Add web-based terminal with WebSocket shell access

[Copilot]

Web-based terminal for admin users, accessible at /terminal. Spawns a real shell process over WebSocket with bidirectional I/O.

Changes

• terminal/terminal.go — New package: HTTP handler (admin-only via auth.RequireAdmin), WebSocket handler bridging stdin/stdout/stderr to a bash process, embedded HTML/CSS/JS template
• terminal/terminal_test.go — Unit tests for shell detection, rendering, responsive styles
• main.go — Route registration (/terminal, /terminal/ws), auth config, logging exclusion
• app/app.go — Terminal link added to nav sidebar
• app/html/terminal.png — Nav icon

Frontend

Mobile-friendly dark terminal UI with command history (↑/↓), auto-scroll, color-coded output (blue commands, red errors), click-to-focus. Responsive down to 600px.

Security

Both the page handler and WebSocket endpoint require admin auth. No new dependencies — reuses existing gorilla/websocket. CodeQL clean.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.coinbase.com
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• arb1.arbitrum.io
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :9090 --de�� _.a --debug-prefix-m-ifaceassert ux_amd64/vet -I ernal/telemetry -I ux_amd64/vet -W 7RiLWObj0 .cfg ux_amd64/vet . --gdwarf2 --64 ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :9090 8224�� C3aMQqfn5 ache/go/1.24.12/x64/src/crypto/i-ifaceassert ux_amd64/vet -g" /tmp/go-build149--norc -I ux_amd64/vet -o elemetry.io/otel@v1.36.0/attribu-p .cfg x64/pkg/tool/linux_amd64/vet ache/go/1.24.12/bash vendor/golang.or--norc -lang=go1.24 x64/pkg/tool/linux_amd64/vet (dns block)
• eth.llamarpc.com
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :9090 --de�� _.a --debug-prefix-m-ifaceassert ux_amd64/vet -I ernal/telemetry -I ux_amd64/vet -W 7RiLWObj0 .cfg ux_amd64/vet . --gdwarf2 --64 ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :9090 8224�� C3aMQqfn5 ache/go/1.24.12/x64/src/crypto/i-ifaceassert ux_amd64/vet -g" /tmp/go-build149--norc -I ux_amd64/vet -o elemetry.io/otel@v1.36.0/attribu-p .cfg x64/pkg/tool/linux_amd64/vet ache/go/1.24.12/bash vendor/golang.or--norc -lang=go1.24 x64/pkg/tool/linux_amd64/vet (dns block)
• feeds.bbci.co.uk
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• feeds.publicradio.org
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• mainnet.base.org
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :9090 --de�� _.a --debug-prefix-m-ifaceassert ux_amd64/vet -I ernal/telemetry -I ux_amd64/vet -W 7RiLWObj0 .cfg ux_amd64/vet . --gdwarf2 --64 ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :9090 8224�� C3aMQqfn5 ache/go/1.24.12/x64/src/crypto/i-ifaceassert ux_amd64/vet -g" /tmp/go-build149--norc -I ux_amd64/vet -o elemetry.io/otel@v1.36.0/attribu-p .cfg x64/pkg/tool/linux_amd64/vet ache/go/1.24.12/bash vendor/golang.or--norc -lang=go1.24 x64/pkg/tool/linux_amd64/vet (dns block)
• mainnet.optimism.io
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :9090 --de�� _.a --debug-prefix-m-ifaceassert ux_amd64/vet -I ernal/telemetry -I ux_amd64/vet -W 7RiLWObj0 .cfg ux_amd64/vet . --gdwarf2 --64 ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :9090 8224�� C3aMQqfn5 ache/go/1.24.12/x64/src/crypto/i-ifaceassert ux_amd64/vet -g" /tmp/go-build149--norc -I ux_amd64/vet -o elemetry.io/otel@v1.36.0/attribu-p .cfg x64/pkg/tool/linux_amd64/vet ache/go/1.24.12/bash vendor/golang.or--norc -lang=go1.24 x64/pkg/tool/linux_amd64/vet (dns block)
• metadata.google.internal
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• news.ycombinator.com
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• reminder.dev
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• rss.art19.com
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• rss.wbur.org
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• search.cnbc.com
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• techcrunch.com
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• www.aljazeera.com
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• www.coindesk.com
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)
• www.theguardian.com
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 -o _.a 49822450/b115//_-ifaceassert ux_amd64/vet -p nal 822450/b115/ ux_amd64/vet -I 0/secure/bidirul-errorsas 0/secure/bidirul-ifaceassert ux_amd64/vet 822450/b115/ --64 (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 /tmp/go-build528506379/b538/vet.cfg /trace/events.go-errorsas /trace/histogram-ifaceassert ux_amd64/vet -p path/filepath -lang=go1.24 ux_amd64/vet o_.o�� /sdk@v1.1.0/inte--log-target /sdk@v1.1.0/intejournal-or-kmsg ux_amd64/vet --gdwarf-5 822450/b182/ -o ux_amd64/vet (dns block)
  • Triggering command: /tmp/mu-server /tmp/mu-server --serve --address :8080 8224�� 1.73.0/internal/-errorsas 1.73.0/internal/-ifaceassert ux_amd64/vet -p golang.org/x/cry--norc -lang=go1.23 ux_amd64/vet bis .243.0/transport/http/dial.go om/modern-go/reflect2@v1.0.2/rel-ifaceassert ux_amd64/vet --gdwarf-5 balancerload -o ux_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Terminal</issue_title>
<issue_description>One of the most annoying issues as a developer is not having a web based terminal. Having access to Shelley on exe.dev was pretty amazing. So having a mobile friendly terminal would be really useful. And then we can venture into agents again if needed. Implement a web based terminal or shell that offers ability to access a file system, ssh, etc and is mobile friendly.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Terminal #83

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.