feat: mobile UX polish, shell injection fix, and performance optimizations
This commit combines multiple improvements for mobile support, reliability, and performance: Mobile & Accessibility Improvements: - Fix touch scrolling on mobile by removing CSS overflow-y:hidden that blocked xterm.js native scroll - Add beforeinput handler to prevent Android IME double-space-to-period duplication - Implement mobile control character toolbar (Esc, Tab, Ctrl/Alt toggles, arrows, special chars) - One-shot modifier toggles bring soft keyboard on demand without showing it for other keys - Replace 25+ unicode/HTML entity icons with inline SVGs across app for better rendering Security & Reliability: - Fix shell injection vulnerability: session names with spaces/special chars now properly quoted - Use shlex.quote() in create_session and delete_session endpoints - URL-encode session names in bell hook to prevent malformed curl URLs - Also hardens against command injection through crafted session names Performance Optimizations: - Eliminate 2.4-5.6 second session creation delay (was 3 compounding bottlenecks) - Frontend: check for new session immediately (was waiting 2s for interval tick) - Backend: eagerly refresh session cache after tmux creation (was waiting for next poll) - Connection: poll for ttyd readiness instead of blind 0.8s sleep - Typical new session now appears in UI in 200-400ms vs previous 4-5 seconds Infrastructure: - Improve ttyd port detection with multi-tool fallback (lsof → fuser → ss) - Add Cloudflare tunnel setup documentation Test Updates: - Update frontend tests to match new setTimeout recursion pattern (replaces setInterval) All 1306 tests pass. Generated with Amplifier Co-Authored-By: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>
This commit is contained in:
Ken