Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@cmd/wsh/cmd/wshcmd-attach.go`:
- Around line 11-22: The attach command advertises a --list mode but never
registers or handles that flag; add a boolean flag to attachCmd (e.g.,
Flags().Bool("list", false, "...")) and update attachRun to check that flag
early: when true, call the existing pkg/waveattach.ListTermBlocks selector
function to fetch the blocks, print or format the list to stdout, and return nil
(skip normal attach flow). Ensure the flag is declared on the attachCmd variable
(not root) and that attachRun uses cmd.Flags().GetBool("list") to branch before
attempting to parse a block id or perform the attach logic.

In `@pkg/waveattach/attach.go`:
- Around line 267-275: The current read-only attach path forwards local stdin to
the remote via sendInput after pk.feed, which enables remote writes; stop
forwarding by removing the sendInput call in the branch that handles filtered
input (the code invoking pk.feed and sendInput) so that pk.feed returns and any
output is handled locally (via the out buffer) only; also remove or guard the
identical sendInput usage in the similar block around the other occurrence (the
one you noted at 304-310) so ControllerInputCommand is not generated remotely
and input remains local-only unless an explicit opt-in mode is added.

In `@pkg/waveattach/auth_test.go`:
- Around line 24-27: The fallback tests can be escaped if the environment has
XDG_DATA_HOME set; update the fallback tests (e.g.,
TestResolveDataDir_FallbackProd and the other fallback tests in this file) to
explicitly clear XDG_DATA_HOME at their start by calling
t.Setenv("XDG_DATA_HOME", "") so ResolveDataDir() will use the temporary HOME
fallback; apply the same t.Setenv call to the other two fallback test functions
in this file.

In `@pkg/waveattach/auth.go`:
- Around line 64-69: ResolveDataDir currently returns the first existing
candidate dir which may be stale; change it to only return a candidate that
actually hosts a running Wave instance by checking for the required
socket/database (e.g. check filepath.Join(candidate, "wave.sock") exists and is
connectable, or the DB file) and continue iterating on error; alternatively (or
additionally) update Connect to not treat a single failed connect as fatal but
continue through the candidates list until a successful net.Dial/connection to
"wave.sock" is made, referencing ResolveDataDir and Connect to implement the
socket existence/connectivity check and iteration logic.

In `@pkg/waveattach/promptsp_test.go`:
- Around line 35-64: TestPromptSP_RealData reads fixtures from /tmp which makes
the unit test non-hermetic; change it to load fixtures from a repo-controlled
test corpus (e.g., testdata/) or require an explicit integration opt-in.
Specifically, update TestPromptSP_RealData to look for files under "testdata"
(not /tmp) and call t.Skipf if they are absent, or alternatively guard the whole
test with testing.Short() or a custom -integration flag so it only runs when
explicitly enabled; keep the existing logic that writes to newViewport and calls
vp.Write/vp.Render unchanged except for the new file paths/gating. Ensure any
added flag or skip logic is documented in the test comment.

In `@pkg/waveattach/screen.go`:
- Around line 293-301: The current workaround in the render pass unconditionally
replaces any cell where ch == "%" and cell.AttributeData.IsBold()/IsInverse()
with a space, which can erase legitimate content; instead, narrow the rule to
the actual PROMPT_SP artifact by detecting its exact signature before mutating
rendered cells: relocate this logic out of the generic renderer into the
terminal input/event processing where raw sequences are available (the code that
decodes incoming terminal bytes), or at minimum check for a stronger
prompt-specific pattern (e.g., the single-cell bold+inverse '%' that appears at
the prompt input column/rightmost column immediately after a wrap/no-content
cell and not surrounded by other styled cells) before changing ch, and only
mutate the exact matching cell (use the same identifiers ch, cell,
cell.AttributeData.IsBold/IsInverse to implement the more specific match).

In `@pkg/wshutil/wshrpc.go`:
- Around line 432-438: The main dispatch loop (runServer) currently calls
handleEventRecv synchronously for every Command_EventRecv, which blocks
runServer because handleEventRecv -> EventListener.RecvEvent executes listener
callbacks inline; instead, create a dedicated ordered event processor (a
buffered channel + single goroutine) and send EventRecv messages to it from
runServer so only that processor serializes arrival order; inside that processor
call handleEventRecv sequentially for events that require ordering (e.g.,
PTY/ordered stream event types determined from msg.Event.Type), but for other
EventRecv types dispatch to listeners asynchronously (goroutine per listener or
worker pool) to avoid stalling runServer and exitCh; update runServer to push to
the new queue rather than calling handleEventRecv directly and ensure the
controller-status listener remains non-blocking or uses a buffered exitCh.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@emain/remotemode.ts`:
- Around line 22-24: The code treats "--remote-host" without a following value
as null; change the parsing so that when a === "--remote-host" you validate
argv[i+1] exists and is not another flag (e.g., doesn't start with '-') and if
it is missing or looks like a flag, throw an error or call process.exit(1) with
a clear message instead of setting value to null; update the matching block(s)
that set value = argv[i + 1] ?? null (including the similar code around lines
31-35) to perform this presence/format check and fail fast when the flag is
provided without a valid host argument.

In `@pkg/waveattach/screen.go`:
- Around line 19-28: renderedCell currently lacks text attribute flags so
attribute-only changes
(bold/italic/dim/blink/inverse/invisible/strikethrough/overline) are ignored and
rendering is skipped; add a bitfield (e.g. attrs uint32 or similar) to the
renderedCell struct, compute the attribute flags in the render loop where cells
are prepared (the place that currently sets
ch/fg/bg/width/underlineStyle/underlineColor), store them into renderedCell, and
update the SGR emission/comparison logic (the block that decides whether to emit
SGR and skips rendering when cells match) to include the new attrs field so
attribute-only changes trigger re-rendering. Ensure the attribute bits cover
bold, italic, dim, blink, inverse, invisible, strikethrough and overline and are
used wherever renderedCell equality is checked.

---

Outside diff comments:
In `@emain/emain-log.ts`:
- Around line 49-53: Prune logic still only matches /^waveapp\.(\d+)\.log$/
while rotateLogIfNeeded writes files as `${LogBaseName}.${n}.log`; update the
pruning match to use the actual LogBaseName rather than hardcoded "waveapp". In
the function that builds logFiles (and any prune-related code), replace the
literal regex with a dynamic one constructed from LogBaseName (escape it if
needed) to capture the numeric suffix (e.g., new
RegExp(`^${escapedLogBaseName}\\.(\\d+)\\.log$`)), so rotated logs created in
remote mode are discovered and cleaned up. Ensure references: rotateLogIfNeeded,
LogBaseName, and the prune/logFiles collection code are updated accordingly.

---

Nitpick comments:
In `@schema/settings.json`:
- Around line 355-360: The schema currently defines "remote:password" (type
string) and "remote:listenport" (type integer) without validation; update the
schema to add basic constraints so invalid values are rejected: for
"remote:password" add a minLength (e.g., 1) and optionally a maxLength, and for
"remote:listenport" add minimum and maximum bounds (e.g., minimum 1 and maximum
65535) to enforce valid TCP port ranges; keep the same property names
("remote:password", "remote:listenport") and types when adding these validation
keys.