feat(terminal): unify xterm client and harden transport - #5038

What changed

This PR builds on #5104. That PR synchronizes browser dimensions with Docker and SSH PTYs and fixes the overwrite reported in #5092. This PR keeps that behavior and adds the remaining terminal transport, lifecycle, and client improvements.

• Moves the server and Docker terminals to one shared xterm client.
• Preserves terminal input byte for byte through WebSocket and node-pty or SSH. This covers X10 mouse reports and bytes outside ASCII.
• Sends terminal input as binary frames and resize controls as validated text JSON frames. Other text frames remain terminal input for older clients.
• Uses the same 500-column and 200-row bounds in the browser and server, then coalesces and deduplicates resize messages.
• Stops PTY writes, resizes, and cleanup after process exit. Resize and kill failures no longer crash the WebSocket handler.
• Removes WebSocket output listeners before disposing xterm, so queued output cannot reach a disposed terminal.
• Defers xterm creation by one animation frame so React StrictMode can cancel its throwaway development mount before fit() runs.
• Adds theme-aware colors, search, Unicode 11 width handling, link detection, and terminal-safe keyboard shortcuts.
• Measures Docker log cell width from the rendered font and updates the log PTY when the viewport changes.
• Keeps normal browser and OS paste, including bracketed multiline Unicode paste.
• Replaces unrestricted OSC 52 clipboard handling with bounded, write-only support. A remote shell can set valid clipboard text but cannot read the browser clipboard.

Why

#5104 fixes the visible PTY-size desynchronization, but its transport still decodes binary WebSocket input as UTF-8 text. Mouse reports and non-ASCII bytes can change before they reach the PTY. Its resize controls also share text frames with stdin.

This PR gives stdin and resize controls distinct frame types. It also centralizes behavior that was duplicated between the server and Docker terminal clients. Both terminals now use the same resizing, cleanup, theme, search, Unicode, link, keyboard, and clipboard code.

Related work

• Builds on fix: sync terminal size with backend PTY (fixes #5092) #5104 and preserves its fix for Terminal overwrite text on overflow #5092.
• Preserves the paste behavior from fix: add clipboard addon to docker container terminal #5066, which closed bug when using terminal #5065, without allowing OSC 52 clipboard reads.
• Adds explicit theme-aware terminal colors relevant to container terminal text is not readable in dark mode #4901.

Validation

The final checks ran with Node 24.4.0 and pnpm 10.22.0 after merging the latest canary and pushing the StrictMode lifecycle fix.

• corepack pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts __test__/wss/utils.test.ts __test__/wss/terminal-transport.test.ts --run passed 33 tests.
• corepack pnpm --filter=dokploy run typecheck passed.
• corepack pnpm --filter=dokploy run build passed. The build logged the expected missing local dokploy-postgres and deprecated local configuration warnings.
• Biome passed on the changed xterm client.
• git diff --check passed.
• React Doctor reported no finding in the changed xterm client. Its branch-wide scan reported findings in other files, but none came from this lifecycle fix.

Checklist

• The branch is based on canary and includes the latest changes from it.
• The contribution follows the Dokploy contribution guide.
• The terminal behavior was tested in a local instance during development.

Tooling disclosure

This contribution was built and validated with Codex.

Greptile Summary

This PR consolidates server and container terminals around a shared xterm client and hardens terminal transport and lifecycle behavior.

• Separates binary terminal input from validated text resize controls.
• Synchronizes bounded PTY dimensions across browser, Docker, and SSH paths.
• Adds shared terminal search, Unicode, links, themes, keyboard handling, and restricted OSC 52 clipboard writes.
• Improves PTY, WebSocket, and xterm cleanup behavior.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the eligible follow-up review scope.

No blocking failure remains.

_{Reviews (3): Last reviewed commit: "Merge remote-tracking branch 'origin/can..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Monitoring and Live Terminal/Log Streaming

Follow-up fix

• Fixes Remote terminal leaks SSH/PTY sessions when WebSocket closes during SSH handshake #5217 by binding SSH cleanup before connect, destroying pending clients when the WebSocket closes, rejecting late SSH channels, and setting an explicit 20-second handshake timeout.
• Synced with canary at 532de2c.
• Revalidated on Node 24.4.0: 35 terminal tests, typecheck, production build, Biome, and git diff checks passed.