[httpsphl]

Second of three slices of M4: bot terminals in the app. This PR is built on #5. Merge #5 first (merge commit); this diff then shrinks to the two commits below.

What changes

• terminal.attach returns liveOffset (spec 8, 11.2): the offset where the replay ends and live output starts.
  • The replay contains queries that terminals answer. With Claude Code 2.1.284, a freshly started bot's buffer holds ESC[6n, three ESC[>0q (XTVERSION) and ESC[?u (keyboard flags).
  • Answering them again sends stale replies into the bot as keystrokes. In a real test, a stray character appeared in the prompt after attaching.
  • The app now leaves the queries in the history unanswered.
• TerminalSession (spec 8, independent of xterm):
  • attach and replay;
  • a newer generation is a new screen;
  • a gap re-attaches from the last byte;
  • duplicates and older generations are ignored;
  • a new connection resumes where the old one stopped;
  • keys typed while disconnected are dropped instead of arriving late.
• TerminalView:
  • xterm.js 6 with fit, WebGL and windowsPty: conpty;
  • a dark screen in both themes (Claude Code picks its colors for a dark terminal);
  • Ctrl+C copies a selection, as in Windows Terminal;
  • size changes reach the PTY.
• Bot view:
  • Terminal and Details tabs; the terminal stays mounted when switching tabs.
  • A start longer than 4 s explains the one-time folder trust prompt (spec 7.4.1).
  • A bot that never started says how to start it.
• FakeBotloft gains terminals: per-bot buffers, a replay sent after the attach answer (as the daemon does), live output, recorded input and sizes.
• Dev preview:
  • It shows sample terminal screens.
  • ?live=<port> connects it to a real dev daemon. The owner token comes from sessionStorage, never from the URL.
  • Release builds do not include the preview (checked in dist).

Tests

• session.test.ts:
  • replay then live output, with only the replay marked as history;
  • a new generation;
  • gap recovery, with the resume point checked;
  • duplicate and old chunks;
  • resuming after a reconnection;
  • input, size (deduplicated), and dropped keys while disconnected.
• App.test.tsx:
  • Terminal and Details tabs;
  • the slow-start trust notice, including when it appears and clears;
  • a never-started bot.
• Rust: liveOffset in the terminal buffer unit tests and in rpc_terminal.
• Totals: 34 app tests and 140 Rust tests. pnpm check, pnpm build, clippy and fmt pass. Each commit passes on its own.

Checked with real Claude Code 2.1.284

The test used the dev preview in a browser, connected with ?live= to a fresh dev daemon.

1. Created a crew and a bot from the UI. The trust prompt appeared in the app's terminal ("This folder pre-approves 1 tool permission: mcp__botloft"), and after 4 s the "Still starting" notice showed.
2. Pressed Down and Enter in xterm. The trust was accepted, the SessionStart hook set the bot to Idle, and the notice cleared.
3. Found a stray character in the prompt; the replay-query issue above. After the fix, a restarted bot and a page reload both replayed cleanly with an empty prompt.
4. Typed "Reply with just the word OK" and pressed Enter. The bot showed Working, the answer "OK" appeared, and the bot went back to Idle.

Manual test (Tauri window)

With BOTLOFT_HOME set to the dev folder, run pnpm tauri dev, then:

1. Create a bot and answer the trust prompt in its terminal.
2. Type a prompt.
3. Resize the window: Claude Code redraws at the new size.
4. Close the app window and open it again. The screen comes back from the replay, with no stray input.