libtmux-mcp 0.1.0.alpha.1

data/lib/libtmux/mcp/process_identity.rb

@@ -0,0 +1,271 @@
+# frozen_string_literal: true
+
+require "fiddle"
+require "socket"
+
+module LibTmux
+  module MCP
+    # Descriptors observe borrowed processes; this class never signals or reaps.
+    class ProcessIdentity
+      PEER_PIDFD = 77 # Linux asm-generic/socket.h, available since Linux 6.6.
+      private_constant :PEER_PIDFD
+      module CleanupDetails
+        attr_reader :mcp_cleanup_errors
+      end
+
+      def self.attach_cleanup(failure, errors)
+        if failure.is_a?(LibTmux::Error)
+          failure.__send__(:attach_cleanup_errors, errors)
+        else
+          failure.extend(CleanupDetails)
+          failure.instance_variable_set(:@mcp_cleanup_errors, ((failure.mcp_cleanup_errors || []) + errors).freeze)
+        end
+      end
+
+      class Resources
+        def initialize(*ios)
+          @ios = ios
+        end
+
+        def add(io)
+          @ios << io
+          io
+        end
+
+        def release(*ios)
+          @ios -= ios
+        end
+
+        def empty?
+          @ios.empty?
+        end
+
+        def close
+          errors = []
+          @ios.dup.each do |io|
+            begin
+              io.close unless io.closed?
+            rescue Exception => error
+              errors << "native observer close failed (#{error.class})"
+            ensure
+              @ios.delete(io) if io.closed?
+            end
+          end
+          raise TransportError.new("native observer cleanup failed", phase: :retire, cleanup_errors: errors) unless errors.empty?
+
+          nil
+        end
+      end
+
+      attr_reader :io, :peer, :generation, :pid
+
+      def self.native(name, arguments, result)
+        unless /\A(?:(?:x86_64|aarch64)-linux|(?:x86_64|arm64)-darwin)/.match?(RUBY_PLATFORM) && Fiddle::SIZEOF_LONG == 8
+          raise UnsupportedFeatureError.new("process cursors require 64-bit Linux or Darwin", phase: :admission)
+        end
+        Fiddle::Function.new(Fiddle::Handle::DEFAULT[name], arguments, result)
+      rescue Fiddle::DLError
+        raise UnsupportedFeatureError.new("native process cursor support is unavailable", phase: :admission), cause: nil
+      end
+
+      def self.readable?(io)
+        poll = native("poll", [Fiddle::TYPE_VOIDP, Fiddle::TYPE_LONG, Fiddle::TYPE_INT], Fiddle::TYPE_INT)
+        data = [io.fileno, 1, 0].pack("iss")
+        # Retry one interrupted nonblocking check without consuming readiness.
+        2.times do
+          result = poll.call(data, 1, 0)
+          if result.negative?
+            errno = Fiddle.last_error
+            next if errno == Errno::EINTR::Errno
+
+            raise TransportError.new("process descriptor poll failed (errno #{errno})", phase: :read)
+          end
+          events = data.unpack("iss").last
+          if (events & 0x28).positive? # POLLERR | POLLNVAL are not process exits.
+            raise TransportError.new("process descriptor poll returned an invalid event", phase: :read)
+          end
+          return (events & 0x11).positive? # POLLIN | POLLHUP retain terminal readiness.
+        end
+
+        raise TransportError.new("process descriptor poll remained interrupted", phase: :read)
+      end
+
+      def self.procfs_namespace
+        File.open("/proc/self/status") do |status|
+          buffer = "\0" * 256
+          statfs = native("fstatfs", [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP], Fiddle::TYPE_INT)
+          valid = statfs.call(status.fileno, buffer).zero? && buffer.unpack1("l!") == 0x9fa0
+          rows = status.read(65_537).lines.grep(/^NSpid:/)
+          valid &&= rows.length == 1 && rows.first.split.drop(1) == [Process.pid.to_s]
+          raise UnsupportedFeatureError.new("process cursors require procfs in the caller PID namespace", phase: :admission) unless valid
+        end
+        File.open("/proc/self/ns/pid")
+      rescue SystemCallError, IOError
+        raise UnsupportedFeatureError.new("process namespace evidence is unavailable", phase: :admission), cause: nil
+      end
+
+      def self.acquire(server, server_pid:, pane_pid:, budget:, on_retire: nil)
+        resources = Resources.new
+        failure = identity = nil
+        begin
+          pane, peer = if RUBY_PLATFORM.include?("darwin")
+            acquire_darwin(server, server_pid, pane_pid, budget, resources)
+          else
+            acquire_linux(server, server_pid, pane_pid, budget, resources)
+          end
+          identity = new(pane, peer, pane_pid)
+          resources.release(pane, peer)
+          identity.ensure_live!
+        rescue Errno::ENOPROTOOPT, Errno::EINVAL, Errno::EPERM, Errno::EACCES, Errno::ENOENT
+          failure = UnsupportedFeatureError.new("peer process identity is unavailable", phase: :admission)
+        rescue Exception => error
+          failure = error
+        ensure
+          begin
+            resources.close
+          rescue TransportError => cleanup
+            on_retire&.call(resources) unless resources.empty?
+            attach_cleanup(failure, cleanup.cleanup_errors) if failure
+            failure ||= cleanup
+          end
+          if failure && identity
+            begin
+              identity.close
+            rescue TransportError => cleanup
+              on_retire&.call(identity)
+              attach_cleanup(failure, cleanup.cleanup_errors)
+            end
+          end
+        end
+        raise failure, cause: nil if failure
+
+        identity
+      end
+
+      def self.acquire_linux(server, server_pid, pane_pid, budget, resources)
+        own_namespace = resources.add(procfs_namespace)
+        route = server.__send__(:with_bound_endpoint) { |_endpoint, pin| pin.command_prefix.last }
+        socket = resources.add(Socket.new(Socket::AF_UNIX, Socket::SOCK_STREAM, 0))
+        address = Socket.sockaddr_un(route)
+        loop do
+          remaining = budget.options.fetch(:timeout)
+          connected = socket.connect_nonblock(address, exception: false)
+          break unless connected == :wait_writable
+
+          Fiber.scheduler.io_wait(socket, IO::WRITABLE, remaining)
+        rescue Errno::EISCONN
+          break
+        end
+        # SO_PEERPIDFD avoids reacquiring a potentially reused SO_PEERCRED PID.
+        peer = resources.add(IO.for_fd(socket.getsockopt(Socket::SOL_SOCKET, PEER_PIDFD).int))
+        peer.close_on_exec = true
+        peer_pid = socket.getsockopt(Socket::SOL_SOCKET, Socket::SO_PEERCRED).data.unpack1("i")
+        unless peer_pid == server_pid && !readable?(peer)
+          raise UnsupportedFeatureError.new("socket peer identity does not establish the tmux process", phase: :admission)
+        end
+        other_namespace = resources.add(File.open("/proc/#{peer_pid}/ns/pid"))
+        same_namespace = [own_namespace.stat.dev, own_namespace.stat.ino] == [other_namespace.stat.dev, other_namespace.stat.ino]
+        unless same_namespace && !readable?(peer)
+          raise UnsupportedFeatureError.new("tmux and observer PID namespaces differ", phase: :admission)
+        end
+        opener = native("pidfd_open", [Fiddle::TYPE_INT, Fiddle::TYPE_INT], Fiddle::TYPE_INT)
+        descriptor = opener.call(pane_pid, 0)
+        if descriptor.negative?
+          error = Fiddle.last_error
+          if [Errno::EMFILE::Errno, Errno::ENFILE::Errno].include?(error)
+            raise CapacityError.new("process descriptor capacity exhausted", phase: :admission)
+          elsif error == Errno::ESRCH::Errno
+            raise TargetNotFoundError.new("pane process is unavailable", phase: :admission)
+          end
+          raise UnsupportedFeatureError.new("pane process identity is unavailable", phase: :admission)
+        end
+
+        pane = resources.add(IO.for_fd(descriptor))
+        pane.close_on_exec = true
+        [pane, peer]
+      end
+
+      def self.acquire_darwin(server, server_pid, pane_pid, budget, resources)
+        budget.options
+        peer = process_events(server_pid, resources)
+        if readable?(peer)
+          raise TargetNotFoundError.new("tmux process is unavailable", phase: :admission)
+        end
+        # Registration may find a recycled PID. A fresh pinned-route reply must
+        # name that same daemon while its retained process observer stays live.
+        name = server.__send__(:builtin_spellings, "display-message", budget: budget).fetch("display-message")
+        result = server.__send__(:execute_typed, [name, "-p", '#{pid}'], **budget.options)
+        unless result.stdout == "#{server_pid}\n".b && !readable?(peer)
+          raise UnsupportedFeatureError.new("bound response does not establish the tmux process", phase: :admission)
+        end
+        budget.options
+        pane = process_events(pane_pid, resources)
+        budget.options
+        [pane, peer]
+      end
+
+      def self.process_events(pid, resources)
+        create = native("kqueue", [], Fiddle::TYPE_INT)
+        register = native("kevent", [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT,
+          Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP], Fiddle::TYPE_INT)
+        descriptor = create.call
+        if descriptor.negative?
+          if [Errno::EMFILE::Errno, Errno::ENFILE::Errno, Errno::ENOMEM::Errno].include?(Fiddle.last_error)
+            raise CapacityError.new("process observer capacity exhausted", phase: :admission)
+          end
+          raise UnsupportedFeatureError.new("process observation is unavailable", phase: :admission)
+        end
+        events = resources.add(IO.for_fd(descriptor))
+        events.close_on_exec = true
+        # NOTE_REAP also covers traced exits whose NOTE_EXIT was suppressed.
+        # Keep the terminal event queued: readiness is the retained death latch.
+        change = [pid, -5, 1, 0x90000000, 0, 0].pack("QsS I qQ")
+        if register.call(events.fileno, change, 1, nil, 0, nil).negative?
+          if Fiddle.last_error == Errno::ESRCH::Errno
+            raise TargetNotFoundError.new("process is unavailable", phase: :admission)
+          end
+          raise UnsupportedFeatureError.new("process observation is unavailable", phase: :admission)
+        end
+        events
+      end
+      private_class_method :acquire_linux, :acquire_darwin, :process_events
+
+      def initialize(io, peer, pid)
+        @io, @peer, @pid = io, peer, pid
+        @generation = SecureRandom.hex(16).freeze
+        @references = 1
+        @resources = Resources.new(io, peer)
+      end
+      private_class_method :new
+
+      def retain
+        raise ClosedError.new("process cursor is closed", phase: :admission) if @references.zero?
+
+        @references += 1
+        self
+      end
+
+      def close
+        @references -= 1 if @references.positive?
+        @resources.close if @references.zero?
+        nil
+      end
+
+      def peer_alive!
+        if @references.zero? || self.class.readable?(@peer)
+          raise TargetNotFoundError.new("retained tmux process is unavailable", phase: :read, delivery: :observed)
+        end
+      end
+
+      def exited?
+        peer_alive!
+        self.class.readable?(@io)
+      end
+
+      def ensure_live!
+        raise TargetNotFoundError.new("retained pane process exited", phase: :read, delivery: :observed) if exited?
+      end
+    end
+    private_constant :ProcessIdentity
+  end
+end

data/lib/libtmux/mcp/resources.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+module LibTmux
+  module MCP
+    class Resources
+      def initialize(application:, endpoint_name:, enabled_tools:, max_response_bytes:)
+        @application, @endpoint, @enabled, @max_bytes = application, endpoint_name, enabled_tools, max_response_bytes
+      end
+
+      def install(server)
+        server.capabilities[:resources] = {subscribe: false, listChanged: false}
+        if @enabled.include?("tmux_snapshot")
+          prefix = "tmux://{endpoint}/{generation}/snapshots/{entity}"
+          server.resource_templates.concat([
+            ::MCP::ResourceTemplate.new(uri_template: prefix, name: "tmux_metadata", mime_type: "application/json",
+              description: "Acquire metadata through tmux_snapshot with its default page limit. Encode every URI component; generation must match discovery. Reports capture interval and truncation."),
+            ::MCP::ResourceTemplate.new(uri_template: "#{prefix}/pages/{cursor}", name: "tmux_metadata_page", mime_type: "application/json",
+              description: "Read a retained tmux_snapshot page without refreshing it. Encode the cursor component; endpoint, generation and entity must match its captured query.")
+          ])
+        end
+        if @enabled.include?("tmux_capture")
+          server.resource_templates << ::MCP::ResourceTemplate.new(
+            uri_template: "tmux://{endpoint}/{generation}/panes/{pane_id}/screen",
+            name: "tmux_screen", mime_type: "text/plain",
+            description: "Capture an exact pane through tmux_capture with its default byte/line bounds, without cursor tracking. Percent-encode pane IDs. Invalid UTF-8 is an application/octet-stream blob; _meta includes capture interval, truncation and unknown history continuity.")
+        end
+        server.resources_read_handler do |params, server_context: nil|
+          read(params[:uri], cancellation: server_context&.cancellation)
+        end
+        server
+      end
+
+      private
+
+      def decode(component)
+        return unless component && component.match?(/\A(?:[A-Za-z0-9._~-]|%[0-9A-F]{2})+\z/)
+
+        value = component.gsub(/%([0-9A-F]{2})/) { [$1.to_i(16)].pack("C") }.force_encoding(Encoding::UTF_8)
+        return unless value.valid_encoding?
+
+        encoded = value.bytes.map { |byte| (byte.chr.match?(/[A-Za-z0-9._~-]/) ? byte.chr : "%%%02X" % byte) }.join
+        value if encoded == component
+      end
+
+      def read(uri, cancellation:)
+        unless uri.is_a?(String) && uri.valid_encoding? && uri.bytesize <= 1024
+          error("invalid_input", "The resource URI is invalid.", protocol: true)
+        end
+        match = /\Atmux:\/\/([^\/]+)\/([^\/]+)\/(snapshots|panes)\/([^\/]+)(?:\/(pages|screen)(?:\/([^\/]+))?)?\z/.match(uri)
+        error("invalid_input", "The resource URI is invalid.", protocol: true) unless match
+        endpoint, generation, collection, target, suffix, cursor = match.captures.map { |part| part && decode(part) }
+        unless endpoint == @endpoint && generation && generation.bytesize <= 128 &&
+            (!match[6] || cursor)
+          error("invalid_input", "The resource URI is invalid.", protocol: true)
+        end
+        if collection == "snapshots" && Internal::Catalog.kinds.map(&:to_s).include?(target) &&
+            (suffix.nil? || (suffix == "pages" && cursor))
+          name = "tmux_snapshot"
+          arguments = cursor ? {"cursor" => cursor} : {"entity" => target}
+        elsif collection == "panes" && target&.match?(/\A%[0-9]+\z/) && suffix == "screen" && cursor.nil?
+          name = "tmux_capture"
+          arguments = {"target" => {"generation" => generation, "kind" => "pane", "id" => target}}
+        else
+          error("invalid_input", "The resource URI is invalid.", protocol: true)
+        end
+        response = @application.call(name, arguments, cancellation: cancellation).structured_content
+        unless response.fetch("ok")
+          failure = response.fetch("error")
+          error(failure.fetch("code"), failure.fetch("message"), details: failure)
+        end
+        data = response.fetch("data")
+        if name == "tmux_snapshot"
+          unless data.fetch("server_identity").fetch("generation") == generation && data.fetch("entity") == target
+            error("stale_target", "The resource generation or captured entity does not match.", delivery: "observed")
+          end
+          contents = [{uri: uri, mimeType: "application/json", text: JSON.generate(response)}]
+        else
+          metadata = data.reject { |key, _| key == "rows" }
+          contents = [{uri: uri, _meta: {"io.github.libtmux/capture" => metadata}}]
+          if data.fetch("encoding") == "utf-8"
+            contents.first.merge!(mimeType: "text/plain", text: data.fetch("rows").join)
+          else
+            bytes = data.fetch("rows").map { |row| row.unpack1("m0") }.join
+            contents.first.merge!(mimeType: "application/octet-stream", blob: [bytes].pack("m0"))
+          end
+        end
+        if JSON.generate(contents).bytesize > @max_bytes
+          error("capacity", "The resource exceeds its response byte limit.", delivery: "observed")
+        end
+        contents
+      end
+
+      def error(code, message, protocol: false, details: nil, delivery: "not_sent")
+        raise ::MCP::Server::RequestHandlerError.new(message, nil,
+          error_code: protocol ? -32602 : -32000,
+          error_data: details || {"code" => code, "message" => message, "delivery" => delivery})
+      end
+    end
+    private_constant :Resources
+  end
+end

data/lib/libtmux/mcp/shell/integration.zsh

@@ -0,0 +1,50 @@
+# Explicitly source with socket, invitation token, Ruby, helper, and load paths.
+[[ -o interactive && -o zle && $# == 5 && -z ${_libtmux_run_fd-} ]] || return 1
+[[ $ZSH_VERSION == 5.9 || $ZSH_VERSION == 5.9.<-> ]] || return 1
+zmodload zsh/net/socket || return 1
+zmodload zsh/system || return 1
+zsocket "$1" || return 1
+typeset -g _libtmux_run_fd=$REPLY
+typeset -g _libtmux_run_ruby=$3 _libtmux_run_helper=$4 _libtmux_run_loadpath=$5 _libtmux_run_buffer=''
+print -r -- "ZLE1 $2 $ZSH_VERSION $TMUX_PANE" >&$_libtmux_run_fd || return 1
+typeset _libtmux_enrollment_ack
+if ! sysread -i $_libtmux_run_fd -s 1 -t 0.5 _libtmux_enrollment_ack || [[ $_libtmux_enrollment_ack != A ]]; then
+  exec {_libtmux_run_fd}<&-
+  unset _libtmux_run_fd
+  return 1
+fi
+unset _libtmux_enrollment_ack
+
+_libtmux_run_widget() {
+  emulate -L zsh
+  setopt localtraps
+  trap '' PIPE
+  local chunk frame exit_status readiness=ready
+  local -a fields
+  if ! sysread -i $_libtmux_run_fd -s 1024 -t 0 chunk; then
+    zle -F $_libtmux_run_fd
+    exec {_libtmux_run_fd}<&-
+    unset _libtmux_run_fd
+    return
+  fi
+  _libtmux_run_buffer+=$chunk
+  if (( ${#_libtmux_run_buffer} > 1024 )); then
+    zle -F $_libtmux_run_fd
+    exec {_libtmux_run_fd}<&-
+    unset _libtmux_run_fd
+    return
+  fi
+  [[ $_libtmux_run_buffer == *$'\n'* ]] || return
+  frame=${_libtmux_run_buffer%%$'\n'*}
+  _libtmux_run_buffer=${_libtmux_run_buffer#*$'\n'}
+  fields=(${=frame})
+  [[ $#fields == 6 && $fields[1] == P && ${#fields[2]} == 32 && ${#fields[3]} == 32 && $fields[2] != *[^0-9a-f]* && $fields[3] != *[^0-9a-f]* ]] || return
+  if [[ $CONTEXT != start || -n $BUFFER || -n $PREBUFFER || $PENDING -gt 0 || $KEYS_QUEUED_COUNT -gt 0 ]]; then
+    readiness=refused
+  fi
+  "$_libtmux_run_ruby" --disable=rubyopt,gems -I "$_libtmux_run_loadpath" "$_libtmux_run_helper" "$fields[4]" "$fields[3]" "$fields[5]" "$fields[2]" "$fields[6]" "$readiness" </dev/null >/dev/null 2>&1
+  exit_status=$?
+  print -r -- "DONE $fields[2] $exit_status" >&$_libtmux_run_fd
+}
+zle -N _libtmux_run_widget
+zle -F -w $_libtmux_run_fd _libtmux_run_widget

data/lib/libtmux/mcp/shell/prepare.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+require 'socket'
+require 'digest/sha2'
+require 'libtmux/process'
+
+# This process is launched with explicit installed load paths and disabled gems.
+class AuthoredShellHelper
+  def initialize(socket, deadline)
+    @socket, @deadline, @buffer = socket, deadline, +''.b
+  end
+
+  def remaining
+    value = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    raise LibTmux::DeadlineExceeded.new('helper deadline expired') unless value.positive?
+
+    value
+  end
+
+  def read_line
+    until (ending = @buffer.index("\n"))
+      raise LibTmux::ProtocolError.new('helper frame is too large') if @buffer.bytesize >= 1024
+
+      read_more(1024 - @buffer.bytesize)
+    end
+    @buffer.slice!(0, ending + 1).chomp
+  end
+
+  def read_bytes(length)
+    read_more([length - @buffer.bytesize, 16_384].min) while @buffer.bytesize < length
+    @buffer.slice!(0, length)
+  end
+
+  def write(bytes)
+    offset = 0
+    while offset < bytes.bytesize
+      duration = remaining
+      count = @socket.write_nonblock(bytes.byteslice(offset, 16_384), exception: false)
+      if count == :wait_writable
+        IO.select(nil, [@socket], nil, duration)
+      else
+        offset += count
+      end
+    end
+  end
+
+  private
+
+  def read_more(limit)
+    duration = remaining
+    bytes = @socket.read_nonblock(limit, exception: false)
+    if bytes == :wait_readable
+      IO.select([@socket], nil, nil, duration)
+    elsif bytes
+      @buffer << bytes
+    else
+      raise EOFError
+    end
+  end
+end
+
+begin
+  path, token, deadline_text, run_id, digest, readiness = ARGV
+  path = path.unpack1('m0')
+  raise ArgumentError unless ARGV.length == 6 && /\A[0-9a-f]{32}\z/.match?(token) &&
+    /\A[0-9a-f]{32}\z/.match?(run_id) && /\A[0-9a-f]{64}\z/.match?(digest)
+  deadline = Float(deadline_text)
+  raise ArgumentError unless deadline.finite?
+  socket = UNIXSocket.new(path)
+  wire = AuthoredShellHelper.new(socket, deadline)
+  prefix = readiness == 'ready' ? 'READY' : 'REFUSED'
+  wire.write("#{prefix} #{run_id} #{token} #{digest} #{Process.ppid}\n")
+  exit 72 unless readiness == 'ready'
+  raise LibTmux::ProtocolError.new('invalid helper grant') unless wire.read_line == "GRANT #{run_id} #{token} #{digest}"
+
+  wire.write("AUTHORIZED #{run_id} #{token} #{digest}\n")
+  fields = wire.read_line.split(' ')
+  unless fields.length == 7 && fields[0, 4] == ['SCRIPT', run_id, token, digest] && fields[4, 3].all? { |value| /\A\d{1,6}\z/.match?(value) }
+    raise LibTmux::ProtocolError.new('invalid helper script envelope')
+  end
+  length, stdout_limit, stderr_limit = fields[4, 3].map(&:to_i)
+  unless length <= 65_536 && stdout_limit <= 262_144 && stderr_limit <= 262_144
+    raise LibTmux::ProtocolError.new('invalid helper script limits')
+  end
+  script = wire.read_bytes(length)
+  unless !script.include?("\0") && Digest::SHA256.hexdigest(script) == digest
+    raise LibTmux::ProtocolError.new('helper script digest mismatch')
+  end
+
+  cancellation = LibTmux::Internal::Cancellation.new
+  wake_reader, wake_writer = IO.pipe
+  watcher = Thread.new do
+    ready = IO.select([socket, wake_reader])
+    if ready.first.include?(socket)
+      # EOF or unsolicited client bytes revoke this helper's outstanding work.
+      socket.read_nonblock(1, exception: false)
+      cancellation.cancel
+    end
+  end
+  environment = %w[TMUX TMUX_PANE].filter_map { |name| "#{name}=#{ENV.fetch(name)}" if ENV.key?(name) }
+  result = LibTmux::Internal::ProcessExecutor.new(stdout_limit: stdout_limit, stderr_limit: stderr_limit,
+    cleanup_timeout: 0.25, drain_timeout: 0.25).run(['/usr/bin/env', *environment, '/bin/sh', '-c', script],
+      timeout: wire.remaining, cancel: cancellation)
+  wake_writer.write_nonblock('x', exception: false)
+  unless watcher.join(0.25)
+    raise LibTmux::TransportError.new('helper cancellation watcher remains active', cleanup_errors: ['watcher retirement remains pending'])
+  end
+  watcher = nil
+  kind, status = result.status.exited? ? ['EXIT', result.status.exitstatus] : ['SIGNAL', result.status.termsig]
+  wire.write("RESULT #{run_id} #{token} #{digest} #{kind} #{status} #{result.stdout.bytesize} #{result.stderr.bytesize}\n")
+  wire.write(result.stdout)
+  wire.write(result.stderr)
+rescue LibTmux::Error => error
+  code = case error
+  when LibTmux::CapacityError then 'capacity'
+  when LibTmux::DeadlineExceeded then 'deadline'
+  when LibTmux::Cancelled then 'cancelled'
+  when LibTmux::ProtocolError then 'protocol'
+  else 'unknown'
+  end
+  begin
+    wire&.write("ERROR #{run_id} #{token} #{digest} #{code} #{error.cleanup_errors.empty? ? 'clean' : 'pending'}\n")
+  rescue StandardError
+    # The client observes unknown completion when the bounded channel is gone.
+  end
+  exit 78
+rescue ArgumentError, SystemCallError, IOError, EOFError
+  exit 77
+ensure
+  if watcher
+    wake_writer.write_nonblock('x', exception: false)
+    retired = watcher.join(0.25)
+  end
+  [wake_reader, wake_writer, socket].compact.each { |io| io.close unless io.closed? }
+  cancellation&.close
+  exit 79 if watcher && !retired
+end