│  │ (shell) │  │(your server)   │  │ (exposes to internet)│  │
-│  └─────────┘  └────────────────┘  └──────────────────────┘  │
-└─────────────────────────────────────────────────────────────┘
-                            │
-                            ▼
-                    ┌─────────────────┐
-                    │  Internet Users │
-                    │  (HTTPS URL)    │
-                    └─────────────────┘
+┌────────────────────────────────────────────────────────────────┐
+│                        Your Browser                            │
+│  ┌──────────┐  ┌───────────┐  ┌─────────────┐  ┌───────────┐   │
+│  │ Terminal │  │   File    │  │   Tunnel    │  │  Settings │   │
+│  │  (xterm) │  │ Explorer  │  │   Manager   │  │   Panel   │   │
+│  └─────┬────┘  └─────┬─────┘  └──────┬──────┘  └─────┬─────┘   │
+│        │             │               │               │         │
+└────────┼─────────────┼───────────────┼───────────────┼─────────┘
+         │  WebSocket  │  REST API     │               │
+         ▼             ▼               ▼               │
+┌────────────────────────────────────────────────────────────────┐
+│                       Node.js Server                           │
+│  ┌─────────────┐  ┌──────────────┐  ┌───────────────────────┐  │
+│  │  WebSocket  │  │   File API   │  │  Cloudflare Tunnel    │  │
+│  │   Handler   │  │ (read/write) │  │      Manager          │  │
+│  └──────┬──────┘  └──────┬───────┘  └───────────┬───────────┘  │
+│         │                │                      │              │
+│         ▼                ▼                      ▼              │
+│  ┌──────────┐  ┌──────────────────┐  ┌──────────────────────┐  │
+│  │ node-pty │  │ Local Filesystem │  │ cloudflared daemon   │  │
+│  │  (shell) │  │ (your server)    │  │ (exposes to internet)│  │
+│  └──────────┘  └──────────────────┘  └──────────────────────┘  │
+└────────────────────────────────────────────────────────────────┘
+                               │
+                               ▼
+                      ┌─────────────────┐
+                      │  Internet Users │
+                      │  (HTTPS URL)    │
+                      └─────────────────┘
 ```
 
 ---
@@ -231,6 +242,9 @@ kill $(pgrep -f 'cloudflared tunnel')
 | Permission denied on shell | Ensure user has shell access: `chsh -s /bin/bash` |
 | File upload fails | Check `public/uploads/` permissions: `chmod 755 public/uploads/` |
 | Port 3000 in use | Change port: `PORT=3001 npm start` |
+| Windows terminal opens PowerShell instead of Git Bash | Set `WEBTUN_SHELL=/usr/bin/bash` in `.env` |
+| Behind reverse proxy, wrong client IP | Set `TRUST_PROXY=true` in `.env` |
+| Tunnel persists after server restart | Tunnels are auto-managed; manual cleanup: `kill $(pgrep -f 'cloudflared tunnel')` |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webtun",
-  "version": "1.4.3",
+  "version": "1.4.6",
   "description": "Self-hosted web terminal with Cloudflare Tunnel, file explorer, and PWA support",
   "author": {
     "name": "Gaurang Patel",

package/postinstall.js

@@ -135,7 +135,7 @@ async function main() {
     if (!downloadWithCurlOrWget()) {
       console.log('  cloudflared install failed (download error) — skipping');
       cleanup();
-      process.exit(0);
+      return;
     }
   }
 
@@ -149,12 +149,12 @@ async function main() {
     if (/^<!doctype\s+html/i.test(head) || /^<html/i.test(head)) {
       console.log('  cloudflared install failed (downloaded file is not a binary) — skipping');
       cleanup();
-      process.exit(0);
+      return;
     }
   } catch (e) {
     console.log('  cloudflared install failed (cannot validate download): ' + e.message);
     cleanup();
-    process.exit(0);
+    return;
   }
 
   function installBin(src, dest) {

package/public/index.html

@@ -14,6 +14,8 @@
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-fit@0.10.0/lib/addon-fit.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-search@0.15.0/lib/addon-search.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-web-links@0.11.0/lib/addon-web-links.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@xterm/addon-unicode11@0.7.0/lib/addon-unicode11.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@xterm/addon-webgl@0.18.1/lib/addon-webgl.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/marked@15.0.7/marked.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/dompurify@3.2.4/dist/purify.min.js"></script>
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/codemirror@5.65.18/lib/codemirror.min.css">
@@ -166,6 +168,8 @@ svg { display: block; }
 .term-wrapper.active { display: flex; }
 .xterm { flex: 1; }
 .xterm-viewport { border-radius: 0; }
+.term-bell-flash { animation: bellFlash 0.15s ease-out; }
+@keyframes bellFlash { 0% { filter: brightness(1.8); } 100% { filter: brightness(1); } }
 #terminals.tiles-mode { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); grid-auto-rows: 1fr; gap: 4px; padding: 4px; position: relative; overflow: auto; min-height: 0; overscroll-behavior: none; }
 #terminals.tiles-mode .term-wrapper { position: relative; inset: unset; display: flex; flex-direction: column; border: 1px solid var(--border); border-radius: var(--radius); overflow: hidden; min-height: 150px; }
 #terminals.tiles-mode .term-wrapper.active { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
@@ -546,13 +550,18 @@ svg { display: block; }
 /* ═══════════════════════════════════════════════════════
     CONTEXT MENU
    ═══════════════════════════════════════════════════════ */
-#ctx-menu { position: fixed; background: var(--bg2); border: 1px solid var(--border); border-radius: var(--radius); box-shadow: 0 4px 20px var(--shadow-color); z-index: 500; display: none; min-width: 160px; overflow: hidden; }
+#ctx-menu { position: fixed; background: var(--bg2); border: 1px solid var(--border); border-radius: var(--radius); box-shadow: 0 4px 20px var(--shadow-color); z-index: 500; display: none; min-width: 160px; overflow: hidden; max-height: calc(100vh - 16px); overflow-y: auto; }
 @media (max-width: 360px) { #ctx-menu { min-width: 140px; max-width: calc(100vw - 16px); font-size: 11px; } }
 #ctx-menu.open { display: block; }
 .ctx-item { padding: 8px 14px; font-size: 12px; cursor: pointer; display: flex; align-items: center; gap: 8px; }
 .ctx-item:hover { background: var(--bg4); }
 .ctx-sep { height: 1px; background: var(--border); margin: 3px 0; }
 .ctx-item.danger { color: var(--red); }
+.ctx-submenu-wrap { }
+.ctx-submenu-arrow { margin-left: auto; font-size: 10px; color: var(--fg3); transition: transform 0.15s; }
+.ctx-submenu-wrap.open > .ctx-item > .ctx-submenu-arrow { transform: rotate(90deg); }
+.ctx-submenu-items { display: none; }
+.ctx-submenu-wrap.open > .ctx-submenu-items { display: block; }
 
 /* ═══════════════════════════════════════════════════════
    TOAST
@@ -656,8 +665,65 @@ svg { display: block; }
 #cmd-lib-search {
   width: calc(100% - 28px); height: 28px; font-size: 12px; margin: 8px 14px 0;
 }
+.cmd-lib-tabs {
+  display: flex; gap: 0; border-bottom: 1px solid var(--border); flex-shrink: 0;
+}
+.cmd-lib-tab {
+  flex: 1; height: 32px; font-size: 12px; font-weight: 600; color: var(--fg2);
+  background: none; border: none; border-bottom: 2px solid transparent;
+  cursor: pointer; transition: all var(--transition-fast);
+  display: flex; align-items: center; justify-content: center; gap: 5px;
+}
+.cmd-lib-tab:hover { color: var(--fg); background: var(--bg3); }
+.cmd-lib-tab.active { color: var(--accent); border-bottom-color: var(--accent); }
+#cmd-hist-list {
+  flex: 1; overflow-y: auto; overflow-x: hidden; padding: 6px; min-height: 0;
+  display: none; flex-direction: column; gap: 2px;
+}
+#cmd-hist-empty {
+  text-align: center; color: var(--fg2); padding: 24px 16px; font-size: 12px;
+}
+.cmd-hist-item {
+  display: flex; align-items: center; gap: 8px; padding: 6px 10px;
+  border-radius: var(--radius-sm); cursor: default; font-size: 12px;
+  transition: background var(--transition-fast);
+}
+.cmd-hist-item:hover { background: var(--bg4); }
+.cmd-hist-item .cmd-hist-cmd {
+  flex: 1; color: var(--fg); font-family: var(--font); overflow: hidden;
+  text-overflow: ellipsis; white-space: nowrap;
+}
+.cmd-hist-item .cmd-hist-time {
+  font-size: 10px; color: var(--fg3); flex-shrink: 0;
+}
+.cmd-hist-item .cmd-hist-run {
+  width: 24px; height: 24px; display: none; align-items: center; justify-content: center;
+  border-radius: var(--radius-sm); color: var(--fg2); flex-shrink: 0; cursor: pointer;
+}
+.cmd-hist-item:hover .cmd-hist-run { display: flex; }
+.cmd-hist-item .cmd-hist-run:hover { background: var(--bg4); color: var(--green); }
+.cmd-hist-item .cmd-hist-del {
+  width: 24px; height: 24px; display: none; align-items: center; justify-content: center;
+  border-radius: var(--radius-sm); color: var(--fg2); flex-shrink: 0; cursor: pointer;
+}
+.cmd-hist-item:hover .cmd-hist-del { display: flex; }
+.cmd-hist-item .cmd-hist-del:hover { color: var(--red); background: var(--bg4); }
+.cmd-hist-header {
+  display: flex; align-items: center; justify-content: space-between;
+  padding: 6px 10px; flex-shrink: 0;
+}
+.cmd-hist-header label { font-size: 11px; color: var(--fg2); display: flex; align-items: center; gap: 4px; }
+.cmd-hist-header input[type="number"] {
+  width: 52px; height: 22px; font-size: 11px; padding: 0 4px; text-align: center;
+}
+.cmd-hist-clear {
+  font-size: 11px; color: var(--red); background: none; border: none; cursor: pointer;
+  padding: 2px 6px; border-radius: var(--radius-sm);
+}
+.cmd-hist-clear:hover { background: var(--bg4); }
 #cmd-lib-list {
-  flex: 1; overflow-y: auto; padding: 6px; min-height: 0;
+  flex: 1; overflow-y: auto; overflow-x: hidden; padding: 6px; min-height: 0;
+  display: flex; flex-direction: column; gap: 2px;
 }
 #cmd-lib-empty {
   text-align: center; color: var(--fg2); padding: 24px 16px; font-size: 12px;
@@ -953,8 +1019,19 @@ svg { display: block; }
               <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
             </button>
           </div>
+          <div class="cmd-lib-tabs">
+            <button class="cmd-lib-tab active" id="cmd-tab-lib" onclick="switchCmdTab('library')">Library</button>
+            <button class="cmd-lib-tab" id="cmd-tab-hist" onclick="switchCmdTab('history')">History</button>
+          </div>
           <input id="cmd-lib-search" type="text" placeholder="Filter commands…" oninput="filterCmdLib()">
           <div id="cmd-lib-list"></div>
+          <div id="cmd-hist-list">
+            <div id="cmd-hist-empty">No commands run yet</div>
+          </div>
+          <div class="cmd-hist-header" id="cmd-hist-header" style="display:none">
+            <label>Keep last <input type="number" id="cmd-hist-max" min="10" max="500" value="50" onchange="updateHistMax(+this.value)"> cmds</label>
+            <button class="cmd-hist-clear" onclick="clearCmdHist()">Clear History</button>
+          </div>
           <div id="cmd-lib-footer">
             <input id="cmd-lib-name-input" type="text" placeholder="Name" onkeydown="if(event.key==='Enter')document.getElementById('cmd-lib-cmd-input').focus()">
             <input id="cmd-lib-cmd-input" type="text" placeholder="Command (e.g. ls -la)" onkeydown="if(event.key==='Enter')addCustomCmd()">
@@ -1193,6 +1270,40 @@ svg { display: block; }
   <div class="ctx-item danger" id="ctx-delete" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/><line x1="10" y1="11" x2="10" y2="17"/><line x1="14" y1="11" x2="14" y2="17"/></svg> Delete</div>
 </div>
 
+<!-- Terminal context menu -->
+<div id="term-ctx-menu" role="menu" style="position:fixed;background:var(--bg2);border:1px solid var(--border);border-radius:var(--radius);box-shadow:0 4px 20px var(--shadow-color);z-index:500;display:none;min-width:180px;overflow:hidden">
+  <!-- Clipboard -->
+  <div class="ctx-item" id="term-ctx-copy" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="9" y="9" width="13" height="13" rx="2"/><path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1"/></svg> Copy</div>
+  <div class="ctx-item" id="term-ctx-paste" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="14" y="2" width="8" height="8" rx="2"/><path d="M16 14H8M8 18h8"/><path d="M5 4h4"/><rect x="2" y="6" width="16" height="16" rx="2"/></svg> Paste</div>
+  <div class="ctx-sep"></div>
+  <div class="ctx-item" id="term-ctx-select-all" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="3" width="18" height="18" rx="2"/><path d="M9 3v18"/><path d="M15 3v18"/><path d="M3 9h18"/><path d="M3 15h18"/></svg> Select All</div>
+  <!-- Tab / Path -->
+  <div class="ctx-sep"></div>
+  <div class="ctx-item" id="term-ctx-new-tab" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><line x1="12" y1="5" x2="12" y2="19"/><line x1="5" y1="12" x2="19" y2="12"/></svg> New Tab Here</div>
+  <div class="ctx-item" id="term-ctx-copy-cwd" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="9" y="9" width="13" height="13" rx="2"/><path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1"/></svg> Copy Working Directory</div>
+  <!-- Control -->
+  <div class="ctx-sep"></div>
+  <div class="ctx-item" id="term-ctx-interrupt" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="3" width="18" height="18" rx="2"/><line x1="9" y1="9" x2="15" y2="15"/><line x1="15" y1="9" x2="9" y2="15"/></svg> Interrupt (Ctrl+C)</div>
+  <!-- More Options -->
+  <div class="ctx-sep"></div>
+  <div class="ctx-submenu-wrap">
+    <div class="ctx-item" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="1"/><circle cx="12" cy="5" r="1"/><circle cx="12" cy="19" r="1"/></svg> More Options<span class="ctx-submenu-arrow">▸</span></div>
+    <div class="ctx-submenu-items">
+      <div class="ctx-item" id="term-ctx-find" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="8"/><line x1="21" y1="21" x2="16.65" y2="16.65"/></svg> Find in Terminal</div>
+      <div class="ctx-item" id="term-ctx-zoom-in" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="8"/><line x1="21" y1="21" x2="16.65" y2="16.65"/><line x1="11" y1="8" x2="11" y2="14"/><line x1="8" y1="11" x2="14" y2="11"/></svg> Zoom In</div>
+      <div class="ctx-item" id="term-ctx-zoom-out" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="8"/><line x1="21" y1="21" x2="16.65" y2="16.65"/><line x1="8" y1="11" x2="14" y2="11"/></svg> Zoom Out</div>
+      <div class="ctx-item" id="term-ctx-select-line" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><line x1="3" y1="12" x2="21" y2="12"/></svg> Select Line</div>
+      <div class="ctx-item" id="term-ctx-scroll-top" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="18 15 12 9 6 15"/></svg> Scroll to Top</div>
+      <div class="ctx-item" id="term-ctx-scroll-bottom" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="6 9 12 15 18 9"/></svg> Scroll to Bottom</div>
+      <div class="ctx-item" id="term-ctx-rename" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M17 3a2.85 2.83 0 1 1 4 4L7.5 20.5 2 22l1.5-5.5Z"/><path d="m15 5 4 4"/></svg> Rename Tab</div>
+      <div class="ctx-item" id="term-ctx-bookmark" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M19 21l-7-5-7 5V5a2 2 0 0 1 2-2h10a2 2 0 0 1 2 2z"/></svg> Bookmark Directory</div>
+    </div>
+  </div>
+  <!-- Danger -->
+  <div class="ctx-sep"></div>
+  <div class="ctx-item danger" id="term-ctx-clear" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="3" width="18" height="18" rx="2"/><path d="M3 9h18"/></svg> Clear</div>
+</div>
+
 <!-- Fuzzy Finder Modal -->
 <div class="overlay" id="finder-overlay">
   <div class="modal modal-md" style="padding:12px">
@@ -1362,6 +1473,7 @@ let settings = {
   cursor: 'block', blink: true, scrollback: 5000, bell: false,
   mobilekeys: false, confirmclose: true, datasaver: false, autostart: false, keepAwake: false
 };
+let serverPlatform = '';
 
 const isElectron = !!(window.electronAPI && window.electronAPI.isElectron);
 
@@ -1471,6 +1583,7 @@ async function unlockApp() {
   const info = await api('/api/home');
   homeDir = info.home;
   currentPath = homeDir;
+  serverPlatform = info.platform || '';
   document.getElementById('hostname-badge').textContent = info.hostname || '—';
 
   // Check tmux availability
@@ -1789,6 +1902,25 @@ function connectWebSocket(tab, isReconnect = false) {
 
   const sendInput = data => {
     if (ws.readyState !== WebSocket.OPEN) return;
+    // On Enter, read command from terminal screen buffer (avoids echo-back pollution)
+    for (let i = 0; i < data.length; i++) {
+      const ch = data.charCodeAt(i);
+      if (ch === 13 || ch === 10) { // Enter
+        try {
+          const buf = tab.term.buffer.active;
+          const line = buf.getLine(buf.baseY + buf.cursorY);
+          if (line) {
+            let text = line.translateToString(true).trim();
+            // Strip prompt prefix: find last $ # or % and take text after it
+            const promptEnd = Math.max(text.lastIndexOf('$'), text.lastIndexOf('#'), text.lastIndexOf('%'));
+            if (promptEnd >= 0 && promptEnd < text.length - 1) {
+              text = text.substring(promptEnd + 1).trim();
+            }
+            if (text) addToCmdHist(text);
+          }
+        } catch {}
+      }
+    }
     const enc = new TextEncoder().encode(data);
     const buf = new Uint8Array(1 + enc.length);
     buf[0] = 0x00; buf.set(enc, 1);
@@ -1819,10 +1951,77 @@ function connectWebSocket(tab, isReconnect = false) {
     setupVisualViewport();
   };
 
+  // OSC sequence handler: intercepts OSC 7, 133, 52 before passing to xterm.js
+  let oscBuf = '';
+  function processTerminalOutput(data) {
+    const str = typeof data === 'string' ? data : new TextDecoder().decode(data);
+    let out = '';
+    let i = 0;
+    while (i < str.length) {
+      // Look for ESC ] (OSC introducer)
+      if (str[i] === '\x1b' && str[i + 1] === ']') {
+        const endIdx = str.indexOf('\x07', i + 2);
+        const stIdx = str.indexOf('\x1b\\', i + 2);
+        let oscEnd = -1;
+        if (endIdx !== -1 && (stIdx === -1 || endIdx < stIdx)) oscEnd = endIdx;
+        else if (stIdx !== -1) oscEnd = stIdx;
+
+        if (oscEnd !== -1) {
+          const oscData = str.substring(i + 2, oscEnd);
+          const semi = oscData.indexOf(';');
+          if (semi !== -1) {
+            const code = oscData.substring(0, semi);
+            const value = oscData.substring(semi + 1);
+            if (code === '7') {
+              // OSC 7: CWD update — file://hostname/path
+              try {
+                const url = new URL(value);
+                tab.cwd = decodeURIComponent(url.pathname);
+              } catch (_) {}
+            } else if (code === '133') {
+              // OSC 133: Shell integration markers (prompt/cmd start/end/done)
+              // Handled silently — available for future command tracking
+            } else if (code === '52') {
+              // OSC 52: Clipboard operations
+              const parts = value.split(';');
+              const targets = parts[0] || 'c';
+              const b64 = parts.slice(1).join(';');
+              if (b64) {
+                // SET clipboard
+                try {
+                  const decoded = atob(b64);
+                  if (targets.includes('c') || targets.includes('p')) {
+                    navigator.clipboard.writeText(decoded).catch(() => {});
+                  }
+                } catch (_) {}
+              } else {
+                // GET clipboard — respond with current clipboard contents
+                navigator.clipboard.readText().then(text => {
+                  const response = '\x1b]52;c;' + btoa(text) + '\x07';
+                  if (tab.ws && tab.ws.readyState === WebSocket.OPEN) {
+                    const enc = new TextEncoder().encode(response);
+                    const buf = new Uint8Array(1 + enc.length);
+                    buf[0] = 0x00; buf.set(enc, 1);
+                    tab.ws.send(buf.buffer);
+                  }
+                }).catch(() => {});
+              }
+            }
+          }
+          i = oscEnd + (str[oscEnd] === '\x07' ? 1 : 2);
+          continue;
+        }
+      }
+      out += str[i];
+      i++;
+    }
+    if (out) tab.term.write(out);
+  }
+
   ws.onmessage = e => {
     const buf = new Uint8Array(e.data);
     const type = buf[0], payload = buf.slice(1);
-    if (type === 0x00) tab.term.write(payload);
+    if (type === 0x00) processTerminalOutput(payload);
     else if (type === 0x01) tab.term.writeln('\r\n\x1b[31m[Process exited]\x1b[0m');
     else if (type === 0x02) tab.term.writeln('\r\n\x1b[31m' + new TextDecoder().decode(payload) + '\x1b[0m');
   };
@@ -1919,7 +2118,7 @@ function initTerminal(tab) {
     scrollback: settings.scrollback,
     allowTransparency: false,
     theme: getXtermTheme(),
-    windowsMode: false,
+    windowsMode: serverPlatform === 'win32',
     convertEol: false,
     bellStyle: settings.bell ? 'sound' : 'none',
     smoothScrollDuration: 80,
@@ -1939,6 +2138,19 @@ function initTerminal(tab) {
   term.loadAddon(searchAddon);
   term.loadAddon(webLinksAddon);
 
+  try {
+    const unicodeAddon = new Unicode11Addon.Unicode11Addon();
+    term.loadAddon(unicodeAddon);
+    term.unicode.activeVersion = '11';
+  } catch (_) {}
+
+  // GPU-accelerated renderer — falls back to canvas if WebGL unavailable
+  try {
+    const webglAddon = new WebglAddon.WebglAddon();
+    webglAddon.onContextLoss(() => { webglAddon.dispose(); });
+    term.loadAddon(webglAddon);
+  } catch (_) {}
+
   term.open(tab.wrapper);
 
   tab.term = term;
@@ -1960,6 +2172,23 @@ function initTerminal(tab) {
     tab.el.querySelector('.tab-title').textContent = tab.title;
   });
 
+  // Bell: visual flash + desktop notification for background tabs
+  term.onBell(() => {
+    // Visual flash on terminal screen
+    const screen = term.element?.querySelector('.xterm-screen');
+    if (screen) {
+      screen.classList.remove('term-bell-flash');
+      void screen.offsetWidth; // reflow to restart animation
+      screen.classList.add('term-bell-flash');
+    }
+    // Desktop notification if tab is in the background
+    if (document.hidden && settings.bell && Notification.permission === 'granted') {
+      try {
+        new Notification(tab.title || 'WebTun', { body: 'Terminal bell', tag: 'webtun-bell' });
+      } catch (_) {}
+    }
+  });
+
   // Resize observer
   tab.resizeObserver = new ResizeObserver(() => {
     if (activeTabId === tab.id) { try { fitTerm(tab); } catch(e) { console.warn(e); } }
@@ -1979,6 +2208,69 @@ function initTerminal(tab) {
     }
   });
 
+  // Terminal right-click context menu
+  term.element.addEventListener('contextmenu', e => {
+    e.preventDefault();
+    const menu = document.getElementById('term-ctx-menu');
+    const sel = term.getSelection();
+    document.getElementById('term-ctx-copy').style.opacity = sel ? '' : '0.5';
+    // Show first to measure actual dimensions
+    menu.style.display = 'block';
+    const mw = menu.offsetWidth;
+    const mh = menu.offsetHeight;
+    const vw = window.innerWidth;
+    const vh = window.innerHeight;
+    let left = e.clientX;
+    let top = e.clientY;
+    // Flip horizontally if overflowing right
+    if (left + mw > vw) left = Math.max(0, e.clientX - mw);
+    // Flip vertically if overflowing bottom
+    if (top + mh > vh) top = Math.max(0, e.clientY - mh);
+    // Clamp to viewport
+    left = Math.max(0, Math.min(left, vw - mw));
+    top = Math.max(0, Math.min(top, vh - mh));
+    menu.style.left = left + 'px';
+    menu.style.top = top + 'px';
+  });
+
+  // Touch-to-mouse translation for TUI apps (mobile)
+  let _tapTimeout = null, _tapPos = null, _longPressTimer = null;
+  term.element.addEventListener('touchstart', e => {
+    if (e.touches.length !== 1) return;
+    const touch = e.touches[0];
+    _tapPos = { x: touch.clientX, y: touch.clientY, time: Date.now() };
+    // Long press detection for right-click
+    _longPressTimer = setTimeout(() => {
+      if (_tapPos) {
+        const evt = new MouseEvent('mousedown', { clientX: _tapPos.x, clientY: _tapPos.y, button: 2, bubbles: true });
+        term.element.dispatchEvent(evt);
+        const upEvt = new MouseEvent('mouseup', { clientX: _tapPos.x, clientY: _tapPos.y, button: 2, bubbles: true });
+        term.element.dispatchEvent(upEvt);
+        _tapPos = null;
+      }
+    }, 500);
+  }, { passive: true });
+  term.element.addEventListener('touchend', e => {
+    clearTimeout(_longPressTimer);
+    if (!_tapPos || e.changedTouches.length !== 1) return;
+    const touch = e.changedTouches[0];
+    const dx = Math.abs(touch.clientX - _tapPos.x);
+    const dy = Math.abs(touch.clientY - _tapPos.y);
+    const dt = Date.now() - _tapPos.time;
+    if (dx < 10 && dy < 10 && dt < 300) {
+      // Short tap → left click
+      const evt = new MouseEvent('mousedown', { clientX: touch.clientX, clientY: touch.clientY, button: 0, bubbles: true });
+      term.element.dispatchEvent(evt);
+      const upEvt = new MouseEvent('mouseup', { clientX: touch.clientX, clientY: touch.clientY, button: 0, bubbles: true });
+      term.element.dispatchEvent(upEvt);
+    }
+    _tapPos = null;
+  }, { passive: true });
+  term.element.addEventListener('touchmove', () => {
+    clearTimeout(_longPressTimer);
+    _tapPos = null;
+  }, { passive: true });
+
   // Fit terminal then connect WebSocket — ensures WS uses correct dimensions
   requestAnimationFrame(() => {
     fitTerm(tab);
@@ -2110,6 +2402,10 @@ function sendKey(key) {
       altLatch = false;
     }
     updateModifierButtons();
+  } else {
+    shiftLatch = false;
+    altLatch = false;
+    updateModifierButtons();
   }
   const tab = getActiveTab();
   if (tab?.ws?.readyState === WebSocket.OPEN) {
@@ -2520,6 +2816,118 @@ function renderBreadcrumb(fullPath) {
 // ═══════════════════════════════════════════════════════
 let fsClipboard = null;
 
+// Terminal context menu actions (registered once)
+function hideTermCtxMenu() {
+  document.getElementById('term-ctx-menu').style.display = 'none';
+  document.querySelectorAll('#term-ctx-menu .ctx-submenu-wrap.open').forEach(el => el.classList.remove('open'));
+}
+document.getElementById('term-ctx-copy').addEventListener('click', () => {
+  const t = getActiveTab();
+  if (t?.term) {
+    const sel = t.term.getSelection();
+    if (sel) {
+      navigator.clipboard.writeText(sel).then(() => {
+        toast('Copied to clipboard', 'success');
+      }).catch(() => {
+        document.execCommand('copy');
+        toast('Copied to clipboard', 'success');
+      });
+    }
+  }
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-paste').addEventListener('click', () => {
+  pasteToTerminal();
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-select-all').addEventListener('click', () => {
+  const t = getActiveTab();
+  if (t?.term) t.term.selectAll();
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-select-line').addEventListener('click', () => {
+  selectTermLine();
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-find').addEventListener('click', () => {
+  toggleSearch();
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-zoom-in').addEventListener('click', () => {
+  applyFontSize((settings.fontSize || 14) + 1);
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-zoom-out').addEventListener('click', () => {
+  applyFontSize((settings.fontSize || 14) - 1);
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-new-tab').addEventListener('click', () => {
+  const t = getActiveTab();
+  newTab(null, null, t?.cwd || currentPath);
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-copy-cwd').addEventListener('click', () => {
+  const t = getActiveTab();
+  const cwd = t?.cwd || currentPath;
+  if (cwd) {
+    navigator.clipboard.writeText(cwd).then(() => {
+      toast('Path copied', 'success');
+    }).catch(() => {
+      document.execCommand('copy');
+      toast('Path copied', 'success');
+    });
+  }
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-bookmark').addEventListener('click', () => {
+  const t = getActiveTab();
+  const cwd = t?.cwd || currentPath;
+  if (cwd) {
+    const bm = getBookmarks();
+    if (bm.some(b => b.path === cwd)) { toast('Already bookmarked', 'info'); }
+    else {
+      const sep = cwd.includes('\\') ? '\\' : '/';
+      bm.push({ name: cwd.split(sep).filter(Boolean).pop() || cwd, path: cwd });
+      saveBookmarks(bm);
+      toast('Bookmarked', 'success');
+    }
+  }
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-interrupt').addEventListener('click', () => {
+  sendKey('\x03');
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-rename').addEventListener('click', () => {
+  const t = getActiveTab();
+  if (t?.el) {
+    const span = t.el.querySelector('.tab-title');
+    if (span) span.dispatchEvent(new MouseEvent('dblclick', { bubbles: true }));
+  }
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-scroll-top').addEventListener('click', () => {
+  const t = getActiveTab();
+  if (t?.term) t.term.scrollToTop();
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-scroll-bottom').addEventListener('click', () => {
+  const t = getActiveTab();
+  if (t?.term) t.term.scrollToBottom();
+  hideTermCtxMenu();
+});
+document.getElementById('term-ctx-clear').addEventListener('click', () => {
+  const t = getActiveTab();
+  if (t?.term) t.term.clear();
+  hideTermCtxMenu();
+});
+// Submenu toggle on click
+document.querySelector('#term-ctx-menu .ctx-submenu-wrap > .ctx-item').addEventListener('click', e => {
+  e.stopPropagation();
+  const wrap = e.currentTarget.closest('.ctx-submenu-wrap');
+  wrap.classList.toggle('open');
+});
+
 function showCtxMenu(e, file) {
   e.preventDefault();
   ctxTarget = file;
@@ -2532,27 +2940,28 @@ function showCtxMenu(e, file) {
   document.getElementById('ctx-zip').style.display = '';
   document.getElementById('ctx-folder-size').style.display = file.isDir ? '' : 'none';
   document.getElementById('ctx-extract').style.display = file.isDir ? 'none' : (file.ext === '.zip' ? '' : 'none');
+  // Measure after content is set
   const mw = menu.offsetWidth, mh = menu.offsetHeight;
-  let left = Math.min(e.clientX, window.innerWidth - mw - 8);
-  let top = Math.min(e.clientY, window.innerHeight - mh - 8);
-  if (left < 0) left = 8;
-  if (top < 0) top = 8;
+  const vw = window.innerWidth, vh = window.innerHeight;
+  let left = e.clientX, top = e.clientY;
+  // Flip horizontally if overflowing right
+  if (left + mw > vw) left = Math.max(0, e.clientX - mw);
+  // Flip vertically if overflowing bottom
+  if (top + mh > vh) top = Math.max(0, e.clientY - mh);
+  // Clamp to viewport
+  left = Math.max(0, Math.min(left, vw - mw));
+  top = Math.max(0, Math.min(top, vh - mh));
   menu.style.left = left + 'px';
   menu.style.top = top + 'px';
   menu.classList.add('open');
   menu.style.display = '';
-  requestAnimationFrame(() => {
-    const rect = menu.getBoundingClientRect();
-    if (rect.right > window.innerWidth) {
-      menu.style.left = Math.max(0, window.innerWidth - rect.width - 8) + 'px';
-    }
-    if (rect.bottom > window.innerHeight) {
-      menu.style.top = Math.max(0, window.innerHeight - rect.height - 8) + 'px';
-    }
-  });
 }
 
-document.addEventListener('click', () => document.getElementById('ctx-menu').classList.remove('open'));
+document.addEventListener('click', () => {
+  document.getElementById('ctx-menu').classList.remove('open');
+  const termMenu = document.getElementById('term-ctx-menu');
+  if (termMenu) termMenu.style.display = 'none';
+});
 
 document.getElementById('ctx-open').onclick = () => { if (!ctxTarget) return; if (isImageFile(ctxTarget.path)) openImageViewer(ctxTarget.path); else loadFiles(ctxTarget.path); };
 document.getElementById('ctx-edit').onclick = () => ctxTarget && openFileEditor(ctxTarget.path);
@@ -3498,6 +3907,9 @@ function toggleSetting(k) {
     const ctrlBtn = document.getElementById('ctrl-toggle-btn');
     if (ctrlBtn) ctrlBtn.style.background = '';
   }
+  if (k === 'bell' && settings.bell && 'Notification' in window && Notification.permission === 'default') {
+    Notification.requestPermission();
+  }
   if (k === 'datasaver') {
     if (settings.datasaver) {
       if (sysStatsTimer) { clearInterval(sysStatsTimer); sysStatsTimer = null; }
@@ -3998,6 +4410,11 @@ function setupKeyboardShortcuts() {
     if (ctrl && e.shiftKey && e.key === 'ArrowLeft') { e.preventDefault(); cycleTab(-1); }
     if (ctrl && e.shiftKey && e.key === 'r') { e.preventDefault(); refreshPreview(); }
     if (e.key === 'Escape') {
+      const termMenu = document.getElementById('term-ctx-menu');
+      if (termMenu && termMenu.style.display !== 'none') {
+        termMenu.style.display = 'none';
+        return;
+      }
       if (document.getElementById('ctx-menu').classList.contains('open')) {
         document.getElementById('ctx-menu').classList.remove('open');
         return;
@@ -4151,10 +4568,13 @@ function pasteToTerminal() {
     if (!text) return;
     const tab = getActiveTab();
     if (tab?.ws && tab.ws.readyState === WebSocket.OPEN) {
-      const enc = new TextEncoder().encode(text);
+      // Bracketed paste: wrap in escape sequences so the shell buffers the input
+      const bracketed = '\x1b[200~' + text + '\x1b[201~';
+      const enc = new TextEncoder().encode(bracketed);
       const buf = new Uint8Array(1 + enc.length);
       buf[0] = 0x00; buf.set(enc, 1);
       tab.ws.send(buf.buffer);
+      tab.term?.focus();
       toast('Pasted to terminal', 'success');
     }
   };
@@ -4171,14 +4591,16 @@ function fallbackPaste(callback) {
     _pasteInput = document.createElement('textarea');
     _pasteInput.style.cssText = 'position:fixed;left:0;top:0;width:1px;height:1px;opacity:0;z-index:-1';
     document.body.appendChild(_pasteInput);
-    _pasteInput.addEventListener('input', () => {
-      callback(_pasteInput.value);
-      _pasteInput.value = '';
+    _pasteInput.addEventListener('paste', () => {
+      setTimeout(() => {
+        callback(_pasteInput.value);
+        _pasteInput.value = '';
+      }, 0);
     });
   }
   _pasteInput.value = '';
   _pasteInput.focus();
-  toast('Tap & hold to paste', 'info');
+  document.execCommand('paste');
 }
 
 function selectAllTerm() {
@@ -4720,9 +5142,8 @@ function toggleCmdLib() {
   panel.classList.toggle('open');
   document.getElementById('cmd-lib-toggle').classList.toggle('active', !isOpen);
   if (!isOpen) {
-    renderCmdLib();
-    document.getElementById('cmd-lib-search').value = '';
-    document.getElementById('cmd-lib-search').focus();
+    loadHistMax();
+    switchCmdTab('library');
     setTimeout(() => {
       document.addEventListener('click', closeCmdLibOnClickOutside, true);
     }, 0);
@@ -4804,7 +5225,13 @@ function renderCmdLib(filter) {
         item.appendChild(delBtn);
       }
 
-      item.addEventListener('click', () => runCmdLib(c.cmd));
+      item.addEventListener('click', () => {
+        const tab = getActiveTab();
+        if (!tab?.term) return;
+        tab.term.focus();
+        document.execCommand('insertText', false, c.cmd);
+        toggleCmdLib();
+      });
       section.appendChild(item);
     });
     list.appendChild(section);
@@ -4828,6 +5255,7 @@ function runCmdLib(cmd) {
   buf.set(enc, 1);
   tab.ws.send(buf.buffer);
   tab.term?.focus();
+  addToCmdHist(cmd);
   toast('Running: ' + cmd, 'info');
 }
 
@@ -4858,6 +5286,155 @@ function deleteCustomCmd(name, cmd) {
   toast('Command removed', 'info');
 }
 
+// ═══════════════════════════════════════════════════════
+// COMMAND HISTORY (server-side storage)
+// ═══════════════════════════════════════════════════════
+let cmdHistMax = 50;
+let _cmdHistCache = [];
+
+function histHeaders() {
+  return { 'Content-Type': 'application/json', 'x-pin-token': localStorage.getItem('wt-pin') || '' };
+}
+function histHeadersDelete() {
+  return { 'x-pin-token': localStorage.getItem('wt-pin') || '' };
+}
+async function getCmdHist() {
+  try {
+    const r = await fetch('/api/history', { headers: histHeadersDelete() });
+    if (!r.ok) return _cmdHistCache;
+    const data = await r.json();
+    _cmdHistCache = data.history || [];
+    if (data.max) cmdHistMax = data.max;
+    return _cmdHistCache;
+  } catch { return _cmdHistCache; }
+}
+function loadHistMax() {
+  getCmdHist().then(() => {
+    const el = document.getElementById('cmd-hist-max');
+    if (el) el.value = cmdHistMax;
+  });
+}
+async function addToCmdHist(cmd) {
+  if (!cmd || !cmd.trim()) return;
+  // Strip ANSI escapes and control characters, keep only printable + space + tab
+  const clean = cmd.replace(/\x1b\[[0-9;]*[a-zA-Z~]/g, '')
+    .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '')
+    .replace(/[\x00-\x08\x0e-\x1f]/g, '')
+    .trim();
+  if (!clean) return;
+  try {
+    await fetch('/api/history', { method: 'POST', headers: histHeaders(), body: JSON.stringify({ cmd: clean, max: cmdHistMax }) });
+    await getCmdHist();
+  } catch {}
+}
+async function removeCmdHistItem(idx) {
+  try {
+    await fetch('/api/history/' + idx, { method: 'DELETE', headers: histHeadersDelete() });
+    await getCmdHist();
+    renderCmdHist();
+  } catch {}
+}
+async function clearCmdHist() {
+  try {
+    await fetch('/api/history', { method: 'DELETE', headers: histHeadersDelete() });
+    _cmdHistCache = [];
+    renderCmdHist();
+    toast('History cleared', 'info');
+  } catch {}
+}
+async function updateHistMax(val) {
+  cmdHistMax = Math.max(10, Math.min(500, val || 50));
+  try {
+    await fetch('/api/history', { method: 'POST', headers: histHeaders(), body: JSON.stringify({ cmd: '', max: cmdHistMax }) });
+  } catch {}
+}
+function switchCmdTab(tab) {
+  const libBtn = document.getElementById('cmd-tab-lib');
+  const histBtn = document.getElementById('cmd-tab-hist');
+  const libList = document.getElementById('cmd-lib-list');
+  const histList = document.getElementById('cmd-hist-list');
+  const histHeader = document.getElementById('cmd-hist-header');
+  const footer = document.getElementById('cmd-lib-footer');
+  const search = document.getElementById('cmd-lib-search');
+  if (tab === 'library') {
+    libBtn.classList.add('active');
+    histBtn.classList.remove('active');
+    libList.style.display = '';
+    histList.style.display = 'none';
+    histHeader.style.display = 'none';
+    footer.style.display = '';
+    search.placeholder = 'Filter commands…';
+    search.oninput = () => filterCmdLib();
+    filterCmdLib();
+  } else {
+    histBtn.classList.add('active');
+    libBtn.classList.remove('active');
+    histList.style.display = 'flex';
+    libList.style.display = 'none';
+    histHeader.style.display = '';
+    footer.style.display = 'none';
+    search.placeholder = 'Filter history…';
+    search.oninput = () => renderCmdHist();
+    renderCmdHist();
+  }
+  search.value = '';
+  search.focus();
+}
+async function renderCmdHist() {
+  const list = document.getElementById('cmd-hist-list');
+  const hist = await getCmdHist();
+  const q = (document.getElementById('cmd-lib-search').value || '').toLowerCase();
+  const filtered = q ? hist.filter(h => h.cmd.toLowerCase().includes(q)) : hist;
+
+  list.innerHTML = '';
+  if (!filtered.length) {
+    list.innerHTML = '<div id="cmd-hist-empty">No commands run yet</div>';
+    return;
+  }
+
+  filtered.forEach((h, i) => {
+    const realIdx = q ? hist.indexOf(h) : i;
+    const item = document.createElement('div');
+    item.className = 'cmd-hist-item';
+
+    const cmdSpan = document.createElement('span');
+    cmdSpan.className = 'cmd-hist-cmd';
+    cmdSpan.textContent = h.cmd;
+    cmdSpan.title = h.cmd;
+    item.appendChild(cmdSpan);
+
+    const timeSpan = document.createElement('span');
+    timeSpan.className = 'cmd-hist-time';
+    const ago = Date.now() - h.time;
+    timeSpan.textContent = ago < 60000 ? 'just now' : ago < 3600000 ? Math.floor(ago / 60000) + 'm ago' : ago < 86400000 ? Math.floor(ago / 3600000) + 'h ago' : new Date(h.time).toLocaleDateString();
+    if (h.count > 1) timeSpan.textContent = '×' + h.count + ' ' + timeSpan.textContent;
+    item.appendChild(timeSpan);
+
+    const runBtn = document.createElement('button');
+    runBtn.className = 'cmd-hist-run';
+    runBtn.title = 'Run in terminal';
+    runBtn.innerHTML = '<svg width="12" height="12" viewBox="0 0 24 24" fill="currentColor" stroke="none"><polygon points="6,3 20,12 6,21"/></svg>';
+    runBtn.addEventListener('click', e => { e.stopPropagation(); runCmdLib(h.cmd); });
+    item.appendChild(runBtn);
+
+    const delBtn = document.createElement('button');
+    delBtn.className = 'cmd-hist-del';
+    delBtn.title = 'Remove';
+    delBtn.textContent = '×';
+    delBtn.addEventListener('click', e => { e.stopPropagation(); removeCmdHistItem(realIdx); });
+    item.appendChild(delBtn);
+
+    item.addEventListener('click', () => {
+      const tab = getActiveTab();
+      if (!tab?.term) return;
+      tab.term.focus();
+      document.execCommand('insertText', false, h.cmd);
+      toggleCmdLib();
+    });
+    list.appendChild(item);
+  });
+}
+
 // ═══════════════════════════════════════════════════════
 // SYSTEM STATS
 // ═══════════════════════════════════════════════════════

package/server.js

@@ -8,7 +8,10 @@ try {
     const idx = trimmed.indexOf('=');
     if (idx === -1) return;
     const key = trimmed.slice(0, idx).trim();
-    const val = trimmed.slice(idx + 1).trim();
+    let val = trimmed.slice(idx + 1).trim();
+    if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+      val = val.slice(1, -1);
+    }
     if (!(key in process.env)) process.env[key] = val;
   });
 } catch {}
@@ -114,13 +117,24 @@ const wss = new WebSocket.Server({ server, path: '/ws' });
 
 const PORT = process.env.PORT || 3000;
 const PIN = process.env.PIN || '';
-const SHELL = process.env.SHELL || (os.platform() === 'win32' ? 'powershell.exe' : (fs.existsSync('/bin/bash') ? '/bin/bash' : 'sh'));
+// On Windows, ignore SHELL env from Git Bash/MSYS2/WSL — prefer PowerShell
+const SHELL = (os.platform() === 'win32' && !process.env.WEBTUN_SHELL)
+  ? 'powershell.exe'
+  : (process.env.SHELL || (os.platform() === 'win32' ? 'powershell.exe' : (fs.existsSync('/bin/bash') ? '/bin/bash' : 'sh')));
 const HOST = process.env.HOST || '0.0.0.0';
 const WORKSPACE_ROOT = process.env.WORKSPACE_ROOT ? path.resolve(process.env.WORKSPACE_ROOT) : os.homedir();
 
 app.use(express.json({ limit: '50mb' }));
 app.use(express.static(path.join(__dirname, 'public')));
 
+// Handle malformed JSON gracefully
+app.use((err, req, res, next) => {
+  if (err.type === 'entity.parse.failed') {
+    return res.status(400).json({ error: 'Invalid JSON' });
+  }
+  next(err);
+});
+
 // Security headers
 app.use((req, res, next) => {
   res.setHeader('X-Content-Type-Options', 'nosniff');
@@ -132,7 +146,9 @@ app.use((req, res, next) => {
 });
 
 // Trust proxy for proper IP detection behind reverse proxy
-app.set('trust proxy', 1);
+// 'loopback' only trusts 127.0.0.1/::1 — safe default for direct connections
+// Set TRUST_PROXY=true in .env if behind a reverse proxy
+app.set('trust proxy', process.env.TRUST_PROXY === 'true' ? 1 : 'loopback');
 
 function constantTimeEqual(a, b) {
   if (typeof a !== 'string' || typeof b !== 'string') return false;
@@ -161,7 +177,7 @@ app.post('/api/auth', authRateLimiter, (req, res) => {
   if (!PIN || (pin && constantTimeEqual(pin, PIN))) {
     res.json({ success: true, token: PIN || 'open' });
   } else {
-    res.status(401).json({ error: 'Invalid PIN' });
+    res.status(401).json({ error: 'Unauthorized' });
   }
 });
 
@@ -332,7 +348,13 @@ function killPid(pid, signal = 'SIGTERM') {
   if (typeof pid !== 'number' || !Number.isInteger(pid) || pid <= 0) return;
   try {
     if (os.platform() === 'win32') {
-      execSync(`taskkill /PID ${pid} /T /F`, { stdio: 'ignore' });
+      try { execSync(`taskkill /PID ${pid} /T /F`, { stdio: 'ignore' }); } catch {}
+      // Fallback: also kill any remaining child processes via WMIC
+      try {
+        const out = execSync(`wmic process where "ParentProcessId=${pid}" get ProcessId /format:list`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        const childPids = out.split('\n').filter(l => l.startsWith('ProcessId=')).map(l => parseInt(l.split('=')[1])).filter(Boolean);
+        for (const cp of childPids) { try { execSync(`taskkill /PID ${cp} /F`, { stdio: 'ignore' }); } catch {} }
+      } catch {}
     } else {
       process.kill(pid, signal);
     }
@@ -344,7 +366,7 @@ function buildSessionEnv() {
     const env = { ...process.env };
     env.TERM = env.TERM || 'xterm-256color';
     env.COLORTERM = env.COLORTERM || 'truecolor';
-    if (!env.HOME && env.USERPROFILE) env.HOME = env.USERPROFILE;
+    if (!env.HOME && env.USERPROFILE) env.HOME = env.USERPROFILE.replace(/\\/g, '/');
     if (!env.USER && env.USERNAME) env.USER = env.USERNAME;
     env.SHELL = SHELL;
     // Prefer Path (Windows) over PATH if both set
@@ -747,7 +769,7 @@ app.post('/api/files/upload', checkPin, (req, res) => {
         cb(err);
       }
     },
-    filename: (_, file, cb) => cb(null, path.basename(file.originalname).replace(/[^a-zA-Z0-9_.\-]/g, '_'))
+    filename: (_, file, cb) => cb(null, path.basename(file.originalname).replace(/[^\w\u00C0-\u024F\u0400-\u04FF\u4E00-\u9FFF\u3040-\u309F\u30A0-\u30FF\uAC00-\uD7AF_.\-]/g, '_'))
   });
   const upload = multer({ storage, limits: { fileSize: 500 * 1024 * 1024, files: 100 } }).array('files');
   upload(req, res, err => {
@@ -779,10 +801,22 @@ app.get('/api/files/stat', checkPin, async (req, res) => {
       isSocket: st.isSocket(), isFIFO: st.isFIFO(),
     };
     try {
-      stat.owner = execFileSync('id', ['-nu', String(st.uid)], { encoding: 'utf8', stdio: 'pipe' }).trim();
+      if (os.platform() === 'win32') {
+        stat.owner = String(st.uid);
+      } else {
+        stat.owner = execFileSync('id', ['-nu', String(st.uid)], { encoding: 'utf8', stdio: 'pipe' }).trim();
+      }
     } catch { stat.owner = String(st.uid); }
     try {
-      stat.group = execFileSync('getent', ['group', String(st.gid)], { encoding: 'utf8', stdio: 'pipe' }).split(':')[0];
+      if (os.platform() === 'win32') {
+        stat.group = String(st.gid);
+      } else if (os.platform() === 'darwin') {
+        const dscl = execSync(`dscl . -read /Groups/${st.gid} RecordName 2>/dev/null`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        const m = dscl.match(/RecordName:\s*(.+)/);
+        stat.group = m ? m[1].trim() : String(st.gid);
+      } else {
+        stat.group = execFileSync('getent', ['group', String(st.gid)], { encoding: 'utf8', stdio: 'pipe' }).split(':')[0];
+      }
     } catch { stat.group = String(st.gid); }
     try {
       const symlink = lst && lst.isSymbolicLink() ? await fsPromises.readlink(p) : null;
@@ -873,7 +907,8 @@ app.post('/api/files/chmod', checkPin, async (req, res) => {
     if (!/^[0-7]{3,4}$/.test(req.body.mode)) return res.status(400).json({ error: 'mode must be a 3-4 digit octal number (e.g. 755, 644, 1777)' });
     const mode = parseInt(req.body.mode, 8);
     await fsPromises.chmod(p, mode);
-    res.json({ success: true, mode: req.body.mode });
+    const warning = os.platform() === 'win32' ? 'chmod has no effect on Windows' : undefined;
+    res.json({ success: true, mode: req.body.mode, ...(warning && { warning }) });
   } catch (e) {
     res.status(500).json({ error: e.message });
   }
@@ -1071,10 +1106,21 @@ app.get('/api/system/network', checkPin, async (req, res) => {
         gateway = route.split('\n')[0].trim() || null;
         const dnsOut = execFileSync('powershell.exe', ['-Command', '(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses'], { encoding: 'utf8', stdio: 'pipe' }).trim();
         dns = dnsOut.split('\n').filter(Boolean);
+      } else if (os.platform() === 'darwin') {
+        const route = execFileSync('sh', ['-c', "route -n get default 2>/dev/null | awk '/gateway:/{print $2}'"], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        gateway = route || null;
+        const resolv = execFileSync('sh', ['-c', "scutil --dns 2>/dev/null | awk '/nameserver\[0\]/{print $3}' | head -3"], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        dns = resolv.split('\n').filter(Boolean);
       } else {
         const route = execFileSync('sh', ['-c', "ip route | grep default | head -1 | awk '{print $3}'"], { encoding: 'utf8', stdio: 'pipe' }).trim();
         gateway = route || null;
-        const resolv = execFileSync('sh', ['-c', "grep nameserver /etc/resolv.conf | awk '{print $2}'"], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        let resolv = '';
+        try {
+          resolv = execFileSync('sh', ['-c', "grep nameserver /etc/resolv.conf | awk '{print $2}'"], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        } catch {}
+        if (!resolv) {
+          try { resolv = execFileSync('sh', ['-c', "resolvectl status 2>/dev/null | awk '/DNS Servers/{found=1; next} /^$/{found=0} found{print $1}' | head -3"], { encoding: 'utf8', stdio: 'pipe' }).trim(); } catch {}
+        }
         dns = resolv.split('\n').filter(Boolean);
       }
     } catch {}
@@ -1085,6 +1131,15 @@ app.get('/api/system/network', checkPin, async (req, res) => {
           const m = l.match(/:(\d+)\s+/);
           return m ? { port: parseInt(m[1]), process: l.split(/\s+/).pop() } : null;
         }).filter(Boolean);
+      } else if (os.platform() === 'darwin') {
+        const out = execFileSync('lsof', ['-i', '-P', '-n', '-sTCP:LISTEN'], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        const lines = out.split('\n').slice(1).filter(Boolean);
+        listenPorts = lines.map(l => {
+          const parts = l.split(/\s+/);
+          const addr = parts[8] || '';
+          const m = addr.match(/:(\d+)$/);
+          return m ? { port: parseInt(m[1]), address: addr, process: parts[0] || '' } : null;
+        }).filter(Boolean);
       } else {
         const out = execFileSync('sh', ['-c', "ss -tlnp 2>/dev/null | tail -n+2"], { encoding: 'utf8', stdio: 'pipe' }).trim();
         listenPorts = out.split('\n').filter(Boolean).map(l => {
@@ -1158,6 +1213,65 @@ app.delete('/api/clipboard', checkPin, (req, res) => {
   res.json({ success: true });
 });
 
+// ── Command history (server-side, persists across sessions) ────────────
+const HISTORY_FILE = path.join(__dirname, '.cmdhist.json');
+let cmdHistory = [];
+let cmdHistMax = 50;
+
+function loadCmdHistory() {
+  try { cmdHistory = JSON.parse(fs.readFileSync(HISTORY_FILE, 'utf8')); } catch { cmdHistory = []; }
+}
+function saveCmdHistory() {
+  try { fs.writeFileSync(HISTORY_FILE, JSON.stringify(cmdHistory)); } catch {}
+}
+loadCmdHistory();
+
+app.get('/api/history', checkPin, (req, res) => {
+  res.json({ history: cmdHistory, max: cmdHistMax });
+});
+
+app.post('/api/history', checkPin, (req, res) => {
+  try {
+    const { cmd, max } = req.body;
+    if (typeof max === 'number' && max >= 10 && max <= 500) {
+      cmdHistMax = max;
+    }
+    if (!cmd || typeof cmd !== 'string' || !cmd.trim()) {
+      // No command — just updating max
+      saveCmdHistory();
+      return res.json({ success: true, history: cmdHistory, max: cmdHistMax });
+    }
+    const clean = cmd.trim();
+    if (cmdHistory.length && cmdHistory[0].cmd === clean) {
+      cmdHistory[0].time = Date.now();
+      cmdHistory[0].count = (cmdHistory[0].count || 1) + 1;
+    } else {
+      cmdHistory.unshift({ cmd: clean, time: Date.now(), count: 1 });
+    }
+    if (cmdHistory.length > cmdHistMax) cmdHistory.length = cmdHistMax;
+    saveCmdHistory();
+    res.json({ success: true, history: cmdHistory });
+  } catch (e) {
+    res.status(500).json({ error: e.message });
+  }
+});
+
+app.delete('/api/history', checkPin, (req, res) => {
+  cmdHistory = [];
+  saveCmdHistory();
+  res.json({ success: true });
+});
+
+app.delete('/api/history/:index', checkPin, (req, res) => {
+  const idx = parseInt(req.params.index);
+  if (isNaN(idx) || idx < 0 || idx >= cmdHistory.length) {
+    return res.status(400).json({ error: 'invalid index' });
+  }
+  cmdHistory.splice(idx, 1);
+  saveCmdHistory();
+  res.json({ success: true, history: cmdHistory });
+});
+
 // ── Session persistence via tmux ──────────────────────────────────────
 const TMUX = (() => { try { return execSync('command -v tmux', { stdio: ['ignore','pipe','ignore'] }).toString().trim(); } catch { return null; } })();
 
@@ -1282,7 +1396,8 @@ wss.on('connection', (ws, req) => {
         });
       }
     } else {
-      proc = pty.spawn(SHELL, [], {
+      const shellArgs = os.platform() === 'win32' ? ['-NoLogo'] : ['-l'];
+      proc = pty.spawn(SHELL, shellArgs, {
         name: 'xterm-256color', cols, rows, cwd,
         env: sessionEnv
       });
@@ -1293,9 +1408,29 @@ wss.on('connection', (ws, req) => {
     return;
   }
 
-  proc.onData(data => send(0x00, data));
+  // Back-pressure: pause PTY output when WebSocket send buffer is full
+  let paused = false;
+  const HIGH_WATER = 4 * 1024 * 1024; // 4MB — pause PTY above this
+  const LOW_WATER  = 1 * 1024 * 1024; // 1MB — resume PTY below this
+
+  proc.onData(data => {
+    if (ws.readyState !== WebSocket.OPEN) return;
+    send(0x00, data);
+    // If WebSocket buffer is backing up, pause PTY to prevent OOM
+    if (!paused && ws.bufferedAmount > HIGH_WATER) {
+      try { proc.pause(); paused = true; } catch (_) {}
+    }
+  });
+
+  // Drain check: resume PTY when buffer drops
+  const drainCheck = setInterval(() => {
+    if (paused && ws.bufferedAmount < LOW_WATER) {
+      try { proc.resume(); paused = false; } catch (_) {}
+    }
+  }, 50);
 
   proc.onExit(() => {
+    clearInterval(drainCheck);
     if (!TMUX || !sessionId) send(0x01, Buffer.from([0]));
     ws.close();
   });
@@ -1314,8 +1449,8 @@ wss.on('connection', (ws, req) => {
       if (buf.length < 1) return;
       const type = buf[0];
       if (type === 0x00) {
-        // Limit input to 64KB per message
-        const payload = buf.slice(1, Math.min(buf.length, 65537));
+        // Limit input to 1MB per message
+        const payload = buf.slice(1, Math.min(buf.length, 1048577));
         proc.write(payload.toString('utf8'));
       } else if (type === 0x01 && buf.length >= 5) {
         const c = buf.readUInt16LE(1), r = buf.readUInt16LE(3);
@@ -1331,6 +1466,7 @@ wss.on('connection', (ws, req) => {
 
   const cleanup = () => {
     clearInterval(pingInterval);
+    clearInterval(drainCheck);
     try { proc.kill(); } catch {}
   };
   ws.on('close', cleanup);
@@ -1448,6 +1584,15 @@ app.get('/api/system', checkPin, async (req, res) => {
         mem: p.mem || '',
         cmd: p.cmd || ''
       }));
+    } else if (os.platform() === 'darwin') {
+      const psOut = await spawnRead('ps', ['-axo', 'pid,user,%cpu,%mem,command', '-r']);
+      const lines = psOut.trim().split('\n').slice(1, 16);
+      for (const line of lines) {
+        const m = line.match(/^\s*(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(.*)/);
+        if (m) {
+          processes.push({ user: m[2], pid: m[1], cpu: m[3], mem: m[4], cmd: m[5] });
+        }
+      }
     } else {
       const psOut = await spawnRead('ps', ['-eo', 'pid,user,%cpu,%mem,cmd', '--no-headers', '--sort=-%cpu']);
       const lines = psOut.trim().split('\n').slice(0, 15);
@@ -1482,9 +1627,12 @@ function isCloudflaredProcess(pid) {
     if (os.platform() === 'win32') {
       const stdout = execSync(`tasklist /FI "PID eq ${pid}" /FO CSV /NH`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
       return stdout.toLowerCase().includes('cloudflared');
-    } else {
+    } else if (os.platform() === 'linux') {
       const cmdline = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8');
       return cmdline.toLowerCase().includes('cloudflared');
+    } else {
+      const stdout = execSync(`ps -p ${pid} -o command=`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+      return stdout.toLowerCase().includes('cloudflared');
     }
   } catch {
     return false;