Merge remote-tracking branch 'origin/main' into issue-84

Author: skulidropek

packages/app/src/docker-git/menu-shared.ts

@@ -41,10 +41,16 @@ const wrapWrite = (baseWrite: OutputWrite): OutputWrite =>
   return baseWrite(chunk, encoding, cb)
 }
 
-const disableMouseModes = (): void => {
-  // Disable xterm/urxvt mouse tracking and "alternate scroll" mode (wheel -> arrow keys).
+const disableTerminalInputModes = (): void => {
+  // Disable mouse/input modes that can leak across TUI <-> SSH transitions.
   process.stdout.write(
-    "\u001B[?1000l\u001B[?1002l\u001B[?1003l\u001B[?1005l\u001B[?1006l\u001B[?1015l\u001B[?1007l"
+    "\u001B[0m" +
+    "\u001B[?25h" +
+    "\u001B[?1l" +
+    "\u001B>" +
+    "\u001B[?1000l\u001B[?1002l\u001B[?1003l\u001B[?1005l\u001B[?1006l\u001B[?1015l\u001B[?1007l" +
+    "\u001B[?1004l\u001B[?2004l" +
+    "\u001B[>4;0m\u001B[>4m\u001B[<u"
   )
 }
 
@@ -201,7 +207,7 @@ export const suspendTui = (): void => {
   if (!process.stdout.isTTY) {
     return
   }
-  disableMouseModes()
+  disableTerminalInputModes()
   if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
     process.stdin.setRawMode(false)
   }
@@ -226,13 +232,13 @@ export const resumeTui = (): void => {
     return
   }
   setStdoutMuted(false)
-  disableMouseModes()
+  disableTerminalInputModes()
   // Return to the alternate screen for Ink rendering.
   process.stdout.write("\u001B[?1049h\u001B[2J\u001B[H")
   if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
     process.stdin.setRawMode(true)
   }
-  disableMouseModes()
+  disableTerminalInputModes()
 }
 
 export const leaveTui = (): void => {
@@ -241,7 +247,7 @@ export const leaveTui = (): void => {
   }
   // Ensure we don't leave the terminal in a broken "mouse reporting" mode.
   setStdoutMuted(false)
-  disableMouseModes()
+  disableTerminalInputModes()
   // Restore the primary screen on exit without clearing it (keeps useful scrollback).
   process.stdout.write("\u001B[?1049l")
   if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {

packages/lib/src/core/templates-entrypoint/tasks.ts

@@ -139,22 +139,15 @@ const renderCloneBodyRef = (config: TemplateConfig): string =>
       fi
     else
       if ! su - ${config.sshUser} -c "GIT_TERMINAL_PROMPT=0 git clone --progress $CLONE_CACHE_ARGS --branch '$REPO_REF' '$AUTH_REPO_URL' '$TARGET_DIR'"; then
-        DEFAULT_REF="$(git ls-remote --symref "$AUTH_REPO_URL" HEAD 2>/dev/null | awk '/^ref:/ {print $2}' | head -n 1 || true)"
-        DEFAULT_BRANCH="$(printf "%s" "$DEFAULT_REF" | sed 's#^refs/heads/##')"
-        if [[ -n "$DEFAULT_BRANCH" ]]; then
-          echo "[clone] branch '$REPO_REF' missing; retrying with '$DEFAULT_BRANCH'"
-          if ! su - ${config.sshUser} -c "GIT_TERMINAL_PROMPT=0 git clone --progress $CLONE_CACHE_ARGS --branch '$DEFAULT_BRANCH' '$AUTH_REPO_URL' '$TARGET_DIR'"; then
-            echo "[clone] git clone failed for $REPO_URL"
-            CLONE_OK=0
-          elif [[ "$REPO_REF" == issue-* ]]; then
-            if ! su - ${config.sshUser} -c "cd '$TARGET_DIR' && git checkout -B '$REPO_REF'"; then
-              echo "[clone] failed to create local branch '$REPO_REF'"
-              CLONE_OK=0
-            fi
-          fi
-        else
+        echo "[clone] branch '$REPO_REF' missing; retrying without --branch"
+        if ! su - ${config.sshUser} -c "GIT_TERMINAL_PROMPT=0 git clone --progress $CLONE_CACHE_ARGS '$AUTH_REPO_URL' '$TARGET_DIR'"; then
           echo "[clone] git clone failed for $REPO_URL"
           CLONE_OK=0
+        elif [[ "$REPO_REF" == issue-* ]]; then
+          if ! su - ${config.sshUser} -c "cd '$TARGET_DIR' && git checkout -B '$REPO_REF'"; then
+            echo "[clone] failed to create local branch '$REPO_REF'"
+            CLONE_OK=0
+          fi
         fi
       fi
     fi

packages/lib/src/core/templates-prompt.ts

@@ -9,6 +9,15 @@
 // INVARIANT: script is deterministic
 // COMPLEXITY: O(1)
 const dockerGitPromptScript = `docker_git_branch() { git rev-parse --abbrev-ref HEAD 2>/dev/null; }
+docker_git_terminal_sanitize() {
+  # Recover interactive TTY settings after abrupt exits from fullscreen/raw-mode tools.
+  if [ -t 0 ]; then
+    stty sane 2>/dev/null || true
+  fi
+  if [ -t 1 ]; then
+    printf "\\033[0m\\033[?25h\\033[?1l\\033>\\033[?1000l\\033[?1002l\\033[?1003l\\033[?1005l\\033[?1006l\\033[?1015l\\033[?1007l\\033[?1004l\\033[?2004l\\033[>4;0m\\033[>4m\\033[<u"
+  fi
+}
 docker_git_short_pwd() {
   local full_path
   full_path="\${PWD:-}"
@@ -61,6 +70,7 @@ docker_git_short_pwd() {
   printf "%s" "$result"
 }
 docker_git_prompt_apply() {
+  docker_git_terminal_sanitize
   local b
   b="$(docker_git_branch)"
   local short_pwd
@@ -178,6 +188,15 @@ zstyle ':completion:*' tag-order builtins commands aliases reserved-words functi
 
 autoload -Uz add-zsh-hook
 docker_git_branch() { git rev-parse --abbrev-ref HEAD 2>/dev/null; }
+docker_git_terminal_sanitize() {
+  # Recover interactive TTY settings after abrupt exits from fullscreen/raw-mode tools.
+  if [[ -t 0 ]]; then
+    stty sane 2>/dev/null || true
+  fi
+  if [[ -t 1 ]]; then
+    printf "\\033[0m\\033[?25h\\033[?1l\\033>\\033[?1000l\\033[?1002l\\033[?1003l\\033[?1005l\\033[?1006l\\033[?1015l\\033[?1007l\\033[?1004l\\033[?2004l\\033[>4;0m\\033[>4m\\033[<u"
+  fi
+}
 docker_git_short_pwd() {
   local full_path="\${PWD:-}"
   if [[ -z "$full_path" ]]; then
@@ -235,6 +254,7 @@ docker_git_short_pwd() {
   print -r -- "$result"
 }
 docker_git_prompt_apply() {
+  docker_git_terminal_sanitize
   local b
   b="$(docker_git_branch)"
   local short_pwd

packages/lib/src/core/templates/docker-compose.ts

@@ -57,7 +57,7 @@ const buildPlaywrightFragments = (
     maybePlaywrightEnv:
       `      MCP_PLAYWRIGHT_ENABLE: "1"\n      MCP_PLAYWRIGHT_CDP_ENDPOINT: "${browserCdpEndpoint}"\n`,
     maybeBrowserService:
-      `\n  ${browserServiceName}:\n    build:\n      context: .\n      dockerfile: ${browserDockerfile}\n    container_name: ${browserContainerName}\n    environment:\n      VNC_NOPW: "1"\n    shm_size: "2gb"\n    expose:\n      - "9223"\n    volumes:\n      - ${browserVolumeName}:/data\n    networks:\n      - ${networkName}\n`,
+      `\n  ${browserServiceName}:\n    build:\n      context: .\n      dockerfile: ${browserDockerfile}\n    container_name: ${browserContainerName}\n    restart: unless-stopped\n    environment:\n      VNC_NOPW: "1"\n    shm_size: "2gb"\n    expose:\n      - "9223"\n    volumes:\n      - ${browserVolumeName}:/data\n    networks:\n      - ${networkName}\n`,
     maybeBrowserVolume: `  ${browserVolumeName}:\n`
   }
 }
@@ -93,6 +93,7 @@ const renderComposeServices = (config: TemplateConfig, fragments: ComposeFragmen
   ${config.serviceName}:
     build: .
     container_name: ${config.containerName}
+    restart: unless-stopped
     environment:
       REPO_URL: "${config.repoUrl}"
       REPO_REF: "${config.repoRef}"

packages/lib/src/shell/docker.ts

@@ -381,6 +381,31 @@ export const runDockerNetworkCreateBridge = (
     (exitCode) => new DockerCommandError({ exitCode })
   )
 
+// CHANGE: create a Docker bridge network with an explicit subnet
+// WHY: allow callers to bypass default address-pool allocation when it is exhausted
+// QUOTE(ТЗ): "научилось создавать сети правильно"
+// REF: user-request-2026-02-20-network-fallback
+// SOURCE: n/a
+// FORMAT THEOREM: ∀(n,s): create(n,s)=0 -> exists(n) ∧ subnet(n)=s
+// PURITY: SHELL
+// EFFECT: Effect<void, DockerCommandError | PlatformError, CommandExecutor>
+// INVARIANT: network driver is always `bridge`
+// COMPLEXITY: O(command)
+export const runDockerNetworkCreateBridgeWithSubnet = (
+  cwd: string,
+  networkName: string,
+  subnet: string
+): Effect.Effect<void, DockerCommandError | PlatformError, CommandExecutor.CommandExecutor> =>
+  runCommandWithExitCodes(
+    {
+      cwd,
+      command: "docker",
+      args: ["network", "create", "--driver", "bridge", "--subnet", subnet, networkName]
+    },
+    [Number(ExitCode(0))],
+    (exitCode) => new DockerCommandError({ exitCode })
+  )
+
 // CHANGE: inspect how many containers are attached to a network
 // WHY: network GC must remove only detached networks
 // QUOTE(ТЗ): "Только так что бы текущие проекты не ложились"

packages/lib/src/usecases/actions/create-project.ts

@@ -143,7 +143,7 @@ const openSshBestEffort = (
         },
         [0, 130],
         (exitCode) => new CommandFailedError({ command: "ssh", exitCode })
-      )
+      ).pipe(Effect.ensuring(ensureTerminalCursorVisible()))
     )
   }).pipe(
     Effect.asVoid,

packages/lib/src/usecases/docker-network-gc.ts

@@ -10,6 +10,7 @@ import {
 import {
   runDockerNetworkContainerCount,
   runDockerNetworkCreateBridge,
+  runDockerNetworkCreateBridgeWithSubnet,
   runDockerNetworkExists,
   runDockerNetworkRemove
 } from "../shell/docker.js"
@@ -20,6 +21,54 @@ const protectedNetworkNames = new Set(["bridge", "host", "none"])
 const isProtectedNetwork = (networkName: string, sharedNetworkName: string): boolean =>
   protectedNetworkNames.has(networkName) || networkName === sharedNetworkName
 
+const sharedNetworkFallbackSubnets: ReadonlyArray<string> = [
+  "10.250.0.0/24",
+  "10.251.0.0/24",
+  "10.252.0.0/24",
+  "10.253.0.0/24",
+  "172.31.250.0/24",
+  "172.31.251.0/24",
+  "172.31.252.0/24",
+  "172.31.253.0/24",
+  "192.168.250.0/24",
+  "192.168.251.0/24"
+]
+
+const createSharedNetworkWithSubnetFallback = (
+  cwd: string,
+  networkName: string
+): Effect.Effect<boolean, PlatformError, CommandExecutor> =>
+  Effect.gen(function*(_) {
+    for (const subnet of sharedNetworkFallbackSubnets) {
+      const created = yield* _(
+        runDockerNetworkCreateBridgeWithSubnet(cwd, networkName, subnet).pipe(
+          Effect.as(true),
+          Effect.catchTag("DockerCommandError", (error) =>
+            Effect.logWarning(
+              `Shared network create fallback failed (${networkName}, subnet ${subnet}, exit ${error.exitCode}); trying next subnet.`
+            ).pipe(Effect.as(false))
+          )
+        )
+      )
+      if (created) {
+        yield* _(Effect.log(`Created shared Docker network ${networkName} with subnet ${subnet}.`))
+        return true
+      }
+    }
+    return false
+  })
+
+const ensureSharedNetworkExists = (
+  cwd: string,
+  networkName: string
+): Effect.Effect<void, DockerCommandError | PlatformError, CommandExecutor> =>
+  runDockerNetworkCreateBridge(cwd, networkName).pipe(
+    Effect.catchTag("DockerCommandError", (error) =>
+      createSharedNetworkWithSubnetFallback(cwd, networkName).pipe(
+        Effect.flatMap((created) => (created ? Effect.void : Effect.fail(error)))
+      ))
+  )
+
 // CHANGE: ensure shared docker network exists before compose up
 // WHY: avoid compose failures when using `external: true` shared network mode
 // QUOTE(ТЗ): "Что бы текущие проекты не ложились"
@@ -44,7 +93,7 @@ export const ensureComposeNetworkReady = (
       exists
         ? Effect.void
         : Effect.log(`Creating shared Docker network: ${networkName}`).pipe(
-          Effect.zipRight(runDockerNetworkCreateBridge(cwd, networkName))
+          Effect.zipRight(ensureSharedNetworkExists(cwd, networkName))
         ))
   )
 }

packages/lib/src/usecases/projects-ssh.ts

@@ -131,7 +131,8 @@ export const connectProjectSsh = (
         [0, 130],
         (exitCode) => new CommandFailedError({ command: "ssh", exitCode })
       )
-    )
+    ),
+    Effect.ensuring(ensureTerminalCursorVisible())
   )
 
 // CHANGE: ensure docker compose is up before SSH connection

packages/lib/src/usecases/projects-up.ts

@@ -27,6 +27,16 @@ import { parseComposePsOutput } from "./projects-core.js"
 
 const maxPortAttempts = 25
 
+const syncManagedProjectFiles = (
+  projectDir: string,
+  template: TemplateConfig
+): Effect.Effect<void, FileExistsError | PlatformError, FileSystem | Path> =>
+  Effect.gen(function*(_) {
+    yield* _(Effect.log(`Applying docker-git templates in ${projectDir} before docker compose up...`))
+    yield* _(writeProjectFiles(projectDir, template, true))
+    yield* _(ensureCodexConfigFile(projectDir, template.codexAuthPath))
+  })
+
 // CHANGE: update template port when the preferred SSH port is reserved or busy
 // WHY: keep each project on a unique port even across restarts
 // QUOTE(ТЗ): "Почему контейнер пытается подниматься на существующий порт?"
@@ -95,8 +105,7 @@ export const runDockerComposeUpWithPortCheck = (
       ? config.template
       : yield* _(ensureAvailableSshPort(projectDir, config))
     // Keep generated templates in sync with the running CLI version.
-    yield* _(writeProjectFiles(projectDir, updated, true))
-    yield* _(ensureCodexConfigFile(projectDir, updated.codexAuthPath))
+    yield* _(syncManagedProjectFiles(projectDir, updated))
     yield* _(ensureComposeNetworkReady(projectDir, updated))
     yield* _(runDockerComposeUp(projectDir))
 

packages/lib/src/usecases/terminal-cursor.ts

@@ -1,6 +1,22 @@
 import { Effect } from "effect"
 
-const cursorVisibleEscape = "\u001B[?25h"
+const terminalSaneEscape =
+  "\u001B[0m" + // reset rendition
+  "\u001B[?25h" + // show cursor
+  "\u001B[?1l" + // normal cursor keys mode
+  "\u001B>" + // normal keypad mode
+  "\u001B[?1000l" + // disable mouse click tracking
+  "\u001B[?1002l" + // disable mouse drag tracking
+  "\u001B[?1003l" + // disable any-event mouse tracking
+  "\u001B[?1005l" + // disable UTF-8 mouse mode
+  "\u001B[?1006l" + // disable SGR mouse mode
+  "\u001B[?1015l" + // disable urxvt mouse mode
+  "\u001B[?1007l" + // disable alternate scroll mode
+  "\u001B[?1004l" + // disable focus reporting
+  "\u001B[?2004l" + // disable bracketed paste
+  "\u001B[>4;0m" + // disable xterm modifyOtherKeys
+  "\u001B[>4m" + // reset xterm modifyOtherKeys
+  "\u001B[<u" // disable kitty keyboard protocol
 
 const hasInteractiveTty = (): boolean => process.stdin.isTTY && process.stdout.isTTY
 
@@ -19,5 +35,8 @@ export const ensureTerminalCursorVisible = (): Effect.Effect<void> =>
     if (!hasInteractiveTty()) {
       return
     }
-    process.stdout.write(cursorVisibleEscape)
+    if (typeof process.stdin.setRawMode === "function") {
+      process.stdin.setRawMode(false)
+    }
+    process.stdout.write(terminalSaneEscape)
   })