feat: add terminal session management with HTTP/WebSocket routes and session history

README.md

@@ -310,8 +310,9 @@ and `/dashboard` routes belong to the Nest server.
 
 The Nest dashboard includes a fleet overview, searchable machine collection,
 private network and port-policy view, host diagnostics, and machine provisioning.
-Open a machine to manage its lifecycle, edit or sync its port rules, copy its SSH
-command, or read recent logs. Select machines in the collection for bulk operations.
+Open a machine to manage its lifecycle, launch terminal sessions, edit or sync
+its port rules, copy its SSH command, or read recent logs. Select machines in the
+collection for bulk operations.
 Use `Ctrl+K` / `⌘K` (or `/`) to find a machine or page. Fleet data refreshes every
 five seconds while the tab is visible; host checks refresh every thirty seconds
 and can also be run manually. Charts show observed machine states and allocated
@@ -342,6 +343,11 @@ The server exposes these routes:
 | `POST` | `/vms/{vm_id}/exec` | Execute a command/script inside a running VM over vsock, with optional root privileges |
 | `POST` | `/vms/{vm_id}/agent/install` | Install/upgrade the execution agent on a stopped VM's private disk |
 | `GET` | `/vms/{identifier}/logs` | Read a bounded, non-following tail of a VM log |
+| `GET` | `/vms/{vm_id}/sessions` | List this VM's saved sessions (Nest) |
+| `POST` | `/vms/{vm_id}/sessions` | Launch a guest terminal; body: `{}` or `{"rows":24,"cols":80}` (Nest) |
+| `GET` | `/vms/{vm_id}/sessions/{session_id}` | Session metadata and status (Nest) |
+| `POST` | `/vms/{vm_id}/sessions/{session_id}/close` | End the shell and retain its history (Nest) |
+| `WS` | `/vms/{vm_id}/sessions/{session_id}/terminal` | Authenticated terminal input, output, resize, and replay (Nest) |
 
 API port rules are objects such as `{"port": 80, "protocol": "HTTP"}`;
 `no_default_ports` is a boolean, default `false`. Create also accepts `storage`,
@@ -359,6 +365,43 @@ Bulk requests use an action (`start`, `stop`, `restart`, `delete`, or
 for each fixed target and do not prompt for confirmation. Interactive SSH
 remains CLI-only. The API and dashboard are not background reconcilers.
 
+### MicroVM Terminal Sessions
+
+Open **Machines → select a microVM → Sessions**, then click **Launch session**.
+Each session opens an interactive guest shell in the dashboard, with terminal
+colors, keyboard input, Ctrl+C, resizing, and persistent shell state such as the
+working directory. Sessions run as the VM's configured guest user; normal guest
+`sudo` commands can request that user's password in the terminal.
+
+The history list belongs to the selected VM. Reopen an active session to
+continue using the same shell, or select an ended session to view its saved
+output. Navigation, browser reloads, and signing out leave the shell running.
+**End session** closes the shell and its processes. Stopping/restarting the VM
+or the Nest server ends live sessions; their saved history remains available.
+
+Nest stores session metadata and the latest **8 MiB of output per session** in
+`$UVM_BASE/nest/sessions.sqlite3` (default `/var/lib/uvm/nest/sessions.sqlite3`).
+The viewer indicates truncated output. Raw keyboard input is not logged
+separately; the transcript contains what the guest terminal outputs. History
+files are private to the host account running Nest. One Nest server owns
+sessions for a given VM registry at a time, with up to 32 active sessions; the
+guest agent shares its eight connection slots between terminals and exec calls.
+
+For existing VMs, use **stop → Sessions → Guest terminal setup → Install / update
+terminal support → start** once. Newly built v5 Ubuntu images include terminal
+support; cached v4 templates are upgraded during new-VM provisioning. The same
+guest-agent/kernel requirements described below apply to terminals.
+
+Terminal support adds the Python `websockets` dependency. In your micromamba
+environment, install the current project and launch with its interpreter:
+
+```sh
+micromamba activate nest
+python -m pip install -e '.[test]'
+sudo env UVM_API_TOKEN="$UVM_API_TOKEN" \
+  "$CONDA_PREFIX/bin/python" -m nest --serve
+```
+
 ### Execute Commands Without SSH
 
 Use an exact VM ID from create/list: