Most of today went into making the web sessions terminal feel like a real terminal rather than a read-only window. The headline is a restart menu for the web server itself: hit Ctrl+R and a little in-terminal menu appears, built out of small composable pieces — parseMenuKey, nextIndex, renderRestartMenu, createMenuState, createKeyHandler — that lets me restart or re-exec the running server without dropping back to the shell. I started it on a different shortcut and then moved it to Ctrl+R once it felt natural. Copy and paste landed too, with a handleClipboardKey handler wiring the usual shortcuts through to the terminal, plus a follow-up fix to stop a paste registering twice. Smaller terminal polish rounded it out: reconnecting cleanly after a server restart instead of going dead, and closing an annoying gap between the terminal and the pane beside it.

The other big piece was a read-only history transcript view. Closed sessions now render their Claude transcript directly in the dashboard — I parse the session .jsonl (parseTranscript, findSessionJsonlPath, entryMessages, toolTarget) and render it through a new TranscriptPane/TranscriptRow, with derived history fields and chips (deriveHistoryFields, HistoryCardChips) summarising each run. It meant splitting the session area into a live TerminalArea and a TranscriptArea, and reworking the WebSocket plumbing (useSessionSocket, useWebSocket, WsDispatch) to feed both. So now I can scroll back through what a finished session actually did without resuming it.

On the backlog side, run cards got an auto-advance toggle so a session can pause between phases instead of barrelling straight through — consumePause and setAutoAdvance carry the state through the daemon and into runPhases. Backlog cards also grew a mark-done button for clearing items straight from the dashboard, and the repo selector now orders projects by recency so the one I touched last is at the top.

The rest was housekeeping with teeth. I added a built-in cli-hook deny for git commit, pointing it at assist commit "<message>" instead — moving the rule out of settings.json and into the hook’s own findBuiltinDeny list so it travels with the tool and gives a useful message rather than a bare denial. And I pinned overrides for a couple of vulnerable transitive dependencies to clear them out of the tree.