cyber-mux 0.4.0 → 0.6.0

package/dist/backend-AErdtLRB.mjs

@@ -0,0 +1,4246 @@
+import { h as withReason, m as nodeExec, s as normalizeWorktreePath } from "./worktree-hHuFZkpW.mjs";
+import { resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+//#region src/env-fallback.ts
+/**
+* The env-prefix fallback — the one compensation for a route that could not set env at birth.
+*
+* env is native at every tier on both backends EXCEPT herdr's worktree `create`/`open`, which take
+* no env parameter (0.7.4 answers `--env` with `unknown option`). A route that hit that wall carries
+* env the only way left: as an `env KEY=VALUE` prefix on the command the pane runs. It is a LAST
+* resort — the values land in `ps` output and the pane's shell history — and it only works when there
+* IS a command to ride; with none, the honest outcome is to warn, never to drop silently.
+*
+* This lives in one module, called by both routes that can lose env (the CLI worktree verbs and the
+* template walk's root pane), so the rule cannot be wired on one and forgotten on the other. Only a
+* route that lost env may call it: prefixing over a natively-set env would push the values into `ps`
+* and shell history on every route, the exact cost the prefix exists to pay only when it must.
+*/
+/**
+* Single-quote a value for a shell command line. Everything is literal inside single quotes, so the
+* only escape needed is for a single quote itself: end the quoting, emit an escaped `'`, reopen.
+* Without this a value carrying a space or a quote would split into extra words, or unbalance the
+* line outright.
+*/
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** `env K=V …` with a trailing space, ready to prepend to a command line. Values are shell-quoted. */
+function envPrefix(env) {
+	return `env ${Object.entries(env).map(([key, value]) => `${key}=${shellQuote(value)}`).join(" ")} `;
+}
+/**
+* Given the env a route could not carry and the command (if any) that would run in the opened pane,
+* decide how env rides in. With a command, env is prefixed onto it and the pane carries the value;
+* with none, env is dropped and the caller warns. No env (or an empty map) is `carried` unchanged, so
+* a caller on the losing route can call this unconditionally and get the right command back.
+*/
+function envFallback(env, command) {
+	if (env === void 0 || Object.keys(env).length === 0) return {
+		kind: "carried",
+		command
+	};
+	if (command === void 0) return {
+		kind: "dropped",
+		variables: Object.keys(env)
+	};
+	return {
+		kind: "carried",
+		command: `${envPrefix(env)}${command}`
+	};
+}
+//#endregion
+//#region src/floating.ts
+/**
+* The floating-pane refusal — the `'pane:float'` placement's answer on a backend that has no
+* floating-pane concept (wezterm, herdr).
+*
+* Its own module rather than a member of `mux.ts` for the reason every other seam type is not a
+* class: `mux.ts` is the CONTRACT and carries no runtime value, so putting the one class the
+* contract's refusal needs there would make every consumer of the types import a value too. It is
+* the core-surface parallel of `CaptureUnsupportedError` (`template-capture.ts`) and
+* `AgentLifecycleUnsupportedError` (`agent.ts`), and it rides the `.` barrel rather than a subpath
+* because the verb it refuses — `open` — is on the surface everybody gets.
+*/
+/**
+* A floating pane asked of a backend that cannot open one (`open` with `at: 'pane:float'` on wezterm
+* or herdr). A refusal, never a substitution: the nearest thing those backends could open is a tiled
+* split, which takes a share of the region and resizes its other panes — exactly the property a float
+* exists to avoid — so a caller would get back a pane whose id satisfies them and whose behavior does
+* not. There is no truthful degrade, so there is no degrade.
+*
+* PORTABLE and exit-code-free by design, the exact mirror of `AgentLifecycleUnsupportedError`. The
+* DECISION to refuse is the library's, made inside each adapter's `open` — the one place that sees
+* both the backend and the requested placement. How the refusal SURFACES (the exit code, the fix
+* hint, the exact sentence) is the CLI's, which catches this and re-raises its own
+* `backend-unsupported` error. `backend` names the backend so a caller composes the message without
+* re-deriving it; the terse `message` is a factual log line.
+*/
+var FloatingPanesUnsupportedError = class extends Error {
+	backend;
+	constructor(backend) {
+		super(`${backend} cannot open a floating pane`);
+		this.backend = backend;
+		this.name = "FloatingPanesUnsupportedError";
+	}
+};
+/**
+* Refuse a `'pane:float'` open on the backend named — the single spelling of the refusal, called by
+* every adapter that lacks the capability so the two cannot drift into two different messages.
+*
+* Takes the NAME rather than the adapter: it is called from inside `open`, where the adapter object is
+* still being constructed on some backends, and the name is the only thing the error carries anyway.
+*/
+function refuseFloatingPane(backend) {
+	throw new FloatingPanesUnsupportedError(backend);
+}
+/**
+* Whether `adapter` can open a floating pane — the declaration read, so a caller asking the question
+* before opening spells it once rather than reaching into an optional member that may be `undefined`.
+*
+* The pre-flight check, not the enforcement: `open` re-checks as its own contract (the same
+* belt-and-braces `agent wait` runs against `agentLifecycle`), so a caller that skips this is refused
+* just as loudly — one exec later.
+*/
+function canFloatPanes(adapter) {
+	return adapter.canFloatPanes === true;
+}
+//#endregion
+//#region src/wait-output.ts
+/** How long a polling backend sleeps between reads when the caller names no cadence. */
+const DEFAULT_WAIT_POLL_MS = 150;
+/**
+* The seam's own precondition on a wait pattern: EXACTLY ONE of `match`/`regex`, and a `regex` that
+* compiles.
+*
+* Enforced here, at the seam, rather than per adapter, for `assertRatioInRange`'s reason — it is a
+* universal property of what a wait pattern IS, true on every backend, not a per-backend policy. Both
+* halves matter for portability in different ways: the one-of rule is refusable by herdr's CLI and by
+* nothing at all on a polling backend, so leaving it to the backend would make the same call fail on
+* one and silently pick a winner on another; and compiling the source turns a MALFORMED pattern into
+* the same loud failure everywhere, instead of a herdr refusal on one backend and a poll that throws
+* on its first read somewhere else.
+*
+* What it deliberately does NOT check is dialect: a pattern using ECMAScript-only syntax compiles here
+* and is then herdr's own to accept or refuse (see `MuxWaitOptions.regex`). Validating against the
+* intersection of two regex engines would mean shipping a third one.
+*/
+function assertWaitPattern(opts) {
+	const hasMatch = opts.match != null;
+	const hasRegex = opts.regex != null;
+	if (hasMatch && hasRegex) throw new Error("wait pattern must be one of match or regex — got both");
+	if (!hasMatch && !hasRegex) throw new Error("wait pattern must be one of match or regex — got neither");
+	if (opts.match != null && opts.match === "") throw new Error("wait pattern match must not be empty");
+	if (opts.regex != null) try {
+		new RegExp(opts.regex);
+	} catch (err) {
+		throw new Error(`wait pattern regex is not a valid expression: ${opts.regex} — ${err.message}`);
+	}
+}
+/**
+* Whether `output` satisfies the pattern, and the single line to point at when it does.
+*
+* The match runs against the WHOLE snapshot, not line by line, so a regex that spans a newline still
+* hits — that is why `matchedLine` is derived separately and left absent when no single line carries
+* the match on its own. Pure, so the tricky half is testable with no multiplexer at all, exactly as
+* `template-capture`'s geometry derivation is.
+*/
+function matchWaitPattern(output, opts) {
+	assertWaitPattern(opts);
+	const hit = (text) => opts.match != null ? text.includes(opts.match) : new RegExp(opts.regex).test(text);
+	if (!hit(output)) return {
+		matched: false,
+		output
+	};
+	const line = output.split("\n").find(hit);
+	return {
+		matched: true,
+		output,
+		...line != null ? { matchedLine: line } : {}
+	};
+}
+/**
+* `waitForOutput` for a backend with NO native wait — poll its own `read` until the pattern matches or
+* the deadline passes. tmux, WezTerm and Zellij all route their seam method straight through here, so
+* the three share one cadence, one deadline rule and one liveness rule rather than three copies that
+* can drift; herdr overrides it with its native primitive.
+*
+* **Reads first, sleeps second.** The snapshot on screen when the call arrives is searched before any
+* sleeping, so a pattern already printed returns immediately — the seam's stated "existing output
+* counts" rule, and the same order herdr's native wait documents for itself.
+*
+* **A gone pane throws instead of timing out**, which is `nudge`'s rule for the same reason: a dead
+* pane and a quiet one both read back empty, so without the liveness probe every dead peer would be
+* reported as a timeout — a shape the caller reads as "still working" — and the real cause would be
+* buried. Probed BEFORE the first read (so a pane that was already gone fails at once rather than
+* after the full timeout) and again after the deadline (so a pane that died mid-wait is not reported as
+* one that merely stayed quiet). Never probed per poll: that would double every backend's query load
+* for a fact that only changes the verdict at the end.
+*/
+async function pollForOutput(adapter, exec, target, opts) {
+	assertWaitPattern(opts);
+	const pollMs = opts.pollMs ?? 150;
+	const now = opts.now ?? (() => Date.now());
+	const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const readOpts = opts.lines != null ? { lines: opts.lines } : void 0;
+	assertPaneLive(adapter, exec, target);
+	const deadline = now() + opts.timeoutMs;
+	let output = "";
+	for (;;) {
+		output = adapter.read(exec, target, readOpts).text;
+		const result = matchWaitPattern(output, opts);
+		if (result.matched) return result;
+		if (now() >= deadline) break;
+		await sleep(pollMs);
+	}
+	assertPaneLive(adapter, exec, target);
+	return {
+		matched: false,
+		output
+	};
+}
+/** The liveness probe both ends of a poll share, throwing `nudge`'s named failure rather than letting a
+* dead pane be reported as a quiet one. */
+function assertPaneLive(adapter, exec, target) {
+	if (!adapter.paneExists(exec, target)) throw new Error(`wait failed: pane ${target.id} no longer exists — the pane is gone, not quiet.`);
+}
+//#endregion
+//#region src/mux.cmux.ts
+/**
+* cmux backend — detected via `$CMUX_WORKSPACE_ID`. Drives cmux's CLI through `cmux <verb> …`
+* (https://cmux.com/docs/api), the same synchronous-CLI shape tmux, herdr, wezterm, and zellij
+* already give `Exec`.
+*
+* cmux is a Ghostty-based macOS terminal with vertical tabs and notifications for AI coding agents.
+* Its hierarchy is Window → Workspace → Pane → Surface. A **Surface** is the terminal unit (a tab
+* within a pane), which maps to cyber-mux's `LivePane`. The env variable `$CMUX_SURFACE_ID` carries
+* the caller's surface identity — analogous to `$TMUX_PANE` or `$WEZTERM_PANE`.
+*
+* Probed from the cmux docs and CLI reference only — cmux is not installed in this sandbox (it is
+* macOS-GUI-only), so nothing here carries the "verified against a live binary" claim
+* `mux.tmux.ts`/`mux.herdr.ts` make; it makes the same honest disclaimer `mux.wezterm.ts` and
+* `mux.zellij.ts` do.
+*
+* Real capability shape that fell out of the probe:
+*
+* - **Surface is the terminal unit, not Pane.** cmux's "pane" holds multiple "surfaces" (tabs). The
+*   terminal a command runs in is a surface, so `CMUX_SURFACE_ID` is the self-identity env var and
+*   `LivePane.id` carries a surface id. `--at tab` maps to `cmux new-surface` (a new tab in the
+*   current pane); `--at pane:*` maps to `cmux new-pane` (a split, which creates a pane with one
+*   surface).
+* - **Workspace is a real tier.** `cmux new-workspace` creates a genuinely separate workspace,
+*   reported as `OpenedPane.workspace`.
+* - **No `--env` on any route.** Like wezterm and zellij, env is native at no tier, so every open
+*   rides the `envFallback` compensation (an `env K=V` prefix on the launch command, or a stderr
+*   warning when there is no command to ride).
+* - **Splits can be sized** — `cmux new-pane --direction right --size 0.3` sizes the NEW pane, so
+*   `ratio` (fraction kept by the ORIGINAL) is inverted to `1 - ratio`. `canSizeSplits` is true.
+* - **`new-pane` has no split-TARGET flag.** It splits the focused pane (or the biggest space); the
+*   `--workspace` flag specifies which workspace, but not which pane within it. So `from` — which
+*   pane a `pane:*` split lands beside — is honored by FOCUSING that surface first, the sole way to
+*   choose the split target. That is a real focus move, and the honest cost of getting the RIGHT
+*   pane split.
+* - **No pane geometry adapter.** `cmux list-panes --json` does not report position, so `regions`
+*   (`describeRegion`/`describeWorkspace`) is not implementable. `template save` refuses on cmux by
+*   naming the backend, the same optional-absence it handles for wezterm.
+* - **No git-worktree concept in the CLI.** No `worktree` subcommand, so — like tmux, wezterm, and
+*   zellij — this backend never binds a worktree to a workspace; callers fall back to plain git plus
+*   `open()`.
+* - **Naming surfaces.** cmux surfaces can be labeled — verified against the skill docs: a label can
+*   be set after creation. No `--label` flag on `new-surface` / `new-pane`, so naming is post-birth.
+*/
+function createCmuxAdapter(deps) {
+	const adapter = {
+		name: "cmux",
+		canSizeSplits: true,
+		/**
+		* `false`, and cmux needs BOTH halves to be true to say otherwise. No creating verb documents a
+		* suppress-focus flag, so a new pane activates; and `new-pane` has no split-TARGET flag, so
+		* `from` is honored by focusing that surface first (see the header and `open` below) — a focus
+		* move made before the open even runs. Suppressing only one would still move the user, which
+		* the seam's own wording rules out.
+		*
+		* Read off cmux's documented CLI, NOT verified against a live binary — no cmux on the machine
+		* this was written on, matching the rest of this header.
+		*/
+		opensWithoutStealingFocus: false,
+		open(exec, opts) {
+			const at = opts.at ?? "tab";
+			if (at === "workspace") {
+				const args = ["--json", "new-workspace"];
+				if (opts.cwd) args.push("--cwd", opts.cwd);
+				const out = exec("cmux", args);
+				if (!out) throw new Error(withReason(exec, "cmux new-workspace failed"));
+				const parsed = parseCmuxOutput(out);
+				if (!parsed.workspace_ref) throw new Error("cmux new-workspace did not report the workspace ref");
+				const surfaceId = parsed.surface_ref;
+				if (!surfaceId) throw new Error("cmux new-workspace did not report the initial surface ref");
+				const opened = openedSurface(surfaceId, parsed.pane_ref, parsed.workspace_ref);
+				if (opts.label) adapter.rename(exec, opened, "tab", opts.label);
+				runLaunch$3(adapter, exec, opened, opts.env, opts.launch);
+				return opened;
+			}
+			if (at === "tab") {
+				const args = ["--json", "new-surface"];
+				if (opts.within) args.push("--pane", opts.within);
+				if (opts.cwd) args.push("--cwd", opts.cwd);
+				const out = exec("cmux", args);
+				if (!out) throw new Error(withReason(exec, "cmux new-surface failed"));
+				const parsed = parseCmuxOutput(out);
+				const surfaceId = parsed.surface_ref;
+				if (!surfaceId) throw new Error("cmux new-surface did not report the surface ref");
+				const opened = openedSurface(surfaceId, parsed.pane_ref, deps.workspace);
+				if (opts.label) adapter.rename(exec, opened, "tab", opts.label);
+				runLaunch$3(adapter, exec, opened, opts.env, opts.launch);
+				return opened;
+			}
+			if (at === "pane:float") refuseFloatingPane(adapter.name);
+			if (opts.from) adapter.focus(exec, opts.from);
+			const args = [
+				"--json",
+				"new-pane",
+				"--direction",
+				at === "pane:down" ? "down" : "right"
+			];
+			if (opts.cwd) args.push("--cwd", opts.cwd);
+			if (opts.ratio != null) args.push("--size", String(1 - opts.ratio));
+			const out = exec("cmux", args);
+			if (!out) throw new Error(withReason(exec, "cmux new-pane failed"));
+			const parsed = parseCmuxOutput(out);
+			const surfaceId = parsed.surface_ref;
+			if (!surfaceId) throw new Error("cmux new-pane did not report the surface ref");
+			const opened = openedSurface(surfaceId, parsed.pane_ref, deps.workspace);
+			if (opts.label) adapter.rename(exec, opened, "pane", opts.label);
+			runLaunch$3(adapter, exec, opened, opts.env, opts.launch);
+			return opened;
+		},
+		rename(exec, target, tier, name) {
+			if (tier === "tab") {
+				exec("cmux", [
+					"rename-surface",
+					"--surface",
+					target.id,
+					"--title",
+					name
+				]);
+				return;
+			}
+			const paneRef = surfaceToPane(exec, target.id);
+			if (paneRef) exec("cmux", [
+				"rename-pane",
+				"--pane",
+				paneRef,
+				"--title",
+				name
+			]);
+		},
+		group() {},
+		sendText(exec, target, text) {
+			exec("cmux", [
+				"send",
+				"--surface",
+				target.id,
+				text
+			]);
+		},
+		sendKeys(exec, target, keys) {
+			for (const key of keys) exec("cmux", [
+				"send-key",
+				"--surface",
+				target.id,
+				toCmuxKey(key)
+			]);
+		},
+		submit(exec, target, text) {
+			if (!text) {
+				adapter.sendKeys(exec, target, ["Enter"]);
+				return;
+			}
+			adapter.sendText(exec, target, text);
+			adapter.sendKeys(exec, target, ["Enter"]);
+		},
+		read(exec, target, opts) {
+			const args = [
+				"read-screen",
+				"--surface",
+				target.id
+			];
+			if (opts?.lines != null) args.push("--lines", String(opts.lines));
+			return { text: exec("cmux", args) ?? "" };
+		},
+		waitForOutput(exec, target, opts) {
+			return pollForOutput(adapter, exec, target, opts);
+		},
+		focus(exec, target) {
+			exec("cmux", [
+				"focus-panel",
+				"--panel",
+				target.id
+			]);
+		},
+		teardown(exec, target) {
+			exec("cmux", [
+				"close-surface",
+				"--surface",
+				target.id
+			]);
+		},
+		paneExists(exec, target) {
+			return listCmuxSurfaces(exec).some((s) => s.id === target.id);
+		},
+		isPaneFocused(exec, target) {
+			const found = listCmuxSurfaces(exec).find((s) => s.id === target.id);
+			if (!found) return void 0;
+			return found.is_focused === true;
+		},
+		listPanes(exec) {
+			return listCmuxSurfaces(exec).map((s) => {
+				const pane = {
+					id: s.id,
+					mux: "cmux",
+					floating: false
+				};
+				if (s.cwd) pane.cwd = s.cwd;
+				if (s.title) pane.label = s.title;
+				return pane;
+			});
+		}
+	};
+	return adapter;
+}
+function parseCmuxOutput(out) {
+	try {
+		return JSON.parse(out);
+	} catch {
+		return {};
+	}
+}
+function listCmuxSurfaces(exec) {
+	const out = exec("cmux", ["list-panes", "--json"]);
+	if (!out) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse(out);
+	} catch {
+		return [];
+	}
+	if (!Array.isArray(parsed)) return [];
+	const surfaces = [];
+	for (const pane of parsed) if (pane && Array.isArray(pane.surfaces)) {
+		for (const s of pane.surfaces) if (s?.surface_ref) surfaces.push({
+			id: s.surface_ref,
+			title: s.title,
+			cwd: s.cwd,
+			is_focused: s.is_focused
+		});
+	}
+	return surfaces;
+}
+function openedSurface(surfaceId, paneRef, workspace) {
+	const opened = {
+		id: surfaceId,
+		tab: paneRef ?? surfaceId
+	};
+	if (workspace) opened.workspace = workspace;
+	return opened;
+}
+function surfaceToPane(exec, surfaceId) {
+	const out = exec("cmux", ["list-panes", "--json"]);
+	if (!out) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(out);
+	} catch {
+		return;
+	}
+	if (!Array.isArray(parsed)) return void 0;
+	for (const pane of parsed) if (pane?.pane_ref && Array.isArray(pane.surfaces)) {
+		for (const s of pane.surfaces) if (s && s.surface_ref === surfaceId) return pane.pane_ref;
+	}
+}
+function runLaunch$3(adapter, exec, target, env, launch) {
+	const fallback = envFallback(env, launch);
+	if (fallback.kind === "dropped") {
+		process.stderr.write(`env (${fallback.variables.join(", ")}) could not be set on this cmux surface — cmux has no --env flag on new-pane/new-surface/new-workspace
+`);
+		return;
+	}
+	if (fallback.command !== void 0) adapter.submit(exec, target, fallback.command);
+}
+/**
+* The core key vocabulary's cmux spelling. cmux uses lowercase key names: enter, tab, escape, etc.
+*/
+const CMUX_KEY_RENAMES = {
+	Enter: "enter",
+	Tab: "tab",
+	Escape: "escape",
+	Backspace: "backspace",
+	Space: "space",
+	Up: "up",
+	Down: "down",
+	Left: "left",
+	Right: "right",
+	"C-c": "ctrl+c"
+};
+function toCmuxKey(key) {
+	return CMUX_KEY_RENAMES[key] ?? key.toLowerCase();
+}
+//#endregion
+//#region src/ratio.ts
+/**
+* The seam's own precondition on `MuxOpenOptions.ratio`: a fraction STRICTLY between 0 and 1.
+*
+* `ratio` is the fraction kept by the ORIGINAL pane. Outside `0 < ratio < 1` there is no split it can
+* name: `1 - ratio` goes negative above 1 (tmux `-l -50%` / wezterm `--percent -50`), and 0 or 1 hands
+* one side the whole region and the other nothing — a mistake, never an intent worth honoring. Left
+* unrendered these produce a silently broken split, not an error, which is the exact silent-wrong
+* output this seam's loud-over-quiet preference exists to refuse.
+*
+* Enforced HERE, at the seam, rather than left to each caller, because the invariant is a universal
+* property of what a ratio IS — true on every backend — not a per-caller policy. (The DEGRADE policy —
+* what a caller does when a backend cannot size a split at all — genuinely stays the caller's, unchanged;
+* range validity and degrade policy are different questions.) A caller cannot reach an adapter with an
+* out-of-range ratio and have it silently rendered; `template`'s schema still refuses one earlier, per
+* node, with a path-qualified message, so the two layers do different jobs and the seam is the backstop.
+*
+* The guard lives WITH the rendering: it is called by each backend's size render helper, so a backend
+* that cannot size a split (zellij) renders no ratio and so never reaches this guard — a dropped value
+* is never checked, valid or not, which is the same as the even-default degrade its callers already take.
+*/
+function assertRatioInRange(ratio) {
+	if (!Number.isFinite(ratio) || ratio <= 0 || ratio >= 1) throw new Error(`ratio must be strictly between 0 and 1 — got ${ratio}`);
+}
+//#endregion
+//#region src/read-window.ts
+/**
+* The READ WINDOW: how much of a pane a capture asks for, and whether rows sat above what came back.
+*
+* Both halves live here because they are one question. A capture is bounded — by the caller's `lines`,
+* or by the backend's own default (the viewport on all four) — and "was anything dropped" is a
+* property of that bound. Unbind the window (`lines: 'all'`) and the answer is `false` by
+* construction, with no probe to spend.
+*
+* The truncation rule itself is shared by every adapter so the four backends answer
+* `MuxReadResult.truncated` by one definition rather than four that can drift — the same reason
+* `pollForOutput` owns one poll cadence for the three polling backends.
+*
+* Pure, and deliberately so: the tricky half of the answer is a row count, testable with no
+* multiplexer at all (`template-capture`'s geometry derivation is the precedent). Each adapter owns
+* only the one thing that genuinely differs — how its backend spells "one row deeper".
+*/
+/**
+* How many terminal ROWS a capture carries.
+*
+* A trailing newline is a terminator, not an empty row: `capture-pane` and `dump-screen` both end
+* their output with one, so counting it would make every capture look one row longer than the screen
+* and — worse — would compare unequal against a probe that happened not to end with one. An empty
+* capture is zero rows, not one.
+*/
+function capturedRows(text) {
+	if (text === "") return 0;
+	return (text.endsWith("\n") ? text.slice(0, -1) : text).split("\n").length;
+}
+/**
+* Whether `capture` omitted older rows, judged against `deeper` — the SAME read taken one row further
+* back.
+*
+* More rows in the deeper read means there was output above the captured window that the caller did
+* not receive. An equal (or smaller) count means the deeper read had nothing more to give: the
+* backend clamped at the top of what it holds, so the caller has everything there is.
+*
+* Row counts, not text equality, because the two reads are not required to render the shared rows
+* identically — herdr's deeper probe reads a different `--source`, and a backend may re-wrap. What
+* both reads DO agree on is how many rows they returned, and that is the whole question.
+*/
+function isReadTruncated(capture, deeper) {
+	return capturedRows(deeper) > capturedRows(capture);
+}
+/**
+* The row count that stands in for "the whole scrollback" on a backend whose read takes a NUMBER and
+* has no all-history token of its own (WezTerm's `--start-line`, herdr's `--lines`) — tmux (`-S -`)
+* and Zellij (`--full`) say it exactly and never reach for this.
+*
+* A million rows is past any real pane's history (tmux's own `history-limit` defaults to 2000) and
+* both backends CLAMP an over-deep window to what they hold rather than failing, so this reads as
+* "everything" without pretending to be a precise number. It stays under a u32, which is what herdr's
+* CLI parses `--lines` as.
+*/
+const FULL_SCROLLBACK_LINES = 1e6;
+//#endregion
+//#region src/region-tree.ts
+const right = (rect) => rect.x + rect.width;
+const bottom = (rect) => rect.y + rect.height;
+const HORIZONTAL = {
+	direction: "right",
+	start: (r) => r.x,
+	end: right
+};
+const VERTICAL = {
+	direction: "down",
+	start: (r) => r.y,
+	end: bottom
+};
+/**
+* The lowest cut on this axis that separates the panes cleanly, or `undefined` if none does.
+*
+* Taking the LOWEST rather than any is what produces a right-comb for an n-ary row: three panes side
+* by side cut first into `[a][b c]`, then `[b][c]` — the exact tree `desugar`'s `comb` emits for
+* `arrange: even-horizontal`, reached from the opposite direction.
+*
+* A candidate is any pane's start edge. It separates cleanly when every pane lies wholly before it
+* or wholly after it, and both sides have something in them.
+*/
+function findCut(panes, axis) {
+	const candidates = [...new Set(panes.map((p) => axis.start(p.rect)))].sort((a, b) => a - b);
+	for (const at of candidates) {
+		const first = panes.filter((p) => axis.end(p.rect) <= at);
+		const second = panes.filter((p) => axis.start(p.rect) >= at);
+		if (first.length === 0 || second.length === 0) continue;
+		if (first.length + second.length !== panes.length) continue;
+		return {
+			direction: axis.direction,
+			ratio: ratioOf(panes, second, axis),
+			first,
+			second
+		};
+	}
+}
+/**
+* The fraction of the split region kept by `first` — the schema's `ratio`.
+*
+* Measured as the COMPLEMENT of what `second` occupies, over the whole region: `1 - second/total`.
+* The obvious `first / (first + second)` is subtly wrong on any backend that draws a divider, and
+* the arithmetic says why — tmux splitting a 50-row region reports 34 + 15, with the 51st row eaten
+* by the divider. `first / (first + second)` reads 34/49 = 0.69; the true split was 0.7, and the
+* divider row belongs to neither pane's height while still costing the region a row.
+*
+* Taking the complement puts that row back where the backend's own arithmetic puts it: tmux's `-l`
+* sizes the NEW pane, so `second` is exactly the fraction asked for and `first` keeps the rest,
+* divider included. That reads 1 - 15/50 = 0.7 — the number the split was actually made with. On a
+* backend with no divider (herdr) the two formulas agree, so nothing is traded for the fix.
+*
+* Both checked against live binaries: this recovers tmux's `-l 40%`/`-l 30%` splits as 0.6/0.7
+* exactly, and reproduces herdr's to within the cell it rounds to.
+*/
+function ratioOf(all, second, axis) {
+	const total = extent(all, axis);
+	if (total <= 0) return .5;
+	return 1 - extent(second, axis) / total;
+}
+/** How far a group of panes reaches along an axis — its bounding box on that axis. */
+function extent(panes, axis) {
+	const starts = panes.map((p) => axis.start(p.rect));
+	const ends = panes.map((p) => axis.end(p.rect));
+	return Math.max(...ends) - Math.min(...starts);
+}
+/**
+* Cut the region into a binary tree, recursively.
+*
+* **`right` is tried before `down`, and the order is load-bearing on a grid.** A 2x2 is genuinely
+* ambiguous — cutting it vertically first and horizontally first both describe the same screen, and
+* neither is more true. Columns-then-rows is the tie-break because that is what `desugar`'s `tiled`
+* emits, so a tiled pool exports back as the tree it was built from rather than its transpose.
+*
+* A region no cut separates cannot come out of a multiplexer: both backends build regions BY
+* splitting, so every region they can report is guillotine-cuttable by construction. Reaching the
+* throw means the geometry did not come from where we think it did — which is worth saying loudly
+* rather than papering over with a tree that misplaces the user's panes.
+*/
+function partition(panes) {
+	if (panes.length === 1) return {
+		type: "pane",
+		pane: panes[0]
+	};
+	const cut = findCut(panes, HORIZONTAL) ?? findCut(panes, VERTICAL);
+	if (!cut) throw new Error(`this region's panes do not form a splittable tree (${panes.length} panes: ${panes.map((p) => p.id).join(", ")}) — export can only capture a region built by splitting`);
+	return {
+		type: "split",
+		direction: cut.direction,
+		ratio: cut.ratio,
+		first: partition(cut.first),
+		second: partition(cut.second)
+	};
+}
+/**
+* The split a pane sits DIRECTLY inside, with the numbers a resize needs — or `undefined` when the
+* region has no split at all (a single-pane region: nothing to take a fraction of).
+*
+* **The target is always one WHOLE side of the split it encloses.** That falls out of the guillotine
+* derivation rather than being asserted: a leaf's parent is the last cut before it, so whichever side
+* of that cut the target lands on holds the target and nothing else. The OTHER side may be a group of
+* panes, which is why it is reported as an extent rather than a pane — a backend sizes the target, and
+* the group on the far side takes what is left.
+*
+* **Extents, not ratios alone, because the backends need different arithmetic.** tmux's
+* `resize-pane -x/-y` takes CELLS, so it needs the split region's extent to turn a fraction into one;
+* herdr's `pane resize --amount` takes a ratio DELTA, so it needs the fraction the split is at now.
+* Reporting both raw facts keeps the per-backend conversion in the adapter that owns it — the same
+* split `MuxOpenOptions.ratio` already makes, where the seam's number is one thing and each backend's
+* rendering of it is another.
+*
+* **`extent` includes the divider a backend draws.** It is the split region's own span, so on tmux
+* `targetExtent + otherExtent` falls one short of it and on herdr the two add up exactly. Neither
+* adapter hard-codes which: the divider is `extent - targetExtent - otherExtent`, measured from the
+* rects the backend just reported.
+*/
+function enclosingSplit(panes, paneId) {
+	if (!panes.some((p) => p.id === paneId)) throw new Error(`pane ${paneId} is not in the region described (${panes.map((p) => p.id).join(", ")})`);
+	let node = partition(panes);
+	while (node.type === "split") {
+		const split = node;
+		const targetIsFirst = holds(split.first, paneId);
+		const side = targetIsFirst ? split.first : split.second;
+		const other = targetIsFirst ? split.second : split.first;
+		if (side.type !== "pane") {
+			node = side;
+			continue;
+		}
+		const axis = split.direction === "right" ? HORIZONTAL : VERTICAL;
+		return {
+			direction: split.direction,
+			targetIsFirst,
+			firstRatio: split.ratio,
+			extent: extent(leaves(split), axis),
+			targetExtent: extent([side.pane], axis),
+			otherExtent: extent(leaves(other), axis)
+		};
+	}
+}
+/** Whether `paneId` is somewhere under `node`. */
+function holds(node, paneId) {
+	return leaves(node).some((p) => p.id === paneId);
+}
+/** Every pane under `node`, in order. */
+function leaves(node) {
+	return node.type === "pane" ? [node.pane] : [...leaves(node.first), ...leaves(node.second)];
+}
+//#endregion
+//#region src/mux.herdr.ts
+/**
+* herdr backend — detected via `$HERDR_ENV`. herdr (https://herdr.dev) is an agent-aware terminal
+* multiplexer that also reports real busy-state (working / idle / blocked / done); this adapter
+* only drives its pane lifecycle, not the state feed. Talks to herdr's own CLI (`herdr pane ...`)
+* rather than its Unix-socket API, so it composes with this codebase's synchronous `Exec`
+* convention exactly like the tmux adapter — no new client/transport needed.
+*
+* The pane lifecycle (split/run/read/close) is verified against a live herdr binary; `pane split`
+* returns a JSON `pane_info` envelope whose id is extracted in `parsePaneId`.
+*
+* **Verified against 0.8.2** (protocol 20), re-probed against a live server by re-running
+* `mux.herdr.integration.test.ts` — the real-boundary suite, not a hand check. Everything this
+* adapter drives held: the split/read/run/send-keys lifecycle, `pane wait-output`'s success and
+* error envelopes, `pane list`/`get`/`layout`, `workspace create`/`tab create`, and the `env` and
+* worktree parameter sets below. The per-claim markers that follow name the version each was LAST
+* established against — a claim still reading 0.7.4/0.7.5/0.8.0 is one a later release gave no
+* occasion to re-measure (no attached client, or no live agent in the pane), not one that failed.
+*
+* What 0.8.2 did NOT re-establish, stated so the claim above is not read wider than it is: the two
+* current-pane-context opens (`at:'tab'`, `at:'pane:right'`) skip when the suite runs INSIDE a herdr
+* pane, and they are the only cases that exercise `--current`. 0.8.2 fixed `pane current`, `pane
+* get`, and `pane layout --current` to resolve the CALLING pane rather than another client's focused
+* pane (herdr #2297, #2298) — but that fix names none of `pane split`, which is where this file's one
+* `--current` sits. So the 0.7.4 caveat on it below stands, unmeasured against 0.8.2 rather than
+* re-confirmed.
+*/
+const herdrMuxAdapter = {
+	name: "herdr",
+	canSizeSplits: true,
+	/**
+	* Every creating verb this adapter issues carries `--no-focus`, so no open moves the user.
+	*
+	* `workspace create` and `tab create` have carried it from the start. `pane split` did NOT, and
+	* measuring it against a live 0.8.2 is what settled whether that was a hole: with the client
+	* focused on the pane being split, a bare `herdr pane split` left focus exactly where it was, and
+	* so did the same command with `--no-focus`. herdr's split simply does not activate what it
+	* creates. So the flag added there is a measured NO-OP today, and it is passed anyway — the seam
+	* now DECLARES this property, and a declaration backed by a backend default is one a future herdr
+	* release can falsify without anything here having to be wrong first. Every route saying what it
+	* wants is what makes the boolean above enforceable rather than incidental.
+	*
+	* No focus move to undo on top of that: `pane split <id>` names its target directly, so herdr
+	* never has to VISIT a pane to choose which one gets split.
+	*/
+	opensWithoutStealingFocus: true,
+	open(exec, opts) {
+		const at = opts.at ?? "tab";
+		const label = opts.label ? ["--label", opts.label] : [];
+		const env = envFlags(opts.env);
+		let opened;
+		if (at === "workspace") {
+			const out = exec("herdr", [
+				"workspace",
+				"create",
+				"--cwd",
+				opts.cwd,
+				...label,
+				...env,
+				"--no-focus"
+			]);
+			if (!out) throw new Error(withReason(exec, "herdr workspace create failed"));
+			opened = parseRootPaneId(out, "herdr workspace create");
+		} else if (at === "tab") {
+			const out = exec("herdr", [
+				"tab",
+				"create",
+				...opts.within ? ["--workspace", opts.within] : [],
+				"--cwd",
+				opts.cwd,
+				...label,
+				...env,
+				"--no-focus"
+			]);
+			if (!out) throw new Error(withReason(exec, "herdr tab create failed"));
+			opened = parseRootPaneId(out, "herdr tab create");
+		} else if (at === "pane:float") refuseFloatingPane(herdrMuxAdapter.name);
+		else {
+			const direction = at === "pane:down" ? "down" : "right";
+			const from = opts.from ? [opts.from.id] : ["--current"];
+			const size = opts.ratio != null ? ["--ratio", toHerdrRatio(opts.ratio)] : [];
+			const out = exec("herdr", [
+				"pane",
+				"split",
+				...from,
+				"--direction",
+				direction,
+				"--cwd",
+				opts.cwd,
+				...size,
+				...env,
+				"--no-focus"
+			]);
+			if (!out) throw new Error(withReason(exec, "herdr pane split failed"));
+			opened = parsePaneId(out);
+			if (opts.label) herdrMuxAdapter.rename(exec, opened, "pane", opts.label);
+		}
+		if (opts.launch) herdrMuxAdapter.submit(exec, opened, opts.launch);
+		return opened;
+	},
+	rename(exec, target, tier, name) {
+		exec("herdr", [
+			tier,
+			"rename",
+			target.id,
+			name
+		]);
+	},
+	group() {},
+	worktree: herdrWorktreeCapability(),
+	sendText(exec, target, text) {
+		exec("herdr", [
+			"pane",
+			"send-text",
+			target.id,
+			text
+		]);
+	},
+	sendKeys(exec, target, keys) {
+		exec("herdr", [
+			"pane",
+			"send-keys",
+			target.id,
+			...keys
+		]);
+	},
+	submit(exec, target, text) {
+		if (!text) {
+			exec("herdr", [
+				"pane",
+				"send-keys",
+				target.id,
+				"Enter"
+			]);
+			return;
+		}
+		exec("herdr", [
+			"pane",
+			"run",
+			target.id,
+			text
+		]);
+	},
+	/**
+	* 0.8.0 added a `truncated` boolean to the read result, and it is REQUIRED in the socket schema's
+	* `PaneReadResult` — but it is not reachable from here, and that is a fact about the CLI rather than
+	* a choice: `herdr pane read` prints the pane's bare TEXT, no envelope, and its only 0.8.0 additions
+	* are `--format`/`--ansi`/`--raw`, which select the text's escaping. There is no `--json`. So the
+	* flag rides the socket API this adapter deliberately does not speak, and the one CLI surface that
+	* does hand back the envelope is `pane wait-output` (`.result.read.truncated` — seen live on 0.8.0).
+	* Surfacing truncation therefore costs a return-shape change, not a flag; see issue #100, which owns
+	* it across all four backends. Noted here so the next reader does not re-derive the dead end.
+	*/
+	read(exec, target, opts) {
+		if (opts?.lines === "all") {
+			const text = paneRead(exec, target, "recent", FULL_SCROLLBACK_LINES);
+			return opts.truncation ? {
+				text,
+				truncated: false
+			} : { text };
+		}
+		const text = paneRead(exec, target, "visible", opts?.lines);
+		if (!opts?.truncation) return { text };
+		return {
+			text,
+			truncated: isReadTruncated(text, paneRead(exec, target, "recent", capturedRows(text) + 1))
+		};
+	},
+	/**
+	* The one backend with a NATIVE wait: `pane wait-output` blocks in herdr itself (arrived in 0.7.5,
+	* still native in 0.8.0), so no poll loop is run here and no snapshot is pulled across the CLI
+	* boundary on every tick.
+	*
+	* `--source visible` is pinned rather than left to herdr's own default (`recent_unwrapped`, verified
+	* against 0.7.5 — the help still says `recent` in 0.8.0). The seam's rule is that a wait searches exactly what
+	* `read` returns, and `read` pins `visible` here; taking the default would make the same wait mean a
+	* different snapshot on this backend than on every polling one.
+	*
+	* Telling a TIMEOUT (an answer) from a broken wait (a failure) is the whole difficulty, because herdr
+	* spells both the same way: exit 1 with an error envelope on stderr, so `Exec` yields `null` for
+	* either. Two tiers answer it, in order:
+	*
+	* 1. **The envelope's `code`**, when the runner captured stderr into `lastError` (re-verified against
+	*    0.8.0: `{"error":{"code":"timeout",…}}` vs `{"error":{"code":"pane_not_found",…}}`). Exact.
+	* 2. **A live pane that actually consumed the deadline**, when it did not. `Exec.lastError` is
+	*    specified as a diagnostic and NEVER a control-flow signal — a runner that discards stderr must
+	*    still work — so the code cannot be the only answer. Liveness alone is not enough either, and the
+	*    reason is a whole released version of the backend: herdr 0.7.4 has no `pane wait-output` at all,
+	*    so it answers with clap's usage text (not an envelope) INSTANTLY, and a liveness-only rule reads
+	*    that as "timed out" — a silently wrong answer for a wait that never ran. Elapsed time is the fact
+	*    that separates them and needs no stderr: a wait that returns in a fraction of its own timeout did
+	*    not wait. Both must hold — the pane is live AND the deadline was spent — or this throws.
+	*
+	* A timeout costs ONE extra `read`, because herdr's timeout envelope carries no snapshot and the seam
+	* promises the caller the evidence its verdict was reached on. It is taken at the deadline, so it is
+	* the same "last look at the pane" a polling backend returns, one poll interval later.
+	*/
+	async waitForOutput(exec, target, opts) {
+		assertWaitPattern(opts);
+		const now = opts.now ?? (() => Date.now());
+		const pattern = opts.match != null ? ["--match", opts.match] : ["--regex", opts.regex];
+		const args = [
+			"pane",
+			"wait-output",
+			target.id,
+			"--source",
+			"visible",
+			"--timeout",
+			String(opts.timeoutMs)
+		];
+		args.push(...pattern);
+		if (opts.lines != null) args.push("--lines", String(opts.lines));
+		const started = now();
+		const out = exec("herdr", args);
+		if (out == null) {
+			if (!isHerdrWaitTimeout(exec, target, opts.timeoutMs, now() - started)) throw new Error(withReason(exec, `herdr pane wait-output failed for pane ${target.id}`));
+			const readOpts = opts.lines != null ? { lines: opts.lines } : void 0;
+			return {
+				matched: false,
+				output: herdrMuxAdapter.read(exec, target, readOpts).text
+			};
+		}
+		return parseWaitOutput(out);
+	},
+	focus(exec, target) {
+		const { workspaceId, tabId } = parsePaneLocation$2(exec("herdr", [
+			"pane",
+			"get",
+			target.id
+		]), target.id);
+		exec("herdr", [
+			"workspace",
+			"focus",
+			workspaceId
+		]);
+		exec("herdr", [
+			"tab",
+			"focus",
+			tabId
+		]);
+	},
+	teardown(exec, target) {
+		exec("herdr", [
+			"pane",
+			"close",
+			target.id
+		]);
+	},
+	paneExists(exec, target) {
+		return exec("herdr", [
+			"pane",
+			"read",
+			target.id,
+			"--source",
+			"visible"
+		]) !== null;
+	},
+	isPaneFocused(exec, target) {
+		const out = exec("herdr", [
+			"pane",
+			"get",
+			target.id
+		]);
+		if (out == null) return void 0;
+		try {
+			const focused = JSON.parse(out)?.result?.pane?.focused;
+			return typeof focused === "boolean" ? focused : void 0;
+		} catch {
+			return;
+		}
+	},
+	listPanes(exec) {
+		const out = exec("herdr", ["pane", "list"]);
+		if (!out) return [];
+		let panes;
+		try {
+			panes = JSON.parse(out)?.result?.panes;
+		} catch {
+			return [];
+		}
+		if (!Array.isArray(panes)) return [];
+		return panes.filter((p) => typeof p?.pane_id === "string").map((p) => {
+			const harness = p.agent || void 0;
+			const label = p.label || void 0;
+			const agentStatus = toAgentStatus(p.agent_status);
+			return {
+				id: p.pane_id,
+				mux: "herdr",
+				floating: false,
+				...harness !== void 0 ? { harness } : {},
+				...agentStatus !== void 0 ? { agentStatus } : {},
+				...p.cwd !== void 0 ? { cwd: p.cwd } : {},
+				...label !== void 0 ? { label } : {}
+			};
+		});
+	},
+	regions: {
+		describeRegion(exec, target) {
+			return herdrRegionPanes(exec, target.id, herdrPaneDetails(exec));
+		},
+		/**
+		* `pane resize --direction <d> --amount <f>` — a signed DELTA on the enclosing split's ratio,
+		* which is why the current ratio has to be read first. herdr's `--direction` names where the
+		* DIVIDER moves, not which pane grows: `right`/`down` raise the split's ratio and `left`/`up`
+		* lower it, whichever side of it the `--pane` sits on. So the target's side never enters the
+		* direction — only the sign of the delta does.
+		*
+		* The current ratio is derived from the RECTS, not read off `layout.splits[].ratio`, for
+		* `describeRegion`'s reason exactly: the splits array is flat and its parent links live only in
+		* an undocumented id convention (`split_1_0`), so matching a pane to its split there would bet on
+		* a spelling herdr never promised. The rects say the same thing in a fact it does promise.
+		*
+		* Verified against a live herdr 0.8.2 (`mux.herdr.integration.test.ts`), which is also where the
+		* `--direction` semantics above were established: `--direction right --amount 0.1` moved a 0.5
+		* split to 0.6 whether the `--pane` was the left one or the right one, and on a nested region
+		* `--direction down` resized the enclosing stacked split rather than the outer one.
+		*/
+		resizePane(exec, target, ratio) {
+			const split = enclosingSplit(herdrRegionPanes(exec, target.id, herdrPaneDetails(exec)), target.id);
+			if (!split) throw new Error(`herdr pane ${target.id} is the only pane in its region — there is no split to resize`);
+			const delta = toHerdrResizeDelta(split, ratio);
+			if (delta === 0) return;
+			const direction = herdrResizeDirection(split.direction, delta);
+			if (exec("herdr", [
+				"pane",
+				"resize",
+				"--pane",
+				target.id,
+				"--direction",
+				direction,
+				"--amount",
+				String(Math.abs(delta))
+			]) === null) throw new Error(withReason(exec, `herdr could not resize pane ${target.id}`));
+		},
+		/**
+		* herdr HAS a workspace tier, so the workspace is a fact the backend holds rather than one
+		* cyber-mux has to reconstruct: the caller's pane names its `workspace_id`, `tab list --workspace`
+		* enumerates that workspace's tabs, and `pane list --workspace` hands back every pane already
+		* stamped with the tab it sits in. No grouping tag is read here and none is written — the tier IS
+		* the group, which is exactly why `open` ignores `workspaceGroup` on this backend.
+		*
+		* The one indirection: geometry is per-PANE (`pane layout --pane`), never per-tab, so each tab's
+		* rects are fetched through any one pane that sits in it. That is safe and race-free, and both
+		* halves were established against 0.7.4: `pane layout` reports live geometry for an UNFOCUSED tab
+		* in a DIFFERENT workspace, so nothing has to be focused first and nothing moves while this runs.
+		*
+		* herdr's own native per-tab layout export would be the obvious road — it takes a `tab_id` — but
+		* `layout` is still NOT a CLI verb in 0.8.0 (its top-level help lists no such subcommand); it is
+		* socket-API-only, and this adapter speaks the CLI by design (so it composes with the synchronous
+		* `Exec` seam). The road is closed, hence the pane indirection.
+		*/
+		describeWorkspace(exec, target) {
+			const { workspaceId } = parsePaneRecord(exec("herdr", [
+				"pane",
+				"get",
+				target.id
+			]));
+			if (!workspaceId) throw new Error(withReason(exec, `herdr could not resolve the workspace around pane ${target.id}`));
+			const out = exec("herdr", [
+				"tab",
+				"list",
+				"--workspace",
+				workspaceId
+			]);
+			if (!out) throw new Error(withReason(exec, `herdr could not enumerate the tabs of workspace ${workspaceId}`));
+			let reported;
+			try {
+				reported = JSON.parse(out)?.result?.tabs;
+			} catch {
+				throw new Error(`herdr tab list returned unparseable output: ${out.slice(0, 200)}`);
+			}
+			if (!Array.isArray(reported) || reported.length === 0) throw new Error(`herdr reported no tabs in workspace ${workspaceId}: ${out.slice(0, 200)}`);
+			const details = herdrPaneDetails(exec, workspaceId);
+			const tabs = [];
+			for (const reportedTab of reported) {
+				if (typeof reportedTab?.tab_id !== "string") continue;
+				const tabId = reportedTab.tab_id;
+				const anchor = [...details].find(([, detail]) => detail.tab === tabId)?.[0];
+				if (!anchor) throw new Error(`herdr reported no panes in tab ${tabId} of workspace ${workspaceId}`);
+				const tab = {
+					id: tabId,
+					panes: herdrRegionPanes(exec, anchor, details)
+				};
+				if (typeof reportedTab.label === "string" && reportedTab.label !== "") tab.label = reportedTab.label;
+				tabs.push(tab);
+			}
+			if (tabs.length === 0) throw new Error(`herdr reported no usable tabs in workspace ${workspaceId}: ${out.slice(0, 200)}`);
+			return tabs;
+		}
+	},
+	agentLifecycle: { waitForState(exec, target, opts) {
+		const until = opts.until ?? [];
+		const status = parseReachedAgentStatus(exec("herdr", [
+			"agent",
+			"wait",
+			target.id,
+			...until.flatMap((state) => ["--until", state]),
+			...opts.timeoutMs != null ? ["--timeout", String(opts.timeoutMs)] : []
+		]));
+		if (!status) throw new Error(withReason(exec, `herdr agent wait reported no reached agent_status for pane ${target.id}`));
+		return status;
+	} }
+};
+/**
+* The set of `agent_status` values herdr reports — unchanged through 0.8.0, whose socket schema still
+* declares `AgentStatus` as exactly this enum, and whose `agent wait --until` still lists exactly these
+* five values. The runtime witness of the `AgentStatus`
+* type, so a string read off a herdr envelope can be NARROWED to it rather than cast. A value outside
+* this set is treated as absent (the feed said something this build does not model), never forced into
+* the type.
+*/
+const AGENT_STATUSES = [
+	"idle",
+	"working",
+	"blocked",
+	"done",
+	"unknown"
+];
+/** A value narrowed to `AgentStatus`, or `undefined` for anything else (a non-string, an empty string,
+* or a status this build does not model) — the normalization both the listing and the wait share. */
+function toAgentStatus(value) {
+	return typeof value === "string" && AGENT_STATUSES.includes(value) ? value : void 0;
+}
+/**
+* The `AgentStatus` a `herdr agent wait` run reached, read defensively from its JSON envelope —
+* `{"result":{"agent":{…,"agent_status":"idle",…},"type":"agent_info"}}` (verified against 0.7.5), so
+* the reached status lives at `.result.agent.agent_status`. Every unresolvable shape — `out` is null
+* (an Exec failure), the JSON does not parse, or the field is missing/empty/unmodeled — folds to
+* `undefined`, exactly as `parsePaneRecord`/`isPaneFocused` fold, so the caller states its own failure.
+*/
+function parseReachedAgentStatus(out) {
+	if (out == null) return void 0;
+	try {
+		return toAgentStatus(JSON.parse(out)?.result?.agent?.agent_status);
+	} catch {
+		return;
+	}
+}
+/**
+* The rects of the region `paneId` sits in, joined with the cwd/label half.
+*
+* Two sources, because herdr splits the answer across two verbs: `pane layout` reports the region's
+* rects (`layout.panes[].rect`) but carries no cwd and no label, while `pane list` carries both and
+* no geometry. Neither alone can build a template — hence `details` is passed IN, so a caller reading
+* many tabs pays for that list once rather than once per tab.
+*
+* `layout.splits[]` is deliberately ignored even though it reports `direction` and `ratio` outright.
+* It is FLAT — `[{id:"split_0_root",...},{id:"split_1_0",...}]` — so the tree is recoverable only by
+* parsing the parent out of that id string, a convention herdr's CLI help never documents and could
+* respell without warning. The rects say the same thing in a fact herdr does promise, so the
+* derivation runs off those; see `RegionInspector.describeRegion` in `mux.ts`.
+*/
+function herdrRegionPanes(exec, paneId, details) {
+	const out = exec("herdr", [
+		"pane",
+		"layout",
+		"--pane",
+		paneId
+	]);
+	if (!out) throw new Error(withReason(exec, `herdr could not describe the region around pane ${paneId}`));
+	let reported;
+	try {
+		reported = JSON.parse(out)?.result?.layout?.panes;
+	} catch {
+		throw new Error(`herdr pane layout returned unparseable output: ${out.slice(0, 200)}`);
+	}
+	if (!Array.isArray(reported) || reported.length === 0) throw new Error(`herdr pane layout reported no panes for ${paneId}: ${out.slice(0, 200)}`);
+	return reported.filter((p) => typeof p?.pane_id === "string").map((p) => {
+		const detail = details.get(p.pane_id);
+		const pane = {
+			id: p.pane_id,
+			rect: {
+				x: p.rect?.["x"] ?? 0,
+				y: p.rect?.["y"] ?? 0,
+				width: p.rect?.["width"] ?? 0,
+				height: p.rect?.["height"] ?? 0
+			}
+		};
+		if (detail?.cwd) pane.cwd = detail.cwd;
+		if (detail?.label) pane.label = detail.label;
+		return pane;
+	});
+}
+/**
+* Each pane's cwd, label and tab, keyed by pane id — the half `pane layout` does not report.
+*
+* `workspace` scopes the list to one workspace when the caller has one to scope by; omitting it lists
+* every pane herdr can see, which is what a single-region read wants (it keys by pane id and never
+* cares which workspace a pane came from).
+*/
+function herdrPaneDetails(exec, workspace) {
+	const details = /* @__PURE__ */ new Map();
+	const out = exec("herdr", [
+		"pane",
+		"list",
+		...workspace ? ["--workspace", workspace] : []
+	]);
+	if (!out) return details;
+	let panes;
+	try {
+		panes = JSON.parse(out)?.result?.panes;
+	} catch {
+		return details;
+	}
+	if (!Array.isArray(panes)) return details;
+	for (const pane of panes) {
+		if (typeof pane?.pane_id !== "string") continue;
+		details.set(pane.pane_id, {
+			cwd: pane.cwd,
+			label: pane.label,
+			tab: pane.tab_id
+		});
+	}
+	return details;
+}
+/**
+* herdr's repeatable `--env KEY=VALUE` — spelled the same way by exactly three verbs: `pane split`,
+* `workspace create` and `tab create`, each backed by a native `env` Record in the socket schema
+* (protocol 16).
+*
+* `worktree create`/`worktree open` are deliberately NOT in that list: their params are
+* `[base, branch, cwd, focus, label, path, workspace_id]` and
+* `[branch, cwd, focus, label, path, workspace_id]` — no `env` — and herdr rejects the flag with
+* `unknown option: --env`. A caller needing env on that route uses the command-prefix fallback.
+* Re-verified against 0.8.0: both param sets are unchanged in protocol 19's schema, and a live
+* `worktree create --env` there still answers `unknown option: --env`.
+*/
+function envFlags(env) {
+	return env ? Object.entries(env).flatMap(([k, v]) => ["--env", `${k}=${v}`]) : [];
+}
+/**
+* The seam's `ratio` as the SIGNED delta `pane resize --amount` wants, in the same fraction-of-the-
+* split-region units herdr's own `--ratio` uses at birth.
+*
+* Both numbers are the FIRST side's fraction, so the target's side is folded in here (`1 - ratio` when
+* the target is the second side) and the direction below reads only the sign. Measured against the
+* split's current ratio as `region-tree.ts` derives it, never against `layout.splits[].ratio` — one
+* definition of "what this split is at" seam-wide is what makes a resize to the ratio a region was
+* just described at a no-op.
+*/
+function toHerdrResizeDelta(split, ratio) {
+	assertRatioInRange(ratio);
+	const delta = (split.targetIsFirst ? ratio : 1 - ratio) - split.firstRatio;
+	return Math.round(delta * 1e6) / 1e6;
+}
+/**
+* Which way herdr moves the divider for a delta of this sign, on a split of this axis.
+*
+* `right`/`down` RAISE the enclosing split's ratio and `left`/`up` lower it — established against a
+* live 0.8.2 rather than read off `--help`, which lists the four values and says nothing about what
+* they move. The axis picks the pair because herdr resolves `--direction` against the nearest ancestor
+* split on that axis: asking `right` of a pane inside a stacked split walks past it to the outer one,
+* which would resize a split the caller never named.
+*/
+function herdrResizeDirection(axis, delta) {
+	if (axis === "right") return delta > 0 ? "right" : "left";
+	return delta > 0 ? "down" : "up";
+}
+/**
+* `--ratio` takes the seam's number VERBATIM — herdr sizes the ORIGINAL pane, so no inversion, unlike
+* tmux's `-l` and wezterm's `--percent`. The guard is the same one those two render helpers call: the
+* seam refuses an out-of-range ratio here rather than pass `--ratio 5` (or `0`) through to a split herdr
+* would then size wrong.
+*/
+function toHerdrRatio(ratio) {
+	assertRatioInRange(ratio);
+	return String(ratio);
+}
+/**
+* Launch a command in a worktree's root pane, carrying env the worktree verb could not set at birth.
+* The prefix-or-warn rule is the seam's (`env-fallback.ts`); this is the one route that invokes it,
+* because it is the one route that loses env. With a command, env rides in as a prefix; with none and
+* env asked for, it warns to stderr (stdout stays machine-readable) rather than dropping in silence.
+*/
+function carryLaunch(exec, target, env, launch) {
+	const fallback = envFallback(env, launch);
+	if (fallback.kind === "dropped") {
+		process.stderr.write(`env (${fallback.variables.join(", ")}) could not be set on this worktree's workspace and no command was given to carry it — herdr worktree create/open take no env parameter
+`);
+		return;
+	}
+	if (fallback.command !== void 0) herdrMuxAdapter.submit(exec, target, fallback.command);
+}
+/**
+* `herdr pane split` emits a JSON envelope, not a bare id:
+* `{"id":"cli:pane:split","result":{"pane":{"pane_id":"w3:pB", ...},"type":"pane_info"}}`.
+* The pane id herdr's other `pane` subcommands accept lives at `.result.pane.pane_id`. Extract it —
+* passing the whole blob downstream lands it in a filename and blows the path length limit.
+*/
+function parsePaneId(out) {
+	return parseOpenedPane(out, "herdr pane split", "pane");
+}
+/**
+* `herdr pane get <id>` emits `{"result":{"pane":{"workspace_id":...,"tab_id":...,...}}}`, or an
+* error envelope when the id no longer names a live pane. Every unresolvable shape — `out` is null
+* (an Exec failure), the JSON does not parse, or a field is missing/empty/not a string — folds to the
+* field simply being absent, so each caller states its OWN failure rather than inheriting one
+* phrased for somebody else's verb.
+*/
+function parsePaneRecord(out) {
+	if (out == null) return {};
+	try {
+		const pane = JSON.parse(out)?.result?.pane;
+		return {
+			workspaceId: nonEmpty(pane?.workspace_id),
+			tabId: nonEmpty(pane?.tab_id)
+		};
+	} catch {
+		return {};
+	}
+}
+function nonEmpty(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+/**
+* The `code` of a herdr error envelope, when the runner captured one — how a wait's TIMEOUT (an answer)
+* is told from any other failure (a throw). Read from `Exec.lastError` because that is where herdr's
+* envelope lands: it is written to stderr with exit 1, so stdout is `null` for every failure alike and
+* the code is the only thing that separates them. Defensive throughout — no reason, unparseable JSON, or
+* a missing/non-string code all answer `undefined`, which routes to the throw rather than to a silent
+* "timed out" the backend never said.
+*/
+/**
+* How much of its own timeout a wait must actually spend before a failure is believed to BE that
+* timeout. A fraction rather than the whole, because process start-up and clock granularity make an
+* exact-or-greater comparison flaky on a real runner; wide enough that the case it exists to catch — a
+* herdr with no `wait-output` subcommand, which returns in milliseconds — is nowhere near it.
+*/
+const HERDR_WAIT_ELAPSED_RATIO = .9;
+/**
+* Whether a failed `pane wait-output` was the DEADLINE passing rather than the wait breaking — the
+* two-tier rule `waitForOutput` documents, kept out of the method so the tiers read as one decision.
+*
+* The envelope's code answers when the runner captured one. Otherwise the answer needs two facts, and
+* neither alone is enough: the pane must be LIVE (a gone pane is a failure, `pollForOutput`'s rule) and
+* the call must have SPENT the deadline (a wait that returned instantly never ran — herdr 0.7.4, whose
+* usage text for an unknown subcommand is not an envelope to read a code from).
+*/
+function isHerdrWaitTimeout(exec, target, timeoutMs, elapsedMs) {
+	const code = herdrErrorCode(exec.lastError);
+	if (code != null) return code === "timeout";
+	if (elapsedMs < timeoutMs * HERDR_WAIT_ELAPSED_RATIO) return false;
+	return herdrMuxAdapter.paneExists(exec, target);
+}
+function herdrErrorCode(reason) {
+	if (!reason) return void 0;
+	try {
+		return nonEmpty(JSON.parse(reason)?.error?.code);
+	} catch {
+		return;
+	}
+}
+/**
+* A successful `pane wait-output` envelope: the snapshot it matched in, and the line it matched on.
+*
+* `matched` is `true` by construction — herdr exits 0 only on a match, so reaching here IS the match;
+* the parse only fills in the evidence. Defensive for the same reason `parsePaneRecord` is: a herdr
+* build that reshapes the envelope degrades to a match with no snapshot, never to a failed wait.
+*/
+function parseWaitOutput(out) {
+	let text;
+	let line;
+	try {
+		const result = JSON.parse(out)?.result;
+		text = nonEmpty(result?.read?.text);
+		line = nonEmpty(result?.matched_line);
+	} catch {}
+	return {
+		matched: true,
+		output: text ?? "",
+		...line != null ? { matchedLine: line } : {}
+	};
+}
+/**
+* The pane's workspace and tab, or a throw — so `focus` never issues a workspace/tab switch against a
+* pane it couldn't actually resolve.
+*/
+function parsePaneLocation$2(out, id) {
+	const { workspaceId, tabId } = parsePaneRecord(out);
+	if (!workspaceId || !tabId) throw new Error(`peer's pane ${id} could not be resolved to beam to`);
+	return {
+		workspaceId,
+		tabId
+	};
+}
+/**
+* herdr binds a git worktree to a workspace as a first-class record, and that binding is what its UI
+* groups a repo's checkouts by. Only `worktree create`/`worktree open` produce it: `git worktree add`
+* followed by `workspace create --cwd <checkout>` yields a workspace herdr does not know is a
+* worktree at all, left out of the group. Hence this capability — see `WorktreeWorkspaceCapability`
+* for what it deliberately does not own.
+*
+* Every call pins the source repo with `--cwd <primaryRoot>` rather than relying on the caller's
+* ambient process cwd (matching how the git adapter always passes `-C <primaryRoot>`), and opens
+* with `--no-focus` so spawning never steals the caller's attention.
+*/
+function herdrWorktreeCapability() {
+	return {
+		createInWorkspace(exec, opts) {
+			const args = [
+				"worktree",
+				"create",
+				"--cwd",
+				opts.primaryRoot,
+				"--branch",
+				opts.branch,
+				"--path",
+				opts.path
+			];
+			if (opts.base) args.push("--base", opts.base);
+			if (opts.label) args.push("--label", opts.label);
+			args.push("--no-focus");
+			const out = exec("herdr", args);
+			if (!out) throw new Error(withReason(exec, "herdr worktree create failed"));
+			const created = parseWorktreeWorkspace(out, "herdr worktree create");
+			carryLaunch(exec, created.target, opts.env, opts.launch);
+			return created;
+		},
+		openInWorkspace(exec, opts) {
+			const args = [
+				"worktree",
+				"open",
+				"--cwd",
+				opts.primaryRoot,
+				"--path",
+				opts.path
+			];
+			if (opts.label) args.push("--label", opts.label);
+			args.push("--no-focus");
+			const out = exec("herdr", args);
+			if (!out) throw new Error(withReason(exec, "herdr worktree open failed"));
+			const opened = parseWorktreeWorkspace(out, "herdr worktree open");
+			carryLaunch(exec, opened.target, opts.env, opts.launch);
+			return opened;
+		},
+		bindings(exec, opts) {
+			return parseWorktreeBindings(exec("herdr", [
+				"worktree",
+				"list",
+				"--cwd",
+				opts.primaryRoot
+			]));
+		},
+		releaseWorkspace(exec, workspace) {
+			exec("herdr", [
+				"workspace",
+				"close",
+				workspace
+			]);
+		}
+	};
+}
+/**
+* `herdr workspace create` and `herdr tab create` both emit their new root pane at
+* `.result.root_pane.pane_id` (a different path than `pane split`'s `.result.pane.pane_id`).
+* `label` names the command in error messages (e.g. "herdr workspace create").
+*/
+function parseRootPaneId(out, label) {
+	return parseOpenedPane(out, label, "root_pane");
+}
+/**
+* Every pane herdr emits carries its own `workspace_id` alongside its `pane_id`, on EVERY route —
+* `workspace create` (which reports the workspace it just made), `tab create` (the workspace the tab
+* was created in), and `pane split` (the workspace the split landed in, i.e. the caller's). Re-verified
+* against herdr 0.8.0. That is why the workspace costs no extra call: it rides in on the same output
+* the pane id is already read from, so probing for it separately would buy nothing and cost a round
+* trip per open.
+*
+* The pane id is required — a route that cannot name its pane has failed. The workspace is NOT: it
+* is read opportunistically and left absent when missing rather than throwing, so a herdr build that
+* stops emitting it degrades to "cannot say" instead of breaking `open` outright. Absent is a
+* meaning this seam already has (`OpenedPane.workspace`); a hard failure here would be inventing a
+* new one for a field no caller is required to use.
+*/
+function parseOpenedPane(out, label, key) {
+	let pane;
+	try {
+		pane = JSON.parse(out)?.result?.[key];
+	} catch {
+		throw new Error(`${label} returned unparseable output: ${out.slice(0, 200)}`);
+	}
+	const paneId = pane?.pane_id;
+	if (typeof paneId !== "string" || paneId === "") throw new Error(`${label} output had no result.${key}.pane_id: ${out.slice(0, 200)}`);
+	const tab = pane?.tab_id;
+	if (typeof tab !== "string" || tab === "") throw new Error(`${label} output had no result.${key}.tab_id: ${out.slice(0, 200)}`);
+	const workspace = pane?.workspace_id;
+	return typeof workspace === "string" && workspace !== "" ? {
+		id: paneId,
+		tab,
+		workspace
+	} : {
+		id: paneId,
+		tab
+	};
+}
+/**
+* `herdr worktree create` and `herdr worktree open` emit the same envelope: the root pane at
+* `.result.root_pane.pane_id` (as `workspace create` does), the checkout at
+* `.result.worktree.{path,branch}`, and the bound workspace at `.result.workspace.workspace_id`.
+* That workspace id IS the binding — the whole reason to route through these instead of plain git.
+* `label` names the command in error messages (e.g. "herdr worktree create").
+*
+* The root pane is read through `parseOpenedPane`, NOT re-parsed here: `root_pane` is the same record
+* `workspace create` emits, so it carries the same `tab_id`, and one spelling is what keeps the two
+* routes from disagreeing about a field both report. That tab is the region's root tab — what lets a
+* caller handed this workspace group or rename it without reaching for the pane id, which would be
+* green on tmux and silently broken on herdr.
+*/
+function parseWorktreeWorkspace(out, label) {
+	let parsed;
+	try {
+		parsed = JSON.parse(out);
+	} catch {
+		throw new Error(`${label} returned unparseable output: ${out.slice(0, 200)}`);
+	}
+	const result = parsed?.result;
+	const target = parseOpenedPane(out, label, "root_pane");
+	const workspace = result?.workspace?.workspace_id;
+	const path = result?.worktree?.path;
+	const branch = result?.worktree?.branch;
+	if (typeof path !== "string" || path === "" || typeof branch !== "string" || branch === "") throw new Error(`${label} output had no result.worktree.{path,branch}: ${out.slice(0, 200)}`);
+	if (typeof workspace !== "string" || workspace === "") throw new Error(`${label} output had no result.workspace.workspace_id: ${out.slice(0, 200)}`);
+	return {
+		target,
+		worktree: {
+			root: resolve(path),
+			branch
+		},
+		workspace
+	};
+}
+/**
+* `herdr worktree list` reports every worktree of the repo, each carrying `open_workspace_id` ONLY
+* while a workspace is currently open on it. Everything else it reports (branch, linked, prunable)
+* is herdr re-reading git — deliberately ignored here; git answers those for every backend.
+* Defensive like `listPanes`: a query that cannot be read reports nothing rather than throwing.
+*/
+function parseWorktreeBindings(out) {
+	const bindings = /* @__PURE__ */ new Map();
+	if (!out) return bindings;
+	let parsed;
+	try {
+		parsed = JSON.parse(out);
+	} catch {
+		return bindings;
+	}
+	const worktrees = parsed?.result?.worktrees ?? [];
+	if (!Array.isArray(worktrees)) return bindings;
+	for (const entry of worktrees) {
+		const path = entry?.path;
+		const workspace = entry?.open_workspace_id;
+		if (typeof path === "string" && path !== "" && typeof workspace === "string" && workspace !== "") bindings.set(normalizeWorktreePath(path), workspace);
+	}
+	return bindings;
+}
+/**
+* One spelling of `pane read`, taken by `read` for the snapshot AND for its truncation probe — so the
+* two differ only in the source and depth they are meant to differ in. `lines` omitted takes herdr's
+* own default window for the source.
+*/
+function paneRead(exec, target, source, lines) {
+	const args = [
+		"pane",
+		"read",
+		target.id,
+		"--source",
+		source
+	];
+	if (lines != null) args.push("--lines", String(lines));
+	return exec("herdr", args) ?? "";
+}
+//#endregion
+//#region src/mux.otty.ts
+/**
+* otty backend — detected via `$OTTY_PANE_ID`. Drives otty's CLI through `otty pane <verb> …`
+* (https://docs.otty.sh/reference/cli), the same synchronous-CLI shape the other backends use.
+*
+* otty is a native terminal-centric workspace app with integrated multiplexing (Windows > Tabs >
+* Splits > Panes). Its hierarchy maps onto cyber-mux's placement tiers as:
+* - **Workspace** → Window (a new window, spawned via `otty open --new-window`)
+* - **Tab** → Tab (a new tab via `otty tab new`)
+* - **Pane** → Pane (a split via `otty pane split`)
+*
+* The env variable `$OTTY_PANE_ID` carries the caller's pane identity — analogous to `$TMUX_PANE`
+* or `$WEZTERM_PANE`. `$OTTY_SOCKET` is the IPC socket path (detection hint only).
+*
+* Probed from the otty docs only — otty is a GUI-only app not installed in this sandbox, so
+* nothing here carries the "verified against a live binary" claim `mux.tmux.ts`/`mux.herdr.ts`
+* make; it makes the same honest disclaimer the other GUI-based adapters do.
+*
+* Real capability shape from the docs:
+*
+* - **Pane is the terminal unit.** `OTTY_PANE_ID` is the self-identity env var and `LivePane.id`
+*   carries a pane id. `--at tab` maps to `otty tab new`; `--at pane:*` maps to `otty pane split`.
+* - **Window is the workspace tier.** `otty open --new-window` creates a genuinely separate window,
+*   reported as `OpenedPane.workspace`.
+* - **No `--env` on any route.** Like wezterm/zellij/cmux, env is native at no tier, so every open
+*   rides the `envFallback` compensation (an `env K=V` prefix on the launch command, or a stderr
+*   warning when there is no command to ride).
+* - **Split direction is explicit.** `otty pane split --right|--bottom` maps `pane:right`/`pane:down`.
+* - **`send-keys` mixes text and key tokens.** `otty pane send-keys --pane <id> -- "text" key:Enter`
+*   can do both in one call. We implement `sendText` and `sendKeys` separately per the contract.
+* - **No pane geometry adapter.** `otty panes --json` does not report position, so `regions` is not
+*   implementable. `template save` refuses on otty by naming the backend.
+* - **No git-worktree concept in the CLI.** No `worktree` subcommand, so — like tmux, wezterm,
+*   zellij, and cmux — this backend never binds a worktree to a workspace; callers fall back to
+*   plain git plus `open()`.
+*/
+function createOttyAdapter(deps) {
+	const adapter = {
+		name: "otty",
+		canSizeSplits: false,
+		/**
+		* `false`, for cmux's two reasons exactly: no suppress-focus flag is documented on `pane split`,
+		* `tab new`, or `open`, and `from` is honored by focusing the target pane first (`open` below),
+		* so an open moves the user twice over.
+		*
+		* Read off otty's documented CLI, NOT verified against a live binary — no otty on the machine
+		* this was written on, matching the rest of this header.
+		*/
+		opensWithoutStealingFocus: false,
+		open(exec, opts) {
+			const at = opts.at ?? "tab";
+			if (at === "workspace") {
+				const args = ["open", "--new-window"];
+				if (opts.cwd) args.push(opts.cwd);
+				const out = exec("otty", args);
+				if (!out) throw new Error(withReason(exec, "otty open --new-window failed"));
+				const parsed = parseOttyOutput(out);
+				if (!parsed.window_id) throw new Error("otty open --new-window did not report the window id");
+				const paneId = parsed.pane_id;
+				if (!paneId) throw new Error("otty open --new-window did not report the initial pane id");
+				const opened = openedPane$1(paneId, parsed.tab_id, parsed.window_id);
+				if (opts.label) adapter.rename(exec, opened, "tab", opts.label);
+				runLaunch$2(adapter, exec, opened, opts.env, opts.launch);
+				return opened;
+			}
+			if (at === "tab") {
+				const args = ["tab", "new"];
+				if (opts.cwd) args.push("--cwd", opts.cwd);
+				const out = exec("otty", args);
+				if (!out) throw new Error(withReason(exec, "otty tab new failed"));
+				const parsed = parseOttyOutput(out);
+				const paneId = parsed.pane_id;
+				if (!paneId) throw new Error("otty tab new did not report the pane id");
+				const opened = openedPane$1(paneId, parsed.tab_id, deps.window);
+				if (opts.label) adapter.rename(exec, opened, "tab", opts.label);
+				runLaunch$2(adapter, exec, opened, opts.env, opts.launch);
+				return opened;
+			}
+			if (at === "pane:float") refuseFloatingPane(adapter.name);
+			if (opts.from) adapter.focus(exec, opts.from);
+			const args = [
+				"pane",
+				"split",
+				at === "pane:down" ? "--bottom" : "--right"
+			];
+			if (opts.cwd) args.push("--cwd", opts.cwd);
+			const out = exec("otty", args);
+			if (!out) throw new Error(withReason(exec, "otty pane split failed"));
+			const parsed = parseOttyOutput(out);
+			const paneId = parsed.pane_id;
+			if (!paneId) throw new Error("otty pane split did not report the pane id");
+			const opened = openedPane$1(paneId, parsed.tab_id, deps.window);
+			if (opts.label) adapter.rename(exec, opened, "pane", opts.label);
+			runLaunch$2(adapter, exec, opened, opts.env, opts.launch);
+			return opened;
+		},
+		rename(exec, target, tier, name) {
+			if (tier === "tab") {
+				exec("otty", [
+					"tab",
+					"rename",
+					"--tab",
+					target.id,
+					"--title",
+					name
+				]);
+				return;
+			}
+			exec("otty", [
+				"pane",
+				"rename",
+				"--pane",
+				target.id,
+				"--title",
+				name
+			]);
+		},
+		group() {},
+		sendText(exec, target, text) {
+			exec("otty", [
+				"pane",
+				"send-keys",
+				"--pane",
+				target.id,
+				"--",
+				text
+			]);
+		},
+		sendKeys(exec, target, keys) {
+			const keyTokens = keys.map((k) => `key:${toOttyKey(k)}`);
+			exec("otty", [
+				"pane",
+				"send-keys",
+				"--pane",
+				target.id,
+				"--",
+				...keyTokens
+			]);
+		},
+		submit(exec, target, text) {
+			if (!text) {
+				adapter.sendKeys(exec, target, ["Enter"]);
+				return;
+			}
+			exec("otty", [
+				"pane",
+				"send-keys",
+				"--pane",
+				target.id,
+				"--",
+				text,
+				"key:Enter"
+			]);
+		},
+		read(exec, target, opts) {
+			const args = [
+				"pane",
+				"capture",
+				"--pane",
+				target.id
+			];
+			if (opts?.lines != null) args.push("--lines", String(opts.lines));
+			return { text: exec("otty", args) ?? "" };
+		},
+		waitForOutput(exec, target, opts) {
+			return pollForOutput(adapter, exec, target, opts);
+		},
+		focus(exec, target) {
+			exec("otty", [
+				"pane",
+				"focus",
+				"--pane",
+				target.id
+			]);
+		},
+		teardown(exec, target) {
+			exec("otty", [
+				"pane",
+				"close",
+				"--pane",
+				target.id
+			]);
+		},
+		paneExists(exec, target) {
+			return listOttyPanes(exec).some((p) => p.id === target.id);
+		},
+		isPaneFocused(exec, target) {
+			const found = listOttyPanes(exec).find((p) => p.id === target.id);
+			if (!found) return void 0;
+			return found.is_focused === true;
+		},
+		listPanes(exec) {
+			return listOttyPanes(exec).map((p) => {
+				const pane = {
+					id: p.id,
+					mux: "otty",
+					floating: false
+				};
+				if (p.cwd) pane.cwd = p.cwd;
+				if (p.title) pane.label = p.title;
+				return pane;
+			});
+		}
+	};
+	return adapter;
+}
+function parseOttyOutput(out) {
+	try {
+		return JSON.parse(out);
+	} catch {
+		return {};
+	}
+}
+function listOttyPanes(exec) {
+	const out = exec("otty", ["panes", "--json"]);
+	if (!out) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse(out);
+	} catch {
+		return [];
+	}
+	if (!Array.isArray(parsed)) return [];
+	const panes = [];
+	for (const p of parsed) if (p?.pane_id) panes.push({
+		id: p.pane_id,
+		title: p.title,
+		cwd: p.cwd,
+		is_focused: p.is_focused
+	});
+	return panes;
+}
+function openedPane$1(paneId, tabId, window) {
+	const opened = {
+		id: paneId,
+		tab: tabId ?? paneId
+	};
+	if (window) opened.workspace = window;
+	return opened;
+}
+function runLaunch$2(adapter, exec, target, env, launch) {
+	const fallback = envFallback(env, launch);
+	if (fallback.kind === "dropped") {
+		process.stderr.write(`env (${fallback.variables.join(", ")}) could not be set on this otty pane — otty has no --env flag on pane split/tab new/open
+`);
+		return;
+	}
+	if (fallback.command !== void 0) adapter.submit(exec, target, fallback.command);
+}
+/**
+* The core key vocabulary's otty spelling. otty uses PascalCase key names: Enter, Tab, Escape, etc.
+*/
+const OTTY_KEY_RENAMES = { "C-c": "Ctrl+c" };
+function toOttyKey(key) {
+	return OTTY_KEY_RENAMES[key] ?? key;
+}
+//#endregion
+//#region src/mux.rmux.ts
+/**
+* rmux backend — an async Rust reimplementation of the tmux command language (`Helvesec/rmux`),
+* detected via `$RMUX`.
+*
+* **A near-copy of `mux.tmux.ts`, on purpose.** rmux reimplements ~90 commands under tmux's own
+* names, flags, target syntax and `#{…}` format vocabulary, so the argv this adapter emits is
+* tmux's argv with a different binary in front of it. The alternative — one shared implementation
+* parameterized by binary name — was considered and REJECTED; the reasoning is in the ADR log
+* (`.agents/spec/design/decisions`, `136-rmux-adapter`). The short form: rmux is a separate project
+* that TRACKS tmux rather than a tmux version, so every future divergence would land as a
+* conditional inside the tmux adapter, which is the seam's own argument against emulation; and the
+* two already differ in the one member that matters most here (`canFloatPanes`), whose long
+* justification on each side is about a *different binary's* command set. A shared file could not
+* carry both verification claims honestly, and this repo's comments are verification claims.
+*
+* **Probed against a live binary — rmux 0.10.0, 2026-08-26**, on an isolated socket
+* (`rmux -L … new-session -d`), not read off documentation. Every claim below that says "verified"
+* names a command that was actually run. What was NOT covered: nothing was driven on Windows or
+* macOS (rmux runs natively on both, and that portability is the strategic reason this backend
+* exists), and no rmux version other than 0.10.0 was exercised.
+*/
+/**
+* The rmux window user option `MuxOpenOptions.workspaceGroup` is stored in — the same `@`-prefixed
+* user option tmux uses, because rmux implements tmux's user-option mechanism unchanged.
+*
+* Verified live on 0.10.0: `set-option -w -t @0 @cm_ws grp1` then `list-windows -F '#{@cm_ws}'`
+* read `grp1` back, and `list-windows -f '#{==:#{@cm_ws},grp1}'` filtered SERVER-SIDE to that
+* window. Both halves matter — the read alone would leave the filter a docs claim.
+*
+* Deliberately the SAME option name as tmux's (`TMUX_WORKSPACE_GROUP_OPTION`), not a namespaced
+* twin: the tag identifies a cyber-mux workspace group, and the two backends never share a server,
+* so a second spelling would buy nothing and cost a way for the two to drift. Named here rather
+* than spelled at each use so this adapter's write side and every read side cannot drift.
+* Server-lifetime, like every window: it dies with the rmux daemon, along with the windows it tags.
+*/
+const RMUX_WORKSPACE_GROUP_OPTION = "@cm_ws";
+/**
+* The rmux window user option a grouped window's OWN name is stored in — the name the caller gave
+* the tab, beside the group id, because rmux inherits tmux's single `window_name` field and so
+* inherits the problem it creates.
+*
+* See `TMUX_TAB_NAME_OPTION` in `mux.tmux.ts` for the full argument; it transfers intact, because
+* the constraint is tmux's data model and rmux reimplements that model. In brief: a caller that
+* composes a display name out of a tab's name (`pool - editor`) has destroyed `editor`, splitting
+* on the separator is ambiguous, and reading the display name verbatim re-prefixes it on every
+* round trip. So the original is stored here and read back from here.
+*
+* Verified live on 0.10.0 alongside the group tag: `set-option -w -t @0 @cm_tab editor` read back
+* through `display-message -p -t %1 '#{@cm_tab}'` as `editor`.
+*/
+const RMUX_TAB_NAME_OPTION = "@cm_tab";
+/** rmux backend — detected via `$RMUX`. */
+const rmuxMuxAdapter = {
+	name: "rmux",
+	canSizeSplits: true,
+	/**
+	* Every route passes `-d`, so no open moves the attached client — the same answer tmux gives, and
+	* for the same reason, since rmux reimplements tmux's command language and inherits the behavior
+	* along with the flag. Verified live on 0.10.0 rather than inherited from that resemblance, on an
+	* isolated socket: a bare `split-window` in a session focused on `%0` left `%1` active, `-d` left
+	* focus on `%0`, and `-P -F` printed the new id either way. `new-window -d` was already here.
+	*
+	* There is no focus move to undo on top of that, as on tmux: `-t` targets the pane to split
+	* directly, so rmux never has to VISIT a pane to choose it. And no third route to cover — rmux has
+	* no `new-pane`, so `pane:float` is refused before any command is issued.
+	*/
+	opensWithoutStealingFocus: true,
+	open(exec, opts) {
+		const at = opts.at ?? "tab";
+		const window = at === "workspace" || at === "tab";
+		if (at === "pane:float") refuseFloatingPane(rmuxMuxAdapter.name);
+		const env = opts.env ? Object.entries(opts.env).flatMap(([k, v]) => ["-e", `${k}=${v}`]) : [];
+		const group = window && opts.workspaceGroup != null;
+		const format = "#{pane_id}	#{window_id}";
+		let args;
+		if (window) args = [
+			"new-window",
+			"-d",
+			...env,
+			"-c",
+			opts.cwd,
+			"-P",
+			"-F",
+			format
+		];
+		else {
+			const from = opts.from ? ["-t", opts.from.id] : [];
+			const size = opts.ratio != null ? ["-l", toRmuxSize(opts.ratio)] : [];
+			args = [
+				"split-window",
+				"-d",
+				at === "pane:down" ? "-v" : "-h",
+				...from,
+				...size,
+				...env,
+				"-c",
+				opts.cwd,
+				"-P",
+				"-F",
+				format
+			];
+		}
+		if (window && opts.label) args.splice(1, 0, "-n", opts.label);
+		const out = exec("rmux", args);
+		if (!out) throw new Error(withReason(exec, `rmux ${args[0]} failed`));
+		const [pane, windowId] = splitOpenReport$1(out, args[0]);
+		const target = {
+			id: pane,
+			tab: windowId
+		};
+		if (group && windowId) rmuxMuxAdapter.group(exec, { id: windowId }, opts.workspaceGroup);
+		if (!window && opts.label) rmuxMuxAdapter.rename(exec, target, "pane", opts.label);
+		if (opts.launch) rmuxMuxAdapter.submit(exec, target, opts.launch);
+		return target;
+	},
+	rename(exec, target, tier, name) {
+		if (tier === "tab") {
+			exec("rmux", [
+				"rename-window",
+				"-t",
+				target.id,
+				name
+			]);
+			return;
+		}
+		exec("rmux", [
+			"select-pane",
+			"-t",
+			target.id,
+			"-T",
+			name
+		]);
+	},
+	group(exec, target, group, name) {
+		exec("rmux", [
+			"set-option",
+			"-w",
+			"-t",
+			target.id,
+			RMUX_WORKSPACE_GROUP_OPTION,
+			group
+		]);
+		if (name !== void 0) exec("rmux", [
+			"set-option",
+			"-w",
+			"-t",
+			target.id,
+			RMUX_TAB_NAME_OPTION,
+			name
+		]);
+	},
+	sendText(exec, target, text) {
+		exec("rmux", [
+			"send-keys",
+			"-t",
+			target.id,
+			"-l",
+			text
+		]);
+	},
+	sendKeys(exec, target, keys) {
+		exec("rmux", [
+			"send-keys",
+			"-t",
+			target.id,
+			...keys.map(toRmuxKey)
+		]);
+	},
+	submit(exec, target, text) {
+		if (!text) {
+			exec("rmux", [
+				"send-keys",
+				"-t",
+				target.id,
+				"Enter"
+			]);
+			return;
+		}
+		rmuxMuxAdapter.sendText(exec, target, text);
+		exec("rmux", [
+			"send-keys",
+			"-t",
+			target.id,
+			"Enter"
+		]);
+	},
+	read(exec, target, opts) {
+		const text = capturePane$1(exec, target, opts?.lines);
+		if (!opts?.truncation) return { text };
+		if (opts.lines === "all") return {
+			text,
+			truncated: false
+		};
+		return {
+			text,
+			truncated: isReadTruncated(text, capturePane$1(exec, target, (opts.lines ?? 0) + 1))
+		};
+	},
+	waitForOutput(exec, target, opts) {
+		return pollForOutput(rmuxMuxAdapter, exec, target, opts);
+	},
+	focus(exec, target) {
+		const { sessionName, windowId } = parsePaneLocation$1(exec("rmux", [
+			"list-panes",
+			"-a",
+			"-F",
+			"#{pane_id} #{session_name} #{window_id}"
+		]), target.id);
+		exec("rmux", [
+			"switch-client",
+			"-t",
+			sessionName
+		]);
+		exec("rmux", [
+			"select-window",
+			"-t",
+			windowId
+		]);
+		exec("rmux", [
+			"select-pane",
+			"-t",
+			target.id
+		]);
+	},
+	teardown(exec, target) {
+		exec("rmux", [
+			"kill-pane",
+			"-t",
+			target.id
+		]);
+	},
+	paneExists(exec, target) {
+		if (exec("rmux", [
+			"has-session",
+			"-t",
+			target.id
+		]) !== null) return true;
+		return (exec("rmux", [
+			"list-panes",
+			"-a",
+			"-F",
+			"#{pane_id}"
+		]) ?? "").split("\n").includes(target.id);
+	},
+	isPaneFocused(exec, target) {
+		const out = exec("rmux", [
+			"list-panes",
+			"-a",
+			"-F",
+			"#{pane_id} #{pane_active} #{window_active} #{session_attached}"
+		]);
+		if (!out) return void 0;
+		const line = out.split("\n").find((l) => l.split(" ")[0] === target.id);
+		if (!line) return void 0;
+		const [, paneActive, windowActive, sessionAttached] = line.split(" ");
+		return paneActive === "1" && windowActive === "1" && sessionAttached !== "0" && sessionAttached !== void 0;
+	},
+	/**
+	* Tab-separated, not space — the same rule `describeRmuxRegion` follows, and for the same reason:
+	* `pane_current_path` and `pane_title` can both contain spaces, so a space-separated format makes
+	* both fields unrecoverable (`my worker` and `/repo/my dir` cannot be told apart by a space). A tab
+	* can appear in neither id nor command, and the two free-text fields are separated by one.
+	*/
+	listPanes(exec) {
+		const out = exec("rmux", [
+			"list-panes",
+			"-a",
+			"-F",
+			"#{pane_id}	#{pane_current_command}	#{pane_current_path}	#{pane_title}	#{host}"
+		]);
+		if (!out) return [];
+		return out.split("\n").filter(Boolean).map((line) => {
+			const [id, , cwd, title, host] = line.split("	");
+			const pane = {
+				id: id ?? "",
+				mux: "rmux",
+				floating: false
+			};
+			if (cwd) pane.cwd = cwd;
+			const label = paneLabel$1(title, host);
+			if (label) pane.label = label;
+			return pane;
+		}).filter((p) => p.id !== "");
+	},
+	regions: {
+		describeRegion(exec, target) {
+			return describeRmuxRegion(exec, target.id);
+		},
+		/**
+		* `resize-pane -x/-y` in CELLS, never `-x <percent>`. rmux reads a percentage against the WINDOW
+		* exactly as tmux does, while the seam's `ratio` is a fraction of the pane's own SPLIT REGION —
+		* the same number only in a two-pane window, so a nested layout would be sized against the wrong
+		* denominator. PROBED rather than inherited from the tmux adapter, because that is this backend's
+		* rule (see the header): on rmux 0.10.0 in a 200-column window, `-x 60%` produced a 120-column
+		* pane — 60% of the window — with the region's own split at a different fraction entirely.
+		*
+		* Verified against a live rmux 0.10.0 (`mux.rmux.integration.test.ts`): `-x` sizes the target pane
+		* and its sibling absorbs the difference, `-y` does the same on a stacked split, and a resize
+		* inside a nested region leaves the outer divider where it was — every case matching tmux 3.7c's
+		* behavior number for number, which is what makes the shared `toRmuxResizeCells` arithmetic honest
+		* rather than assumed.
+		*/
+		resizePane(exec, target, ratio) {
+			const split = enclosingSplit(describeRmuxRegion(exec, target.id), target.id);
+			if (!split) throw new Error(`rmux pane ${target.id} is the only pane in its region — there is no split to resize`);
+			const flag = split.direction === "right" ? "-x" : "-y";
+			if (exec("rmux", [
+				"resize-pane",
+				"-t",
+				target.id,
+				flag,
+				String(toRmuxResizeCells(split, ratio))
+			]) === null) throw new Error(withReason(exec, `rmux could not resize pane ${target.id}`));
+		},
+		/**
+		* rmux has NO workspace tier — `workspace` and `tab` both collapse onto a Window — so a workspace
+		* is not a fact this backend holds. What it holds is the grouping TAG the walk wrote
+		* (`MuxOpenOptions.workspaceGroup`, stored in a window user option), so the read here is
+		* literally *"which windows carry this group id"*.
+		*
+		* The tag, never the label. `list-windows -a` spans SESSIONS, so a bare name match would
+		* over-collect a same-named window from another session, and taking the workspace off a
+		* `<workspace> - <tab>` label is unsound in the first place (`acme - beta - main` splits two ways,
+		* both legal). `-f '#{==:#{@cm_ws},<id>}'` keys on what actually identifies the group, filtered
+		* server-side — verified live on rmux 0.10.0, which is the half a docs read could not settle.
+		*
+		* A window with NO tag is a workspace of ONE: the honest answer for a window nobody grouped, and
+		* it costs no further call — the caller's own window is the whole workspace.
+		*/
+		describeWorkspace(exec, target) {
+			const out = exec("rmux", [
+				"display-message",
+				"-p",
+				"-t",
+				target.id,
+				`#{window_id}\t#{${RMUX_WORKSPACE_GROUP_OPTION}}\t#{${RMUX_TAB_NAME_OPTION}}\t#{window_name}`
+			]);
+			if (!out) throw new Error(withReason(exec, `rmux could not resolve the workspace around pane ${target.id}`));
+			const [windowId, group, ownName, ...nameParts] = out.split("\n")[0].split("	");
+			if (!windowId) throw new Error(`rmux did not report the window around pane ${target.id}`);
+			if (!group) return [rmuxTab(exec, windowId, ownName, nameParts.join("	"))];
+			const listed = exec("rmux", [
+				"list-windows",
+				"-a",
+				"-F",
+				`#{window_id}\t#{${RMUX_TAB_NAME_OPTION}}\t#{window_name}`,
+				"-f",
+				`#{==:#{${RMUX_WORKSPACE_GROUP_OPTION}},${group}}`
+			]);
+			if (!listed) throw new Error(withReason(exec, `rmux could not enumerate the windows grouped as ${group}`));
+			const tabs = listed.split("\n").filter(Boolean).map((line) => line.split("	")).filter(([id]) => Boolean(id)).map(([id, own, ...rest]) => rmuxTab(exec, id, own, rest.join("	")));
+			if (tabs.length === 0) throw new Error(`rmux reported no windows grouped as ${group}`);
+			return tabs;
+		}
+	}
+};
+/**
+* One window, read as a tab: its id, the tab's OWN name, and its region's geometry.
+*
+* `ownName` is what `group` stored (`RMUX_TAB_NAME_OPTION`) and it WINS, because `windowName` is the
+* display name — on a grouped window that is the composed `pool - editor`, whose `editor` rmux's
+* single name field no longer holds. Reporting the display name instead would compound the prefix on
+* every capture/apply round trip (`pool - pool - editor`), and splitting it back apart is the unsound
+* parse the option exists to refuse.
+*
+* The window name is the FALLBACK, not a second guess: a window carrying no stored name is one nobody
+* composed a display name for, so its name already IS its own name.
+*/
+function rmuxTab(exec, windowId, ownName, windowName) {
+	const tab = {
+		id: windowId,
+		panes: describeRmuxRegion(exec, windowId)
+	};
+	const label = ownName || windowName;
+	if (label) tab.label = label;
+	return tab;
+}
+/**
+* Every pane of the region `id` names, with its rectangle. `id` is a pane id (that pane's own window)
+* or a window id (that window) — `list-panes -t` resolves both, which is what lets the region read and
+* the workspace read share one query instead of two that could drift apart.
+*
+* `-t` scopes `list-panes` to ONE window — the region tier, which is what capture captures. Without
+* `-a`, so this never reaches the panes of some other window.
+*
+* `#{pane_left}`/`#{pane_top}` are window-relative, and the widths exclude the divider column rmux
+* draws between panes — both verified live on 0.10.0, where an 80x24 window split side by side
+* reported `%0 0 0 39 24` and `%1 40 0 40 24` (39 + 40 = 79, not 80). That is exactly what
+* `RegionPane.rect` documents, so nothing is adjusted here. The check is not a formality: a backend
+* that INCLUDED the divider would silently shift every rect a captured template stores.
+*
+* Tab-separated, not space: `pane_current_path` and `pane_title` can both contain spaces, and
+* splitting a path on spaces is how a directory with one in it silently becomes the wrong pane.
+*/
+function describeRmuxRegion(exec, id) {
+	const out = exec("rmux", [
+		"list-panes",
+		"-t",
+		id,
+		"-F",
+		"#{pane_id}	#{pane_left}	#{pane_top}	#{pane_width}	#{pane_height}	#{pane_current_path}	#{pane_title}	#{host}"
+	]);
+	if (!out) throw new Error(withReason(exec, `rmux could not describe the region around pane ${id}`));
+	const panes = [];
+	for (const line of out.split("\n").filter(Boolean)) {
+		const [paneId, left, top, width, height, cwd, title, host] = line.split("	");
+		if (!paneId) continue;
+		const pane = {
+			id: paneId,
+			rect: {
+				x: Number(left),
+				y: Number(top),
+				width: Number(width),
+				height: Number(height)
+			}
+		};
+		if (cwd) pane.cwd = cwd;
+		const label = paneLabel$1(title, host);
+		if (label) pane.label = label;
+		panes.push(pane);
+	}
+	if (panes.length === 0) throw new Error(`rmux reported no panes in the region around pane ${id}`);
+	return panes;
+}
+/**
+* An rmux pane's label — its title, unless that title is the hostname rmux handed it.
+*
+* **rmux has no "unset title"**, exactly as tmux has none: it defaults `pane_title` to the hostname
+* (verified live on 0.10.0 — every pane of a fresh session reported the machine's hostname, and
+* `#{host}` reported the same string). Exporting that would label them all alike, and that label
+* would then resolve to every pane in the session — ambiguity manufactured out of nothing. A title
+* that differs from the host is one someone set (cyber-mux's own `select-pane -T` among them), so it
+* is the author's and survives.
+*
+* One home for the rule, called by BOTH reads — `listPanes` (which a name resolves against) and
+* `describeRmuxRegion` (which a capture exports). Two spellings of a heuristic this load-bearing is
+* how the listing and the capture come to disagree about which panes are named.
+*/
+function paneLabel$1(title, host) {
+	return title && title !== host ? title : void 0;
+}
+/**
+* The `-P -F '#{pane_id}\t#{window_id}'` report EVERY open asks for, split back into its two ids.
+* Tab-separated because neither id can contain a tab.
+*
+* A report that does not carry both throws rather than returning half an answer: the window is the
+* pane's tab, which `OpenedPane.tab` promises is always present, and it is also what a grouping open
+* tags. Guessing either would be worse than failing — a caller would name or group nothing and never
+* learn it.
+*/
+function splitOpenReport$1(out, command) {
+	const [pane, windowId] = out.split("	");
+	if (!pane || !windowId) throw new Error(`rmux ${command} did not report the new pane's id and window id`);
+	return [pane, windowId];
+}
+/**
+* The seam's `ratio` as the CELL count `resize-pane -x/-y` wants for the target pane — rmux's copy of
+* the tmux adapter's `toTmuxResizeCells`, for the header's reason.
+*
+* Computed through the SECOND side rather than the target directly, because that is the definition
+* `ratioOf` (`region-tree.ts`) reads a live split back with, and a write that used the other formula
+* would not round-trip: rmux eats a column for the divider exactly as tmux does (probed on 0.10.0 —
+* a 200-column window splits into 119 + 80), so `first / (first + second)` and `1 - second / total`
+* disagree by that column. The divider is MEASURED rather than assumed to be one, so nothing here
+* depends on that probe staying true.
+*/
+function toRmuxResizeCells(split, ratio) {
+	assertRatioInRange(ratio);
+	const second = Math.round((split.targetIsFirst ? 1 - ratio : ratio) * split.extent);
+	if (!split.targetIsFirst) return second;
+	const divider = split.extent - split.targetExtent - split.otherExtent;
+	return split.extent - divider - second;
+}
+/**
+* `ratio` is the fraction kept by the ORIGINAL pane; rmux's `-l` sizes the NEW one, exactly as tmux's
+* does. So this INVERTS — `1 - ratio`. The direction was PROBED rather than inherited from the tmux
+* adapter: on rmux 0.10.0, `split-window -h -l 30%` in an 80-column window left the original at 55
+* columns and gave the new pane 24, which is the new pane taking the 30%. Reading the inversion off
+* the sibling adapter is how a shared-by-assumption number comes out silently backwards — a 0.333
+* template would size the original pane at 67%.
+*
+* Percent rather than cells: rmux takes `-l` as either, and a percentage is the only form that means
+* the same thing without first querying the region's size.
+*/
+function toRmuxSize(ratio) {
+	assertRatioInRange(ratio);
+	return `${Math.round((1 - ratio) * 100)}%`;
+}
+/**
+* The core vocabulary's rmux spelling. Exactly one member differs, and it was PROBED against the live
+* binary rather than inherited from `TMUX_KEY_RENAMES`: rmux has no `Backspace` key name, so it falls
+* through to tmux's unrecognized-token behavior and TYPES the word. Verified on 0.10.0 —
+* `send-keys 'echo DEFX'` then `send-keys Backspace` produced the line `echo DEFXBackspace`, while
+* the same sequence with `BSpace` produced `echo DEF`. So rmux's name for that key is `BSpace`, and
+* the rename is real behavior on this binary rather than a claim carried over from tmux(1).
+*
+* Deliberately a rename table, NOT a validation table: a token outside the core is forwarded
+* verbatim (the contract), so this must not reject what it does not recognize. Keeping a full rmux
+* key list here would make the passthrough a second vocabulary to maintain.
+*/
+const RMUX_KEY_RENAMES = { Backspace: "BSpace" };
+/**
+* One spelling of the capture, taken by `read` for the snapshot AND for the one-row-deeper truncation
+* probe — so the two differ in exactly the number they disagree about and nothing else. `lines`
+* omitted is rmux's own default window: the visible screen, with no `-S` at all.
+*/
+function capturePane$1(exec, target, lines) {
+	const args = [
+		"capture-pane",
+		"-p",
+		"-t",
+		target.id
+	];
+	if (lines === "all") args.push("-S", "-");
+	else if (lines != null) args.push("-S", `-${lines}`);
+	return exec("rmux", args) ?? "";
+}
+function toRmuxKey(key) {
+	return RMUX_KEY_RENAMES[key] ?? key;
+}
+/**
+* `rmux list-panes -a -F '#{pane_id} #{session_name} #{window_id}'` lists every pane server-wide.
+* Resolving fails — no line's pane id matches `id` — when the pane no longer exists in the backend,
+* and that must throw so `focus` never issues a switch-client/select-window against a pane it
+* couldn't actually resolve.
+*/
+function parsePaneLocation$1(out, id) {
+	const line = (out ?? "").split("\n").find((l) => l.split(" ")[0] === id);
+	if (!line) throw new Error(`peer's pane ${id} could not be resolved to beam to`);
+	const [, sessionName, windowId] = line.split(" ");
+	return {
+		sessionName,
+		windowId
+	};
+}
+//#endregion
+//#region src/mux.tmux.ts
+/**
+* The tmux window user option `MuxOpenOptions.workspaceGroup` is stored in. A user option (the
+* `@` prefix) is tmux's own mechanism for a value it stores but never interprets, so tmux carries
+* the tag without cyber-mux teaching it anything: it survives a window rename, and `list-windows`
+* both reads it back (`#{@cm_ws}`) and filters on it server-side (`-f '#{==:#{@cm_ws},<id>}'`).
+*
+* Named here rather than spelled at each use so the write side and every read side cannot drift.
+* Server-lifetime, like every window: it dies with the tmux server, along with the windows it tags.
+*/
+const TMUX_WORKSPACE_GROUP_OPTION = "@cm_ws";
+/**
+* The tmux window user option a grouped window's OWN name is stored in — the name the caller gave the
+* tab, beside the group id, because tmux's single `window_name` field no longer holds it.
+*
+* tmux has ONE name field per space. A caller that composes a display name out of a tab's name
+* (`pool - editor`) has destroyed `editor`, and there is no sound way back: splitting on the separator
+* is ambiguous (`acme - beta - main` reads two legal ways), and reading the display name verbatim
+* re-prefixes it on every round trip (`pool - pool - editor`). So the original is stored here and read
+* back from here — the same rule the group id follows, one tier down. The display name is a human's to
+* read; this is what a machine reads.
+*
+* A user option (the `@` prefix) for `TMUX_WORKSPACE_GROUP_OPTION`'s reasons exactly: tmux stores it
+* without interpreting it, it survives a window rename, and `list-windows` reads it back
+* (`#{@cm_tab}`). Named here rather than spelled at each use so the write side and every read side
+* cannot drift.
+*/
+const TMUX_TAB_NAME_OPTION = "@cm_tab";
+/** tmux backend — detected via `$TMUX`. */
+const tmuxMuxAdapter = {
+	name: "tmux",
+	canSizeSplits: true,
+	/**
+	* `new-pane` opens a floating pane — tmux 3.7's own new command ("Add floating panes. These are
+	* panes which sit above the layout ('tiled panes') like popups but unlike popups are not modal and
+	* behave like panes", CHANGES 3.6b → 3.7), bound to `*` by default.
+	*
+	* Declared UNCONDITIONALLY rather than probed off `tmux -V`, and that is deliberate: this adapter
+	* takes no version reading anywhere (its `-l`, `-e` and `@`-option paths are all declared the same
+	* way), and a version probe would cost an exec on every resolution to pre-empt a failure tmux
+	* already reports precisely. On tmux ≤ 3.6 the command does not exist and `new-pane` fails with
+	* tmux's own `unknown command` — surfaced by the `withReason` throw in `open`, which names the
+	* command that failed. A silent wrong-pane is the failure mode worth engineering against, and this
+	* has none: there is nothing for an absent `new-pane` to be mistaken for.
+	*
+	* Both sides of this placement are now pinned against a real 3.7c binary — the read side by
+	* `#{pane_floating_flag}`, the create side by the `new-pane` rows in `mux.tmux.integration.test.ts`.
+	* The branch below was originally written off tmux's CHANGES file, because the tmux installed when
+	* it landed was 3.6b and had no `new-pane` to run it against.
+	*/
+	canFloatPanes: true,
+	/**
+	* Every route passes `-d`, so no open moves the attached client. tmux is the backend where this
+	* cost the most to make true: `-d` was already on `new-window`, but `split-window` and `new-pane`
+	* were issuing it nowhere, and both ACTIVATE what they create. Measured on 3.7c rather than read
+	* off the man page — a bare `split-window` in a session focused on %0 left %1 active, and a bare
+	* `new-pane` did the same for the float; with `-d` each left focus on %0 and still printed the new
+	* id through `-P -F`. So the flag costs the id report nothing, which is what makes it free to add.
+	*
+	* There is no focus move to undo on top of that, unlike zellij: `-t` targets the pane to split
+	* directly, so tmux never has to VISIT a pane to choose it.
+	*/
+	opensWithoutStealingFocus: true,
+	open(exec, opts) {
+		const at = opts.at ?? "tab";
+		const window = at === "workspace" || at === "tab";
+		const env = opts.env ? Object.entries(opts.env).flatMap(([k, v]) => ["-e", `${k}=${v}`]) : [];
+		const group = window && opts.workspaceGroup != null;
+		const format = "#{pane_id}	#{window_id}";
+		let args;
+		if (at === "pane:float") args = [
+			"new-pane",
+			"-d",
+			...opts.from ? ["-t", opts.from.id] : [],
+			...env,
+			"-c",
+			opts.cwd,
+			"-P",
+			"-F",
+			format
+		];
+		else if (window) args = [
+			"new-window",
+			"-d",
+			...env,
+			"-c",
+			opts.cwd,
+			"-P",
+			"-F",
+			format
+		];
+		else {
+			const from = opts.from ? ["-t", opts.from.id] : [];
+			const size = opts.ratio != null ? ["-l", toTmuxSize(opts.ratio)] : [];
+			args = [
+				"split-window",
+				"-d",
+				at === "pane:down" ? "-v" : "-h",
+				...from,
+				...size,
+				...env,
+				"-c",
+				opts.cwd,
+				"-P",
+				"-F",
+				format
+			];
+		}
+		if (window && opts.label) args.splice(1, 0, "-n", opts.label);
+		const out = exec("tmux", args);
+		if (!out) throw new Error(withReason(exec, `tmux ${args[0]} failed`));
+		const [pane, windowId] = splitOpenReport(out, args[0]);
+		const target = {
+			id: pane,
+			tab: windowId
+		};
+		if (group && windowId) tmuxMuxAdapter.group(exec, { id: windowId }, opts.workspaceGroup);
+		if (!window && opts.label) tmuxMuxAdapter.rename(exec, target, "pane", opts.label);
+		if (opts.launch) tmuxMuxAdapter.submit(exec, target, opts.launch);
+		return target;
+	},
+	rename(exec, target, tier, name) {
+		if (tier === "tab") {
+			exec("tmux", [
+				"rename-window",
+				"-t",
+				target.id,
+				name
+			]);
+			return;
+		}
+		exec("tmux", [
+			"select-pane",
+			"-t",
+			target.id,
+			"-T",
+			name
+		]);
+	},
+	group(exec, target, group, name) {
+		exec("tmux", [
+			"set-option",
+			"-w",
+			"-t",
+			target.id,
+			TMUX_WORKSPACE_GROUP_OPTION,
+			group
+		]);
+		if (name !== void 0) exec("tmux", [
+			"set-option",
+			"-w",
+			"-t",
+			target.id,
+			TMUX_TAB_NAME_OPTION,
+			name
+		]);
+	},
+	sendText(exec, target, text) {
+		exec("tmux", [
+			"send-keys",
+			"-t",
+			target.id,
+			"-l",
+			text
+		]);
+	},
+	sendKeys(exec, target, keys) {
+		exec("tmux", [
+			"send-keys",
+			"-t",
+			target.id,
+			...keys.map(toTmuxKey)
+		]);
+	},
+	submit(exec, target, text) {
+		if (!text) {
+			exec("tmux", [
+				"send-keys",
+				"-t",
+				target.id,
+				"Enter"
+			]);
+			return;
+		}
+		tmuxMuxAdapter.sendText(exec, target, text);
+		exec("tmux", [
+			"send-keys",
+			"-t",
+			target.id,
+			"Enter"
+		]);
+	},
+	read(exec, target, opts) {
+		const text = capturePane(exec, target, opts?.lines);
+		if (!opts?.truncation) return { text };
+		if (opts.lines === "all") return {
+			text,
+			truncated: false
+		};
+		return {
+			text,
+			truncated: isReadTruncated(text, capturePane(exec, target, (opts.lines ?? 0) + 1))
+		};
+	},
+	waitForOutput(exec, target, opts) {
+		return pollForOutput(tmuxMuxAdapter, exec, target, opts);
+	},
+	focus(exec, target) {
+		const { sessionName, windowId } = parsePaneLocation(exec("tmux", [
+			"list-panes",
+			"-a",
+			"-F",
+			"#{pane_id} #{session_name} #{window_id}"
+		]), target.id);
+		exec("tmux", [
+			"switch-client",
+			"-t",
+			sessionName
+		]);
+		exec("tmux", [
+			"select-window",
+			"-t",
+			windowId
+		]);
+		exec("tmux", [
+			"select-pane",
+			"-t",
+			target.id
+		]);
+	},
+	teardown(exec, target) {
+		exec("tmux", [
+			"kill-pane",
+			"-t",
+			target.id
+		]);
+	},
+	paneExists(exec, target) {
+		if (exec("tmux", [
+			"has-session",
+			"-t",
+			target.id
+		]) !== null) return true;
+		return (exec("tmux", [
+			"list-panes",
+			"-a",
+			"-F",
+			"#{pane_id}"
+		]) ?? "").split("\n").includes(target.id);
+	},
+	isPaneFocused(exec, target) {
+		const out = exec("tmux", [
+			"list-panes",
+			"-a",
+			"-F",
+			"#{pane_id} #{pane_active} #{window_active} #{session_attached}"
+		]);
+		if (!out) return void 0;
+		const line = out.split("\n").find((l) => l.split(" ")[0] === target.id);
+		if (!line) return void 0;
+		const [, paneActive, windowActive, sessionAttached] = line.split(" ");
+		return paneActive === "1" && windowActive === "1" && sessionAttached !== "0" && sessionAttached !== void 0;
+	},
+	/**
+	* Tab-separated, not space — the same rule `describeTmuxRegion` follows, and for the same reason:
+	* `pane_current_path` and `pane_title` can both contain spaces. The old space-separated format
+	* recovered the cwd by rejoining everything after the command, which works only while the cwd is
+	* the LAST field. A label is a human's and may hold anything, so appending one to that format would
+	* make both fields unrecoverable — `my worker` and `/repo/my dir` cannot be told apart by a space.
+	* A tab can appear in neither id nor command, and the two free-text fields are separated by one.
+	*/
+	listPanes(exec) {
+		const out = exec("tmux", [
+			"list-panes",
+			"-a",
+			"-F",
+			"#{pane_id}	#{pane_current_command}	#{pane_current_path}	#{pane_title}	#{host}	#{pane_floating_flag}"
+		]);
+		if (!out) return [];
+		return out.split("\n").filter(Boolean).map((line) => {
+			const [id, , cwd, title, host, floating] = line.split("	");
+			const pane = {
+				id: id ?? "",
+				mux: "tmux",
+				floating: floating === "1"
+			};
+			if (cwd) pane.cwd = cwd;
+			const label = paneLabel(title, host);
+			if (label) pane.label = label;
+			return pane;
+		}).filter((p) => p.id !== "");
+	},
+	regions: {
+		describeRegion(exec, target) {
+			return describeTmuxRegion(exec, target.id);
+		},
+		/**
+		* `resize-pane -x/-y` in CELLS, never `-x <percent>`, and the difference is not cosmetic: tmux
+		* takes a percentage of the WINDOW, while the seam's `ratio` is a fraction of the pane's own
+		* SPLIT REGION. Those are the same number only in a two-pane window, so a nested layout would be
+		* sized against the wrong denominator — silently, and only for the users with more than one
+		* split. Cells computed from the rects tmux just reported are exact at every depth.
+		*
+		* Verified against a live tmux 3.7c (`mux.tmux.integration.test.ts`): `-x` sizes the target pane
+		* and its sibling absorbs the difference, `-y` does the same on a stacked split, and a resize
+		* inside a nested region leaves the outer divider where it was.
+		*/
+		resizePane(exec, target, ratio) {
+			const split = enclosingSplit(describeTmuxRegion(exec, target.id), target.id);
+			if (!split) throw new Error(`tmux pane ${target.id} is the only pane in its region — there is no split to resize`);
+			const flag = split.direction === "right" ? "-x" : "-y";
+			const cells = toTmuxResizeCells(split, ratio);
+			if (exec("tmux", [
+				"resize-pane",
+				"-t",
+				target.id,
+				flag,
+				String(cells)
+			]) === null) throw new Error(withReason(exec, `tmux could not resize pane ${target.id}`));
+		},
+		/**
+		* tmux has NO workspace tier — `workspace` and `tab` both collapse onto a Window — so a workspace
+		* is not a fact this backend holds. What it holds is the grouping TAG the walk wrote
+		* (`MuxOpenOptions.workspaceGroup`, stored in a window user option), so the read here is
+		* literally *"which windows carry this group id"*.
+		*
+		* The tag, never the label. `list-windows -a` spans SESSIONS, so a bare name match would
+		* over-collect a same-named window from another session, and taking the workspace off a
+		* `<workspace> - <tab>` label is unsound in the first place (`acme - beta - main` splits two ways,
+		* both legal). `-f '#{==:#{@cm_ws},<id>}'` keys on what actually identifies the group, filtered
+		* server-side — the tag survives a window rename, which a name-encoded grouping does not.
+		*
+		* A window with NO tag is a workspace of ONE: the honest answer for a window nobody grouped, and
+		* it costs no further call — the caller's own window is the whole workspace.
+		*/
+		describeWorkspace(exec, target) {
+			const out = exec("tmux", [
+				"display-message",
+				"-p",
+				"-t",
+				target.id,
+				`#{window_id}\t#{${TMUX_WORKSPACE_GROUP_OPTION}}\t#{${TMUX_TAB_NAME_OPTION}}\t#{window_name}`
+			]);
+			if (!out) throw new Error(withReason(exec, `tmux could not resolve the workspace around pane ${target.id}`));
+			const [windowId, group, ownName, ...nameParts] = out.split("\n")[0].split("	");
+			if (!windowId) throw new Error(`tmux did not report the window around pane ${target.id}`);
+			if (!group) return [tmuxTab(exec, windowId, ownName, nameParts.join("	"))];
+			const listed = exec("tmux", [
+				"list-windows",
+				"-a",
+				"-F",
+				`#{window_id}\t#{${TMUX_TAB_NAME_OPTION}}\t#{window_name}`,
+				"-f",
+				`#{==:#{${TMUX_WORKSPACE_GROUP_OPTION}},${group}}`
+			]);
+			if (!listed) throw new Error(withReason(exec, `tmux could not enumerate the windows grouped as ${group}`));
+			const tabs = listed.split("\n").filter(Boolean).map((line) => line.split("	")).filter(([id]) => Boolean(id)).map(([id, own, ...rest]) => tmuxTab(exec, id, own, rest.join("	")));
+			if (tabs.length === 0) throw new Error(`tmux reported no windows grouped as ${group}`);
+			return tabs;
+		}
+	}
+};
+/**
+* One window, read as a tab: its id, the tab's OWN name, and its region's geometry.
+*
+* `ownName` is what `group` stored (`TMUX_TAB_NAME_OPTION`) and it WINS, because `windowName` is the
+* display name — on a grouped window that is the composed `pool - editor`, whose `editor` tmux's
+* single name field no longer holds. Reporting the display name instead would compound the prefix on
+* every capture/apply round trip (`pool - pool - editor`), and splitting it back apart is the unsound
+* parse the option exists to refuse.
+*
+* The window name is the FALLBACK, not a second guess: a window carrying no stored name is one nobody
+* composed a display name for, so its name already IS its own name. That covers the untagged window —
+* a workspace of one — and any window a caller grouped without naming.
+*/
+function tmuxTab(exec, windowId, ownName, windowName) {
+	const tab = {
+		id: windowId,
+		panes: describeTmuxRegion(exec, windowId)
+	};
+	const label = ownName || windowName;
+	if (label) tab.label = label;
+	return tab;
+}
+/**
+* Every pane of the region `id` names, with its rectangle. `id` is a pane id (that pane's own window)
+* or a window id (that window) — `list-panes -t` resolves both, which is what lets the region read and
+* the workspace read share one query instead of two that could drift apart.
+*
+* `-t` scopes `list-panes` to ONE window — the region tier, which is what capture captures. Without
+* `-a`, so this never reaches the panes of some other window.
+*
+* `#{pane_left}`/`#{pane_top}` are window-relative, and the widths exclude the divider column tmux
+* draws between panes (a 200-wide window split side by side reports 119 + 80, not 200) — both are
+* exactly what `RegionPane.rect` documents, so nothing is adjusted here.
+*
+* Tab-separated, not space: `pane_current_path` and `pane_title` can both contain spaces, and
+* splitting a path on spaces is how a directory with one in it silently becomes the wrong pane.
+*/
+function describeTmuxRegion(exec, id) {
+	const out = exec("tmux", [
+		"list-panes",
+		"-t",
+		id,
+		"-F",
+		"#{pane_id}	#{pane_left}	#{pane_top}	#{pane_width}	#{pane_height}	#{pane_current_path}	#{pane_title}	#{host}"
+	]);
+	if (!out) throw new Error(withReason(exec, `tmux could not describe the region around pane ${id}`));
+	const panes = [];
+	for (const line of out.split("\n").filter(Boolean)) {
+		const [paneId, left, top, width, height, cwd, title, host] = line.split("	");
+		if (!paneId) continue;
+		const pane = {
+			id: paneId,
+			rect: {
+				x: Number(left),
+				y: Number(top),
+				width: Number(width),
+				height: Number(height)
+			}
+		};
+		if (cwd) pane.cwd = cwd;
+		const label = paneLabel(title, host);
+		if (label) pane.label = label;
+		panes.push(pane);
+	}
+	if (panes.length === 0) throw new Error(`tmux reported no panes in the region around pane ${id}`);
+	return panes;
+}
+/**
+* A tmux pane's label — its title, unless that title is the hostname tmux handed it.
+*
+* **tmux has no "unset title"**: it defaults `pane_title` to the hostname, so a pane nobody ever named
+* reports a name nobody chose, and every pane in an untouched session reports the SAME one. Exporting
+* that would label them all `zeta`, and `zeta` would then resolve to every pane in the session —
+* ambiguity manufactured out of nothing. A title that differs from the host is one someone set
+* (cyber-mux's own `select-pane -T` among them), so it is the author's and survives.
+*
+* One home for the rule, called by BOTH reads — `listPanes` (which a name resolves against) and
+* `describeTmuxRegion` (which a capture exports). Two spellings of a heuristic this load-bearing is
+* how the listing and the capture come to disagree about which panes are named.
+*
+* The comparison is the workaround, not the shape of the thing: herdr has the honest primitive and
+* omits the key outright until a pane is renamed, so it needs no rule at all.
+*/
+function paneLabel(title, host) {
+	return title && title !== host ? title : void 0;
+}
+/**
+* The `-P -F '#{pane_id}\t#{window_id}'` report EVERY open asks for, split back into its two ids.
+* Tab-separated because neither id can contain a tab.
+*
+* A report that does not carry both throws rather than returning half an answer: the window is the
+* pane's tab, which `OpenedPane.tab` promises is always present, and it is also what a grouping open
+* tags. Guessing either would be worse than failing — a caller would name or group nothing and never
+* learn it.
+*/
+function splitOpenReport(out, command) {
+	const [pane, windowId] = out.split("	");
+	if (!pane || !windowId) throw new Error(`tmux ${command} did not report the new pane's id and window id`);
+	return [pane, windowId];
+}
+/**
+* The seam's `ratio` as the CELL count `resize-pane -x/-y` wants for the target pane.
+*
+* Computed through the SECOND side rather than the target directly, because that is the definition
+* `ratioOf` (`region-tree.ts`) reads a live split back with, and a write that used the other formula
+* would not round-trip: tmux eats a column for the divider, so `first / (first + second)` and
+* `1 - second / total` disagree by exactly that column. Going through the second side means a region
+* described at 0.6 and resized to 0.6 is a no-op, which is the property a caller restoring a drifted
+* layout depends on.
+*
+* The divider is MEASURED (`extent - targetExtent - otherExtent`) rather than assumed to be one
+* column: it is the same arithmetic on a backend that draws no divider, so nothing here is tmux-shaped
+* beyond the flag it renders into.
+*/
+function toTmuxResizeCells(split, ratio) {
+	assertRatioInRange(ratio);
+	const second = Math.round((split.targetIsFirst ? 1 - ratio : ratio) * split.extent);
+	if (!split.targetIsFirst) return second;
+	const divider = split.extent - split.targetExtent - split.otherExtent;
+	return split.extent - divider - second;
+}
+/**
+* `ratio` is the fraction kept by the ORIGINAL pane; tmux's `-l` sizes the NEW one. So this INVERTS
+* — `1 - ratio` — where herdr's `--ratio` passes the same number through untouched. The two backends
+* genuinely convert in opposite directions, and applying the inversion to both (or to neither) is
+* the way this gets silently backwards: a 0.333 template would size the original pane at 67%.
+*
+* Percent rather than cells: tmux takes `-l` as either, and a percentage is the only form that means
+* the same thing without first querying the region's size.
+*/
+function toTmuxSize(ratio) {
+	assertRatioInRange(ratio);
+	return `${Math.round((1 - ratio) * 100)}%`;
+}
+/**
+* The core vocabulary's tmux spelling. Exactly one member differs — probed, not read off tmux(1):
+* tmux has no `Backspace` key name, so it would *type* the word (its unrecognized-token fallback);
+* its name for that key is `BSpace` (tmux(1): "the following special key names are accepted: Up,
+* Down, Left, Right, BSpace, BTab, DC ..."). Every other core key — `Up` `Down` `Left` `Right`
+* `Enter` `Escape` `Tab` `Space` `C-c` `F1`-`F12` — is already tmux's own name for it.
+*
+* Deliberately a rename table, NOT a validation table: a token outside the core is forwarded
+* verbatim (the contract), so this must not reject what it does not recognize. Keeping a full tmux
+* key list here would make the passthrough a second vocabulary to maintain.
+*/
+const TMUX_KEY_RENAMES = { Backspace: "BSpace" };
+/**
+* One spelling of the capture, taken by `read` for the snapshot AND for the one-row-deeper truncation
+* probe — so the two differ in exactly the number they disagree about and nothing else. `lines`
+* omitted is tmux's own default window: the visible screen, with no `-S` at all.
+*/
+function capturePane(exec, target, lines) {
+	const args = [
+		"capture-pane",
+		"-p",
+		"-t",
+		target.id
+	];
+	if (lines === "all") args.push("-S", "-");
+	else if (lines != null) args.push("-S", `-${lines}`);
+	return exec("tmux", args) ?? "";
+}
+function toTmuxKey(key) {
+	return TMUX_KEY_RENAMES[key] ?? key;
+}
+/**
+* `tmux list-panes -a -F '#{pane_id} #{session_name} #{window_id}'` lists every pane server-wide.
+* Resolving fails — no line's pane id matches `id` — when the pane no longer exists in the backend,
+* and that must throw so `focus` never issues a switch-client/select-window against a pane it
+* couldn't actually resolve.
+*/
+function parsePaneLocation(out, id) {
+	const line = (out ?? "").split("\n").find((l) => l.split(" ")[0] === id);
+	if (!line) throw new Error(`peer's pane ${id} could not be resolved to beam to`);
+	const [, sessionName, windowId] = line.split(" ");
+	return {
+		sessionName,
+		windowId
+	};
+}
+//#endregion
+//#region src/new-id.ts
+/** The real id source — a v4 UUID. The shell binds this; core takes `NewId` as a parameter. */
+const nodeNewId = () => randomUUID();
+//#endregion
+//#region src/mux.wezterm.ts
+/**
+* WezTerm backend — detected via `$WEZTERM_PANE`. Drives WezTerm's built-in multiplexer through
+* `wezterm cli …` (https://wezterm.org/cli/general.html), the same synchronous-CLI shape tmux and
+* herdr already give `Exec`.
+*
+* Probed from `wezterm cli --help`/the CLI reference docs only — there is no live WezTerm GUI in
+* this sandbox, so nothing here carries the "verified against a live binary" claim `session.tmux.ts`
+* and `session.herdr.ts` make. Several real capability gaps fell out of that probe, not just missing
+* polish:
+*
+* - **No `--env` on `spawn`/`split-pane` at all.** Unlike herdr (native everywhere except one
+*   worktree route), WezTerm's CLI has no env flag on ANY space-creating command — every route is
+*   the exception, so `open`'s env always rides the `envFallback` compensation (a `env K=V` prefix
+*   on the launch command, or a stderr warning with none to ride), never a native flag.
+* - **No way to title a PANE**, at birth or after — `set-tab-title`/`set-window-title` exist, there
+*   is no pane equivalent. `rename(..., 'pane', …)` throws; `open`'s pane-tier `label` degrades to a
+*   stderr warning rather than silently dropping it or failing the whole open.
+* - **No focus-query primitive** — `list --format json`'s documented fields carry no active/focused
+*   indicator for a pane, tab, or window. `isPaneFocused` always answers `undefined`, which is the
+*   seam's own honest answer for "no primitive to report focus", not a workaround.
+* - **No per-key press primitive** — there is no `send-keys`-shaped verb, only `send-text`. The core
+*   vocabulary is instead realized by encoding each key as its raw terminal byte sequence and typing
+*   it via `send-text --no-paste`; see `WEZTERM_KEY_BYTES`.
+* - **No pane geometry** — `list --format json` reports a pane's `size` (rows/cols) but no position,
+*   so there is nothing to build a `PaneRect` from. `describeRegion`/`describeWorkspace` are omitted
+*   entirely, the same optional-omission `template save` already handles for a backend that cannot.
+* - **No git-worktree concept in the CLI at all** — no `worktree` subcommand, so like tmux this
+*   backend never binds one to a workspace; `worktree` is omitted.
+*
+* `spawn`/`split-pane` report only the new pane's bare id — unlike tmux/herdr, which embed the tab
+* (and workspace) in the same `-F`/JSON envelope the pane id rides out on. So `OpenedPane.tab` costs
+* a follow-up `wezterm cli list --format json` lookup here, not a free read of output already held.
+*/
+/**
+* Build the WezTerm adapter over its injected effects. The only effect it takes is `newId` — the id
+* source for the fresh workspace name minted when the caller opens a `workspace` without a `label`.
+* Exported as a factory (with `weztermMuxAdapter` binding the real one below) so a test can inject a
+* deterministic id instead of a UUID, exactly the seam `Exec`/`TemplateStore` already are.
+*/
+function createWeztermAdapter(deps) {
+	const adapter = {
+		name: "wezterm",
+		canSizeSplits: true,
+		/**
+		* `false`: WezTerm's CLI documents no suppress-focus flag on any creating verb — neither
+		* `cli spawn` (which opens a tab or a window) nor `cli split-pane` — and both activate what they
+		* create. So every open moves the user, and this says so rather than pretending otherwise.
+		*
+		* There is nothing to emulate it with. Re-activating the caller's pane afterward would be a
+		* `cli activate-pane` — a second visible focus move, landing the user back where they started
+		* after a visible detour — which is worse than the honest `false`, not better.
+		*
+		* Read off the WezTerm CLI reference, NOT verified against a live binary: there is no wezterm on
+		* the machine this was written on, the same disclaimer the rest of this header carries.
+		*/
+		opensWithoutStealingFocus: false,
+		open(exec, opts) {
+			const at = opts.at ?? "tab";
+			if (at === "workspace") {
+				const workspace = opts.label ?? `cyber-mux-${deps.newId().slice(0, 8)}`;
+				const out = exec("wezterm", [
+					"cli",
+					"spawn",
+					"--new-window",
+					"--workspace",
+					workspace,
+					"--cwd",
+					opts.cwd
+				]);
+				if (!out) throw new Error(withReason(exec, "wezterm cli spawn --new-window failed"));
+				const pane = out.trim();
+				if (!pane) throw new Error("wezterm cli spawn --new-window did not report the new pane id");
+				const opened = {
+					id: pane,
+					tab: resolveTab(exec, pane),
+					workspace
+				};
+				runLaunch$1(adapter, exec, opened, opts.env, opts.launch);
+				return opened;
+			}
+			if (at === "tab") {
+				const out = exec("wezterm", [
+					"cli",
+					"spawn",
+					...opts.within ? ["--window-id", resolveWorkspaceWindow(exec, opts.within)] : [],
+					"--cwd",
+					opts.cwd
+				]);
+				if (!out) throw new Error(withReason(exec, "wezterm cli spawn failed"));
+				const pane = out.trim();
+				if (!pane) throw new Error("wezterm cli spawn did not report the new pane id");
+				const opened = withTabAndWorkspace(exec, pane);
+				if (opts.label) adapter.rename(exec, { id: opened.tab }, "tab", opts.label);
+				runLaunch$1(adapter, exec, opened, opts.env, opts.launch);
+				return opened;
+			}
+			if (at === "pane:float") refuseFloatingPane(adapter.name);
+			const direction = at === "pane:down" ? ["--bottom"] : ["--right"];
+			const from = opts.from ? ["--pane-id", opts.from.id] : [];
+			const size = opts.ratio != null ? ["--percent", toWeztermSize(opts.ratio)] : [];
+			const out = exec("wezterm", [
+				"cli",
+				"split-pane",
+				...direction,
+				...from,
+				...size,
+				"--cwd",
+				opts.cwd
+			]);
+			if (!out) throw new Error(withReason(exec, "wezterm cli split-pane failed"));
+			const pane = out.trim();
+			if (!pane) throw new Error("wezterm cli split-pane did not report the new pane id");
+			const opened = withTabAndWorkspace(exec, pane);
+			if (opts.label) process.stderr.write(`wezterm cannot name a pane — "${opts.label}" was not set on pane ${opened.id}\n`);
+			runLaunch$1(adapter, exec, opened, opts.env, opts.launch);
+			return opened;
+		},
+		rename(exec, target, tier, name) {
+			if (tier === "tab") {
+				exec("wezterm", [
+					"cli",
+					"set-tab-title",
+					"--tab-id",
+					target.id,
+					name
+				]);
+				return;
+			}
+			throw new Error(`wezterm cannot name a pane (only a tab or window) — asked to rename ${target.id}`);
+		},
+		group() {},
+		sendText(exec, target, text) {
+			exec("wezterm", [
+				"cli",
+				"send-text",
+				"--pane-id",
+				target.id,
+				text
+			]);
+		},
+		sendKeys(exec, target, keys) {
+			const bytes = keys.map((k) => WEZTERM_KEY_BYTES[k] ?? k).join("");
+			exec("wezterm", [
+				"cli",
+				"send-text",
+				"--pane-id",
+				target.id,
+				"--no-paste",
+				bytes
+			]);
+		},
+		submit(exec, target, text) {
+			if (!text) {
+				adapter.sendKeys(exec, target, ["Enter"]);
+				return;
+			}
+			adapter.sendText(exec, target, text);
+			adapter.sendKeys(exec, target, ["Enter"]);
+		},
+		read(exec, target, opts) {
+			const text = getText(exec, target, opts?.lines);
+			if (!opts?.truncation) return { text };
+			if (opts.lines === "all") return {
+				text,
+				truncated: false
+			};
+			return {
+				text,
+				truncated: isReadTruncated(text, getText(exec, target, (opts.lines ?? 0) + 1))
+			};
+		},
+		waitForOutput(exec, target, opts) {
+			return pollForOutput(adapter, exec, target, opts);
+		},
+		focus(exec, target) {
+			exec("wezterm", [
+				"cli",
+				"activate-pane",
+				"--pane-id",
+				target.id
+			]);
+		},
+		teardown(exec, target) {
+			exec("wezterm", [
+				"cli",
+				"kill-pane",
+				"--pane-id",
+				target.id
+			]);
+		},
+		paneExists(exec, target) {
+			return listWeztermPanes(exec).some((p) => String(p.pane_id) === target.id);
+		},
+		isPaneFocused() {},
+		listPanes(exec) {
+			return listWeztermPanes(exec).map((p) => {
+				const pane = {
+					id: String(p.pane_id),
+					mux: "wezterm",
+					floating: false
+				};
+				const cwd = weztermCwd(p.cwd);
+				if (cwd) pane.cwd = cwd;
+				return pane;
+			});
+		}
+	};
+	return adapter;
+}
+const weztermMuxAdapter = createWeztermAdapter({ newId: nodeNewId });
+/**
+* `wezterm cli spawn`/`split-pane` report ONLY the new pane's bare id on stdout — unlike tmux/herdr,
+* neither embeds the tab (or workspace) in that same output. So the tab this pane landed in is a
+* follow-up `list --format json` lookup rather than a free read of an envelope already held.
+* `OpenedPane.tab` is still required — every multiplexer has the Tab level — it simply costs more
+* here than the "no extra call" property tmux/herdr get to claim.
+*/
+function resolveTab(exec, pane) {
+	const found = listWeztermPanes(exec).find((p) => String(p.pane_id) === pane);
+	if (!found) throw new Error(`wezterm did not report a tab for the new pane ${pane}`);
+	return String(found.tab_id);
+}
+/**
+* A window of the named workspace — what `spawn --window-id` needs to place a tab in a workspace
+* WezTerm's CLI cannot target directly (`--workspace` only names the space a `--new-window` spawn
+* creates, so it cannot place a tab in an existing one).
+*
+* Throws rather than falling back to an untargeted spawn: an unresolvable anchor means the workspace
+* is gone, and the untargeted spawn is exactly the wrong-space bug `within` was added to close.
+*/
+function resolveWorkspaceWindow(exec, workspace) {
+	const found = listWeztermPanes(exec).find((p) => p.workspace === workspace);
+	if (!found) throw new Error(`wezterm reported no window in workspace ${workspace} to open a tab in`);
+	return String(found.window_id);
+}
+/** `resolveTab` plus the workspace the same lookup already answers — one call serves both facts. */
+function withTabAndWorkspace(exec, pane) {
+	const found = listWeztermPanes(exec).find((p) => String(p.pane_id) === pane);
+	if (!found) throw new Error(`wezterm did not report a tab for the new pane ${pane}`);
+	return {
+		id: pane,
+		tab: String(found.tab_id),
+		workspace: found.workspace
+	};
+}
+/**
+* Env is native at NO tier on this backend — `spawn`/`split-pane` take no `--env` at all, unlike
+* herdr (native everywhere but one worktree route). So every `open` funnels through the same
+* fallback herdr's worktree route uses: with a launch command, env rides in as an `env K=V` prefix;
+* with none, a warning names what did not land. `envFallback` is a no-op when there is no env to
+* carry, so this is safe to call unconditionally.
+*/
+function runLaunch$1(adapter, exec, target, env, launch) {
+	const fallback = envFallback(env, launch);
+	if (fallback.kind === "dropped") {
+		process.stderr.write(`env (${fallback.variables.join(", ")}) could not be set on this wezterm pane — wezterm has no --env flag on any space-creating command
+`);
+		return;
+	}
+	if (fallback.command !== void 0) adapter.submit(exec, target, fallback.command);
+}
+/** One `wezterm cli list --format json` call, parsed defensively — never throws on bad output. */
+function listWeztermPanes(exec) {
+	const out = exec("wezterm", [
+		"cli",
+		"list",
+		"--format",
+		"json"
+	]);
+	if (!out) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse(out);
+	} catch {
+		return [];
+	}
+	if (!Array.isArray(parsed)) return [];
+	return parsed.filter((p) => p != null && p.pane_id != null && p.tab_id != null && p.window_id != null);
+}
+/** `cwd` is reported as a `file://` URI; strip the scheme and host down to the bare path. */
+function weztermCwd(cwd) {
+	if (!cwd) return void 0;
+	const match = /^file:\/\/[^/]*(\/.*)$/.exec(cwd);
+	return match ? decodeURIComponent(match[1]) : cwd;
+}
+/**
+* `ratio` is the fraction kept by the ORIGINAL pane; `--percent` sizes the NEW one (the issue's own
+* probe note, #47) — the same inversion tmux's `-l` needs, unlike herdr's pass-through.
+*/
+function toWeztermSize(ratio) {
+	assertRatioInRange(ratio);
+	return String(Math.round((1 - ratio) * 100));
+}
+/**
+* The core vocabulary, realized as raw terminal bytes rather than a backend key NAME — there is no
+* send-keys-shaped verb to name a key TO, only `send-text`. Escape sequences are the ANSI/VT100
+* "cursor key mode" forms every common shell/program already parses; `Backspace` sends DEL (`\x7f`),
+* what most terminals emit for that key today (probed, not read off any wezterm spec — wezterm ships
+* no such table because it has no key-name CLI surface to spec).
+*
+* `Home`/`End`/`Delete`/`Insert`/`PageUp`/`PageDown` are extras beyond the core, included for the
+* same reason tmux "knows" `Home` even though the core vocabulary does not name it: these are
+* standard-enough ANSI keys that encoding them costs nothing extra and a caller reaching for one
+* should not silently get the literal word typed instead.
+*/
+const WEZTERM_KEY_BYTES = {
+	Up: "\x1B[A",
+	Down: "\x1B[B",
+	Right: "\x1B[C",
+	Left: "\x1B[D",
+	Enter: "\r",
+	Escape: "\x1B",
+	Tab: "	",
+	Space: " ",
+	Backspace: "",
+	"C-c": "",
+	F1: "\x1BOP",
+	F2: "\x1BOQ",
+	F3: "\x1BOR",
+	F4: "\x1BOS",
+	F5: "\x1B[15~",
+	F6: "\x1B[17~",
+	F7: "\x1B[18~",
+	F8: "\x1B[19~",
+	F9: "\x1B[20~",
+	F10: "\x1B[21~",
+	F11: "\x1B[23~",
+	F12: "\x1B[24~",
+	Home: "\x1B[H",
+	End: "\x1B[F",
+	Delete: "\x1B[3~",
+	Insert: "\x1B[2~",
+	PageUp: "\x1B[5~",
+	PageDown: "\x1B[6~"
+};
+/**
+* One spelling of the capture, taken by `read` for the snapshot AND for its one-row-deeper truncation
+* probe, so the two differ only in the number they are meant to disagree about.
+*
+* `--start-line` counts backward into scrollback from 0 (the top of the visible screen); the end
+* defaults to the bottom of the screen. Negative-N approximates "last N lines" the way tmux's `-S -N`
+* does, though the two are not guaranteed to line up cell-for-cell. `lines` omitted is WezTerm's own
+* default window — the visible screen, with no `--start-line` at all.
+*/
+function getText(exec, target, lines) {
+	const args = [
+		"cli",
+		"get-text",
+		"--pane-id",
+		target.id
+	];
+	const start = lines === "all" ? FULL_SCROLLBACK_LINES : lines;
+	if (start != null) args.push("--start-line", String(-start));
+	return exec("wezterm", args) ?? "";
+}
+//#endregion
+//#region src/mux.zellij.ts
+/**
+* Zellij backend — detected via `$ZELLIJ`. Drives Zellij's built-in multiplexer through `zellij
+* action …` (https://zellij.dev/documentation/cli-actions), the same synchronous-CLI shape tmux,
+* herdr and wezterm already give `Exec`.
+*
+* Requires **Zellij ≥ 0.45.0**. The whole per-pane-addressable surface this adapter stands on landed
+* in 0.44.0 (2026-03-23): `--pane-id` across the action verbs, `list-panes --json`, ids returned from
+* `new-pane`/`new-tab`, and `focus-pane-id` (0.44.1). Before that release Zellij's CLI was almost
+* entirely FOCUS-relative — no stable per-pane handle — and no faithful adapter was possible. On an
+* older binary these commands fail and the adapter surfaces the failure rather than silently
+* mis-targeting the focused pane.
+*
+* The floor moved from 0.44.1 to **0.45.0** (2026-08-20) for `--no-focus`, which is what lets this
+* backend answer `opensWithoutStealingFocus` at all. Raising it rather than keeping the old
+* focus-stealing path as a fallback, for four reasons that compound:
+*
+* - The seam member is a **static declaration**, like `canSizeSplits` and `canFloatPanes` — there is
+*   no runtime probe behind any of them. An adapter cannot declare `true` and then quietly degrade on
+*   an old binary without lying in precisely the way the declaration exists to prevent, and a
+*   conditional value has nowhere to live.
+* - Version-probing to decide would be a NEW behavior for this file, which reads no version anywhere,
+*   and would cost an exec on every open to pre-empt a failure zellij already reports precisely.
+* - A fallback would be a second code path that nothing here can ever exercise: there is no zellij on
+*   the machine this was written on, and the integration suite skips its rows without one (issue
+*   #125). Untested code guarding an untestable condition is a liability, not a safety net.
+* - The 0.44 failure is LOUD and creates nothing. Zellij's CLI parses in clap's strict mode (the
+*   v0.45.0 tree sets no `ignore_errors`, `allow_hyphen_values`, `allow_external_subcommands`, or
+*   `trailing_var_arg` anywhere in `zellij-utils/src/cli.rs`), so an unknown `--no-focus` is a parse
+*   error on stderr and a nonzero exit — surfaced by the `withReason` throw in `open`, which names the
+*   command. There is no silent wrong-pane for it to become, which is the one failure mode worth
+*   engineering against. tmux sets this precedent exactly: `new-pane` is declared unconditionally and
+*   an older binary fails with tmux's own `unknown command`.
+*
+* **The 0.45.0 surface is UNVERIFIED against a running binary** — read out of the v0.45.0 source tree
+* (`zellij-utils/src/cli.rs`, `zellij-server/src/route.rs`), not driven. Everything below attributed
+* to 0.44.3 was driven, and stays driven; the two claims are kept apart on purpose.
+*
+* Originally probed from the Zellij docs + CHANGELOG alone; now **driven against a live 0.44.3
+* binary** by `mux.zellij.integration.test.ts`, so the command shapes below carry the same
+* verified-against-a-real-binary claim `session.tmux.ts`/`session.herdr.ts` make. What the live probe
+* changed, and what a doc probe could not have known:
+*
+* - The id forms are confirmed and asymmetric: `new-pane` prints the PREFIXED `terminal_N`, while
+*   `list-panes --json` reports `id` as a BARE integer. `samePane` is what makes those the same pane,
+*   so it is load-bearing rather than defensive.
+* - That bare integer is NOT unique: a live session reports `id: 0` for both its suppressed
+*   `zellij:link` PLUGIN pane and its first terminal pane. The number is unique only within a kind,
+*   and `is_plugin` is what says which kind — so `listZellijPanes` qualifies every bare id to
+*   `terminal_N`/`plugin_N` before anything compares or reports it. Both prefixed forms are what
+*   `--pane-id` itself accepts, and a bare `N` addresses the TERMINAL pane (verified: renaming
+*   `--pane-id 3` renames terminal 3 and leaves plugin 3 alone), which is exactly the fold
+*   `normalizePaneId` makes.
+* - Which `list-panes --json` field names are real, and what each one carries. The label guard reads
+*   `terminal_command`, not `pane_command` — a doc probe had that one backwards; see `ZellijPane`.
+*   `pane_cwd` and `pane_command` are real too, and both are present ONLY on a terminal pane: a
+*   plugin pane's record omits the keys entirely, which is how a probe that sampled one concluded
+*   the fields did not exist at all. That is the failure mode of a doc probe, and the reason this
+*   file now has a suite.
+* - `new-pane --direction` requires an attached client focused on a TERMINAL pane, and fails
+*   SILENTLY without one — it prints a plausible new pane id and exits 0 having created nothing.
+*   Re-probed against 0.44.3 with the client parked on zellij's own release-notes PLUGIN pane, which
+*   is where a fresh attach lands: the split printed `terminal_2`, exited 0, and the pane count did
+*   not move. `open()` does not propagate that phantom — see `openedForPane`, which now believes a
+*   reported id only where it names a pane that was NOT already standing.
+* - **A `zellij action` reply can be delivered to the WRONG command**, and **a session no client has
+*   ever attached to reports `list-panes --json` as an empty ARRAY** rather than as an error. Both
+*   are the reason this file retries a listing instead of reading one empty answer as the truth; see
+*   `LIST_PANES_ATTEMPTS` for the repro behind the first and `mux.zellij.integration.test.ts`'s
+*   readiness gate for the second. So the older claim that every verb but `--direction` works against
+*   a client-less session is wrong: the listing is silent there, and everything in this file that
+*   resolves an id reads the listing.
+*
+* Real capability shape that fell out of the probe:
+*
+* - **The session is the workspace tier, but a SEPARATE session's panes are un-addressable through
+*   this seam.** Zellij's native tiers are Session › Tab › Pane, so a `workspace` placement would
+*   naturally open a new session (`zellij attach --create-background`). But Zellij pane ids are
+*   SESSION-SCOPED — driving another session's pane requires `zellij --session <name> action …` — and
+*   `MuxTarget` carries only an opaque pane id, no session. A pane returned from a freshly-created
+*   session would therefore fail on the next `write`/`read`/`focus`, which is a trap, not a feature.
+*   So this adapter operates within the AMBIENT session: `workspace` collapses to a new **tab**, the
+*   same collapse tmux makes for a Window. Unlike tmux, the occupied workspace IS reported —
+*   `OpenedPane.workspace` carries the ambient session name (`deps.session`), because every pane
+*   genuinely lives in that session. (Lifting the collapse needs a seam change: a session qualifier
+*   on `MuxTarget`. Recorded in the ADR log.)
+* - **No `--env` on `new-pane`/`new-tab`.** Like wezterm, env is native at no tier, so every open
+*   rides the `envFallback` compensation (an `env K=V` prefix on the launch command, or a stderr
+*   warning when there is no command to ride).
+* - **Tiled splits cannot be sized.** `new-pane`'s `-x/-y/--width/--height` all require `--floating`;
+*   a tiled `pane:*` split is always even. So `canSizeSplits` is omitted and a `ratio` is dropped —
+*   callers degrade to the even default, the same path the flag's absence already documents.
+* - **`new-pane` has no split-TARGET flag.** It splits the focused pane (or the biggest space); the
+*   only flag is `--tab-id`. So `from` — which pane a `pane:*` split lands beside — is honored by
+*   FOCUSING that pane first, the sole way to choose the split target. That is still a real focus
+*   move; what changed in 0.45.0 is that it is now UNDONE, not that it stopped happening. See
+*   `opensWithoutStealingFocus`, and `open` for why `--no-focus` cannot be the answer on that path —
+*   it re-anchors the split on the ISSUING pane and would make the focus move pointless and the target
+*   wrong.
+* - **No pane geometry adapter.** `list-panes --json` does report `pane_x`/`pane_y`, so `regions`
+*   (`describeRegion`/`describeWorkspace`) is IMPLEMENTABLE here — unlike wezterm, which lacks
+*   position entirely — but the cell-vs-divider semantics of Zellij's rects need a live binary to pin,
+*   so it is deliberately left as a follow-up rather than guessed. `template save` refuses on zellij
+*   by naming the backend, the same optional-absence it already handles for wezterm.
+* - **No git-worktree concept in the CLI.** No `worktree` subcommand, so — like tmux and wezterm —
+*   this backend never binds one to a workspace; callers fall back to plain git plus `open()`.
+*
+* Wins Zellij has that wezterm does not: it CAN name a pane (`new-pane --name` / `rename-pane`), and
+* it CAN report which pane is focused (`list-panes --json`'s `is_focused`), so `isPaneFocused`
+* answers a real value rather than always `unknown`.
+*/
+/**
+* Build the Zellij adapter over its injected effects. The only effect it takes is `session` — the
+* ambient Zellij session name (`$ZELLIJ_SESSION_NAME`), reported as `OpenedPane.workspace` so a
+* caller learns which workspace a new pane landed in. Undefined when unknown (the exported singleton),
+* in which case `workspace` is simply omitted — the same absent-not-false convention the seam uses
+* elsewhere. Exported as a factory (with `zellijMuxAdapter` binding the effect-less one) so
+* `backend.ts` can bind the real session name off `env` at resolution, exactly the seam `Exec` and
+* wezterm's `newId` already are.
+*/
+function createZellijAdapter(deps) {
+	const adapter = {
+		name: "zellij",
+		canFloatPanes: true,
+		/**
+		* Every route this adapter can take ends with the caller's focus where it started, which is the
+		* end-state the seam declares — NOT "focus never moves at any instant", which zellij cannot offer
+		* on the one route that has to choose a split target. Two different mechanisms get there, and
+		* which one applies is decided by whether `from` was named:
+		*
+		* - **No target to choose** (`new-tab`, and `new-pane` with no `from`): `--no-focus`, and nothing
+		*   moves at all. Zellij 0.45.0's flag, on the verbs this adapter uses.
+		* - **A named `from`**: focus it, split it, then focus back to the pane that was focused before —
+		*   a real, visible round trip. `--no-focus` is deliberately NOT passed here; see `open`, where
+		*   passing it would silently split the WRONG pane.
+		*
+		* **Written blind, now driven in CI.** There is no zellij on the machine this was written on, so
+		* `--no-focus` was read out of the v0.45.0 source tree (`zellij-utils/src/cli.rs`, the
+		* `no_focus: bool` field on `CliAction::NewPane`/`NewTab`) rather than off a live `--help`. CI's
+		* live-backends job pins 0.45.0 and runs `mux.zellij.integration.test.ts` against it, where two
+		* rows assert the CLIENT does not move — one per mechanism above. That is the evidence for this
+		* boolean. A LOCAL run is not: the suite skips every row when no binary is present and still
+		* reports green (issue #125).
+		*/
+		opensWithoutStealingFocus: true,
+		open(exec, opts) {
+			const at = opts.at ?? "tab";
+			if (at === "tab" || at === "workspace") {
+				const args = [
+					"action",
+					"new-tab",
+					"--no-focus",
+					"--cwd",
+					opts.cwd
+				];
+				if (opts.label) args.push("--name", opts.label);
+				const before = paneIdSet(exec);
+				const out = exec("zellij", args);
+				if (out === null) throw new Error(withReason(exec, "zellij action new-tab failed"));
+				const opened = openedForTab(exec, out.trim(), before, deps.session);
+				runLaunch(adapter, exec, opened, opts.env, opts.launch);
+				return opened;
+			}
+			const before = paneIdSet(exec);
+			const restoreTo = opts.from ? clientPane(exec) : void 0;
+			if (opts.from) adapter.focus(exec, opts.from);
+			const placement = at === "pane:float" ? ["--floating"] : ["--direction", at === "pane:down" ? "down" : "right"];
+			const focusFlag = opts.from ? [] : ["--no-focus"];
+			const args = [
+				"action",
+				"new-pane",
+				...placement,
+				...focusFlag,
+				"--cwd",
+				opts.cwd
+			];
+			if (opts.label) args.push("--name", opts.label);
+			const out = exec("zellij", args);
+			if (out === null) throw new Error(withReason(exec, "zellij action new-pane failed"));
+			const opened = openedForPane(exec, out.trim(), before, deps.session);
+			if (restoreTo) exec("zellij", [
+				"action",
+				"focus-pane-id",
+				restoreTo
+			]);
+			runLaunch(adapter, exec, opened, opts.env, opts.launch);
+			return opened;
+		},
+		rename(exec, target, tier, name) {
+			if (tier === "tab") {
+				exec("zellij", [
+					"action",
+					"rename-tab-by-id",
+					target.id,
+					name
+				]);
+				return;
+			}
+			exec("zellij", [
+				"action",
+				"rename-pane",
+				"--pane-id",
+				target.id,
+				name
+			]);
+		},
+		group() {},
+		sendText(exec, target, text) {
+			exec("zellij", [
+				"action",
+				"write-chars",
+				"--pane-id",
+				target.id,
+				text
+			]);
+		},
+		sendKeys(exec, target, keys) {
+			exec("zellij", [
+				"action",
+				"send-keys",
+				"--pane-id",
+				target.id,
+				...keys.map(toZellijKey)
+			]);
+		},
+		submit(exec, target, text) {
+			if (!text) {
+				adapter.sendKeys(exec, target, ["Enter"]);
+				return;
+			}
+			adapter.sendText(exec, target, text);
+			adapter.sendKeys(exec, target, ["Enter"]);
+		},
+		read(exec, target, opts) {
+			if (opts?.lines === "all") {
+				const text = exec("zellij", [
+					"action",
+					"dump-screen",
+					"--pane-id",
+					target.id,
+					"--full"
+				]) ?? "";
+				return opts.truncation ? {
+					text,
+					truncated: false
+				} : { text };
+			}
+			if (opts?.lines != null) {
+				const full = exec("zellij", [
+					"action",
+					"dump-screen",
+					"--pane-id",
+					target.id,
+					"--full"
+				]) ?? "";
+				const text = lastLines(full, opts.lines);
+				return opts.truncation ? {
+					text,
+					truncated: isReadTruncated(text, full)
+				} : { text };
+			}
+			const text = exec("zellij", [
+				"action",
+				"dump-screen",
+				"--pane-id",
+				target.id
+			]) ?? "";
+			if (!opts?.truncation) return { text };
+			return {
+				text,
+				truncated: isReadTruncated(text, exec("zellij", [
+					"action",
+					"dump-screen",
+					"--pane-id",
+					target.id,
+					"--full"
+				]) ?? "")
+			};
+		},
+		waitForOutput(exec, target, opts) {
+			return pollForOutput(adapter, exec, target, opts);
+		},
+		focus(exec, target) {
+			exec("zellij", [
+				"action",
+				"focus-pane-id",
+				target.id
+			]);
+		},
+		teardown(exec, target) {
+			exec("zellij", [
+				"action",
+				"close-pane",
+				"--pane-id",
+				target.id
+			]);
+		},
+		paneExists(exec, target) {
+			return listZellijPanes(exec).some((p) => samePane(p.id, target.id));
+		},
+		isPaneFocused(exec, target) {
+			const found = listZellijPanes(exec).find((p) => samePane(p.id, target.id));
+			if (!found) return void 0;
+			return found.is_focused === true;
+		},
+		listPanes(exec) {
+			return listZellijPanes(exec).map((p) => {
+				const pane = {
+					id: p.id,
+					mux: "zellij",
+					floating: p.is_floating === true
+				};
+				if (p.pane_cwd) pane.cwd = p.pane_cwd;
+				const label = zellijLabel(p.title, p.terminal_command);
+				if (label) pane.label = label;
+				return pane;
+			});
+		}
+	};
+	return adapter;
+}
+const zellijMuxAdapter = createZellijAdapter({});
+/**
+* How many times a listing is re-asked before it is reported as empty, and how many times an open
+* re-looks for the pane it just made.
+*
+* Both exist for ONE verified defect in zellij 0.44.3's CLI, which no amount of adapter care can
+* prevent and every verb here rides on: **a `zellij action` reply can be delivered to the wrong
+* command.** Driven under CPU contention, a command exits 0 having printed NOTHING, and the reply it
+* should have received arrives on the stdout of the command issued after it. Reproduced by
+* alternating `new-tab` and `list-panes --json` 40 times on a loaded 2-core box — twice in 40, the
+* `new-tab` printed an empty string and the `list-panes` that followed it printed `27`. Two hundred
+* back-to-back `list-panes --json` calls with no mutating verb between them lost nothing, so it is
+* the mutating verbs that open the window.
+*
+* The consequences land squarely here. An empty reply to `list-panes --json` is not an empty session
+* — a live zellij session always has at least one pane — so reading it as one made every id
+* resolution in this file fail at once. And an id printed by `new-pane`/`new-tab` may belong to the
+* PREVIOUS command, so it can name a pane that has been standing all along.
+*
+* A retry is the honest remedy because the loss is per-call and independent: the same read reissued
+* answers. These are ceilings on a wedged server, not a wait that decides a pass.
+*
+* What a retry CANNOT reach, stated so a caller knows the edge: a misdelivered reply may also be a
+* valid pane array — an older one, which simply does not carry a pane opened since. Nothing in the
+* shape of that answer marks it stale, so `listPanes` cannot reject it and a single negative read
+* (`paneExists`, `isPaneFocused`) can be wrong. A caller that needs certainty on this backend re-asks;
+* `mux.zellij.integration.test.ts` does exactly that.
+*/
+const LIST_PANES_ATTEMPTS = 3;
+const OPEN_RESOLVE_ATTEMPTS = 10;
+/**
+* One `zellij action list-panes --json` read, parsed defensively — `undefined` for output that is not
+* a pane array, so a caller can tell "zellij did not answer" from "zellij answered, with no panes".
+* Every id is QUALIFIED on the way out (see `zellijPaneId`), so what this returns — and therefore
+* what `LivePane.id` carries and what `samePane` compares — names exactly one live pane.
+*/
+function readZellijPanes(exec) {
+	const out = exec("zellij", [
+		"action",
+		"list-panes",
+		"--json"
+	]);
+	if (!out) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(out);
+	} catch {
+		return;
+	}
+	if (!Array.isArray(parsed)) return void 0;
+	return parsed.filter((p) => p != null && p.id != null).map((p) => ({
+		...p,
+		id: zellijPaneId(p.id, p.is_plugin)
+	}));
+}
+/**
+* The id a listing record is reported under — qualified by KIND, because zellij's bare number is not
+* unique. Plugin panes and terminal panes are numbered in separate spaces, so a live session reports
+* `id: 0` for both its suppressed `zellij:link` plugin pane and its first terminal pane; reporting
+* both as `'0'` collapsed two genuinely different panes onto one `LivePane.id`, and every resolution
+* by id — `paneExists`, `isPaneFocused`, and `openedForPane`'s guard against a phantom `new-pane`
+* result — could then land on the wrong one.
+*
+* A bare integer therefore takes the `terminal_`/`plugin_` prefix its `is_plugin` names, which is the
+* form `new-pane` already prints and the form `--pane-id` accepts for BOTH kinds (verified against a
+* live 0.44.3). An id that already carries a prefix is left exactly as it is — this qualifies what
+* zellij left ambiguous, it does not rewrite what zellij spelled out.
+*
+* A record with no `is_plugin` at all is read as a terminal pane: that is the same answer
+* `normalizePaneId` gives a bare id, and the kind zellij's own bare-id addressing resolves to.
+*/
+function zellijPaneId(id, isPlugin) {
+	const raw = String(id);
+	if (!/^\d+$/.test(raw)) return raw;
+	return isPlugin === true ? `plugin_${raw}` : `terminal_${raw}`;
+}
+/**
+* The session's panes — never throws on bad output, and never reports a LOST reply as an empty
+* session. A read that did not come back as a pane array is simply re-asked (`LIST_PANES_ATTEMPTS`);
+* only a session that refuses every time answers `[]`, which is then a real answer rather than a
+* dropped one. See `LIST_PANES_ATTEMPTS` for the defect this stands in front of.
+*/
+function listZellijPanes(exec) {
+	for (let attempt = 1; attempt <= LIST_PANES_ATTEMPTS; attempt++) {
+		const panes = readZellijPanes(exec);
+		if (panes) return panes;
+	}
+	return [];
+}
+/**
+* The panes standing right now, keyed the way `samePane` compares them — an open's BEFORE side. A
+* pane already in this set cannot be the one the open just made, which is the whole check.
+*/
+function paneIdSet(exec) {
+	return new Set(listZellijPanes(exec).map((p) => normalizePaneId(p.id)));
+}
+/**
+* The pane THE CLIENT is on, or `undefined` when nothing answers — the restore target an open that
+* moved focus has to land back on.
+*
+* `zellij action list-clients` prints a header row and then one row per client; the second
+* whitespace-separated column is the pane id, in the `terminal_N`/`plugin_N` form `focus-pane-id`
+* accepts. The FIRST client row is taken: this adapter is single-client throughout (`MuxTarget`
+* carries no client qualifier any more than it carries a session one), and with several attached
+* there is no "the caller's client" for it to prefer.
+*
+* `undefined` on an empty or unparseable answer — a session no client has ever attached to reports
+* exactly that. Nothing to restore then, and nothing was stolen either, so the caller issues no
+* focus verb rather than inventing one.
+*/
+function clientPane(exec) {
+	return (exec("zellij", ["action", "list-clients"]) ?? "").split("\n")[1]?.trim().split(/\s+/)[1] || void 0;
+}
+/**
+* The TERMINAL panes that appeared since `before` — the only candidates an open can have made.
+*
+* Plugin panes are excluded because zellij loads them on its own schedule, not the caller's: a tab
+* opened by `new-tab` can be carrying a plugin pane in the same listing as its own initial pane, and
+* that plugin record can sort FIRST. Resolving an open to it hands the caller a `plugin_N` — an id
+* that exists, so nothing downstream refuses it, and that then answers nothing a pane is asked. Seen
+* at the real boundary: an `open()` at `tab` returned `plugin_15`, and the `rename()` that followed
+* renamed a pane the caller never opened. `new-tab` and `new-pane` both create a TERMINAL pane, so
+* the kind is the discriminator, and `is_plugin` is the field that carries it.
+*/
+function appearedTerminals(exec, before) {
+	return listZellijPanes(exec).filter((p) => p.is_plugin !== true && !before.has(normalizePaneId(p.id)));
+}
+/**
+* The `OpenedPane` for a pane `new-pane` just made — resolved against the listing rather than taken
+* on the word of the id zellij printed, because that word is not reliable (see
+* `LIST_PANES_ATTEMPTS`): the reply may be empty, or may be the PREVIOUS command's, in which case
+* `paneId` names a pane that has been standing all along.
+*
+* So the id is believed only where it names a pane ABSENT from `before` — the phantom guard this file
+* has always meant to be, now closed. Where it cannot be believed, the session itself answers: a
+* single pane that appeared over this open is unambiguous, and adopting it recovers a reply zellij
+* lost instead of failing an open that genuinely happened. That fallback waits one round, so a
+* printed id that is merely SLOW to appear still wins over a guess.
+*
+* Throws rather than guessing a tab: `OpenedPane.tab` is required (every multiplexer has the Tab
+* level), and a wrong tab is worse than a loud failure.
+*/
+function openedForPane(exec, paneId, before, session) {
+	for (let attempt = 1; attempt <= OPEN_RESOLVE_ATTEMPTS; attempt++) {
+		const appeared = appearedTerminals(exec, before);
+		const claimed = paneId ? appeared.find((p) => samePane(p.id, paneId)) : void 0;
+		if (claimed?.tab_id != null) return openedPane(paneId, String(claimed.tab_id), session);
+		const only = appeared.length === 1 ? appeared[0] : void 0;
+		if ((attempt > 1 || !paneId) && only?.tab_id != null) return openedPane(only.id, String(only.tab_id), session);
+	}
+	throw new Error(paneId ? `zellij did not report a tab for the new pane ${paneId}` : "zellij action new-pane did not report the new pane id, and no new pane appeared");
+}
+/**
+* The `OpenedPane` for a tab `new-tab` just made — its initial pane resolved as the `list-panes`
+* record that carries that tab id AND was not already standing. Same reply-delivery defect, same
+* shape of answer as `openedForPane`: a `tabId` that names a tab whose panes all predate the open is
+* a stale reply, not this tab, and a single pane that appeared over the open answers when the id
+* cannot.
+*
+* Throws rather than guessing: a new tab must have a pane, and a caller handed a tab with no pane
+* could neither drive nor name it.
+*/
+function openedForTab(exec, tabId, before, session) {
+	for (let attempt = 1; attempt <= OPEN_RESOLVE_ATTEMPTS; attempt++) {
+		const appeared = appearedTerminals(exec, before);
+		const claimed = tabId ? appeared.find((p) => p.tab_id != null && String(p.tab_id) === tabId) : void 0;
+		if (claimed) return openedPane(claimed.id, tabId, session);
+		const only = appeared.length === 1 ? appeared[0] : void 0;
+		if ((attempt > 1 || !tabId) && only?.tab_id != null) return openedPane(only.id, String(only.tab_id), session);
+	}
+	throw new Error(tabId ? `zellij did not report a pane in the new tab ${tabId}` : "zellij action new-tab did not report the new tab id, and no new pane appeared");
+}
+/**
+* Assemble an `OpenedPane`, attaching `workspace` only when the ambient session name is known — the
+* absent-not-false convention. Every Zellij pane genuinely lives in a session, so where the name IS
+* known this is never absent, on every placement including `pane:*`; where it is not (the effect-less
+* singleton), it is omitted rather than reported as a false "none".
+*/
+function openedPane(id, tab, session) {
+	const opened = {
+		id,
+		tab
+	};
+	if (session) opened.workspace = session;
+	return opened;
+}
+/**
+* Env is native at NO tier on this backend — `new-pane`/`new-tab` take no `--env`, like wezterm. So
+* every `open` funnels through the same fallback herdr's worktree route uses: with a launch command,
+* env rides in as an `env K=V` prefix; with none, a warning names what did not land. `envFallback` is
+* a no-op when there is no env to carry, so this is safe to call unconditionally.
+*/
+function runLaunch(adapter, exec, target, env, launch) {
+	const fallback = envFallback(env, launch);
+	if (fallback.kind === "dropped") {
+		process.stderr.write(`env (${fallback.variables.join(", ")}) could not be set on this zellij pane — zellij has no --env flag on new-pane/new-tab
+`);
+		return;
+	}
+	if (fallback.command !== void 0) adapter.submit(exec, target, fallback.command);
+}
+/**
+* The core key vocabulary's Zellij spelling — a rename table, NOT a validation table: a token outside
+* the core is forwarded verbatim (the seam's passthrough), so this must not reject what it does not
+* recognize. Only the two members that differ from the core name are listed; `Up` `Down` `Left`
+* `Right` `Enter` `Tab` `Space` `Backspace` `F1`–`F12` are already Zellij's own names. Probed from
+* Zellij's key-binding vocabulary in the docs, not verified against a live `send-keys`:
+*
+* - `Escape` → `Esc`: Zellij's key name for that key is `Esc`.
+* - `C-c` → `Ctrl c`: Zellij writes a modified key as space-separated words (`"Ctrl a"`, `"Alt Shift
+*   b"`), so the whole `Ctrl c` is one argument — the modifier and key are not two keys.
+*/
+const ZELLIJ_KEY_RENAMES = {
+	Escape: "Esc",
+	"C-c": "Ctrl c"
+};
+function toZellijKey(key) {
+	return ZELLIJ_KEY_RENAMES[key] ?? key;
+}
+/**
+* A Zellij pane's label — its title, unless that title is the running command Zellij handed an unnamed
+* pane. Zellij defaults an unnamed pane's title to its `terminal_command`, so a title equal to it is
+* ambient rather than chosen; exporting it would put the same manufactured name on every shell pane,
+* exactly the collision tmux's hostname guard exists to prevent. A title that differs from the command
+* is one someone set (`new-pane --name`/`rename-pane`), so it is the author's and survives.
+*/
+function zellijLabel(title, command) {
+	return title && title !== command ? title : void 0;
+}
+/**
+* Normalize a pane id to a single canonical form for comparison. Per the Zellij docs a bare integer
+* `N` is the same terminal pane as `terminal_N`; `plugin_N` is a distinct space. So a bare id is
+* folded to its `terminal_` form and everything else is left as-is — a comparison-only transform,
+* never stored (`MuxTarget.id` stays whatever the backend reported).
+*/
+function normalizePaneId(id) {
+	return /^\d+$/.test(id) ? `terminal_${id}` : id;
+}
+/** Whether two pane ids name the same pane, treating a bare `N` and its `terminal_N` twin as equal. */
+function samePane(a, b) {
+	return normalizePaneId(a) === normalizePaneId(b);
+}
+/** The last `n` lines of `text` — `read`'s client-side approximation of a trailing-lines capture. */
+function lastLines(text, n) {
+	const lines = text.split("\n");
+	return lines.slice(Math.max(0, lines.length - n)).join("\n");
+}
+//#endregion
+//#region src/mux-probe.ts
+const KNOWN_MUX = [
+	"tmux",
+	"rmux",
+	"herdr",
+	"wezterm",
+	"zellij",
+	"cmux",
+	"otty",
+	"screen",
+	"none"
+];
+function isKnownMux(v) {
+	return v != null && KNOWN_MUX.includes(v);
+}
+/**
+* The single source of the mux → per-pane-env-var mapping. tmux exports `$TMUX_PANE`; herdr exports
+* `$HERDR_PANE_ID` (both in the same `wX:pY`-style namespace); WezTerm exports `$WEZTERM_PANE` in
+* every pane (its own bare-integer id) — per the issue that requested that backend (#47), the same
+* fast-path extension `$TMUX_PANE`/`$HERDR_PANE_ID` already get; Zellij exports `$ZELLIJ_PANE_ID` in
+* every terminal pane (its own `terminal_N`/bare-`N` id) — per the issue that requested this backend
+* (#46); cmux exports `$CMUX_SURFACE_ID` in every terminal (its surface ref, e.g. `surface:7`) — per
+* the issue that requested this backend (#48). screen carries no per-pane env var. Both the ancestry
+* probe and the `currentPane` self-identity helper read the pane through this table so the two never
+* diverge on which env var a given mux uses.
+*
+* **rmux is the one entry whose ORDER against another matters**, and the reason is not cosmetic: an
+* rmux pane exports `$RMUX_PANE` AND `$TMUX_PANE`, both holding the same `%N` id, because rmux
+* reimplements the tmux command language and keeps tmux's env contract for anything that reads it
+* (probed live on rmux 0.10.0 — a pane's env carried `RMUX=<socket>,<pid>,<session>`,
+* `RMUX_PANE=%1`, `TMUX=<the same triple>`, `TMUX_PANE=%1`, `TERM_PROGRAM=rmux`). So `$TMUX_PANE`
+* is NOT evidence of tmux, and every read that walks this table must ask rmux BEFORE tmux, or an
+* rmux session self-identifies as tmux and gets driven with the wrong binary. The table itself is
+* unordered — `currentPane` and `discoverByAncestry` below each carry the ordering, and each says so.
+*/
+const PANE_ENV = {
+	tmux: (env) => env["TMUX_PANE"],
+	rmux: (env) => env["RMUX_PANE"],
+	herdr: (env) => env["HERDR_PANE_ID"],
+	wezterm: (env) => env["WEZTERM_PANE"],
+	zellij: (env) => env["ZELLIJ_PANE_ID"],
+	cmux: (env) => env["CMUX_SURFACE_ID"],
+	otty: (env) => env["OTTY_PANE_ID"]
+};
+/**
+* Resolve THIS session's own pane from env alone (no `ps` walk): the `$CYBER_MUX_PANE` fast-path a
+* spawn propagates → `$RMUX_PANE` (rmux) → `$TMUX_PANE` (tmux) → `$HERDR_PANE_ID` (herdr) →
+* `$WEZTERM_PANE` (wezterm) → `$ZELLIJ_PANE_ID` (zellij) → `$CMUX_SURFACE_ID` (cmux) →
+* `$OTTY_PANE_ID` (otty). Returns the pane tagged with its multiplexer, or undefined when the
+* session is in no pane-carrying multiplexer. This is the mux-agnostic self-identity key.
+*
+* **rmux is asked before tmux, and that order is load-bearing** — an rmux pane sets `$TMUX_PANE`
+* too (see `PANE_ENV`), so the tmux question is not a question rmux answers `no` to. The reverse
+* order would report every rmux pane as tmux and hand `resolveMuxAdapter` the wrong binary.
+*/
+function currentPane(env) {
+	if (env["CYBER_MUX_PANE"]) return {
+		mux: env["CYBER_MUX"] === "rmux" ? "rmux" : env["CYBER_MUX"] === "herdr" ? "herdr" : env["CYBER_MUX"] === "wezterm" ? "wezterm" : env["CYBER_MUX"] === "zellij" ? "zellij" : env["CYBER_MUX"] === "cmux" ? "cmux" : env["CYBER_MUX"] === "otty" ? "otty" : "tmux",
+		pane: env["CYBER_MUX_PANE"]
+	};
+	const rmux = PANE_ENV.rmux(env);
+	if (rmux) return {
+		mux: "rmux",
+		pane: rmux
+	};
+	const tmux = PANE_ENV.tmux(env);
+	if (tmux) return {
+		mux: "tmux",
+		pane: tmux
+	};
+	const herdr = PANE_ENV.herdr(env);
+	if (herdr) return {
+		mux: "herdr",
+		pane: herdr
+	};
+	const wezterm = PANE_ENV.wezterm(env);
+	if (wezterm) return {
+		mux: "wezterm",
+		pane: wezterm
+	};
+	const zellij = PANE_ENV.zellij(env);
+	if (zellij) return {
+		mux: "zellij",
+		pane: zellij
+	};
+	const cmux = PANE_ENV.cmux(env);
+	if (cmux) return {
+		mux: "cmux",
+		pane: cmux
+	};
+	const otty = PANE_ENV.otty(env);
+	if (otty) return {
+		mux: "otty",
+		pane: otty
+	};
+}
+/**
+* Two-mode multiplexer detection.
+*
+* Fast-path: `$CYBER_MUX` (tmux | rmux | herdr | wezterm | zellij | cmux | otty | screen | none) is
+* trusted outright — this also serves as an OVERRIDE (`=none` forces no-mux even inside a real
+* multiplexer).
+* `$CYBER_MUX_PANE` carries the pane id alongside it. Detection RECOGNIZES `screen` (so an override
+* pinning it, or a real screen ancestor, is reported truthfully rather than silently ignored), but
+* `screen` is not a drivable backend — `resolveMuxAdapter` rejects it with a reason. Recognition is
+* not support.
+*
+* Discovery (else): walk the process ancestry from `$$` via `ps -o ppid=,comm= -p <pid>`, since the
+* tool's own shell may not be the human's pane. `$RMUX`/`$TMUX`/`$HERDR_ENV` are NOT trusted alone —
+* they are used only as a fast-positive hint the ancestry walk falls back to when the walk itself is
+* inconclusive (e.g. `ps` unavailable), never as a substitute for it.
+*/
+function probeMultiplexer(exec, env, opts = {}) {
+	const prefix = opts.envPrefix ?? "CYBER_MUX";
+	const override = env[prefix];
+	const pane = env[`${prefix}_PANE`];
+	if (isKnownMux(override)) return {
+		mux: override,
+		...pane ? { pane } : {},
+		via: "env"
+	};
+	if (opts.discover === false) return {
+		mux: "none",
+		via: "ancestry"
+	};
+	return discoverByAncestry(exec, env);
+}
+const MUX_COMM = [
+	{
+		re: /^tmux(:|$)/,
+		mux: "tmux"
+	},
+	{
+		re: /^rmux(-daemon|-server)?(:|$)/,
+		mux: "rmux"
+	},
+	{
+		re: /^herdr(:|$)/,
+		mux: "herdr"
+	},
+	{
+		re: /^wezterm(-gui|-mux-server)?(:|$)/,
+		mux: "wezterm"
+	},
+	{
+		re: /^zellij(:|$)/,
+		mux: "zellij"
+	},
+	{
+		re: /^screen(:|$)/,
+		mux: "screen"
+	}
+];
+/** The per-pane env var for a mux, via the shared `PANE_ENV` table; undefined for screen/none. */
+function paneFor(mux, env) {
+	return mux === "tmux" || mux === "rmux" || mux === "herdr" || mux === "wezterm" || mux === "zellij" || mux === "cmux" ? PANE_ENV[mux](env) : void 0;
+}
+/**
+* An ancestry-discovered probe, OMITTING `pane` when the mux carries none — never carrying it as an
+* explicit `undefined`, so `MuxProbe.pane` stays an absent-or-present field (the same conditional
+* shape the `$CYBER_MUX_PANE` fast-path uses above).
+*/
+function ancestryProbe(mux, env) {
+	const pane = paneFor(mux, env);
+	return {
+		mux,
+		...pane !== void 0 ? { pane } : {},
+		via: "ancestry"
+	};
+}
+const MAX_ANCESTORS = 32;
+function walkAncestry(exec, env) {
+	let pid = process.pid;
+	const seen = /* @__PURE__ */ new Set();
+	for (let i = 0; i < MAX_ANCESTORS; i++) {
+		if (seen.has(pid)) break;
+		seen.add(pid);
+		const line = exec("ps", [
+			"-o",
+			"ppid=,comm=",
+			"-p",
+			String(pid)
+		]);
+		if (!line) break;
+		const trimmed = line.trim();
+		const spaceIdx = trimmed.indexOf(" ");
+		const ppidStr = spaceIdx === -1 ? trimmed : trimmed.slice(0, spaceIdx);
+		const comm = spaceIdx === -1 ? "" : trimmed.slice(spaceIdx + 1).trim();
+		const ppid = Number.parseInt(ppidStr, 10);
+		for (const entry of MUX_COMM) if (entry.re.test(comm)) return ancestryProbe(entry.mux, env);
+		if (!Number.isFinite(ppid) || ppid <= 1) break;
+		pid = ppid;
+	}
+}
+function discoverByAncestry(exec, env) {
+	const found = walkAncestry(exec, env);
+	if (found) return found;
+	if (env["RMUX"]) return ancestryProbe("rmux", env);
+	if (env["TMUX"]) return ancestryProbe("tmux", env);
+	if (env["HERDR_ENV"]) return ancestryProbe("herdr", env);
+	if (env["WEZTERM_PANE"]) return ancestryProbe("wezterm", env);
+	if (env["ZELLIJ"]) return ancestryProbe("zellij", env);
+	if (env["CMUX_WORKSPACE_ID"]) return ancestryProbe("cmux", env);
+	if (env["OTTY_PANE_ID"]) return ancestryProbe("otty", env);
+	return {
+		mux: "none",
+		via: "ancestry"
+	};
+}
+//#endregion
+//#region src/nudge.ts
+/** Max flush re-submits after the initial submit, before nudge fails loud. */
+const DEFAULT_ATTEMPTS = 10;
+/** Wait after a submit before reading the pane back, in ms. */
+const DEFAULT_SETTLE_MS = 400;
+/** Length of the message prefix used as the staged-text needle. */
+const NEEDLE_LEN = 40;
+/**
+* Whether `message` is still sitting staged in `visible`'s input box (not yet submitted). A real
+* submit scrolls the message into the transcript, leaving the bottom input box empty, so the
+* needle is absent from the tail; while staged it sits in the bottom input box, so the needle is
+* present. `visible` being null/empty means the turn can't be confirmed — treated as still staged
+* so callers keep retrying rather than falsely reporting success.
+*/
+function isStaged(visible, message) {
+	if (!visible) return true;
+	const needle = message.replace(/\s+/g, " ").trim().slice(0, NEEDLE_LEN);
+	if (needle === "") return true;
+	return visible.split("\n").filter((l) => l.trim() !== "").slice(-5).join(" ").replace(/\s+/g, " ").trim().includes(needle);
+}
+/**
+* Submit `message` to `target` and verify the peer actually took the turn — a booting harness can
+* swallow the Enter of the initial `submit`, leaving the text staged unsent while nudge would
+* otherwise report false success. Types the message exactly once; a swallowed Enter is recovered by
+* flushing the staged buffer (`adapter.submit` with no text, a bare Enter) — never re-typing the
+* message — up to a bounded number of attempts. Throws if the turn is never taken within the cap.
+*
+* A pane that no longer exists is rejected up front rather than retried: a gone pane and a booting
+* one both read back empty, so without the liveness probe the retry loop reports a dead peer as
+* "never took the turn" — a boot-race shape — and buries the real cause.
+*
+* **Not built on `waitForOutput`, deliberately.** The two look alike and wait on opposite conditions:
+* `waitForOutput` returns when a pattern APPEARS anywhere in the snapshot, while nudge returns when the
+* message DISAPPEARS from the input box at the bottom (`isStaged`) — a negative, position-sensitive
+* condition the wait primitive cannot express, and one that must not be satisfied by the same text
+* sitting up in the transcript, which is exactly where a submitted message ends up. Nor is the loop body
+* the same: nudge does not merely observe between polls, it re-submits, so its "poll" is a corrective
+* action with its own attempt budget rather than a read. What the two DO share is the liveness rule —
+* a gone pane throws instead of being reported as a quiet one — and `pollForOutput` adopts it from here.
+*/
+async function nudge(adapter, exec, target, message, opts = {}) {
+	const attempts = opts.attempts ?? DEFAULT_ATTEMPTS;
+	const settleMs = opts.settleMs ?? DEFAULT_SETTLE_MS;
+	const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	if (!adapter.paneExists(exec, target)) throw new Error(`nudge failed: pane ${target.id} no longer exists — the peer's session is gone, not busy.`);
+	adapter.submit(exec, target, message);
+	await sleep(settleMs);
+	if (!isStaged(adapter.read(exec, target).text, message)) return {
+		taken: true,
+		resubmits: 0
+	};
+	for (let attempt = 1; attempt <= attempts; attempt++) {
+		adapter.submit(exec, target);
+		await sleep(settleMs);
+		if (!isStaged(adapter.read(exec, target).text, message)) return {
+			taken: true,
+			resubmits: attempt
+		};
+	}
+	throw new Error(`nudge failed: peer at pane ${target.id} never took the turn — input still staged after ${attempts} re-submit attempts`);
+}
+//#endregion
+//#region src/backend.ts
+/**
+* Resolve the raw backend for the multiplexer this process is inside, via the two-mode mux probe
+* (`$CYBER_MUX` fast-path/override, else ancestry discovery from `$$` falling back to the
+* `$RMUX`/`$TMUX`/`$HERDR_ENV`/`$WEZTERM_PANE`/`$ZELLIJ`/`$CMUX_WORKSPACE_ID` hint when the walk is
+* inconclusive) — tmux/rmux/herdr/wezterm/zellij/cmux/otty map to their adapters; anything else throws,
+* because a caller asking to drive panes with no multiplexer has an unmet precondition, and a loud,
+* actionable failure beats a silent no-op.
+*
+* The zellij adapter is bound to the ambient session name (`$ZELLIJ_SESSION_NAME`) at resolution — it
+* reports that as `OpenedPane.workspace`, so the session name has to come from the SAME `env` the
+* probe reads. A missing name simply omits `workspace`; see `createZellijAdapter`. The cmux adapter
+* is similarly bound to the ambient workspace id (`$CMUX_WORKSPACE_ID`).
+*
+* `screen` is a KNOWN mux — the probe detects it (ancestry) and honors it as an override (fast-path)
+* — but it is NOT a drivable backend, so it throws its OWN message naming the reason rather than the
+* generic "no multiplexer" one. That distinction is the whole point of issue #45: a caller who
+* pinned `CYBER_MUX=screen` declared a real multiplexer, and telling them "run inside a multiplexer"
+* would be a lie. The empirical probe behind the rejection is recorded in the ADR log
+* (`.agents/spec/design/decisions`): GNU Screen addresses its split regions POSITIONALLY (no
+* per-pane id), and `$WINDOW` is left unset in panes opened via `screen -X`, so a driver-created
+* pane has no stable identity to send to, read from, self-identify by, or enumerate — the exact
+* affordance `SessionTarget.id`/`currentPane`/`LivePane.id` are load-bearing on, and the exact one
+* wezterm (#47) had and screen lacks. Keeping the value KNOWN-but-rejected honors the override's
+* whole reason to exist: pinning it tells the caller the truth immediately instead of silently
+* discovering something else.
+*
+* Returns the PURE, exec-injected `MuxAdapter` seam — the one whose methods each take an `Exec`.
+* `resolveMux` binds one of these into a `MuxSession`; this is the lower layer, exported for a caller
+* that wants to thread its own runner per call rather than bind one. Not in a multiplexer? Gate on
+* `probeMultiplexer(env).mux !== 'none'` first — that answer never throws.
+*/
+function resolveMuxAdapter(env, exec = nodeExec) {
+	const probe = probeMultiplexer(exec, env);
+	if (probe.mux === "tmux") return tmuxMuxAdapter;
+	if (probe.mux === "rmux") return rmuxMuxAdapter;
+	if (probe.mux === "herdr") return herdrMuxAdapter;
+	if (probe.mux === "wezterm") return weztermMuxAdapter;
+	if (probe.mux === "zellij") return createZellijAdapter({ session: env["ZELLIJ_SESSION_NAME"] });
+	if (probe.mux === "cmux") return createCmuxAdapter({ workspace: env["CMUX_WORKSPACE_ID"] });
+	if (probe.mux === "otty") return createOttyAdapter({ window: void 0 });
+	if (probe.mux === "screen") throw new Error("cyber-mux detected GNU Screen, which it cannot drive: Screen addresses its split regions positionally (no per-pane id) and leaves $WINDOW unset in panes opened via `screen -X`, so a pane has no stable identity to send to, read from, or self-identify by. Run inside tmux ($TMUX), rmux ($RMUX set), herdr ($HERDR_ENV=1), wezterm ($WEZTERM_PANE set), zellij ($ZELLIJ set), or cmux ($CMUX_WORKSPACE_ID set) instead.");
+	throw new Error("cyber-mux requires a session backend — run inside tmux ($TMUX), rmux ($RMUX set), herdr ($HERDR_ENV=1), wezterm ($WEZTERM_PANE set), zellij ($ZELLIJ set), cmux ($CMUX_WORKSPACE_ID set), or otty ($OTTY_PANE_ID set)");
+}
+/**
+* Resolve the multiplexer this process is inside and return it as a `MuxSession` with `exec` BOUND —
+* the ergonomic entry point. `deps.exec` (default `nodeExec`) runs the detection probe AND is the
+* default runner every method binds; a per-call `deps` overrides it.
+*
+* Throws when no supported multiplexer is detected (see `resolveMuxAdapter`); gate on
+* `probeMultiplexer(env).mux !== 'none'` first if a caller runs with-or-without one. For the pure
+* exec-injected seam, reach for `resolveMuxAdapter` instead.
+*/
+function resolveMux(env, deps) {
+	const boundExec = deps?.exec ?? nodeExec;
+	const raw = resolveMuxAdapter(env, boundExec);
+	const pick = (d) => d?.exec ?? boundExec;
+	return {
+		name: raw.name,
+		...raw.canSizeSplits !== void 0 ? { canSizeSplits: raw.canSizeSplits } : {},
+		callerPane: () => callerPane(raw, env),
+		open: (opts, d) => raw.open(pick(d), opts),
+		rename: (target, tier, name, d) => raw.rename(pick(d), target, tier, name),
+		group: (target, group, name, d) => raw.group(pick(d), target, group, name),
+		sendText: (target, text, d) => raw.sendText(pick(d), target, text),
+		sendKeys: (target, keys, d) => raw.sendKeys(pick(d), target, keys),
+		submit: (target, text, d) => raw.submit(pick(d), target, text),
+		read: (target, opts, d) => raw.read(pick(d), target, opts),
+		waitForOutput: (target, opts, d) => raw.waitForOutput(pick(d), target, opts),
+		focus: (target, d) => raw.focus(pick(d), target),
+		teardown: (target, d) => raw.teardown(pick(d), target),
+		paneExists: (target, d) => raw.paneExists(pick(d), target),
+		isPaneFocused: (target, d) => raw.isPaneFocused(pick(d), target),
+		listPanes: (d) => raw.listPanes(pick(d)),
+		nudge: (target, message, opts, d) => nudge(raw, pick(d), target, message, opts),
+		...raw.worktree ? { worktree: bindWorktree(raw.worktree, pick) } : {},
+		...raw.regions ? { regions: bindRegions(raw.regions, pick) } : {},
+		...raw.agentLifecycle ? { agentLifecycle: bindAgentLifecycle(raw.agentLifecycle, pick) } : {}
+	};
+}
+function bindAgentLifecycle(agent, pick) {
+	return { waitForState: (target, opts, d) => agent.waitForState(pick(d), target, opts) };
+}
+function bindWorktree(wt, pick) {
+	return {
+		createInWorkspace: (opts, d) => wt.createInWorkspace(pick(d), opts),
+		openInWorkspace: (opts, d) => wt.openInWorkspace(pick(d), opts),
+		bindings: (opts, d) => wt.bindings(pick(d), opts),
+		releaseWorkspace: (workspace, d) => wt.releaseWorkspace(pick(d), workspace)
+	};
+}
+function bindRegions(regions, pick) {
+	return {
+		describeRegion: (target, d) => regions.describeRegion(pick(d), target),
+		describeWorkspace: (target, d) => regions.describeWorkspace(pick(d), target)
+	};
+}
+/**
+* This process's own pane, as something `adapter` can address — `MuxOpenOptions.from`'s intended
+* argument for a `pane:*` open, so a split lands on the caller rather than on whichever pane the
+* user is looking at (see `from`'s note for why each backend's default gets that wrong).
+*
+* `undefined` when this session is in no pane, or in a pane belonging to a *different* multiplexer
+* than `adapter` drives — that mismatch is reachable (a `$TMUX_PANE` inherited into a herdr pane,
+* `$CYBER_MUX` overridden to the other backend), and handing one backend the other's pane id would
+* turn a self-identity mixup into a split of some unrelated pane. Falling back to the backend's own
+* default is the conservative answer: still possibly the wrong pane, but never a foreign id.
+*
+* A `MuxSession` exposes this bound as `mux.callerPane()`; this free form is for the raw seam.
+*/
+function callerPane(adapter, env) {
+	const self = currentPane(env);
+	return self && self.mux === adapter.name ? { id: self.pane } : void 0;
+}
+//#endregion
+export { refuseFloatingPane as A, isReadTruncated as C, pollForOutput as D, matchWaitPattern as E, FloatingPanesUnsupportedError as O, capturedRows as S, assertWaitPattern as T, RMUX_WORKSPACE_GROUP_OPTION as _, nudge as a, partition as b, createZellijAdapter as c, weztermMuxAdapter as d, nodeNewId as f, RMUX_TAB_NAME_OPTION as g, tmuxMuxAdapter as h, isStaged as i, envFallback as j, canFloatPanes as k, zellijMuxAdapter as l, TMUX_WORKSPACE_GROUP_OPTION as m, resolveMux as n, currentPane as o, TMUX_TAB_NAME_OPTION as p, resolveMuxAdapter as r, probeMultiplexer as s, callerPane as t, createWeztermAdapter as u, rmuxMuxAdapter as v, DEFAULT_WAIT_POLL_MS as w, FULL_SCROLLBACK_LINES as x, herdrMuxAdapter as y };
+
+//# sourceMappingURL=backend-AErdtLRB.mjs.map