@vibelord/lanes 1.0.0

package/payload/lanes/libexec/legacy_sessions.py

@@ -0,0 +1,130 @@
+"""Track pre-persistence Docker shells without pretending their lost Docker connection is reattachable."""
+import json
+import os
+import select
+import signal
+import sys
+import time
+from pathlib import Path
+
+import lanes_lib as L
+
+
+def process(pid):
+    root = Path(L.proc_root()) / str(pid)
+    stat = (root / 'stat').read_text().rsplit(') ', 1)[1].split()
+    return {'pid': int(pid), 'ppid': int(stat[1]), 'sid': int(stat[3]), 'tty': stat[4], 'start': stat[19],
+            'uid': root.stat().st_uid, 'cgroup': (root / 'cgroup').read_text(),
+            'cwd': os.readlink(root / 'cwd'), 'command': (root / 'comm').read_text().strip()}
+
+
+def observe():
+    lanes, groups = {}, {}
+    for path in (L.STATE / 'legacy-sessions').glob('*.json'):
+        entry = L.read_json(path) or {}
+        identity = entry.get('legacy') or {}
+        try:
+            actual = process(identity['pid'])
+            if actual['start'] != identity['start']:
+                continue
+            state = {'state': 'quiet', 'pid': actual['pid'], 'cwd': actual['cwd'],
+                     'command': actual['command'], 'legacy': True}
+        except (FileNotFoundError, ProcessLookupError, KeyError):
+            continue
+        except OSError:
+            state = {'state': 'unknown', 'observed': 'error', 'legacy': True}
+        lanes[entry['id']] = state
+        groups.setdefault(entry['workspace'], []).append(entry)
+        L.atomic_write(L.STATE / 'resolve.dynamic' / entry['id'],
+                       '\n'.join(['exec', entry['container'], 'legacy', entry['id'], entry['name']]) + '\n')
+    return lanes, groups
+
+
+def close(entry):
+    identity = entry.get('legacy') or {}
+    recorded = L.read_json(L.STATE / 'legacy-sessions' / (entry['id'] + '.json')) or {}
+    if recorded.get('legacy') != identity:
+        raise L.LanesError('Legacy shell identity changed; nothing was closed')
+    try:
+        root = process(identity['pid'])
+    except (OSError, KeyError):
+        raise L.LanesError('Legacy shell could not be checked; nothing was closed')
+    if root['start'] != identity['start'] or root['uid'] != os.getuid():
+        raise L.LanesError('Legacy shell changed; nothing was closed')
+    members = {}
+    for path in Path(L.proc_root()).iterdir():
+        if not path.name.isdigit():
+            continue
+        try:
+            candidate = process(path.name)
+            if candidate['uid'] == root['uid'] and candidate['cgroup'] == root['cgroup']:
+                members[candidate['pid']] = candidate
+        except OSError:
+            continue
+    # The root may have exited and its PID been reused while we scanned /proc.
+    # Keep the recorded identity authoritative rather than adopting the scan's replacement.
+    if members.get(root['pid'], {}).get('start') != root['start']:
+        raise L.LanesError('Legacy shell changed or could not be checked; nothing was closed')
+    chosen = {root['pid']} | {pid for pid, p in members.items()
+                            if p['sid'] == root['sid'] and p['tty'] == root['tty'] and root['tty'] != '0'}
+    while True:
+        children = {pid for pid, p in members.items() if p['ppid'] in chosen}
+        if children <= chosen:
+            break
+        chosen.update(children)
+    handles, root_verified = [], False
+    try:
+        for pid in chosen:
+            fd = None
+            try:
+                fd = os.pidfd_open(pid)
+                if process(pid)['start'] != members[pid]['start']:
+                    os.close(fd)
+                    continue
+                handles.append(fd)
+                if pid == root['pid']:
+                    root_verified = True
+            except (OSError, KeyError):
+                if fd is not None:
+                    os.close(fd)
+                continue
+        if not root_verified:
+            raise L.LanesError('Legacy shell could not be checked; nothing was closed')
+        # pidfds remain attached to these processes even if the kernel recycles their numeric pids.
+        for fd in handles:
+            try:
+                signal.pidfd_send_signal(fd, signal.SIGHUP)
+            except ProcessLookupError:
+                pass
+        remaining, deadline = set(handles), time.monotonic() + 2
+        while remaining and time.monotonic() < deadline:
+            ready, _, _ = select.select(list(remaining), [], [], 0.1)
+            remaining.difference_update(ready)
+        for fd in remaining:
+            try:
+                signal.pidfd_send_signal(fd, signal.SIGKILL)
+            except ProcessLookupError:
+                pass
+    finally:
+        for fd in handles:
+            os.close(fd)
+    (L.STATE / 'legacy-sessions' / (entry['id'] + '.json')).unlink(missing_ok=True)
+
+
+def view(container, lane_id):
+    L._require(L.IDENT, lane_id, 'legacy shell')
+    entry = L.read_json(L.STATE / 'legacy-sessions' / (lane_id + '.json')) or {}
+    if entry.get('container') != container:
+        raise L.LanesError('Legacy shell no longer exists')
+    print('\033[2J\033[H\n  ' + entry['name'] + '\n', flush=True)
+    print('  This shell predates persistent terminals. Its original Docker connection cannot be reattached.\n'
+          '  Its shell and running jobs are preserved. Use × in Unregistered to terminate them.\n'
+          '  New + creates a shell you can leave and reopen.\n', flush=True)
+    print('  Container: ' + container + '\n  Process: ' + str(entry['legacy']['pid']), flush=True)
+    while True:
+        time.sleep(30)
+
+
+if __name__ == '__main__':
+    if len(sys.argv) == 4 and sys.argv[1] == 'view':
+        view(sys.argv[2], sys.argv[3])

package/payload/lanes/libexec/session_actions.py

@@ -0,0 +1,276 @@
+"""Explicit New/Close actions for unregistered terminals; observation never creates or kills."""
+import hashlib
+import json
+import os
+import secrets
+import shlex
+import signal
+import time
+from pathlib import Path
+
+import lanes_lib as L
+
+
+def shell_socket(workspace):
+    return 'lanes-shells-' + L._require(L.IDENT, workspace, 'workspace')
+
+
+def session_key(entry):
+    binding = entry.get('tmux') or {}
+    return entry.get('container'), binding.get('socket'), binding.get('session')
+
+
+def session_id(workspace, container, socket, name):
+    digest = hashlib.sha256(json.dumps([container, socket, name]).encode()).hexdigest()[:10]
+    return f'{workspace}--x-{L.slug(name)[:40]}-{digest}'
+
+
+def workspace_roots(workspace):
+    roots = set(workspace.get('discovery_roots') or [])
+    roots.update(lane.get('folder') for lane in workspace.get('lanes', []) if lane.get('folder'))
+    if workspace.get('cwd'):
+        roots.add(workspace['cwd'])
+    for root in list(roots):
+        roots.add(root.rstrip('/') + '-worktrees')
+        parent = str(Path(root).parent)
+        if parent.endswith('-workspace'):
+            roots.add(parent)
+    return {root.rstrip('/') for root in roots if root and root not in ('/', L.CONTAINER_HOME)}
+
+
+def workspace_for(registry, container, socket, cwd, owners=(), preferred=None):
+    candidates = [w for w in registry['workspaces'] if w.get('container') == container or
+                  any(lane.get('container') == container for lane in w.get('lanes', []))]
+    by_id = {w['id']: w for w in candidates}
+    if preferred in by_id:
+        return preferred
+    explicit = next((w['id'] for w in candidates if shell_socket(w['id']) == socket), None)
+    if explicit:
+        return explicit
+    if len(owners) == 1:
+        return next(iter(owners))
+    scored = [(len(root), w['id']) for w in candidates for root in workspace_roots(w)
+              if cwd == root or cwd.startswith(root + '/')]
+    if scored:
+        best = max(n for n, _ in scored)
+        winners = {w for n, w in scored if n == best}
+        if len(winners) == 1:
+            return next(iter(winners))
+    if len(candidates) == 1:
+        return candidates[0]['id']
+    return None
+
+
+def make_entry(workspace, container, socket, name, pane, previous=None):
+    previous = previous or {}
+    entry = {'id': previous.get('id') or session_id(workspace, container, socket, name),
+             'name': previous.get('name') or name, 'holder': 'tmux', 'container': container,
+             'workspace': workspace, 'tmux': {'socket': socket, 'session': name},
+             'color': None, 'icon': '👻', 'closable': True,
+             'identity': {'session_id': pane.get('session_id', ''),
+                          'created': pane.get('session_created', '')}}
+    meta = L.read_json(L.STATE / 'user-sessions' / (entry['id'] + '.json'), {}) or {}
+    if session_key(meta) == session_key(entry):
+        entry['name'] = meta.get('name') or entry['name']
+    L.atomic_write(L.STATE / 'resolve.dynamic' / entry['id'],
+                   '\n'.join(['tmux', container, socket, name, entry['name']]) + '\n')
+    return entry
+
+
+def new_shell(workspace):
+    registry = L.load_registry()
+    board = next((w for w in registry['workspaces'] if w['id'] == workspace), None)
+    if not board:
+        raise L.LanesError('Workspace no longer exists; reload the sidebar')
+    container = L._require(L.IDENT, board['container'], 'container')
+    cwd = L._require(L.SAFE_PATH, board['cwd'], 'working directory')
+    socket = shell_socket(workspace)
+    name = 'shell-' + time.strftime('%Y%m%d-%H%M%S') + '-' + secrets.token_hex(3)
+    lane_id = session_id(workspace, container, socket, name)
+    entry = {'id': lane_id, 'workspace': workspace, 'container': container, 'holder': 'tmux',
+             'tmux': {'socket': socket, 'session': name},
+             'name': 'Shell ' + time.strftime('%H:%M:%S') + ' · ' + name[-6:]}
+    metadata = L.STATE / 'user-sessions' / (lane_id + '.json')
+    L.atomic_write(metadata, json.dumps(entry) + '\n')
+    # Creation is the only place that may start a tmux server. It runs INSIDE the container.
+    rc, out, err = L.run_bounded(
+        ['docker', 'exec', '-u', 'coder', '-e', 'TERM=xterm-256color', '-e', 'COLORTERM=truecolor',
+         '-w', cwd, container, 'tmux', '-L', socket, 'new-session', '-d', '-s', name, '-c', cwd,
+         '-x', '100', '-y', '30', '-P', '-F', '#{session_id}\t#{session_created}', '/bin/bash', '-l'], 15)
+    if rc != 0:
+        # A timeout is not proof that creation failed. Discovery will find a shell that did start.
+        raise L.LanesError('New shell: ' + (err.strip()[-180:] or 'no answer yet; discovery will check'))
+    parts = out.strip().split('\t')
+    if len(parts) != 2:
+        raise L.LanesError('Shell started; waiting for discovery to identify it')
+    return make_entry(workspace, container, socket, name,
+                      {'session_id': parts[0], 'session_created': parts[1]}, entry)
+
+
+def clear_viewers(lane_id):
+    for target in (L.STATE / 'views').glob('*/*.target'):
+        try:
+            if target.read_text().strip() != lane_id:
+                continue
+            L.atomic_write(target, '!empty\n')
+            pid = int(target.with_suffix('.pid').read_text().strip())
+            if b'view.sh' in Path(f'{L.proc_root()}/{pid}/cmdline').read_bytes():
+                os.kill(pid, signal.SIGUSR1)
+        except (OSError, ValueError):
+            pass
+
+
+def rename_session(workspace, entry, new_name):
+    """Rename an unregistered session. Updates user-sessions metadata and resolve.dynamic.
+    `new_name` must pass the _title() gate (non-empty, no control chars).
+    Returns the updated entry dict."""
+    L._title(new_name)   # raises LanesError on invalid name
+    lane_id = entry['id']
+    meta_path = L.STATE / 'user-sessions' / (lane_id + '.json')
+    meta = L.read_json(meta_path, {}) or {}
+    meta['name'] = new_name
+    L.atomic_write(meta_path, json.dumps(meta) + '\n')
+    # resolve.dynamic/<id>: lines are holder, container, socket, session, name
+    resolve_path = L.STATE / 'resolve.dynamic' / lane_id
+    if resolve_path.exists():
+        lines = resolve_path.read_text().split('\n')
+        if len(lines) >= 5:
+            lines[4] = new_name
+            L.atomic_write(resolve_path, '\n'.join(lines[:5]) + '\n')
+    return dict(entry, name=new_name)
+
+
+def rename_registered(manifest_path, registry_name, new_name):
+    """Rename a registered lane by writing a displayNames override to the workspace manifest JSON.
+    `manifest_path` is the path to workspaces.<board>.json; `registry_name` is the terminal's declared
+    name; `new_name` is the display override. Callers must run `lanes sync` after this returns."""
+    L._title(new_name)
+    data = json.loads(Path(manifest_path).read_text())
+    if 'displayNames' not in data:
+        data['displayNames'] = {}
+    if new_name == registry_name:
+        data['displayNames'].pop(registry_name, None)   # removing the override restores the default
+    else:
+        data['displayNames'][registry_name] = new_name
+    L.atomic_write(manifest_path, json.dumps(data, indent=2, ensure_ascii=False) + '\n', mode=0o644)
+
+
+def promote_to_registered(workspace_id, entry, registry):
+    """Promote an unregistered tmux session to a registered lane by writing its binding to terminals.json.
+
+    The session must have holder=='tmux' and the workspace must have exactly one repository source
+    (unambiguous write target). After this call, callers should run `lanes sync` and reload.
+    Raises LanesError for unsupported configurations or invalid session state."""
+    if entry.get('holder') != 'tmux':
+        raise L.LanesError('Only tmux sessions can be promoted (zmx and exec holders are not supported)')
+    board = next((w for w in registry.get('workspaces', []) if w['id'] == workspace_id), None)
+    if not board:
+        raise L.LanesError('Workspace not found')
+    # Find the terminals.json source — must be a single unambiguous path
+    sources = [lane.get('source') for lane in board.get('lanes', []) if lane.get('source')]
+    unique_sources = list(dict.fromkeys(s for s in sources if s))
+    if not unique_sources:
+        raise L.LanesError(
+            'No registry source found for this workspace; add the lane to terminals.json manually')
+    if len(unique_sources) > 1:
+        raise L.LanesError(
+            'Multiple registry sources in this workspace; add the lane to terminals.json manually')
+    terminals_path = Path(unique_sources[0])
+    if not terminals_path.exists():
+        raise L.LanesError(f'Registry file not found: {terminals_path}')
+    tmux = entry.get('tmux') or {}
+    socket_name = tmux.get('socket', '')
+    session_name = tmux.get('session', '')
+    if not socket_name or not session_name:
+        raise L.LanesError('Session has no tmux binding; cannot promote')
+    data = json.loads(terminals_path.read_text())
+    terminals = data.get('terminals') or []
+    lane_block = data.setdefault('lanes', {})
+    lane_terminals = lane_block.setdefault('terminals', {})
+    name = entry.get('name', session_name)
+    # Guard: do not overwrite an existing registered terminal with the same name
+    if any(t.get('name') == name for t in terminals):
+        raise L.LanesError(f'A terminal named {name!r} already exists; rename it first')
+    if name in lane_terminals:
+        raise L.LanesError(f'A binding for {name!r} already exists; rename it first')
+    terminals.append({'name': name, 'command': entry.get('create') or ''})
+    lane_terminals[name] = {'holder': 'tmux', 'tmux': {'socketName': socket_name, 'sessionName': session_name}}
+    if entry.get('create'):
+        lane_terminals[name]['create'] = entry['create']
+    data['terminals'] = terminals
+    L.atomic_write(terminals_path, json.dumps(data, indent=2, ensure_ascii=False) + '\n', mode=0o644)
+    # Remove the user-sessions metadata — the terminal is now governed by the registry
+    meta_path = L.STATE / 'user-sessions' / (entry['id'] + '.json')
+    meta_path.unlink(missing_ok=True)
+
+
+def close_session(workspace, entry):
+    """Close the exact observed session, never an identically named replacement or a registered lane."""
+    registry = L.load_registry()
+    current = (L.read_json(L.STATE / 'status.json', {}) or {}).get('unregistered', {}).get(workspace, [])
+    published = next((x for x in current if x['id'] == entry['id']), None)
+    if not published or session_key(published) != session_key(entry) or not entry.get('closable'):
+        raise L.LanesError('Session changed; reload before closing')
+    if entry.get('legacy'):
+        import legacy_sessions
+        legacy_sessions.close(entry)
+        clear_viewers(entry['id'])
+        (L.STATE / 'resolve.dynamic' / entry['id']).unlink(missing_ok=True)
+        return
+    registered = {session_key(lane) for w in registry['workspaces'] for lane in w.get('lanes', [])
+                  if lane.get('holder') == 'tmux'}
+    if session_key(entry) in registered:
+        raise L.LanesError('Registered lanes cannot be closed here')
+    container, socket, name = session_key(entry)
+    L._require(L.IDENT, container, 'container')
+    L._require(L.IDENT, socket, 'socket')
+    # The session gate admits what TMUX itself can hold, not what a lane may be DECLARED with — the same rule
+    # `holders/tmux.sh` uses (DEF-891). statusd publishes every live session as a 👻 row with `closable: True`,
+    # its name inside the declaration grammar or not (the `<name> (drain)` twins the Studio mints among them),
+    # and the sidebar draws the red × on each; a gate copied from `lanes_lib.TMUX_SESSION` refused exactly
+    # those rows with "Invalid session" before any tmux call, so the operator was offered a close that could
+    # never succeed (DEF-916). The raw name is never a kill target: the identity probe below targets
+    # `=<name>:` — the trailing `:` also keeps a trailing `;` from ending the tmux command — and the kill
+    # itself runs inside tmux against the pinned `$sid`. Control characters stay refused: no listing
+    # round-trips them.
+    if not name or any(ord(c) < 32 or ord(c) == 127 for c in name):
+        raise L.LanesError(f'Invalid session: {name!r}')
+    identity = entry.get('identity') or {}
+    sid, created = identity.get('session_id', ''), identity.get('created', '')
+    if not sid.startswith('$') or not sid[1:].isdigit() or not created.isdigit():
+        raise L.LanesError('Session identity is not ready; wait for the next status update')
+    info = (L.read_json(L.STATE / 'containers.json', {}) or {}).get(container) or {}
+    outcome, actual = L.tmux_probe(info, socket,
+                                  ['display-message', '-p', '-t', '=' + name + ':',
+                                   '#{session_id}\t#{session_created}'], 5)
+    if outcome != 'ok' or actual.strip() != sid + '\t' + created:
+        raise L.LanesError('Session changed or could not be checked; nothing was closed')
+    # A grouped member SHARES this session's windows, so `kill-session` on the leader only unlinks the
+    # leader's winlinks: every window and every process keeps running under the member, the row leaves
+    # status.json, and the survivor comes back next cycle as a NEW 👻 — while the footer said "Closed"
+    # (MEASURED on tmux 3.4, review round 8; DEF-981). `studio_host::lane::stop` already kills the Host's
+    # own `view-<studio>-<ch>` members first and refuses `not_stoppable` for a stranger; this is the same
+    # rule on the same shape, so the two surfaces answer alike. A listing that does not answer closes
+    # nothing: no verdict is not "no members".
+    outcome, listing = L.tmux_probe(info, socket,
+                                    ['list-sessions', '-F', '#{session_name}\t#{session_group}'], 5)
+    if outcome != 'ok':
+        raise L.LanesError('Could not read the session groups; nothing was closed')
+    views, strangers = L.grouped_members(listing, name)
+    if strangers:
+        raise L.LanesError(
+            f'{len(strangers)} session(s) are grouped onto it and would keep its panes alive: '
+            + ', '.join(sorted(strangers)[:3]) + ' — end them first; nothing was closed')
+    for member in views:
+        # Named by the listing, targeted exactly, and only ever a name the Studio Host mints.
+        L.tmux_probe(info, socket, ['kill-session', '-t', '=' + member + ':'], 5)
+    # The conditional executes inside tmux: even a replacement between the check and kill is protected.
+    outcome, error = L.tmux_probe(info, socket,
+        ['if-shell', '-F', '-t', sid, '#{==:#{session_created},' + created + '}',
+         'kill-session -t ' + shlex.quote(sid), 'display-message -p stale-session'], 5)
+    if outcome != 'ok' or error.strip():
+        raise L.LanesError('Could not confirm close: ' + (error or outcome))
+    clear_viewers(entry['id'])
+    for directory in ('resolve.dynamic', 'user-sessions'):
+        path = L.STATE / directory / (entry['id'] + ('.json' if directory == 'user-sessions' else ''))
+        path.unlink(missing_ok=True)

package/payload/lanes/libexec/sidebar

@@ -0,0 +1,8 @@
+#!/bin/sh
+# Never leave the sidebar pane empty: restart the TUI if it ever exits.
+trap '' INT QUIT
+here=$(cd "$(dirname "$0")" && pwd)
+while :; do
+    python3 -S -E "$here/sidebar.py" "$@" || :
+    sleep 1
+done