aicodeman 1.26.1 → 1.27.0

package/dist/tmux-manager.js

@@ -422,6 +422,60 @@ function truncatePaneLineByVisibleColumns(line, maxColumns) {
 export function normalizeScrollbackEol(buffer) {
     return buffer.replace(/\r?\n/g, '\r\n');
 }
+/**
+ * Read the pane's cursor and size, or null when tmux cannot say.
+ *
+ * Every field is validated together: a caller that gets a value back can place
+ * a caret with it, and one that gets null must not try.
+ */
+export function queryPaneCursor(run) {
+    let raw;
+    try {
+        raw = run().trim();
+    }
+    catch (cursorErr) {
+        console.error('[TmuxManager] Failed to query pane cursor after capture:', cursorErr);
+        return null;
+    }
+    const [cursorX, cursorY, cols, rows] = raw.split(/\s+/).map((value) => parseInt(value, 10));
+    if (!Number.isFinite(cursorX) ||
+        !Number.isFinite(cursorY) ||
+        !Number.isFinite(cols) ||
+        !Number.isFinite(rows) ||
+        cursorX < 0 ||
+        cursorY < 0 ||
+        cols <= 0 ||
+        rows <= 0) {
+        return null;
+    }
+    return { cols, rows, cursorX, cursorY };
+}
+/** SGR attributes, which is all `capture-pane -e` emits. */
+// eslint-disable-next-line no-control-regex
+const CAPTURE_STYLE_SEQUENCE = /\x1b\[[0-9;:]*m/g;
+/** Whether a capture holds anything a reader would see, styles discounted. */
+export function hasVisibleContent(capture) {
+    return /\S/.test(capture.replace(CAPTURE_STYLE_SEQUENCE, ''));
+}
+/**
+ * Put the caret back where the pane has it, counting UP from the bottom of what
+ * was just replayed.
+ *
+ * Relative rather than absolute (`CUP`) on purpose. `\x1b[<row>;<col>H` numbers
+ * rows from the top of the browser's screen, so it only lands correctly while
+ * the browser's row count equals the pane's — and it need not, because
+ * `resizeWindow` fires its tmux resize without waiting, so a capture can be
+ * taken before a requested resize has been applied. Counting up from the last
+ * replayed row is anchored to the content instead, which is the thing both ends
+ * genuinely share.
+ */
+export function formatCursorRestore(geometry) {
+    const up = Math.max(0, geometry.rows - 1 - geometry.cursorY);
+    const right = Math.max(0, geometry.cursorX);
+    // `\r` first so the column is known: the replay leaves the caret wherever the
+    // last row's text ended.
+    return `${up > 0 ? `\x1b[${up}A` : ''}\r${right > 0 ? `\x1b[${right}C` : ''}`;
+}
 export function formatPaneSnapshot(lines, geometry) {
     const cols = Math.max(1, geometry.cols);
     // Paint the full pane width. Earlier this dropped the rightmost column
@@ -610,7 +664,7 @@ export function remoteTmuxSessionName(sessionId) {
  *   even when the remote path contains spaces.
  */
 export function buildRemoteLaunchCommand(options) {
-    const { mode, remote, sessionId, claudeMode, allowedTools } = options;
+    const { mode, remote, sessionId, claudeMode, allowedTools, ompConfig, resumeSessionId } = options;
     // §6.3: honor the session's EFFECTIVE claude permission mode on remote instead of
     // hardcoding --dangerously-skip-permissions, so a non-granted multi-user user's
     // downgraded 'auto' actually reaches the remote agent (the default command otherwise
@@ -619,11 +673,68 @@ export function buildRemoteLaunchCommand(options) {
     // `defaultRemoteCommandForMode`: `claude` lives under a per-user PATH entry that
     // only an interactive login shell resolves (see that function's comment).
     const override = remote.commands?.[mode];
-    const modeCommand = override
-        ? override
-        : mode === 'claude'
-            ? remoteLoginShellCommand(`claude${buildClaudePermissionFlags(claudeMode, allowedTools)}`)
-            : defaultRemoteCommandForMode(mode);
+    let modeCommand;
+    if (override) {
+        modeCommand = override;
+    }
+    else if (mode === 'claude') {
+        // Deterministic conversation pinning for SSH-remote claude (mirrors the
+        // docker-claude shape in claudeDockerPaneCommand, INCLUDING the distinct
+        // resumeId branch it declares — this used to only mirror the same-id
+        // fallback shape, silently dropping an explicit resumeSessionId that
+        // differs from sessionId, e.g. a resume-from-history launch): the FIRST
+        // run creates the conversation under --session-id <sessionId>; a respawn
+        // / reattach re-runs the same idempotent command, --session-id exits
+        // non-zero ("already in use"), and the `||` fallback RESUMES that same
+        // conversation. Without a pinned id, every reattach relaunched a bare
+        // `claude` and started a NEW conversation (found live 2026-08-29: remote
+        // claude ctrl-d / ctrl-c relaunched a fresh session). A per-host
+        // `commands.claude` override stays authoritative (admin's explicit
+        // choice) and skips this entirely.
+        const permFlags = buildClaudePermissionFlags(claudeMode, allowedTools);
+        const cmd = `claude${permFlags}`;
+        // Defense in depth, mirroring claudeDockerPaneCommand's own belt-and-braces check:
+        // sessionId is server-minted and always safe in practice, but this command is built
+        // as a single shellescaped string and then executed as shell code on the remote
+        // host, so an unsafe value here is validated rather than trusted.
+        if (!RESUME_ID_SAFE.test(sessionId)) {
+            modeCommand = remoteLoginShellCommand(cmd);
+        }
+        else {
+            const rid = resumeSessionId && RESUME_ID_SAFE.test(resumeSessionId) ? resumeSessionId : undefined;
+            modeCommand = remoteLoginShellCommand(rid && rid !== sessionId
+                ? `${cmd} --resume ${rid} || ${cmd} --session-id ${sessionId}`
+                : `${cmd} --session-id ${sessionId} || ${cmd} --resume ${sessionId}`);
+        }
+    }
+    else if (mode === 'omp') {
+        // Remote OMP respawn must RESUME the same conversation instead of
+        // relaunching fresh (found live 2026-08-29: remote ctrl-c/ctrl-d relaunched
+        // a brand-new omp session). The pinned id, when known, is passed as an
+        // explicit --resume; otherwise fall back to omp's own "most recent"
+        // --continue so a dead-pane respawn still lands back in the conversation.
+        // Rendered through the CLI registry (buildSpawnCommandFromRegistry), the
+        // SAME mode-agnostic path local/docker spawns use — not appendResumeFlag(),
+        // which would hand the id to the login shell as $0 after the quoted `-c
+        // 'omp'`, and not a raw buildOmpCommand() call, which the registry refactor
+        // (#347) deleted. Gives every registry CLI with a resume form this
+        // behaviour for free, and the flags can't drift from the local builder.
+        const ompEntry = getCli('omp');
+        const ompCmd = ompEntry
+            ? (buildSpawnCommandFromRegistry(ompEntry, {
+                mode: 'omp',
+                sessionId,
+                ompConfig: {
+                    ...ompConfig,
+                    resumeSessionId: resumeSessionId || ompConfig?.resumeSessionId,
+                },
+            }) ?? 'omp')
+            : 'omp';
+        modeCommand = remoteLoginShellCommand(ompCmd);
+    }
+    else {
+        modeCommand = defaultRemoteCommandForMode(mode);
+    }
     const remoteName = remoteTmuxSessionName(sessionId);
     // Innermost: the command tmux runs in the new pane. Run via `/bin/sh -c` by
     // tmux, so the path needs shell-quoting here. `exec` replaces the shell with
@@ -1554,7 +1665,7 @@ export class TmuxManager extends EventEmitter {
             const fullCmd = docker
                 ? buildDockerLaunchCommand(resolveDockerLaunchOptions(mode, docker, sessionId, resumeSessionId))
                 : remote
-                    ? buildRemoteSessionCommand({ mode, remote, sessionId, claudeMode, allowedTools })
+                    ? buildRemoteSessionCommand({ mode, remote, sessionId, claudeMode, allowedTools, ompConfig, resumeSessionId })
                     : localFullCmd;
             // Create tmux session in three steps to handle cold-start (no server running)
             // and avoid the race where the command exits before remain-on-exit is set:
@@ -1758,7 +1869,7 @@ export class TmuxManager extends EventEmitter {
         const fullCmd = docker
             ? buildDockerLaunchCommand(resolveDockerLaunchOptions(mode, docker, sessionId, resumeSessionId))
             : remote
-                ? buildRemoteSessionCommand({ mode, remote, sessionId, claudeMode, allowedTools })
+                ? buildRemoteSessionCommand({ mode, remote, sessionId, claudeMode, allowedTools, ompConfig, resumeSessionId })
                 : localFullCmd;
         try {
             // Same per-CLI env setup as createSession, re-applied so the respawned pane inherits it.
@@ -2809,11 +2920,14 @@ export class TmuxManager extends EventEmitter {
      *   the browser xterm reproduces the live frame. Used for fast tab switches.
      * - Full history (`opts.fullHistory`): `capture-pane -p -e -J -S -<N>` grabs
      *   the tmux scrollback (COD-47, bounded to the configured history limit),
-     *   returned as linear scrollback text with SGR codes preserved (NOT
-     *   repositioned — a multi-screen history can't be painted into a single
-     *   visible frame, so the snapshot repaint is skipped). `-J` re-joins lines
-     *   hard-wrapped at the pane width so they reflow in the browser xterm.
-     *   Used for full page reloads so the user gets back their scroll history.
+     *   returned as linear scrollback text with SGR codes preserved. Rows are not
+     *   repainted at absolute positions — a multi-screen history can't be painted
+     *   into a single visible frame — but the capture DOES end with a cursor move
+     *   putting the caret back where the pane has it, counted up from the last
+     *   replayed row. `-J` re-joins lines hard-wrapped at the pane width so they
+     *   reflow in the browser xterm. Used for full page reloads so the user gets
+     *   back their scroll history. Returns '' for a pane holding nothing visible,
+     *   so the caller keeps whatever history it already had.
      *   Caveat: lines tmux has already evicted past its history-limit are gone.
      */
     /**
@@ -2872,35 +2986,37 @@ export class TmuxManager extends EventEmitter {
                 execOpts.maxBuffer =
                     (opts?.maxCaptureBytes ?? DEFAULT_TERMINAL_BUFFER_MAX_BYTES) + FULL_HISTORY_CAPTURE_SLACK_BYTES;
             }
-            const buffer = execSync(`${this.tmux()} ${captureFlags} -t ${shellescape(target)}`, execOpts).replace(/\n+$/g, '');
-            // Full-history spans many screens — return it as raw linear scrollback
-            // rather than repainting rows at single-screen absolute positions. tmux
-            // joins scrollback rows with a bare `\n`; normalize to `\r\n` so a fresh
-            // xterm (convertEol:false) starts each replayed line at column 0 instead
-            // of staircasing diagonally (COD-138).
+            const rawCapture = execSync(`${this.tmux()} ${captureFlags} -t ${shellescape(target)}`, execOpts);
+            // Query the cursor BEFORE deciding anything else. On the full-history path
+            // it settles both how the capture is trimmed and whether a cursor move is
+            // appended, and those two have to agree: trailing blank rows are only safe
+            // to keep when a move follows to put the caret back above them.
+            const geometry = queryPaneCursor(() => execSync(`${this.tmux()} display-message -p -t ${shellescape(target)} '#{cursor_x} #{cursor_y} #{pane_width} #{pane_height}'`, { encoding: 'utf-8', timeout: EXEC_TIMEOUT_MS }));
             if (fullHistory) {
-                return normalizeScrollbackEol(buffer);
-            }
-            try {
-                const cursor = execSync(`${this.tmux()} display-message -p -t ${shellescape(target)} '#{cursor_x} #{cursor_y} #{pane_width} #{pane_height}'`, {
-                    encoding: 'utf-8',
-                    timeout: EXEC_TIMEOUT_MS,
-                }).trim();
-                const [cursorX, cursorY, cols, rows] = cursor.split(/\s+/).map((value) => parseInt(value, 10));
-                if (Number.isFinite(cursorX) &&
-                    Number.isFinite(cursorY) &&
-                    Number.isFinite(cols) &&
-                    Number.isFinite(rows) &&
-                    cursorX >= 0 &&
-                    cursorY >= 0 &&
-                    cols > 0 &&
-                    rows > 0) {
-                    return formatPaneSnapshot(buffer.split('\n'), { cols, rows, cursorX, cursorY });
-                }
-            }
-            catch (cursorErr) {
-                console.error('[TmuxManager] Failed to query pane cursor after capture:', cursorErr);
+                // Without geometry there is no cursor move, so fall back to the old trim.
+                // Keeping the blank rows here would park the caret at the bottom of the
+                // pane with nothing to correct it — worse than not trying at all.
+                if (!geometry)
+                    return normalizeScrollbackEol(rawCapture.replace(/\n+$/g, ''));
+                // Take the line terminator off and nothing else. The trailing blank rows
+                // that remain are the real bottom of the screen, and the cursor move
+                // below counts up from it. tmux joins rows with a bare `\n`; normalize to
+                // `\r\n` so a fresh xterm (convertEol:false) starts each replayed line at
+                // column 0 instead of staircasing diagonally (COD-138).
+                const trimmed = rawCapture.replace(/\n$/, '');
+                // An all-blank pane has to keep reading as "nothing to replay". The caller
+                // treats an empty string as "capture unavailable" and keeps the byte
+                // history; blank rows plus a cursor move are not empty, so without this a
+                // blank pane REPLACES that history with a blank screen — the downgrade
+                // `_replayWouldShrinkBuffer` exists to refuse, arriving from the server
+                // side where that guard cannot see it.
+                if (!hasVisibleContent(trimmed))
+                    return '';
+                return `${normalizeScrollbackEol(trimmed)}${formatCursorRestore(geometry)}`;
             }
+            const buffer = rawCapture.replace(/\n+$/g, '');
+            if (geometry)
+                return formatPaneSnapshot(buffer.split('\n'), geometry);
             // Cursor query failed or geometry was invalid, so we skip the absolute-
             // positioned snapshot repaint and fall back to the raw capture. Normalize
             // its bare `\n` line endings to `\r\n` so the replay doesn't staircase