refactor(pty): rename model-facing tools to terminal_* and harden teardown

Rename the six model-facing tools pty_* -> terminal_* and align every
description, guidance section, ACP card title, and rendered result to
terminal terminology. Package and service internals keep their technical
PTY names (PtyService, "unknown PTY session", node-pty).

Harden the local backend teardown:
- a failed close is retryable: drop the memoized rejection so a later
  terminal_close re-runs against the live process table
- service disposal clears the backend, reservation, and owner-cleanup
  registries even when a close fails
- stop readiness polling before teardown so an in-flight send settles as
  session_exit instead of a mis-inferred wait reason
- bound the sanitizer's pending buffer against unterminated escape runs

Update the tool catalog, package READMEs, the bilingual Agent Note, and the
acp/headless pty-tools snapshots to match.

packages/pty/pty-local/tests/sanitize.spec.ts

@@ -3,7 +3,7 @@ import { normalizeTerminalText, TerminalSanitizer } from '@deepseek-ai/dsh-pty-l
 
 describe('TerminalSanitizer', () => {
   it('removes split CSI and owned OSC prompt markers', () => {
-    const sanitizer = new TerminalSanitizer()
+    const sanitizer = new TerminalSanitizer(64)
     expect(sanitizer.push('red\x1b[3')).toEqual({ text: 'red', prompt: false })
     expect(sanitizer.push('1m text\x1b[0m\r\n')).toEqual({ text: ' text\n', prompt: false })
     expect(sanitizer.push('\x1b]133;')).toEqual({ text: '', prompt: false })
@@ -11,7 +11,7 @@ describe('TerminalSanitizer', () => {
   })
 
   it('drops unrelated OSC, short escapes, BEL, and incomplete trailing escape', () => {
-    const sanitizer = new TerminalSanitizer()
+    const sanitizer = new TerminalSanitizer(64)
     expect(sanitizer.push('a\x1b]0;title\x1b\\b\x1b7c\x07')).toEqual({ text: 'abc', prompt: false })
     expect(sanitizer.push('tail\x1b')).toEqual({ text: 'tail', prompt: false })
     expect(sanitizer.flush()).toBe('')
@@ -24,4 +24,39 @@ describe('TerminalSanitizer', () => {
   it('normalizes CRLF and standalone carriage returns', () => {
     expect(normalizeTerminalText('a\r\nb\rc\x07')).toBe('a\nb\nc')
   })
+
+  it('bounds and discards unterminated control sequences through their terminators', () => {
+    const oscBel = new TerminalSanitizer(8)
+    expect(oscBel.push(`\x1b]0;${'x'.repeat(16)}`)).toEqual({ text: '', prompt: false })
+    expect(oscBel.push('more\x07tail')).toEqual({ text: 'tail', prompt: false })
+
+    const oscSt = new TerminalSanitizer(8)
+    oscSt.push(`\x1b]0;${'x'.repeat(16)}`)
+    expect(oscSt.push('more\x1b')).toEqual({ text: '', prompt: false })
+    expect(oscSt.push('\\tail')).toEqual({ text: 'tail', prompt: false })
+
+    const oscDirectSt = new TerminalSanitizer(8)
+    oscDirectSt.push(`\x1b]0;${'x'.repeat(16)}`)
+    expect(oscDirectSt.push('more\x1b\\tail')).toEqual({ text: 'tail', prompt: false })
+
+    const oscFalseSt = new TerminalSanitizer(8)
+    oscFalseSt.push(`\x1b]0;${'x'.repeat(16)}`)
+    oscFalseSt.push('\x1b')
+    expect(oscFalseSt.push('more')).toEqual({ text: '', prompt: false })
+    expect(oscFalseSt.push('\x07tail')).toEqual({ text: 'tail', prompt: false })
+
+    const oscNonTerminatingEscape = new TerminalSanitizer(8)
+    oscNonTerminatingEscape.push(`\x1b]0;${'x'.repeat(16)}`)
+    expect(oscNonTerminatingEscape.push('more\x1bxmore\x07tail')).toEqual({ text: 'tail', prompt: false })
+
+    const csi = new TerminalSanitizer(8)
+    expect(csi.push(`\x1b[${'1'.repeat(16)}`)).toEqual({ text: '', prompt: false })
+    expect(csi.push('123')).toEqual({ text: '', prompt: false })
+    expect(csi.push('mtext')).toEqual({ text: 'text', prompt: false })
+
+    const flushed = new TerminalSanitizer(8)
+    flushed.push(`\x1b]0;${'x'.repeat(16)}`)
+    expect(flushed.flush()).toBe('')
+    expect(flushed.push('text')).toEqual({ text: 'text', prompt: false })
+  })
 })

packages/pty/pty-local/tests/session.spec.ts

@@ -124,9 +124,9 @@ describe('LocalPtySession readiness and output', () => {
     vi.useFakeTimers()
     const terminal = new FakeTerminal()
     const inspector = new FakeInspector()
-    inspector.pgid = undefined
     const session = new LocalPtySession(terminal.asPty(), inspector, config())
     await initialize(session, terminal)
+    inspector.pgid = undefined
 
     const inferred = session.startSend({ text: 'sleep', submit: false })
     terminal.emitData('working')
@@ -238,6 +238,27 @@ describe('LocalPtySession readiness and output', () => {
     await vi.advanceTimersByTimeAsync(100)
     await timedOut
   })
+
+  it('trusts prompt markers only while the startup shell owns the foreground group', async () => {
+    vi.useFakeTimers()
+    const terminal = new FakeTerminal()
+    const inspector = new FakeInspector()
+    const session = new LocalPtySession(terminal.asPty(), inspector, config())
+    await initialize(session, terminal)
+
+    const operation = session.startSend({ text: 'run', submit: true })
+    let settled = false
+    void operation.done.then(() => { settled = true })
+    inspector.pgid = 789
+    terminal.emitData('\x1b]133;D;0\x07spoofed')
+    await vi.advanceTimersByTimeAsync(10)
+    expect(settled).toBe(false)
+
+    inspector.pgid = 456
+    terminal.emitData('\x1b]133;D;0\x07dsh> ')
+    await vi.advanceTimersByTimeAsync(10)
+    expect((await operation.done).waitReason).toBe('stdin_read')
+  })
 })
 
 describe('LocalPtySession bounds, signals, and teardown', () => {
@@ -278,7 +299,7 @@ describe('LocalPtySession bounds, signals, and teardown', () => {
     const session = new LocalPtySession(terminal.asPty(), inspector, config())
     expect(await session.signal('SIGINT')).toEqual({ delivered: true, targetPgid: 456 })
     inspector.pgid = terminal.pid
-    await expect(session.signal('SIGKILL')).rejects.toThrow('use pty_kill')
+    await expect(session.signal('SIGKILL')).rejects.toThrow('use terminal_close')
     inspector.pgid = undefined
     await expect(session.signal('SIGTERM')).rejects.toThrow('cannot resolve')
   })
@@ -297,6 +318,23 @@ describe('LocalPtySession bounds, signals, and teardown', () => {
     expect(() => session.startSend({ text: '', submit: false })).toThrow('closing')
   })
 
+  it('settles an active send as session_exit when closed mid-operation', async () => {
+    vi.useFakeTimers()
+    const terminal = new FakeTerminal()
+    const session = new LocalPtySession(terminal.asPty(), new FakeInspector(), config({ disposeGraceMs: 50 }))
+    await initialize(session, terminal)
+    const operation = session.startSend({ text: 'run', submit: true })
+    // The shell returns to its prompt while the send is active; a running
+    // readiness poll would otherwise mis-settle this as stdin_read once close
+    // begins, so teardown must stop polling before its grace period.
+    terminal.emitData('\x1b]133;D;0\x07dsh> ')
+    terminal.throwKill = true
+    const closing = session.close('mid-send')
+    await vi.advanceTimersByTimeAsync(60)
+    expect((await operation.done).waitReason).toBe('session_exit')
+    await closing
+  })
+
   it('waits for SIGKILL recipients to leave the process table after the shell exits', async () => {
     vi.useFakeTimers()
     const terminal = new FakeTerminal()