@volter/supercode-terminal 0.2.71 → 0.2.72

package/CAPABILITIES.md

@@ -23,7 +23,7 @@ means it must not be presented as supported.
 | Scrollback, selection and copy | UI/xterm | verified | Bounded scrollback and native xterm selection. |
 | Find in one terminal, next/previous match | UI | verified | Search covers the active xterm buffer. Cross-tab search is missing. |
 | URL detection | UI | partial | The stable xterm web-link provider is active; host policy and end-to-end link opening still need a dedicated proof. |
-| Exclusive input ownership | tmux/host | partial | `acquireInput`, `ownsInput` and `releaseInput` serialize a paste with other input and remain with the pane across a client restart. [Recorded tmux proof](../../docs/evidence/claude-input-2026-10-07.md#recorded-review-fixes) rejects a replacement while the badge is unrecorded, then confirms one native message after daemon restart. Older pane servers refuse this door; Windows ownership restart remains unmeasured. |
+| Exclusive input ownership | tmux/host | partial | `acquireInput`, `ownsInput` and `releaseInput` serialize a paste with other input and remain with the pane across a client restart. [Recorded tmux proof](../../docs/evidence/claude-input-2026-10-07.md#recorded-review-fixes) rejects a replacement while the badge is unrecorded, then confirms one native message after daemon restart. `PaneServerHost.createSession` can require this ABI before creating a pane; [manual old/current server admission](../../docs/evidence/launch-input-ownership-admission-2026-10-09.md) is recorded on macOS. Older pane servers refuse this door; Windows ownership restart and admission remain unmeasured. |
 | Paste and bracketed paste | UI | verified | Multiline or large pastes require confirmation; history is memory-only. Advanced transforms and slow paste are missing. |
 | Save terminal contents | UI | partial | The normal buffer is projected to a bounded plain-text download; the browser download boundary and continuous logging still need dedicated proof. |
 | Bell and background activity | UI | verified | A controlled tmux shell proved active visual bell plus inactive activity/bell tab state. System notifications are host policy. |

package/README.md

@@ -52,6 +52,13 @@ PTY host reads its own live catalog; an older pane server refuses this operation
 This is a host observation, not a physical window/tab reading or an existence
 lock against a subsequent launch.
 
+`PaneServerHost.createSession({ ..., requireInputOwnership: true })` requires
+the connected server's ownership operation before creating a pane. An older
+server rejects with `input_ownership_unsupported` and starts no process; the
+same connection handles admission and creation. Omitting the option preserves
+ordinary creation. [Manual old/current server SDK readings](../../docs/evidence/launch-input-ownership-admission-2026-10-09.md)
+do not qualify Windows or native harness first-message delivery.
+
 The substrate was moved from a retired package without behavioral changes.
 Its existing home paths, environment variables, and tmux ownership markers stay
 compatible. Those files retain Apache-2.0 licensing; see `NOTICE-SUBSTRATE` and

package/index.d.ts

@@ -91,7 +91,8 @@ export class PaneServerHost {
   listSessions(): Promise<TerminalSession[]>;
   /** Requires a compatible pane server; an unsupported operation rejects. */
   hasLiveContext(contextKey: string): Promise<boolean>;
-  createSession(input: { command: TmuxCommand; contextKey?: string; cwd?: string; env?: Record<string, string>; name?: string }): Promise<TerminalSession>;
+  /** Require the running pane server's ownership door before creating a pane. */
+  createSession(input: { command: TmuxCommand; contextKey?: string; cwd?: string; env?: Record<string, string>; name?: string; requireInputOwnership?: boolean }): Promise<TerminalSession>;
   capture(sessionId: string, options?: { lines?: number; preserveEscapes?: boolean }): Promise<string>;
   sendInput(sessionId: string, data: string, options?: { deadlineMs?: number; submitMode?: 'retry' | 'single' | 'none'; inputOwner?: string }): Promise<TerminalInputDelivery>;
   /** Exclusive input ownership, retained by the pane host across client restart. */

package/index.mjs

@@ -1117,7 +1117,7 @@ export class PaneServerHost {
 
   listSessions() { return this.#request('listSessions', []); }
   hasLiveContext(contextKey) { assertContextKey(contextKey); return this.#request('hasLiveContext', [contextKey]); }
-  createSession(input) { return this.#request('createSession', [input]); }
+  createSession(input) { return this.#request('createSession', [input], { requireInputOwnership: input.requireInputOwnership === true }); }
   capture(sessionId, options = {}) { return this.#request('capture', [sessionId, options]); }
   sendInput(sessionId, data, options = {}) { return this.#request('sendInput', [sessionId, data, options]); }
   acquireInput(sessionId, owner) { return this.#request('acquireInput', [sessionId, owner]); }
@@ -1175,12 +1175,27 @@ export class PaneServerHost {
     // A server that is leaving refuses a request unrun (`pane_server_restarting`): it is asked again of the next one.
     for (let attempt = 0; ; attempt += 1) {
       const connection = await this.#connect();
-      const id = this.#next++;
       try {
-        return await new Promise((resolve, reject) => {
-          this.#pending.set(id, { resolve, reject, connection });
-          connection.write(`${JSON.stringify({ id, op, args, ...extra })}\n`);
-        });
+        if (op === 'createSession' && extra.requireInputOwnership) {
+          // The installed client can be newer than the server that still holds
+          // this machine's panes. Check its actual ownership door before any
+          // process starts, on the same connection that will create the pane.
+          // null cannot identify a PtyTerminalHost session: session_not_found
+          // means the vendor's ownership operation ran without touching a pane.
+          try {
+            await this.#call(connection, 'ownsInput', [null, 'capability_check']);
+            throw new TerminalHostError('input_ownership_unconfirmed', 'The pane server did not confirm its input ownership door; no pane was created.');
+          } catch (error) {
+            if (error?.code === 'unsupported') {
+              throw new TerminalHostError('input_ownership_unsupported', 'The running pane server does not support input ownership required for this first message; no pane was created. Update the pane server through its owner before retrying.');
+            }
+            if (error?.code !== 'session_not_found') throw error;
+          }
+          if (connection.destroyed || this.#connection !== connection) {
+            throw new TerminalHostError('pane_server_unreachable', 'The pane server connection changed during input ownership admission; no pane was created.');
+          }
+        }
+        return await this.#call(connection, op, args, { ...extra, requireInputOwnership: undefined });
       } catch (error) {
         if (error?.code !== 'pane_server_restarting' || attempt >= 20) throw error;
         await sleep(250);
@@ -1188,6 +1203,15 @@ export class PaneServerHost {
     }
   }
 
+  #call(connection, op, args, extra = {}) {
+    const id = this.#next++;
+    return new Promise((resolve, reject) => {
+      this.#pending.set(id, { resolve, reject, connection });
+      try { connection.write(`${JSON.stringify({ id, op, args, ...extra })}\n`); }
+      catch (error) { this.#pending.delete(id); reject(error); }
+    });
+  }
+
   #connect() {
     if (this.#connection && !this.#connection.destroyed) return Promise.resolve(this.#connection);
     return (this.#connecting ??= this.#open().finally(() => { this.#connecting = null; }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-terminal",
-  "version": "0.2.71",
+  "version": "0.2.72",
   "type": "module",
   "description": "Optional leak-safe terminal and tmux host adapter for Volter Harness frontends",
   "exports": {