fix: v0.5.0 security and robustness fixes from the 2026-10-07 review

- Ask Claude: strip control characters, send as bracketed paste (closes #2)
- end: forget before kill, so ending from inside a session leaves no ghost (closes #3)
- reconnects use `attach --existing` and never resurrect ended/renamed sessions (closes #4)
- repo: git --no-optional-locks, no safe.directory override, refresh on connect/bell/60s (closes #5)
- uploads: unique names via mktemp, cleanup trap on hangup (closes #6)
- clipboard: write-only OSC 52 provider, tmux allow-passthrough off (closes #7)
- uploads: size check up front, streamed slices, idle timeout (closes #9)
- --list: path last in TSV rows, tolerant numbers (closes #10)
- tokens via curl config on stdin; userinfo stripped from remote URLs (closes #11)
- ttyd max clients 32 and at most 2 concurrent side-channel calls (#8; BroadcastChannel polling still open)
- tmux: fixed terminal-features index (no duplicates on re-source), no status-right clock

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/term.js

@@ -3,7 +3,17 @@ import { FitAddon } from '@xterm/addon-fit';
 import { WebglAddon } from '@xterm/addon-webgl';
 import { WebLinksAddon } from '@xterm/addon-web-links';
 import { Unicode11Addon } from '@xterm/addon-unicode11';
-import { ClipboardAddon } from '@xterm/addon-clipboard';
+import { Base64, ClipboardAddon } from '@xterm/addon-clipboard';
+
+// Terminal output (tmux copy-mode, Claude) may *write* the browser clipboard
+// via OSC 52, but must never read it: anything printed could exfiltrate it (devdesk#7).
+const writeOnlyClipboard = {
+  readText: () => '',
+  writeText: (selection, text) => {
+    if (selection === 'c') return navigator.clipboard?.writeText(text).catch(() => {});
+    return undefined;
+  },
+};
 
 // LotusGuild TDS tokens (web_template base.css :root) mapped onto the ANSI palette.
 export const THEME = Object.freeze({
@@ -62,7 +72,7 @@ export function createTerminal(container, { fontSize, onShiftEnter }) {
   term.loadAddon(fit);
   term.loadAddon(new Unicode11Addon());
   term.unicode.activeVersion = '11';
-  term.loadAddon(new ClipboardAddon()); // OSC 52 from tmux copy-mode / Claude
+  term.loadAddon(new ClipboardAddon(new Base64(), writeOnlyClipboard));
   term.loadAddon(new WebLinksAddon((event, uri) => {
     event.preventDefault();
     window.open(uri, '_blank', 'noopener');
@@ -90,6 +100,8 @@ export function createTerminal(container, { fontSize, onShiftEnter }) {
 
   term.open(container);
 
+  // Touch devices: the DOM renderer is more reliable at high DPR than WebGL.
+  if (window.matchMedia?.('(pointer: coarse)').matches) return { term, fit };
   try {
     const webgl = new WebglAddon();
     webgl.onContextLoss(() => webgl.dispose());