fix: bug-hunt round — batched events, wss, sanitization, layout bounds

[jkyberneees]

Summary

A bug hunt across the whole project. Each finding was first reproduced with a failing (RED) test, and findings that could not be reproduced or that contradicted pinned, deliberate behaviour were dropped. The fixes go in as separate commits, one per area.

Fixed

• tui, batched events: ingestWireBatch dropped the follow-up commands of every event. A queued prompt was popped but never sent, and the done bell, bg_job/subagent_state/memory_event refreshes and plan fetches were lost. They are now carried out of the batch.
• client:
  • wss:// attach never did a TLS handshake, so https servers always failed.
  • The trailing thinking deltas now flush after 50ms of silence.
  • Memory consolidation uses the 30s client instead of the 3s one.
• server: extra query parameters on an attach URL no longer end up before /ws or in the REST base.
• bodek:
  • The server log, which holds the WS token, is removed and exclusively created with mode 0600 instead of reusing a possibly pre-created file.
  • Settings saves merge only the changed fields over the current file, so another running instance's choices are not lost.
• tokens / workspace: an unreadable (as opposed to missing) store is no longer replaced by an empty one.
• tui, wire content: sub-agent phase/status and job/agent status are sanitized before rendering. Previously raw escape sequences, including OSC 52, could reach the terminal.
• tui, layout: the cockpit popover is windowed and scrollable. Drawer detail rows are bounded by display cells.
• tui, text handling: palette backspace and plainClip no longer split multi-byte characters.
• tui, state: a delete reply removes the right session after the selection moved. The stale-age clock resets per turn. The find bar ignores key sentinels. copyMark resets on clear.

Dropped after validation

• The upgrade check with pseudo-versions is pinned by an existing test and its comment.
• n/N navigation in the find bar is deliberate and pinned.
• A shared, truncated server log path is documented behaviour.

Testing

• make fmt, make vet and make test (race) are green, including the new regression tests (*/bughunt_regress_test.go).
• make lint could not run in the cloud sandbox: its golangci-lint was built with Go 1.25 against a module targeting 1.26.0. CI will run it.
• The tokens and workspace regression tests skip as root. They were verified failing before and passing after the fix when run as an unprivileged user.
• One existing test (TestPlainBatchProgressPrintsInWireOrder) now strips OSC sequences before counting, because the done title and bell now fire from a batch too.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GozYvJdU9Yx4uLnCKCcTEg

---

Generated by Claude Code