[alexfrmn]

What changed?

Right-click paste now uses xterm’s term.paste(), preserving a multiline clipboard block as one draft so a comment can be appended before submission. Plain left-clicks retain native focus and selection without synthesizing arrow keys.

For a running Codex session whose initial bracketed-paste sequence has fallen out of bounded scrollback, restore the mode before pasting when live process metadata identifies codex. Other applications retain their terminal paste mode.

Add input regression coverage and run test:terminal-input in the existing browser CI step.

Why?

• The context-menu handler sent clipboard contents directly to the PTY. Newlines and tabs could be interpreted as submit/queue keys, splitting one paste into multiple requests.
• The click-to-cursor handler converted screen coordinates into potentially hundreds of arrow presses, including clicks on previous output. In Codex CLI 0.154.0, Left on an empty composer opens the Agent command center (upstream shortcut).
• Reconnecting to a long-running session could lose paste mode because the bounded replay no longer contained its initial enable sequence.

Reproduce by right-clicking a long clipboard sample containing paragraphs, tabs and a trailing newline, appending a comment, then clicking previous output with an empty composer. Pasting should preserve one draft; clicking should only focus/select.

Verification

• pnpm exec tsc --noEmit
• pnpm lint on the clean source snapshot
• pnpm build
• pnpm test:pty-gateway
• pnpm test:browser-regression: 18 checks against an isolated app and real PTY/gateway
• pnpm test:terminal-input: 8 checks against the deployed frontend with mocked API/WebSocket traffic, including truncated replay, non-Codex mode, selection and Escape
• Manual retest: a 2,314-character right-click paste displayed as one [Pasted Content 2314 chars] block and arrived together with the appended comment as one message
• I did not add secrets, production data, or private infrastructure details.

The input implementation and regression scripts in this PR match the tested deployment. The fallback for missing paste mode depends on the existing live metadata identifying the foreground command as codex.

GitHub CI status (2026-09-14)

Run 34849038267 passed typecheck, lint, build and PTY gateway smoke, then failed the existing production dependency audit: 43 findings (2 critical, 13 high, 23 moderate, 5 low). Browser and Docker steps were therefore skipped in GitHub; the local browser results above remain independently verified. This PR changes no dependency versions or lockfile. Dependency remediation remains a separate follow-up.