Keep restored terminal output and project scripts from typing into busy shells - #775

What Changed

• Server history sanitizer now also strips DECRQM/DECRPM (…$p/…$y), XTVERSION (CSI > q), the kitty keyboard query and reply (CSI ? u), and DECRQSS/XTGETTCAP DCS queries and replies (7-bit and 8-bit). Setters that share a final byte (DECSTR, DECSCL, DECSCUSR, restore-cursor, kitty push) and other DCS strings such as sixel stay in history.
• New client replay gate (client-runtime/state/terminal/replayGate.ts). While a view replays a snapshot, a history delta or output buffered while it was detached, xterm's replies to queries in that output are dropped instead of being sent to the shell. Keystrokes typed during a replay still go through.
• The reply classifier lives once in @ryco/shared/terminalReports, shared by the client gate and the server.
• terminal.write accepts requireIdle. Under the thread lock, the server refuses with TerminalBusyError (running, unverified, inputRaced) and writes nothing unless a fresh process-table read finds the shell idle. Focus reports and query replies do not count as input for this check.
• Nodes advertise capabilities.terminalWriteRequireIdle. Clients read it from the node's own config, so hosted nodes that are not the primary count too.
• Project scripts reuse the base terminal only with requireIdle and fall back to a new terminal when the node refuses. On nodes without the capability they always get a new terminal.
• The setup script runner writes with requireIdle. The exit\n close fallback is sent only with requireIdle.
• Closing a terminal that is running a command asks first. The drawer, workspace panel and close shortcut share one close helper.
• An empty ps or PowerShell process table now counts as a failed read, including for activity polling.

Why

• Replayed output answered terminal queries again after a reconnect, a reattach or reopening the drawer, so junk such as ^[[?2026;2$y appeared at the prompt. Ports fix(server): strip replayable terminal queries from history pingdotgg/t3code#5319 (strip list) and the replay detach idea from feat(web): render terminals with libghostty-vt pingdotgg/t3code#4860.
• Project scripts decided to reuse a terminal from the client's cached running state, which lags the server. The command could then be typed into vim, a dev server or a REPL. Ports the idle check from Simplify terminal workspace management Emanuele-web04/synara#1559, plus the close confirmation from feat(web): confirm before closing a terminal pingdotgg/t3code#7592 (asked only when a command is running).
• Review fixes:
  • fish turns on focus reporting, and running a script moves focus right before the write, so those reports would have made every reuse fail as inputRaced.
  • The capability was read from the primary's projected config, which misses hosted nodes that are not the primary.

Testing

• bun run check: pass (format, lint 0 errors, typecheck:fast)
• RYCO_TEST_MAX_WORKERS=4 bun run check:changed: format, lint, TS7 + Effect typecheck and all affected packages pass, except apps/web service.hostedPrimary.test.ts, which timed out after 5 s under load. Rerun alone twice, it passed 4/4 both times; this PR does not touch that code.
• RYCO_TEST_MAX_WORKERS=4 bun run --cwd apps/server test -- src/terminal/Layers/Manager.test.ts: 73 passed. The new focus-report test fails when every write updates the settle timestamp.
• RYCO_TEST_MAX_WORKERS=4 bun run --cwd apps/server test -- src/terminal/Layers/Manager.test.ts src/project/Layers/ProjectSetupScriptRunner.test.ts src/environment/Layers/ServerEnvironment.test.ts src/agentControl/Mcp/hostedBoundaries.test.ts: 79 passed (before the review fixes)
• bun run --cwd packages/shared test -- src/terminalReports.test.ts: 4 passed
• bun run --cwd packages/client-runtime test -- src/state/terminal: 37 passed
• bun run --cwd packages/contracts test -- src/terminal.test.ts src/environment.test.ts: 40 passed
• bun run --cwd apps/web test -- src/terminalRequireIdle.test.ts: 3 passed. 2 fail with the old config lookup.
• bun run --cwd apps/web test:browser -- src/components/TerminalReplay.browser.tsx: 6 passed
• bun run --cwd apps/web test:browser -- src/components/ChatView.Workspace.browser.tsx -t "project script|closing a terminal|project scripts|asks before closing": 5 passed

Follow-ups

• When several clients show one terminal, each live view answers live queries. Choose one reply owner per terminal.
• terminal.open relaunches a live shell when cwd or env differ, which can stop a running command without asking.
• A partly typed command at an idle prompt still gets the script command appended. A server check cannot see this.
• The close confirmation trusts the client's running state. A server-verified close would need the UI to wait before removing the terminal.
• A shell blocked in a builtin such as read looks idle to the process table.

🤖 Generated with Claude Code

^{Need help on this PR? Tag @codesmith-bot with what you need.}