@vibelord/lanes 1.5.0 → 1.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibelord/lanes",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Installer for Lanes: shared agent terminals over SSH with Zellij views, registry sync, uploads and a phone interface.",
   "license": "MIT",
   "type": "module",

package/payload/lanes/VERSION

@@ -1 +1 @@
-1.5.0
+1.5.1

package/payload/lanes/bin/lanes

@@ -1127,8 +1127,8 @@ def cmd_attach(args):
     # Record the base and bring the owner (W8 A2) in line, also for sessions that existed before either was known.
     record_base(device, args)
     record_look(device, args)
-    # Views idle until a real client (with a real size) has attached once. We exec into the zellij
-    # client below, so a detached helper raises the flag shortly after the client has sized the session.
+    # Views idle until a real client (with a real size) has attached once. We exec into the display
+    # supervisor below, so a detached helper raises the flag shortly after its client has sized the session.
     ready = L.STATE / 'clients' / f'{device}.ready'
     if not ready.exists() and os.fork() == 0:
         os.setsid()
@@ -1163,7 +1163,11 @@ def cmd_attach(args):
                      'COLORTERM': os.environ.get('COLORTERM', 'truecolor')})
     if L.run_bounded(['infocmp', env['TERM']], 5)[0] != 0:   # unknown here — or no answer: the safe default
         env['TERM'] = 'xterm-256color'
-    os.execve(str(ZELLIJ), ZELLIJ_BASE + ['attach', device], env)
+    # Own the terminal backlog as well as SSH's transport. A slow Zellij 0.45.1
+    # client can stay alive after its server has dropped it (Exit is behind the
+    # queued frames); keepalives alone cannot make lanes-launch reconnect it.
+    os.execve(sys.executable, [sys.executable, str(L.REPO / 'libexec/attach.py'),
+                              *ZELLIJ_BASE, 'attach', device], env)
 
 
 def cmd_open(args):

package/payload/lanes/docs/ARCHITECTURE.md

@@ -711,6 +711,23 @@ identity so folder permissions work. On Linux it is a systemd user service that
 user manager holds, looked up before every login, so an agent a desktop session hands over after boot is used
 without a restart. The installer's remembered `--no-uploads` / `--no-desktop` remove what an earlier install added.
 
+Desktop `lanes attach` execs `libexec/attach.py`, a PTY supervisor for exactly one Zellij client. It relays raw
+input and output with nonblocking writes, forwards the terminal size, and restores terminal modes on exit.
+`OUTPUT_LIMIT` (1 MiB) and `OUTPUT_AGE` (5 s) bound output waiting for the SSH terminal; no output means no timeout.
+Crossing either bound terminates only its child, with `STOP_GRACE` (1 s) before KILL, and exits 1 for the existing
+`lanes-launch` reconnect loop. The view server, its panes and their tmux/zmx holders remain alive. The existing
+`clients/<device>.<client>.pid` now names the supervisor; its argv still carries the exact Zellij attach command,
+so stale-predecessor cleanup reaches the supervisor and its owned child. No new durable state is introduced.
+
+This closes the desktop failure observed on Anarchy on 2026-10-16 (DEF-1965). In the pinned Zellij 0.45.1,
+[`ClientSender`](https://github.com/zellij-org/zellij/blob/v0.45.1/zellij-server/src/os_input_output.rs) removes a
+client when its 5,000-message queue fills, but sends Exit only after draining queued messages. The
+[`input handler`](https://github.com/zellij-org/zellij/blob/v0.45.1/zellij-client/src/input_handler.rs) can then wait
+indefinitely for an action acknowledgement. The transport remains alive while the display cannot interact.
+The supervisor bounds terminal backpressure before that can strand an attachment; it does not patch upstream
+Zellij or cover its separate browser transport. `tests/attach_backpressure.py` proves the unread-terminal control,
+bounded disconnect, holder survival and keyboard switching after reattachment with the installed pin.
+
 The sidebar sends an upload request naming paths, workspace and device. The client checks its folder allowlist,
 streams an archive over SSH, and reports original errors and progress. The host extracts data into that
 workspace's `uploads/` folder without overwriting files; an optional paste places the resulting paths in the

package/payload/lanes/docs/RUNBOOK.md

@@ -378,7 +378,16 @@ lanes studio-host re-key --yes       after the owner revoked the Host: a new mac
   stderr. Writes are atomic and only on a change; the file stays 0600 and `~/.ssh` 0700. A non-default sshd
   `AuthorizedKeysFile` does not read this block.
 
-- **A view looks wrong / stuck:** `lanes rebuild mac`. Views are disposable; agents are untouched; the client reconnects.
+- **A desktop stops accepting keys while SSH stays connected:** reconnect that window's display first (close and
+  reopen the Lanes window, or terminate only its verified SSH display child so `lanes-launch` retries). Do not
+  restart holders or containers. `lanes attach` now supervises its Zellij client with `libexec/attach.py`: output
+  waiting to reach the terminal is limited to 1 MiB and an oldest pending chunk age of 5 s. Either bound ends only
+  that client (TERM, then KILL after 1 s if needed), exits 1, and lets `lanes-launch` reconnect to the existing view.
+  Idle terminals have no deadline; input, resizing and normal exit codes pass through. A client that cannot drain
+  its terminal cannot be rescued by SSH keepalives alone (DEF-1965). This guard covers desktop SSH attachments;
+  Zellij's browser transport does not use it. Already attached desktops pick it up on their next attachment.
+- **A view's layout looks wrong:** `lanes rebuild mac`. Views are disposable; agents are untouched; the client
+  reconnects. Rebuilding also ends that view's Host tab shell, so prefer a display reconnect for a frozen client.
 - **A lane was added/renamed/removed in a repo's `.vscode/terminals.json`:** nothing to do. `lanes-sync.timer`
   re-reads registries every 2 minutes and the sidebar follows. The zellij layout is never edited live. A sync that
   finds nothing new leaves `registry.json` (and its `generated_at`) untouched and only records the time in

package/payload/lanes/libexec/attach.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Bound the desktop client's terminal backlog; reconnect a slow display, never its session.
+
+Zellij 0.45.1 removes a slow client when its 5,000-message queue fills, but
+sends Exit only after draining that queue. Input can wait for an unblock that
+the removed client will never receive. SSH keepalives cannot detect this.
+This relay bounds bytes and age before the terminal can block Zellij's writer.
+"""
+import collections
+import errno
+import fcntl
+import os
+import pty
+import select
+import signal
+import sys
+import termios
+import time
+import tty
+
+OUTPUT_LIMIT = 1024 * 1024
+OUTPUT_AGE = 5.0
+CHUNK = 65536
+STOP_GRACE = 1.0
+# CAN cancels a partial escape sequence. Leave the alternate screen and restore
+# terminal modes even when the child cannot run its own teardown.
+RESET = (b'\x18\x1b[?2026l\x1b[?1049l\x1b[?1000l\x1b[?1002l\x1b[?1003l'
+         b'\x1b[?1006l\x1b[?2004l\x1b[<u\x1b[0m\x1b[?25h')
+
+
+def relay(command, output_limit=OUTPUT_LIMIT, output_age=OUTPUT_AGE):
+    if not command:
+        raise ValueError('No display command supplied')
+    if not os.isatty(0) or not os.isatty(1):
+        raise ValueError('The Lanes display needs a terminal')
+    saved = termios.tcgetattr(0)
+    size = fcntl.ioctl(0, termios.TIOCGWINSZ, b'\0' * 8)
+    flags = fcntl.fcntl(1, fcntl.F_GETFL)
+    pending = collections.deque()  # (time read, remaining bytes); includes partial writes
+    pending_size = 0
+    input_pending = b''
+    child = master = None
+    status = None
+    stopped = False
+    reason = None
+
+    def stop(_sig, _frame):
+        nonlocal stopped
+        stopped = True
+
+    def resize(_sig=None, _frame=None):
+        # forkpty returns -1 in the child. The parent's first resize can send
+        # SIGWINCH before that child has restored its inherited handlers.
+        if master is not None and master >= 0:
+            try:
+                fcntl.ioctl(master, termios.TIOCSWINSZ,
+                            fcntl.ioctl(0, termios.TIOCGWINSZ, b'\0' * 8))
+            except OSError:
+                pass  # the terminal may have closed while SIGWINCH was pending
+
+    signals = (signal.SIGHUP, signal.SIGTERM, signal.SIGINT, signal.SIGWINCH)
+    handlers = {sig: signal.getsignal(sig) for sig in signals}
+    try:
+        # Install before fork: a close during startup must still reap our child.
+        for sig in signals:
+            signal.signal(sig, resize if sig == signal.SIGWINCH else stop)
+        tty.setraw(0)
+        child, master = pty.fork()
+        if child == 0:
+            for sig in signals:
+                signal.signal(sig, signal.SIG_DFL)
+            try:
+                # Give the first render the real dimensions, before exec can
+                # race the parent's initial SIGWINCH forwarding.
+                fcntl.ioctl(0, termios.TIOCSWINSZ, size)
+                os.execvpe(command[0], command, os.environ)
+            except OSError as error:
+                os.write(2, f'lanes: cannot start display: {error}\r\n'.encode())
+                os._exit(127)
+        os.set_blocking(master, False)
+        fcntl.fcntl(1, fcntl.F_SETFL, flags | os.O_NONBLOCK)
+        resize()
+        eof = False
+        while not stopped:
+            if status is None:
+                pid, value = os.waitpid(child, os.WNOHANG)
+                if pid:
+                    status = value
+            if pending and time.monotonic() - pending[0][0] >= output_age:
+                reason = 'display output stalled'
+                break
+            if eof and not pending:
+                break
+            readers = ([] if eof else [master]) + ([] if input_pending or status is not None else [0])
+            writers = ([1] if pending else []) + ([master] if input_pending and not eof else [])
+            readable, writable, _ = select.select(readers, writers, [], 0.05)
+            # Drain first: a writable terminal should not trip the byte limit.
+            if 1 in writable:
+                at, data = pending[0]
+                try:
+                    written = os.write(1, data)
+                except BlockingIOError:
+                    written = 0
+                pending_size -= written
+                if written == len(data):
+                    pending.popleft()
+                elif written:
+                    pending[0] = (at, data[written:])
+            if master in writable:
+                try:
+                    written = os.write(master, input_pending)
+                    input_pending = input_pending[written:]
+                except BlockingIOError:
+                    pass
+            if 0 in readable:
+                input_pending = os.read(0, CHUNK)
+                if not input_pending:
+                    break
+            if master in readable:
+                try:
+                    data = os.read(master, CHUNK)
+                except BlockingIOError:
+                    continue
+                except OSError as error:
+                    if error.errno != errno.EIO:
+                        raise
+                    data = b''  # Linux PTYs report EIO when the slave closes
+                if not data:
+                    eof = True
+                elif pending_size + len(data) > output_limit:
+                    reason = 'display output exceeded its backlog limit'
+                    break
+                else:
+                    pending.append((time.monotonic(), data))
+                    pending_size += len(data)
+    finally:
+        if child and status is None:
+            # Signal only our unreaped child, never a session server or holder.
+            try:
+                os.kill(child, signal.SIGTERM)
+            except ProcessLookupError:
+                pass
+            deadline = time.monotonic() + STOP_GRACE
+            while time.monotonic() < deadline:
+                pid, value = os.waitpid(child, os.WNOHANG)
+                if pid:
+                    status = value
+                    break
+                time.sleep(0.02)
+            if status is None:
+                try:
+                    os.kill(child, signal.SIGKILL)
+                except ProcessLookupError:
+                    pass
+                _, status = os.waitpid(child, 0)
+        if master is not None:
+            os.close(master)
+        # Never block cleanup on the display that caused the timeout. The next
+        # attach repaints from current session state; queued stale output dies here.
+        ending = RESET
+        if reason:
+            ending += f'\r\nlanes: {reason}; reconnecting the display.\r\n'.encode()
+        try:
+            os.write(1, ending)
+        except OSError:
+            pass
+        try:
+            termios.tcsetattr(0, termios.TCSANOW, saved)
+        finally:
+            fcntl.fcntl(1, fcntl.F_SETFL, flags)
+            for sig, handler in handlers.items():
+                signal.signal(sig, handler)
+    # 1 is a reconnectable failure in lanes-launch; 64–78 impose a 60 s hold.
+    return 1 if reason or stopped else (os.waitstatus_to_exitcode(status) if status is not None else 0)
+
+
+if __name__ == '__main__':
+    try:
+        sys.exit(relay(sys.argv[1:]))
+    except (OSError, ValueError) as error:
+        sys.exit(f'lanes: display attach failed: {error}')

package/payload/manifest.json

@@ -1,8 +1,8 @@
 {
  "name": "@vibelord/lanes",
- "version": "1.5.0",
- "commit": "ac8e653198f940c895645325759f19fb1dabe18e",
- "digest": "sha256:acf5755212a15acabefd00c799c206bf05dd7003696fccdbdf21058785c54374",
+ "version": "1.5.1",
+ "commit": "3b7ac2e84a23ed47f2ab3f404232286c47d3f2e8",
+ "digest": "sha256:1647256dba4c8075b45ba74c973e4ccaf00ae74e2f572f5678c16e7ad1f682bc",
  "executables": [
   "bin/lanes",
   "client/install.sh",