feat: Tab-based terminal UI with optional tmux

[dgokeeffe]

Summary

• Tab-based UI as default: New TabManager class replaces the grid layout as the default experience. Clean tab bar with add (+), close (X), and keyboard cycling (Ctrl+Shift+N).
• Mode toggle: Users can switch between tabs and grid modes. Persisted in localStorage. Server-configurable default via TERMINAL_MODE env var.
• Optional tmux: TMUX_ENABLED=false creates raw PTY sessions without tmux. New GET /api/active-sessions endpoint enables session reconnection without tmux.
• Polling optimization: In tab mode, only the active tab HTTP-polls; hidden tabs receive output via WebSocket only.
• 151 tests passing (29 new), 26/26 TDD gate tests green, 14/14 live validation checks pass.

Changes

File	Change
app.py	/api/active-sessions endpoint, TMUX_ENABLED gating in session creation, pane_id tracking
static/index.html	TabManager class, tab bar CSS, mode toggle button (position:fixed), batchPoll filtering, restoreOrCreate for non-tmux mode
app.yaml.template	Commented TERMINAL_MODE and TMUX_ENABLED env vars
tests/test_tab_ui.py	22 frontend structure tests
tests/test_active_sessions.py	7 backend endpoint tests

Test plan

• TDD gate tests: 26/26 machine gates pass (uv run pytest tests/gates/ -x)
• Full suite: 151 pass, 2 pre-existing failures (unrelated test_mlflow_tracing.py)
• Live validation: backend API (6/6), frontend render (3/3), frontend interaction (5/5)
• Manual: grid-to-tab focus preservation (AC-7)
• Manual: tmux reconnect on refresh (AC-10)
• Manual: session cleanup after 120s timeout (AC-12)

🤖 Generated with Claude Code

[datasciencemonkey]

Hey David! Thanks for the work on PR #38 : the enterprise hardening stuff (tmux persistence, auth, security headers, state sync, git credential helper) is really solid.

We've been working in parallel on a frontend overhaul on feat/multi-tab-terminals (PR #46) — tab-based UI, 8 themes, font picker, search, voice dictation, keyboard shortcuts modal, splash screen, etc. The two PRs conflict heavily on static/index.html since both rewrote the frontend.

The backends are mostly compatible though. Your additions are additive to the existing Flask+PTY core. Would you be open to splitting #38 into two PRs?

1. Backend — tmux, auth middleware, security headers, OAuth M2M, state sync, git credential helper, CI workflow
2. Frontend — grid layout UI

That way we can merge your backend first, then rebase our frontend on top and get the best of both — your enterprise backend with our UX layer. Let me know what you think!

[datasciencemonkey]

Auth: OAuth M2M concern

The M2M token refresh path worries me from a multi-user perspective. The typical failure mode we've seen:

• Team shares a single service principal + token across all users
• All terminal actions audit as the SP identity, not the individual user
• SP gets granted broad permissions to cover everyone's needs
• Token gets copied into .env files, Slack, notebooks — token sprawl
• Can't revoke one user's access without revoking everyone's

For CoDA specifically, the better pattern is OAuth on-behalf-of-user — Databricks Apps injects a short-lived DATABRICKS_TOKEN scoped to the logged-in user automatically. The databricks-sdk picks this up with zero config. Each user's actions are audited under their own identity and bounded by their existing UC permissions.

M2M is the right choice for headless/automated workloads (jobs, pipelines, CI/CD) — but for an interactive app with named users, delegated user identity is strictly better.

Suggestion: Can we gate the M2M path behind an explicit opt-in env var (e.g. CODA_USE_M2M=true) with a warning in the docs that shared SPs break per-user auditing? That way it's available for edge cases but not the default path users reach for.