Operational follow-ups for paste-image endpoint (#84)

[Ark0N]

Operational gaps in the paste-image endpoint introduced in #84 — non-security, but worth filing so they don't get lost.

1. No rate-limit and no GC for .claude-images/

The endpoint enforces a 10MB per-request cap (src/web/server.ts:929-936) but no aggregate cap, no per-IP token-bucket, and cleanup only runs when killMux=true on session destroy. Soft-closed sessions leave their image dirs on disk indefinitely. An authenticated user (or anyone if CODEMAN_PASSWORD is unset and the instance is tunneled) can loop 10MB POSTs to fill the disk.

Fix: add a per-IP token-bucket on /api/sessions/:id/paste-image (e.g., 30/min, 100MB/hr); reject if du -s .claude-images/ exceeds a per-session cap; periodic GC of files older than 7 days even without killMux=true.

2. Filename collision on same-millisecond uploads

paste-${Date.now()}${ext} (src/web/routes/session-routes.ts:~1545) collides under concurrent paste from two browser tabs. Last-write-wins overwrites the prior file silently, and the response's path still references the (now-overwritten) name — the first uploader's terminal @-mentions a file whose contents are the second uploader's image.

Fix: append randomBytes(8).toString('hex') (or use randomUUID()) so concurrent uploads never collide.

3. Bracketed-paste bypass on Ctrl+V

The Ctrl+V interceptor in src/web/public/terminal-ui.js:86-92 swallows all paste events and re-sends text via sendInput(), which strips xterm's bracketed-paste markers. Claude CLI / bash can no longer distinguish "typed" from "pasted" text — relevant to prompt-injection defences in Claude Code, which treat bracketed-paste content differently.

Fix: detect "no image" early and return true from customKeyEventHandler so xterm's native paste flow handles the text path with bracketed-paste preserved.

[Ark0N]

Closing — all three items were addressed by #90 (commit 101cee0, merged 2026-05-19). PR #90 didn't reference this issue in its body, which is why it didn't auto-close.

Mapping:

Item	PR #90 commit	Where it lives now
1. Rate-limit + GC for .claude-images/	bc597e0	consumePasteToken token-bucket (30/min per IP+session) in src/web/routes/session-routes.ts:172; hourly GC of paste-* files older than 7d in new src/web/paste-image-gc.ts, started/stopped from WebServer.start/stop
2. Filename collision on same-ms uploads	2ff9d26	src/web/routes/session-routes.ts:1655 — paste-${Date.now()}-${randomBytes(4).toString('hex')}${ext}
3. Bracketed-paste bypass on Ctrl+V	41e6009	src/web/public/image-input.js:98 — text-only paste now goes through terminal.paste(text) so xterm preserves bracketed-paste markers (CSI 200~ ... CSI 201~); the Ctrl+V interceptor in terminal-ui.js only routes to image-input.js's handler now

If any of these don't match the original intent or have a hole I missed, reopen and I'll dig in.