Sanitize history replay and ship tmux config

Every page reload used to append a stray "1; 2c0; 276; 0c" to the shell:
xterm processed a Device Attributes query from tmux's scrollback,
replied, and tmux forwarded the reply to the inner shell.

- sanitizeForReplay strips CSI terminal-query/status sequences
  (final byte c/n) and OSC color queries (10/11;?) from the history
  frame. Colors and formatting are preserved.
- server/tmux.conf centralises tmux options (default-terminal,
  escape-time 0, focus-events on, status off, history-limit 10000,
  set-clipboard on, set-titles off, aggressive-resize on). tmux now
  starts with `-f tmux.conf` and each session re-sources it so a
  long-running daemon picks up changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: chapterjason

server/src/session/replay.ts

@@ -0,0 +1,10 @@
+// Strip escape sequences that would trigger the terminal to emit a
+// response (Device Attributes, cursor-position / status reports, OSC
+// color queries). Replaying them lets xterm re-answer, and those
+// answers leak onto the shell.
+const CSI_QUERY = /\x1b\[[?>=]?[0-9;]*[cn]/g;
+const OSC_COLOR_QUERY = /\x1b\][0-9]+;\?(?:\x07|\x1b\\)/g;
+
+export function sanitizeForReplay(data: string): string {
+  return data.replace(CSI_QUERY, "").replace(OSC_COLOR_QUERY, "");
+}

server/src/session/session.ts

@@ -1,10 +1,15 @@
 import { spawn, type IPty } from "node-pty";
 import { randomUUID } from "node:crypto";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { SCROLLBACK_BYTES } from "../config.js";
 import type { SessionInfo } from "../types/session.js";
+import { sanitizeForReplay } from "./replay.js";
 import { Scrollback } from "./scrollback.js";
 import * as tmux from "./tmux.js";
 
+const TMUX_CONF = resolve(dirname(fileURLToPath(import.meta.url)), "../../tmux.conf");
+
 export type OutputListener = (chunk: string) => void;
 export type ExitListener = (code: number, signal?: number) => void;
 
@@ -47,6 +52,8 @@ export class Session {
     this.pty = spawn(
       "tmux",
       [
+        "-f",
+        TMUX_CONF,
         "new-session",
         "-A",
         "-s",
@@ -79,8 +86,7 @@ export class Session {
   }
 
   private async configureTmux(): Promise<void> {
-    await tmux.setOption(this.tmuxName, "status", "off");
-    await tmux.setOption(this.tmuxName, "history-limit", "10000");
+    await tmux.sourceFile(TMUX_CONF);
     await tmux.setTitle(this.tmuxName, this._title);
   }
 
@@ -116,7 +122,7 @@ export class Session {
   }
 
   history(): string {
-    return this.scrollback.snapshot();
+    return sanitizeForReplay(this.scrollback.snapshot());
   }
 
   subscribe(onData: OutputListener, onExit: ExitListener): () => void {

server/src/session/tmux.ts

@@ -84,3 +84,7 @@ export async function setOption(name: string, option: string, value: string): Pr
 export async function kill(name: string): Promise<void> {
   await run(["kill-session", "-t", name]).catch(() => {});
 }
+
+export async function sourceFile(path: string): Promise<void> {
+  await run(["source-file", path]).catch(() => {});
+}

server/tmux.conf

@@ -0,0 +1,8 @@
+set-option -g default-terminal "xterm-256color"
+set-option -g escape-time 0
+set-option -g focus-events on
+set-option -g set-titles off
+set-option -g aggressive-resize on
+set-option -g set-clipboard on
+set-option -g status off
+set-option -g history-limit 10000