@songsid/agend 2.1.12 → 2.2.0-alpha.2

package/dist/tmux-read.js

@@ -0,0 +1,213 @@
+import { execFile } from "node:child_process";
+import { measureSyncWork } from "./sync-work-attribution.js";
+export const TMUX_READ_MAX_BYTES = 1024 * 1024;
+export const TMUX_READ_QUEUE_LIMIT = 256;
+export const TMUX_CONTROL_ATTEMPT_MS = 2_000;
+export const TMUX_FALLBACK_CHILDREN = 2;
+export class TmuxReadError extends Error {
+    kind;
+    code;
+    constructor(kind, message, cause) {
+        super(message, { cause });
+        this.kind = kind;
+        const code = cause?.code;
+        if (typeof code === "string" || typeof code === "number")
+            this.code = code;
+    }
+}
+/** Only an ordinary nonzero exit is a semantic tmux command failure. */
+function fallbackReadError(error) {
+    const detail = error;
+    const kind = detail?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" ? "limit"
+        : detail?.killed ? "timeout"
+            : typeof detail?.code === "number" && detail.code !== 0 && !detail.signal ? "command" : "transport";
+    return new TmuxReadError(kind, "tmux fallback read failed", error);
+}
+export function tmuxReadArgs(query) {
+    const target = "window" in query ? `${query.session}:${query.window}` : query.session;
+    if (/[\x00-\x1f\x7f]/u.test(target))
+        throw new TmuxReadError("command", "Invalid tmux read target");
+    switch (query.kind) {
+        case "windows": return ["list-windows", "-t", target, "-F", "#{window_id}|||#{window_name}"];
+        case "pane": return ["list-panes", "-t", target, "-F", {
+                id: "#{pane_id}", status: "#{pane_dead} #{pane_dead_status}", pid: "#{pane_pid}",
+            }[query.field]];
+        case "tty": return ["display-message", "-p", "-t", target, "#{pane_tty}"];
+        case "capture": {
+            const args = ["capture-pane", "-t", target, "-p"];
+            if (query.joined)
+                args.push("-J");
+            if (query.history !== undefined) {
+                if (!Number.isSafeInteger(query.history))
+                    throw new TmuxReadError("command", "Invalid tmux history size");
+                args.push("-S", `-${query.history}`);
+            }
+            return args;
+        }
+    }
+}
+/** tmux's command lexer, not a shell: quoted parts concatenate into one token. */
+export function tmuxCommandToken(value) {
+    if (/[\x00-\x1f\x7f]/u.test(value))
+        throw new TmuxReadError("command", "Invalid tmux command token");
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function killReadChild(child) {
+    try {
+        child?.kill();
+    }
+    catch { /* physical ownership still waits for exit */ }
+}
+/** One logical FIFO shared by control and fallback; physical children can outlive a job. */
+export class TmuxReadLane {
+    socket;
+    control;
+    jobs = [];
+    active = null;
+    physical = new Set();
+    stopped = false;
+    lifetime = 0;
+    constructor(socket, control) {
+        this.socket = socket;
+        this.control = control;
+    }
+    start() { this.stopped = false; }
+    wake() { this.pump(); }
+    stop() {
+        this.stopped = true;
+        this.lifetime++;
+        for (const job of [this.active, ...this.jobs]) {
+            if (job)
+                this.finish(job, new TmuxReadError("stopped", "tmux read client stopped"));
+        }
+        for (const job of this.physical)
+            killReadChild(job.child);
+    }
+    read(args, timeoutMs) {
+        if (this.stopped)
+            return Promise.reject(new TmuxReadError("stopped", "tmux read client stopped"));
+        if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+            return Promise.reject(new TmuxReadError("timeout", "tmux read deadline expired"));
+        if (this.jobs.length + Number(this.active !== null) >= TMUX_READ_QUEUE_LIMIT) {
+            return Promise.reject(new TmuxReadError("limit", "tmux read queue full"));
+        }
+        return new Promise((resolve, reject) => {
+            const job = {
+                args, deadline: performance.now() + timeoutMs, lifetime: this.lifetime, resolve, reject, done: false,
+            };
+            job.timer = setTimeout(() => {
+                if (this.active === job && !job.child)
+                    this.control.retire();
+                killReadChild(job.child);
+                this.finish(job, new TmuxReadError("timeout", "tmux read deadline expired"));
+            }, Math.max(1, Math.floor(timeoutMs)));
+            this.jobs.push(job);
+            this.pump();
+        });
+    }
+    current(job) {
+        return !job.done && !this.stopped && job.lifetime === this.lifetime && performance.now() < job.deadline;
+    }
+    finish(job, error, output = "") {
+        if (job.done)
+            return;
+        job.done = true;
+        clearTimeout(job.timer);
+        this.jobs = this.jobs.filter(item => item !== job);
+        if (this.active === job)
+            this.active = null;
+        if (error)
+            job.reject(error);
+        else
+            job.resolve(output);
+        this.pump();
+    }
+    pump() {
+        if (this.stopped || this.active)
+            return;
+        const job = this.jobs[0];
+        if (!job)
+            return;
+        if (!this.current(job)) {
+            this.finish(job, new TmuxReadError("timeout", "tmux read deadline expired"));
+            return;
+        }
+        if (!this.control.ready() && this.physical.size >= TMUX_FALLBACK_CHILDREN)
+            return;
+        this.jobs.shift();
+        this.active = job;
+        void this.run(job);
+    }
+    async run(job) {
+        if (this.control.ready()) {
+            try {
+                const remaining = job.deadline - performance.now();
+                const attempt = performance.now() + Math.min(TMUX_CONTROL_ATTEMPT_MS, remaining / 2);
+                const result = await this.control.execute(job.args, attempt);
+                if (!this.current(job))
+                    throw new TmuxReadError("timeout", "tmux read deadline expired");
+                this.finish(job, undefined, result);
+                return;
+            }
+            catch (error) {
+                if (job.done)
+                    return;
+                if (!(error instanceof TmuxReadError) || error.kind !== "transport") {
+                    this.finish(job, error);
+                    return;
+                }
+            }
+        }
+        if (!this.current(job)) {
+            this.finish(job, new TmuxReadError("timeout", "tmux read deadline expired"));
+            return;
+        }
+        // A timed-out fallback child keeps its physical slot until actual exit.
+        if (this.physical.size >= TMUX_FALLBACK_CHILDREN) {
+            this.active = null;
+            this.jobs.unshift(job);
+            return;
+        }
+        this.physical.add(job);
+        const release = () => { if (this.physical.delete(job))
+            this.pump(); };
+        let spawnReturned = false;
+        let callbackError;
+        try {
+            const args = this.socket ? ["-L", this.socket, ...job.args] : job.args;
+            const child = measureSyncWork("tmux.spawn", () => execFile("tmux", args, {
+                timeout: Math.max(1, Math.floor(job.deadline - performance.now())), maxBuffer: TMUX_READ_MAX_BYTES,
+            }, (error, stdout) => {
+                // Node can invoke this callback on error before a live child exits
+                // (e.g. kill EPERM). It settles the read, not physical ownership.
+                callbackError = error;
+                if (spawnReturned && error && job.child?.pid === undefined)
+                    release();
+                if (job.done)
+                    return;
+                if (!this.current(job))
+                    this.finish(job, new TmuxReadError("timeout", "tmux read deadline expired"));
+                else
+                    this.finish(job, error ? fallbackReadError(error) : undefined, String(stdout));
+            }));
+            job.child = child;
+            spawnReturned = true;
+            child?.once("exit", release);
+            child?.once("close", release);
+            child?.once("error", () => { if (child.pid === undefined)
+                release(); });
+            // Native execFile always returns a ChildProcess. The no-child branch
+            // also permits inert test doubles; a failed spawn has no process to own.
+            if (!child || (callbackError && child.pid === undefined))
+                release();
+            if (job.done && this.physical.has(job))
+                killReadChild(child);
+        }
+        catch (error) {
+            if (!spawnReturned || job.child?.pid === undefined)
+                release();
+            this.finish(job, fallbackReadError(error));
+        }
+    }
+}
+//# sourceMappingURL=tmux-read.js.map

package/dist/tmux-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmux-read.js","sourceRoot":"","sources":["../src/tmux-read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAqB,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAexC,MAAM,OAAO,aAAc,SAAQ,KAAK;IAEjB;IADZ,IAAI,CAAmB;IAChC,YAAqB,IAA+D,EAAE,OAAe,EAAE,KAAe;QACpH,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QADP,SAAI,GAAJ,IAAI,CAA2D;QAElF,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;QACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7E,CAAC;CACF;AAED,wEAAwE;AACxE,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,KAAsE,CAAC;IACtF,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,KAAK,mCAAmC,CAAC,CAAC,CAAC,OAAO;QACzE,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;YAC5B,CAAC,CAAC,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACtG,OAAO,IAAI,aAAa,CAAC,IAAI,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAoB;IAC/C,MAAM,MAAM,GAAG,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACtF,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACpG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;QAC7F,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;gBACrD,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,kCAAkC,EAAE,GAAG,EAAE,aAAa;aACjF,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAChB,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1E,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;gBAC1G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IACrG,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAmBD,SAAS,aAAa,CAAC,KAAoB;IACzC,IAAI,CAAC;QAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,6CAA6C,CAAC,CAAC;AAChF,CAAC;AAED,4FAA4F;AAC5F,MAAM,OAAO,YAAY;IAOH;IAA+B;IAN3C,IAAI,GAAc,EAAE,CAAC;IACrB,MAAM,GAAmB,IAAI,CAAC;IAC9B,QAAQ,GAAG,IAAI,GAAG,EAAW,CAAC;IAC9B,OAAO,GAAG,KAAK,CAAC;IAChB,QAAQ,GAAG,CAAC,CAAC;IAErB,YAAoB,MAAqB,EAAU,OAA6B;QAA5D,WAAM,GAAN,MAAM,CAAe;QAAU,YAAO,GAAP,OAAO,CAAsB;IAAG,CAAC;IAEpF,KAAK,KAAW,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC;IACvC,IAAI,KAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE7B,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ;YAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,IAAc,EAAE,SAAiB;QACpC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACrI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,qBAAqB,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG;gBACV,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK;aAC1F,CAAC;YACb,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC7D,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC,CAAC;YAC/E,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,GAAY;QAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1G,CAAC;IAEO,MAAM,CAAC,GAAY,EAAE,KAAe,EAAE,MAAM,GAAG,EAAE;QACvD,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO;QACrB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAC5C,IAAI,KAAK;YAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;YAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,sBAAsB;YAAE,OAAO;QAClF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAY;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;gBACnD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;gBACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;gBACzF,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,GAAG,CAAC,IAAI;oBAAE,OAAO;gBACrB,IAAI,CAAC,CAAC,KAAK,YAAY,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACpE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,aAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YACvE,MAAM,KAAK,GAAG,eAAe,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE;gBACvE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,mBAAmB;aACnG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACnB,mEAAmE;gBACnE,kEAAkE;gBAClE,aAAa,GAAG,KAAK,CAAC;gBACtB,IAAI,aAAa,IAAI,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,SAAS;oBAAE,OAAO,EAAE,CAAC;gBACtE,IAAI,GAAG,CAAC,IAAI;oBAAE,OAAO;gBACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC,CAAC;;oBAChG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC,CAAC;YACJ,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,aAAa,GAAG,IAAI,CAAC;YACrB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7B,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC;gBAAE,OAAO,EAAE,CAAC;YACpE,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;CACF"}

package/dist/topic-commands.d.ts

@@ -7,6 +7,8 @@ export { parseContextPercent, parseTokenContextRatio } from "./context-percent.j
 export type { TokenContextRatio } from "./context-percent.js";
 type ExecutionFleetContext = FleetContext & {
     getInstanceExecutionState?(instanceName: string): "idle" | "working" | "stuck" | null;
+    /** The running launch's own steer capability (CliBackend.supportsSteer, #1405); undefined when it has none to give. */
+    instanceLaunchSupportsSteer?(instanceName: string): boolean | undefined;
 };
 /** Sanitize a directory name into a valid instance name. Keeps Unicode letters (incl. CJK). */
 export declare function sanitizeInstanceName(name: string): string;
@@ -174,6 +176,18 @@ export declare class TopicCommands {
     private ctx;
     constructor(ctx: ExecutionFleetContext);
     /** Get the adapter that should reply to a given inbound message */
+    /**
+     * #754: who may run a typed Telegram command is decided by the command table — the same rule a Discord slash
+     * command goes through (`decideCommand`), here with its Telegram column — before any handler runs. `msg.adapterId`
+     * is the topic's owning adapter (ownedCopy), so the admin it asks about is that bot's. A command the table does not
+     * know (`/raw`) or does not handle here (a passthrough cell) is left to the handlers below. `command` is what the
+     * dispatcher recognized (GENERAL_FORMS / INSTANCE_FORMS), so the table judges exactly what would run.
+     *
+     * Synchronous on purpose (#1399 review): the decision, the handler's own checks and the command's effect run in one
+     * stretch, so the instance cannot be rebound to another bot between the check and the act. The refusal, if any.
+     */
+    private tableRefusal;
+    private sendRefusal;
     private getReplyAdapter;
     /**
      * #1346: keep only the owning adapter's copy. When several bots share a
@@ -189,17 +203,13 @@ export declare class TopicCommands {
     /** Parse and dispatch commands from the General topic */
     handleGeneralCommand(msg: InboundMessage, instanceName?: string): Promise<boolean>;
     /**
-     * Build the dashboard URL text (View / Settings / Web UI). The Settings/Web UI
-     * URLs carry the web token; when `htmlSpoiler` is set they're wrapped in a
-     * Telegram HTML spoiler (`<tg-spoiler>`) so the token isn't shown in the clear
-     * in a shared topic (the caller must send with format: "html"). /view is
-     * public, so it's never spoilered. DC uses the plain form (ephemeral reply).
+     * Pure, secret-free dashboard/menu copy. Issuance belongs to the private
+     * delivery action; rendering or previewing this text cannot retire a code.
      */
-    getDashboardText(htmlSpoiler?: boolean): string;
+    getDashboardText(_htmlSpoiler?: boolean, showRemoteHint?: boolean): string;
     /**
-     * /dashboard (TG): admin-only. Replies directly in the topic; the token-
-     * bearing URLs are wrapped in a Telegram HTML spoiler so they aren't shown in
-     * the clear (the adapter supports plain/HTML, not MarkdownV2's `||…||`).
+     * /dashboard (TG): admin-only menu in General; codes are sent privately.
+     * `/dashboard revoke` also closes the public link and signs browsers out.
      */
     private handleDashboardCommand;
     /** Handle /ctx or /compact in any instance topic — returns true if handled */
@@ -249,7 +259,8 @@ export declare class TopicCommands {
      * Backends whose TUI accepts a busy-pane paste as steering input,
      * live-verified: claude-code and codex buffer-then-submit at the turn
      * boundary, grok accepts it in its input line. kiro's legacy TUI swallows
-     * the paste outright, and opencode/antigravity are unverified — for those
+     * the paste outright; its TUI front-ends steer, so kiro answers per launch
+     * (#1405). opencode/antigravity are unverified — for those
      * the user gets an honest "not supported" instead of a silent queue
      * fallback that looks like a steer but behaves like a normal message.
      */