@brimveyn/aimux 1.19.3 → 1.19.5

package/src/cli/commands/tab/run.ts

@@ -7,7 +7,6 @@
  * timeout trips. Exactly one JSON object is emitted and the exit code encodes
  * the outcome, so a driver can branch without re-snapshotting the screen.
  */
-import type { QuestionKind } from '../../../state/types'
 import type { CliCommand } from '../../registry'
 
 import {
@@ -16,73 +15,9 @@ import {
   IPC_CAPABILITY_TURN_LIFECYCLE,
 } from '../../../ipc/protocol'
 import { SHARED_FLAGS } from '../../flags'
-import { EXIT_OK, EXIT_QUESTION, EXIT_RUNTIME, EXIT_TIMEOUT, writeJson } from '../../output'
-import { buildPromptPayload, writePromptPayload } from './prompt-io'
-
-/** Overall cap on a single turn — 15 min, long enough for a heavy build task. */
-const DEFAULT_TIMEOUT_MS = 900_000
-
-/**
- * The four terminal shapes of a `tab run`. Modelled as a discriminated union so
- * the JSON we emit and the exit code we return are derived from one value, and
- * so the outcome→exit mapping can be unit-tested without a live daemon.
- * `durationMs` is measured from prompt submit, not attach, so it reflects the
- * worker's think time rather than our connection overhead.
- */
-export type RunOutcome =
-  | { durationMs: number; outcome: 'completed' }
-  | { durationMs: number; error: string; outcome: 'error' }
-  | {
-      durationMs: number
-      kind: QuestionKind
-      options?: string[]
-      outcome: 'question'
-      question: string
-    }
-  | { durationMs: number; outcome: 'timeout' }
-
-/**
- * Map an outcome to its process exit code. Pure and total over the union so a
- * driver's `case $?` stays exhaustive: 0 completed, 10 question/permission
- * (worker is blocked and wants input), 3 the tab errored/exited, 124 we hit the
- * overall cap.
- */
-export function outcomeExitCode(outcome: RunOutcome): number {
-  switch (outcome.outcome) {
-    case 'completed':
-      return EXIT_OK
-    case 'question':
-      return EXIT_QUESTION
-    case 'error':
-      return EXIT_RUNTIME
-    case 'timeout':
-      return EXIT_TIMEOUT
-  }
-}
-
-/**
- * Resolve the prompt text from exactly one source. We require exactly one of
- * `--prompt-file`, `--stdin`, or the positional `[text]` so an orchestrator
- * never silently sends the wrong buffer when two sources are set (e.g. a stale
- * positional plus a fresh `--prompt-file`).
- */
-async function resolvePromptText(
-  promptFile: string | undefined,
-  fromStdin: boolean,
-  positionalText: string | undefined
-): Promise<string> {
-  const sources = [promptFile !== undefined, fromStdin, positionalText !== undefined].filter(
-    (present) => present
-  ).length
-  if (sources !== 1) {
-    throw new Error(
-      'provide exactly one prompt source: --prompt-file <f>, --stdin, or a [text] positional'
-    )
-  }
-  if (promptFile !== undefined) return Bun.file(promptFile).text()
-  if (fromStdin) return Bun.stdin.text()
-  return positionalText ?? ''
-}
+import { writeJson } from '../../output'
+import { awaitTurn, DEFAULT_TIMEOUT_MS, turnOutcomeExitCode } from './await-turn'
+import { buildPromptPayload, resolvePromptText, writePromptPayload } from './prompt-io'
 
 export const tabRun: CliCommand = {
   args: [{ name: 'tabId', required: true }, { name: 'text' }],
@@ -136,86 +71,20 @@ export const tabRun: CliCommand = {
 
     const payload = buildPromptPayload(text, false)
 
-    return new Promise<number>((resolve) => {
-      // Subscribe BEFORE writing: these events fire only on transitions, so a
-      // late subscription would race the worker starting its turn.
-      let start = Date.now()
-      // Uptake guard. The tab may sit `idle` from a prior turn; a stale
-      // `tabTurnComplete` (or the settle window closing on that old idle) must
-      // not read as "this turn completed". Only honour completion once we've
-      // seen the tab go `working` after our submit.
-      let sawWorking = false
-
-      const settle = (outcome: RunOutcome): void => {
-        cleanup()
-        writeJson(outcome)
-        resolve(outcomeExitCode(outcome))
-      }
-      const durationMs = (): number => Date.now() - start
-
-      const offStatus = daemon.on('tabStatus', (p) => {
-        if (p.tabId !== tabId) return
-        if (p.status === 'working') sawWorking = true
-      })
-      const offTurn = daemon.on('tabTurnComplete', (p) => {
-        if (p.tabId !== tabId) return
-        // Ignore end-of-turn until the worker actually started working, so a
-        // lingering pre-submit idle can't be mis-read as completion.
-        if (!sawWorking) return
-        settle({ durationMs: durationMs(), outcome: 'completed' })
-      })
-      const offQuestion = daemon.on('tabQuestion', (p) => {
-        if (p.tabId !== tabId) return
-        // A question is honoured immediately — it can legitimately arrive
-        // before `working` (the worker asks before doing anything).
-        settle({
-          durationMs: durationMs(),
-          kind: p.kind,
-          options: p.options,
-          outcome: 'question',
-          question: p.prompt,
-        })
-      })
-      const offExit = daemon.on('tabExit', (p) => {
-        if (p.tabId !== tabId) return
-        settle({ durationMs: durationMs(), error: `exit ${p.exitCode}`, outcome: 'error' })
-      })
-      const offError = daemon.on('tabError', (p) => {
-        if (p.tabId !== tabId) return
-        settle({ durationMs: durationMs(), error: p.message, outcome: 'error' })
-      })
-
-      const timer = setTimeout(() => {
-        settle({ durationMs: durationMs(), outcome: 'timeout' })
-      }, timeoutMs)
-
-      const cleanup = (): void => {
-        offStatus()
-        offTurn()
-        offQuestion()
-        offExit()
-        offError()
-        clearTimeout(timer)
-      }
-
-      // Submit after subscribing, then reset the clock so `durationMs` measures
-      // the worker's turn rather than our attach/write overhead. On a write
-      // failure the tab likely died — surface it as an error outcome rather
-      // than sitting idle until the timeout.
-      const submit = async (): Promise<void> => {
-        try {
-          await writePromptPayload(daemon, tabId, payload, appendEnter)
-          start = Date.now()
-        } catch (error) {
-          settle({
-            durationMs: durationMs(),
-            error: error instanceof Error ? error.message : String(error),
-            outcome: 'error',
-          })
-        }
-      }
-      void submit()
+    // Submit inside `onArmed` so subscriptions are live before the worker starts
+    // its turn; `assumeWorking: false` keeps the uptake guard, so a lingering
+    // pre-submit idle can't be misread as completion.
+    const outcome = await awaitTurn({
+      assumeWorking: false,
+      daemon,
+      onArmed: async () => {
+        await writePromptPayload(daemon, tabId, payload, appendEnter)
+      },
+      tabId,
+      timeoutMs,
     })
+    writeJson(outcome)
+    return turnOutcomeExitCode(outcome)
   },
   summary: 'Submit a prompt and block until the turn completes or the worker asks',
   verb: 'run',

package/src/cli/commands/tab/send.ts

@@ -23,6 +23,11 @@ export const tabSend: CliCommand = {
       kind: 'boolean',
       name: 'stdin',
     },
+    {
+      description: 'read the payload from this file instead of <text>',
+      kind: 'string',
+      name: 'prompt-file',
+    },
     {
       description:
         'after submitting, block until the tab transitions to working (uptake confirmed)',
@@ -44,6 +49,8 @@ export const tabSend: CliCommand = {
     }
 
     const fromStdin = ctx.args.flags.stdin === true
+    const promptFile =
+      typeof ctx.args.flags['prompt-file'] === 'string' ? ctx.args.flags['prompt-file'] : undefined
     const asKeys = ctx.args.flags.keys === true
     const appendEnter = ctx.args.flags.enter === true
     const awaitSubmit = ctx.args.flags['await-submit'] === true
@@ -60,7 +67,26 @@ export const tabSend: CliCommand = {
       throw new Error('--await-submit requires --enter')
     }
 
-    const text = fromStdin ? await Bun.stdin.text() : (ctx.args.positionals[1] ?? '')
+    // At most one payload source. Unlike `tab run`, zero sources is valid here
+    // (`tab send <tab> --enter` submits an empty line), so we only reject
+    // conflicting combinations rather than requiring exactly one.
+    if (promptFile !== undefined) {
+      if (fromStdin) throw new Error('--prompt-file cannot be combined with --stdin')
+      if (asKeys)
+        throw new Error('--prompt-file cannot be combined with --keys (chords go in <text>)')
+      if (ctx.args.positionals[1] !== undefined) {
+        throw new Error('--prompt-file cannot be combined with a <text> positional')
+      }
+    }
+
+    let text: string
+    if (promptFile !== undefined) {
+      text = await Bun.file(promptFile).text()
+    } else if (fromStdin) {
+      text = await Bun.stdin.text()
+    } else {
+      text = ctx.args.positionals[1] ?? ''
+    }
     if (asKeys && text === '') {
       throw new Error('--keys requires the chord notation as <text>')
     }

package/src/cli/commands/worktree/create-core.ts

@@ -0,0 +1,96 @@
+import type { SessionRecord, WorktreeRecord } from '../../../state/types'
+import type { DaemonClient } from '../../client/daemon-client'
+
+import { createGitWorktree, removeGitWorktree } from '../../../git/worktree'
+import { IPC_CAPABILITY_WORKTREE_LIFECYCLE_EVENTS } from '../../../ipc/protocol'
+import { createPrefixedId } from '../../../platform/id'
+import {
+  assertSafeAimuxWorktreePath,
+  ensureAimuxWorktreeRoot,
+  makeWorktreePath,
+} from '../../../platform/worktree-paths'
+
+export interface CreateWorktreeParams {
+  /** Base ref for the branch (callers default to 'HEAD'). */
+  base: string
+  /** Branch name (callers default to `aimux/<name>`). */
+  branch: string
+  daemon: DaemonClient
+  name: string
+  workspace: SessionRecord
+}
+
+/**
+ * Create a git worktree + its catalog record for a workspace. Shared by
+ * `worktree create` and `tab create --new-worktree`. Checks the daemon
+ * capability BEFORE touching disk, and rolls back the on-disk worktree if
+ * catalog registration fails (so `worktree list` never surfaces an orphan).
+ * Throws on any failure; returns the registered record on success.
+ */
+export async function createWorkspaceWorktree(
+  params: CreateWorktreeParams
+): Promise<WorktreeRecord> {
+  const { base, branch, daemon, name, workspace } = params
+
+  const primary = workspace.worktrees?.find((w) => w.source === 'primary')
+  if (!primary) {
+    throw new Error(
+      `workspace "${workspace.name}" has no primary worktree — set --project when creating it`
+    )
+  }
+
+  // Check the daemon's capability BEFORE mutating disk — otherwise a capability
+  // mismatch would leave a git worktree on disk with no catalog record.
+  if (!daemon.hasCapability(IPC_CAPABILITY_WORKTREE_LIFECYCLE_EVENTS)) {
+    throw new Error(
+      'daemon predates worktreeLifecycleEvents capability — restart aimux to pick up the new daemon'
+    )
+  }
+
+  const worktreeId = createPrefixedId('worktree')
+  const targetPath = makeWorktreePath({
+    repoRoot: primary.repoRoot,
+    worktreeId,
+    worktreeName: name,
+  })
+  await ensureAimuxWorktreeRoot()
+  await assertSafeAimuxWorktreePath(targetPath)
+
+  await createGitWorktree({
+    baseRef: base,
+    branchName: branch,
+    repoPath: primary.repoRoot,
+    targetPath,
+  })
+
+  const now = new Date().toISOString()
+  const record: WorktreeRecord = {
+    baseRef: base,
+    branch,
+    createdAt: now,
+    createdByAimux: true,
+    id: worktreeId,
+    name,
+    path: targetPath,
+    repoRoot: primary.repoRoot,
+    source: 'aimux-temp',
+    updatedAt: now,
+  }
+
+  try {
+    await daemon.expectOk('addWorktreeRecord', { sessionId: workspace.id, worktree: record })
+  } catch (error) {
+    // Catalog registration failed — roll back the on-disk worktree so
+    // `worktree list` doesn't perpetually surface an orphan. Swallow rollback
+    // errors: report the original failure, the real problem to surface.
+    try {
+      await removeGitWorktree({ force: true, repoPath: primary.repoRoot, targetPath })
+    } catch {
+      // Best-effort rollback; leave the git-side worktree if it can't be removed
+      // cleanly. `worktree list` will flag it as gitTracked with no catalog.
+    }
+    throw error
+  }
+
+  return record
+}

package/src/cli/commands/worktree/create.ts

@@ -1,16 +1,8 @@
-import type { WorktreeRecord } from '../../../state/types'
 import type { CliCommand } from '../../registry'
 
-import { createGitWorktree, removeGitWorktree } from '../../../git/worktree'
-import { IPC_CAPABILITY_WORKTREE_LIFECYCLE_EVENTS } from '../../../ipc/protocol'
-import { createPrefixedId } from '../../../platform/id'
-import {
-  assertSafeAimuxWorktreePath,
-  ensureAimuxWorktreeRoot,
-  makeWorktreePath,
-} from '../../../platform/worktree-paths'
 import { SHARED_FLAGS } from '../../flags'
 import { EXIT_OK, writeJson } from '../../output'
+import { createWorkspaceWorktree } from './create-core'
 
 export const worktreeCreate: CliCommand = {
   args: [],
@@ -31,80 +23,15 @@ export const worktreeCreate: CliCommand = {
     const base = typeof ctx.args.flags.base === 'string' ? ctx.args.flags.base : 'HEAD'
 
     const workspace = ctx.getWorkspace()
-    const primary = workspace.worktrees?.find((w) => w.source === 'primary')
-    if (!primary) {
-      throw new Error(
-        `workspace "${workspace.name}" has no primary worktree — set --project when creating it`
-      )
-    }
-
-    // Check the daemon's capability BEFORE mutating disk — otherwise a
-    // capability mismatch would leave a git worktree on disk with no
-    // catalog record to track it.
     const daemon = await ctx.getDaemon()
-    if (!daemon.hasCapability(IPC_CAPABILITY_WORKTREE_LIFECYCLE_EVENTS)) {
-      throw new Error(
-        'daemon predates worktreeLifecycleEvents capability — restart aimux to pick up the new daemon'
-      )
-    }
-
-    const worktreeId = createPrefixedId('worktree')
-    const targetPath = makeWorktreePath({
-      repoRoot: primary.repoRoot,
-      worktreeId,
-      worktreeName: name,
-    })
-    await ensureAimuxWorktreeRoot()
-    await assertSafeAimuxWorktreePath(targetPath)
-
-    await createGitWorktree({
-      baseRef: base,
-      branchName: branch,
-      repoPath: primary.repoRoot,
-      targetPath,
-    })
-
-    const now = new Date().toISOString()
-    const record: WorktreeRecord = {
-      baseRef: base,
-      branch,
-      createdAt: now,
-      createdByAimux: true,
-      id: worktreeId,
-      name,
-      path: targetPath,
-      repoRoot: primary.repoRoot,
-      source: 'aimux-temp',
-      updatedAt: now,
-    }
-
-    try {
-      await daemon.expectOk('addWorktreeRecord', { sessionId: workspace.id, worktree: record })
-    } catch (error) {
-      // Catalog registration failed — roll back the on-disk worktree so
-      // `worktree list` doesn't perpetually surface an orphan. Swallow
-      // rollback errors: report the original failure, which is the real
-      // problem the operator needs to see.
-      try {
-        await removeGitWorktree({
-          force: true,
-          repoPath: primary.repoRoot,
-          targetPath,
-        })
-      } catch {
-        // Best-effort rollback; leave the git-side worktree if it can't be
-        // removed cleanly. `worktree list --workspace` will flag it as
-        // `gitTracked: true, catalog: no` on the next inspection.
-      }
-      throw error
-    }
+    const record = await createWorkspaceWorktree({ base, branch, daemon, name, workspace })
 
     writeJson({
-      branch,
-      id: worktreeId,
-      name,
-      path: targetPath,
-      repoRoot: primary.repoRoot,
+      branch: record.branch,
+      id: record.id,
+      name: record.name,
+      path: record.path,
+      repoRoot: record.repoRoot,
     })
     return EXIT_OK
   },

package/src/cli/flags.ts

@@ -6,7 +6,7 @@
 
 export interface FlagSpec {
   name: string
-  kind: 'string' | 'number' | 'boolean'
+  kind: 'string' | 'number' | 'boolean' | 'optional-string'
   description?: string
 }
 
@@ -59,6 +59,13 @@ export function parseArgs(
         flags[name] = true
         continue
       }
+      if (spec.kind === 'optional-string') {
+        // Value binds ONLY in the `=` form (`--flag=value`). A bare `--flag`
+        // must not swallow the next token (it may be a positional), so it
+        // parses as boolean `true`.
+        flags[name] = eq === -1 ? true : token.slice(eq + 1)
+        continue
+      }
       const raw = eq === -1 ? argv[++i] : token.slice(eq + 1)
       if (raw === undefined) {
         throw new CliUsageError(`flag --${name} requires a value`)

package/src/cli/index.ts

@@ -20,8 +20,8 @@ const EXIT_CODES_BLOCK = [
   '  2    usage error (bad flags, unknown command, missing argument)',
   '  3    runtime error (server replied with error, command failed)',
   '  4    daemon unreachable (socket missing and autostart failed)',
-  '  10   question (tab run: worker is blocked on a question/permission)',
-  '  124  timeout (tab wait, tab tail --timeout, workspace switch --wait)',
+  '  10   question (tab run / tab await: worker is blocked on a question/permission)',
+  '  124  timeout (tab run, tab await, tab wait, tab tail --timeout, workspace switch --wait)',
 ].join('\n')
 
 const OUTPUT_CONTRACT_BLOCK = [
@@ -52,6 +52,7 @@ function formatArgs(args: readonly ArgSpec[]): string {
 function flagValueHint(flag: FlagSpec): string {
   if (flag.kind === 'boolean') return ''
   if (flag.kind === 'number') return ' <n>'
+  if (flag.kind === 'optional-string') return `[=<${flag.name}>]`
   return ` <${flag.name}>`
 }
 

package/src/cli/registry.ts

@@ -1,6 +1,7 @@
 import type { CliContext } from './context'
 import type { ArgSpec, FlagSpec } from './flags'
 
+import { tabAwait } from './commands/tab/await'
 import { tabClose } from './commands/tab/close'
 import { tabCreate } from './commands/tab/create'
 import { tabFocus } from './commands/tab/focus'
@@ -33,6 +34,7 @@ export const COMMANDS: readonly CliCommand[] = [
   tabCreate,
   tabSend,
   tabRun,
+  tabAwait,
   tabFocus,
   tabClose,
   tabSnapshot,

package/src/config.ts

@@ -13,7 +13,14 @@ function migrateThemeId(value: unknown): ThemeId | undefined {
   return resolveLegacyThemeId(value)
 }
 
-export const CONFIG_PATH = `${getProfileConfigDir()}/aimux.json`
+/**
+ * Path to the active profile's config file, resolved at CALL time. It must not
+ * be a module-level constant: `runCli` applies `--profile` (via `AIMUX_PROFILE`)
+ * after this module is imported, so a frozen path would read the wrong profile.
+ */
+export function getConfigPath(): string {
+  return `${getProfileConfigDir()}/aimux.json`
+}
 
 export interface PersistedGitPane {
   diffModeRatio?: number
@@ -238,12 +245,13 @@ function isCustomCommandsRecord(value: unknown): value is Record<string, string>
 }
 
 export function loadConfigResult(): ConfigLoadResult {
+  const configPath = getConfigPath()
   try {
-    if (!existsSync(CONFIG_PATH)) {
+    if (!existsSync(configPath)) {
       return { config: DEFAULT_CONFIG, issues: [], source: 'defaults' }
     }
 
-    const raw = readFileSync(CONFIG_PATH, 'utf8')
+    const raw = readFileSync(configPath, 'utf8')
     const parsed = JSON.parse(raw) as {
       version?: number
       customCommands?: unknown
@@ -346,7 +354,7 @@ export function loadConfigResult(): ConfigLoadResult {
     const validWorktreeTemplates = parseWorktreeTemplates(parsed.worktreeTemplates, issues)
 
     if (issues.length > 0) {
-      logDebug('config.load.validationIssue', { issues, path: CONFIG_PATH })
+      logDebug('config.load.validationIssue', { issues, path: configPath })
     }
 
     return {
@@ -371,7 +379,7 @@ export function loadConfigResult(): ConfigLoadResult {
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error)
-    logDebug('config.load.error', { error: message, path: CONFIG_PATH })
+    logDebug('config.load.error', { error: message, path: configPath })
     return {
       config: DEFAULT_CONFIG,
       issues: [`failed to load config: ${message}`],
@@ -385,14 +393,15 @@ export function loadConfig(): AimuxConfig {
 }
 
 export function saveConfig(config: AimuxConfig): boolean {
+  const configPath = getConfigPath()
   try {
     mkdirSync(getProfileConfigDir(), { recursive: true })
-    writeFileSync(CONFIG_PATH, `${JSON.stringify(config, null, 2)}\n`)
+    writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`)
     return true
   } catch (error) {
     logDebug('config.save.error', {
       error: error instanceof Error ? error.message : String(error),
-      path: CONFIG_PATH,
+      path: configPath,
     })
     return false
   }

package/src/doctor.ts

@@ -1,6 +1,6 @@
 import { existsSync } from 'node:fs'
 
-import { CONFIG_PATH, loadConfigResult } from './config'
+import { getConfigPath, loadConfigResult } from './config'
 import { ASSISTANT_OPTIONS, isCommandAvailable, parseCommand } from './pty/command-registry'
 
 export interface DoctorCheck {
@@ -22,11 +22,12 @@ function getConfigDetails(configResult: ReturnType<typeof loadConfigResult>): st
     return configResult.issues.join('; ')
   }
 
-  if (existsSync(CONFIG_PATH)) {
-    return `loaded ${CONFIG_PATH}`
+  const configPath = getConfigPath()
+  if (existsSync(configPath)) {
+    return `loaded ${configPath}`
   }
 
-  return `using defaults (${CONFIG_PATH} not found)`
+  return `using defaults (${configPath} not found)`
 }
 
 function getAssistantDetails(

package/src/git/diff-limits.ts

@@ -0,0 +1,8 @@
+// Git plumbing and Bun's file API both hand a blob back as a single JS string. Past
+// JavaScriptCore's string cap the allocation does not throw — it aborts the process
+// with SIGTRAP, which no try/catch can intercept and which takes the whole TUI down
+// with it. Every read of file content in the git layer is gated on this.
+//
+// 5 MB covers source files and mid-sized CSVs. Anything past it is a build artefact
+// or a download, and nobody reviews those line-by-line.
+export const MAX_DIFF_BYTES = 5 * 1024 * 1024