handmux 0.17.0 → 0.17.4

package/public/index.html

@@ -48,7 +48,7 @@
       @keyframes bootDot { 0%,100% { opacity: .22; transform: translateY(0); } 40% { opacity: 1; transform: translateY(-3px); } }
       @media (prefers-reduced-motion: reduce) { .boot-glow, .boot-dots i { animation: none; opacity: .8; } }
     </style>
-    <script type="module" crossorigin src="/assets/index-C8uRJNnP.js"></script>
+    <script type="module" crossorigin src="/assets/index-BfJTQWOA.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-BT03K2MQ.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" crossorigin href="/assets/index-BT03K2MQ.css"></noscript>
   </head>
   <body>

package/src/agents/claude.js

@@ -10,7 +10,64 @@
 //   sessions       cwd → session resolution + the `resume` command, for orphan takeover
 import path from 'node:path';
 import os from 'node:os';
-import { resolveEncodedDirSession, isSessionUuid } from './scanUtils.js';
+import { promises as fsp } from 'node:fs';
+import { resolveEncodedDirSession, isSessionUuid, normTty } from './scanUtils.js';
+
+// The NATIVE installer names the real binary by version (~/.local/share/claude/versions/2.1.196 —
+// ~/.local/bin/claude is only a symlink to it), and tmux #{pane_current_command} follows that basename
+// ("2_1_196", dots sanitized to underscores) instead of "claude". ps can't tie it: ps `comm` shows the
+// process's self-set title ("claude"), which does NOT match tmux's report (verified live on a native-
+// install machine). Matching any semver-shaped name would misidentify any version-named binary, so we
+// corroborate with the process's REAL executable path (`lsof -d txt` on macOS, /proc/<pid>/exe on
+// Linux): a pid on the pane's tty whose exe BASENAME equals tmux's version comm, and whose path carries
+// "claude" — every official install layout carries it (Caskroom/claude-code@latest, .local/share/
+// claude/versions, node_modules/@anthropic-ai/claude-code, …), version- and layout-proof, while a
+// foreign version-named binary's path doesn't. Only then is the pane's cmd normalized to 'claude', so
+// every downstream match (identity + liveness) stays exact-name. Verdicts are cached per (tty, cmd) in
+// an injected Map — a cache miss costs one ps + one lsof per candidate pane, once per version per pane.
+const VERSION_COMM_RE = /^\d+[._]\d+[._]\d+$/;
+const CLAUDE_PATH_RE = /claude/;
+
+// The real executable path of a pid: first txt entry from lsof (resolves symlinks → the actual binary),
+// falling back to /proc on Linux where lsof output may be restricted. '' when unknowable.
+async function exePath(run, pid) {
+  const out = await run('lsof', ['-a', '-p', String(pid), '-d', 'txt', '-Fn']);
+  for (const line of String(out).split('\n')) if (line[0] === 'n') return line.slice(1).trim();
+  try { return await fsp.readlink(`/proc/${pid}/exe`); } catch { return ''; }
+}
+
+export async function resolveVersionedComms(panes, run, verdicts = new Map()) {
+  const candidates = panes.filter((p) => p && p.tty && VERSION_COMM_RE.test(p.cmd || ''));
+  if (!candidates.length) return panes;
+  const key = (p) => `${normTty(p.tty)}|${p.cmd}`;
+  for (const p of candidates) if (verdicts.get(key(p)) === true) p.cmd = 'claude';
+  const pending = candidates.filter((p) => p.cmd !== 'claude' && !verdicts.has(key(p)));
+  if (!pending.length) return panes;
+
+  const out = await run('ps', ['-Ao', 'tty=,pid=,comm=']);
+  const procs = []; // [{ tty, pid, comm }]
+  for (const line of String(out).split('\n')) {
+    const m = line.match(/^\s*(\S+)\s+(\d+)\s+(.*)$/);
+    if (!m) continue;
+    const tty = normTty(m[1]);
+    if (tty) procs.push({ tty, pid: m[2], comm: m[3].trim() });
+  }
+  for (const p of pending) {
+    let ok = false;
+    // Tie by tty + exe BASENAME (== tmux's version comm; ps comm is the self-set title and can't be
+    // trusted to match), then require the real path to carry "claude" — a random semver-named binary
+    // elsewhere is NOT Claude.
+    const want = p.cmd.replace(/_/g, '.');
+    for (const r of procs.filter((r) => r.tty === normTty(p.tty))) {
+      const exe = await exePath(run, r.pid);
+      const base = exe.split('/').pop() || '';
+      if ((base === p.cmd || base === want) && CLAUDE_PATH_RE.test(exe)) { ok = true; break; }
+    }
+    verdicts.set(key(p), ok);
+    if (ok) p.cmd = 'claude';
+  }
+  return panes;
+}
 
 // Build the 需要你 one-liner for a PermissionRequest, from the tool it's gating on (PermissionRequest
 // carries tool_name + tool_input, unlike the later permission_prompt Notification which only has an
@@ -103,7 +160,9 @@ export const claude = {
   label: 'Claude Code',
   procName: 'claude',
   // Which tmux #{pane_current_command} values mean "this agent is still the pane's foreground app" (inbox
-  // liveness). Claude sets its process title to "claude", so an exact single-name match is right.
+  // liveness). Claude sets its process title to "claude", so an exact single-name match is right — for
+  // native-install machines (whose comm is the VERSION string) resolveVersionedComms below normalizes the
+  // cmd back to 'claude' at ingest, keeping every match here exact-name.
   procNames: ['claude'],
   // The `claude` CLI sets its process title to "claude" (verified via ps): match the program token at the
   // start of argv — bare "claude", "claude --continue", or an absolute path ending in /claude. Anchored so

package/src/agents/index.js

@@ -16,5 +16,7 @@ const BY_ID = new Map(AGENTS.map((a) => [a.id, a]));
 export function getAgent(id) { return BY_ID.get(id) || claude; }
 
 // The driver whose foreground process this tmux #{pane_current_command} is, or null. Used by the inbox to
-// decide a recorded pane is still running its agent (vs. the agent having exited to a shell).
+// decide a recorded pane is still running its agent (vs. the agent having exited to a shell). Matches the
+// canonical procName only — never the ambiguous extras in procNames (e.g. Codex's 'node'); native-install
+// Claude binaries (comm = version string) are normalized to 'claude' at ingest (resolveVersionedComms).
 export function agentForProc(cmd) { return AGENTS.find((a) => a.procName === cmd) || null; }

package/src/claudeEvents.js

@@ -2,6 +2,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getAgent, agentForProc } from './agents/index.js';
+import { resolveVersionedComms } from './agents/claude.js';
+import { defaultRun } from './agents/scanUtils.js';
 import { claude } from './agents/claude.js';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
@@ -134,12 +136,16 @@ function readStateFile(file) {
 }
 
 // Per-process event reader. Deps injected for testability:
-//   commands.listLivePanes() → [{ id, cmd, session, window, windowName }]  (one tmux call: liveness+location)
+//   commands.listLivePanes() → [{ id, cmd, tty, session, window, windowName }]  (one tmux call)
+//   run(cmd, args) → stdout   (only used by the version-named-comm corroboration; default defaultRun)
 //   push.sendToSession(session, payload, {ttl, urgency, topic})
 //   file: the hook-maintained JSON state file (DEFAULT_STATE_FILE).
 // The hook is the sole writer; the server reads the file fresh on every getStates and on every file
 // change (the watcher, for push). No persisted state of our own — the file IS the persistence.
-export function createClaudeEvents({ commands, push, file = DEFAULT_STATE_FILE, now = () => Date.now(), statMtime = defaultStatMtime, readTail = defaultReadTail } = {}) {
+export function createClaudeEvents({ commands, push, file = DEFAULT_STATE_FILE, now = () => Date.now(), statMtime = defaultStatMtime, readTail = defaultReadTail, run = defaultRun } = {}) {
+  // Cache for resolveVersionedComms verdicts ((tty|cmd) → bool) — one corroboration per version per pane,
+  // not one per poll. Per instance: prod shares one server-wide map; tests get isolation for free.
+  const commVerdicts = new Map();
   const lastPushed = {}; // pane → 'needs' | 'done' | null  (in-process push-transition dedup, by display view)
   // The dedup above is in-process ONLY: a restart (e.g. ./deploy.sh) wipes it while the hook's state
   // file on disk keeps every pane's latest 需要你/已完成. Without priming, the first read after boot
@@ -181,7 +187,13 @@ export function createClaudeEvents({ commands, push, file = DEFAULT_STATE_FILE,
     const allow = allowedSessions == null ? null : new Set(allowedSessions);
     const recorded = readStateFile(file);
     let live = null;
-    try { live = new Map((await commands.listLivePanes()).map((p) => [p.id, p])); } catch { /* tmux down */ }
+    try {
+      const panes = await commands.listLivePanes();
+      // Native-install Claude binaries report a version string as pane_current_command — corroborate via
+      // ps and normalize to 'claude' BEFORE any identity/liveness match (see agents/claude.js).
+      await resolveVersionedComms(panes, run, commVerdicts);
+      live = new Map(panes.map((p) => [p.id, p]));
+    } catch { /* tmux down */ }
 
     const out = {};
     for (const [pane, rec] of Object.entries(recorded)) {
@@ -312,5 +324,14 @@ export function createClaudeEvents({ commands, push, file = DEFAULT_STATE_FILE,
     return { sessionId, transcriptPath, cwd };
   }
 
-  return { getStates, start, stop, paneSession };
+  // Agent identity is needed independently of session metadata: a Codex pane may not have a Claude-style
+  // transcript path, but the current Claude-only chat lens must still fail closed instead of cwd-falling
+  // back to an unrelated Claude jsonl. Untagged legacy hook rows are Claude.
+  function paneAgent(pane) {
+    const rec = readStateFile(file)[pane];
+    if (!rec || typeof rec !== 'object') return null;
+    return typeof rec.agent === 'string' && rec.agent ? rec.agent : 'claude';
+  }
+
+  return { getStates, start, stop, paneSession, paneAgent };
 }

package/src/cli/pushCmd.js

@@ -3,6 +3,7 @@
 // Scope is mutually exclusive: --device (by key) or --session, else all. Pure parse + injectable
 // runner so it unit-tests without spawning or real fetch.
 import { readState } from './state.js';
+import { sanitizeNotificationUrl } from '../urlPolicy.js';
 
 const collect = (acc, v) => acc.concat(String(v).split(',').map((s) => s.trim()).filter(Boolean));
 
@@ -23,11 +24,13 @@ export function parsePushArgs(argv) {
   const [title, body] = positional;
   if (!title || !body) return { error: 'usage: handmux push <title> <body> [--session X]... [--device K]... [--tag T] [--url U]' };
   if (sessions.length && devices.length) return { error: 'use --session or --device, not both' };
+  const safeUrl = url == null ? null : sanitizeNotificationUrl(url);
+  if (url != null && !safeUrl) return { error: '--url must be an http(s) URL or a relative path' };
   const out = { title, body };
   if (sessions.length) out.sessions = sessions;
   if (devices.length) out.devices = devices;
   if (tag) out.tag = tag;
-  if (url) out.url = url;
+  if (safeUrl) out.url = safeUrl;
   return out;
 }
 

package/src/notifications.js

@@ -8,6 +8,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import crypto from 'node:crypto';
 import { readJsonArray, writeJsonAtomic } from './jsonStore.js';
+import { sanitizeNotificationUrl } from './urlPolicy.js';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const DIR = process.env.NOTIF_DIR || path.resolve(here, '../data/notifications');
@@ -24,7 +25,8 @@ const load = (file) => readJsonArray(file).filter((n) => n && typeof n.title ===
 export function record(pushKeys, { title, body, tag, url } = {}) {
   const rec = { id: genId(), ts: Date.now(), title: String(title ?? ''), body: String(body ?? '') };
   if (tag) rec.tag = String(tag);
-  if (url) rec.url = String(url);
+  const safeUrl = sanitizeNotificationUrl(url);
+  if (safeUrl) rec.url = safeUrl;
   for (const key of pushKeys || []) {
     const file = fileFor(key);
     if (!file) continue;

package/src/previewServer.js

@@ -5,6 +5,8 @@
 // Also handles dynamic preview: Host-based dispatch to loopback ports (HTTP + WS upgrade).
 import net from 'node:net';
 import http from 'node:http';
+import https from 'node:https';
+import tls from 'node:tls';
 import express from 'express';
 import { tokenEquals } from './auth.js';
 import { safePreviewName } from './previews.js';
@@ -57,7 +59,15 @@ function cookieScope(domain) {
 // Resolve the on-disk file for a request path under a preview: '' or '<dir>/' → its index.html.
 function fileFor(rest) { return (!rest || rest.endsWith('/')) ? `${rest}index.html` : rest; }
 
-export function createPreview({ previews, token, domain = null }) {
+export function createPreview({
+  previews,
+  token,
+  domain = null,
+  httpRequest = http.request,
+  httpsRequest = https.request,
+  netConnect = net.connect,
+  tlsConnect = tls.connect,
+}) {
   const router = express.Router();
   const cookieDomain = cookieScope(domain);
 
@@ -117,9 +127,16 @@ export function createPreview({ previews, token, domain = null }) {
   // its own root, so path/method/headers/body forward as-is. `host` is the loopback family the app was
   // found on at register time ('127.0.0.1' or '::1'); the Host header stays 127.0.0.1:<port> so a dev
   // server's host check (e.g. Vite, whose allowedHosts include localhost/127.0.0.1) is satisfied.
-  function proxyHttp(port, host, req, res) {
+  function proxyHttp(port, host, protocol, req, res) {
     const headers = { ...req.headers, host: `127.0.0.1:${port}` };
-    const up = http.request({ host: host || '127.0.0.1', port, method: req.method, path: req.url, headers }, (upRes) => {
+    const secure = protocol === 'https';
+    const request = secure ? httpsRequest : httpRequest;
+    const options = { host: host || '127.0.0.1', port, method: req.method, path: req.url, headers };
+    // Local HTTPS dev servers commonly use a self-signed certificate. The connection target is constrained
+    // to loopback by registration/probing, so accepting that certificate does not expand trust to a network
+    // host. SNI stays localhost because that is what development certificates are normally issued for.
+    if (secure) Object.assign(options, { servername: 'localhost', rejectUnauthorized: false });
+    const up = request(options, (upRes) => {
       res.writeHead(upRes.statusCode, upRes.headers);
       upRes.on('error', () => res.destroy()); // mid-stream upstream reset (after headers) → tear down the client socket
       upRes.pipe(res);
@@ -147,7 +164,7 @@ export function createPreview({ previews, token, domain = null }) {
     if (state === 'missing') return res.status(404).type('html').send('<!doctype html><meta charset="utf-8"><h1>预览不存在</h1>');
     if (state === 'expired') return res.status(410).type('html').send('<!doctype html><meta charset="utf-8"><h1>预览已过期</h1><p>请回到 app 重新启动预览。</p>');
     if (entry.kind !== 'dynamic') return res.status(404).end(); // a static name reached via subdomain — not served here
-    proxyHttp(entry.port, entry.host, req, res);
+    proxyHttp(entry.port, entry.host, entry.protocol, req, res);
   }
 
   // WebSocket (and any raw Upgrade) for a dynamic preview: same cookie auth, then a bare TCP pipe to
@@ -165,7 +182,13 @@ export function createPreview({ previews, token, domain = null }) {
     if (!credOk({ query, headers: req.headers }, token)) return socket.destroy();
     const { state, entry } = previews.get(name);
     if (state !== 'active' || entry.kind !== 'dynamic') return socket.destroy();
-    const up = net.connect(entry.port, entry.host || '127.0.0.1', () => {
+    const secure = entry.protocol === 'https';
+    const options = { port: entry.port, host: entry.host || '127.0.0.1' };
+    if (secure) Object.assign(options, {
+      servername: 'localhost', rejectUnauthorized: false, ALPNProtocols: ['http/1.1'],
+    });
+    const connect = secure ? tlsConnect : netConnect;
+    const up = connect(options, () => {
       const fwd = { ...req.headers, host: `127.0.0.1:${entry.port}` };
       up.write(`GET ${req.url} HTTP/1.1\r\n`);
       for (const [k, v] of Object.entries(fwd)) up.write(`${k}: ${v}\r\n`);

package/src/previews.js

@@ -69,16 +69,17 @@ export function createPreviews({
     return { name: entry.name, kind: entry.kind, expiresAt: entry.expiresAt };
   };
 
-  async function register({ name, dir, port }) {
+  async function register({ name, dir, port, protocol = 'http' }) {
     const nm = safePreviewName(name);
     if (!nm) return { error: 'bad name', status: 400 };
     if (port !== undefined && port !== null && port !== '') {
       if (!dynamicEnabled) return { error: 'dynamic disabled', status: 400 };
+      if (protocol !== 'http' && protocol !== 'https') return { error: 'bad protocol', status: 400 };
       const p = Number(port);
       if (!Number.isInteger(p) || p < 1 || p > 65535) return { error: 'bad port', status: 400 };
       const host = await probePort(p); // '127.0.0.1' | '::1' | null
       if (!host) return { error: 'port not listening', status: 400 };
-      return upsert({ name: nm, kind: 'dynamic', port: p, host });
+      return upsert({ name: nm, kind: 'dynamic', port: p, host, protocol });
     }
     if (typeof dir !== 'string' || dir[0] !== '/') return { error: 'not absolute', status: 400 };
     let real;
@@ -94,14 +95,17 @@ export function createPreviews({
     const entry = entries.find((e) => e && e.name === name);
     if (!entry) return { state: 'missing' };
     if (entry.expiresAt <= now()) { entries = entries.filter((e) => e.name !== name); flush(); return { state: 'expired' }; }
-    return { state: 'active', entry: { kind: 'static', ...entry } }; // legacy rows (no kind) → static
+    const normalized = entry.kind === 'dynamic'
+      ? { ...entry, kind: 'dynamic', protocol: entry.protocol === 'https' ? 'https' : 'http' }
+      : { kind: 'static', ...entry }; // legacy rows (no kind) → static
+    return { state: 'active', entry: normalized };
   }
 
   function list() {
     const active = entries.filter((e) => e && e.expiresAt > now());
     if (active.length !== entries.length) { entries = active; flush(); }
     return active.map((e) => (e.kind === 'dynamic'
-      ? { name: e.name, kind: 'dynamic', port: e.port, expiresAt: e.expiresAt }
+      ? { name: e.name, kind: 'dynamic', port: e.port, protocol: e.protocol === 'https' ? 'https' : 'http', expiresAt: e.expiresAt }
       : { name: e.name, kind: 'static', dir: e.dir, expiresAt: e.expiresAt }));
   }
 

package/src/routes/previews.js

@@ -10,12 +10,14 @@ export function previewRoutes({ previews, previewDomain, token }) {
   // dynamic reverse-proxy reachable at https://<name>.<DOMAIN>/ (only when previewDomain is set).
   r.post('/previews', async (req, res, next) => {
     if (!previews) return res.status(503).json({ error: 'previews disabled' });
-    const { name, dir, port } = req.body || {};
+    const { name, dir, port, protocol } = req.body || {};
     if (typeof name !== 'string' || !name) return res.status(400).json({ error: 'bad request' });
     const hasPort = port !== undefined && port !== null && port !== '';
     if (!hasPort && (typeof dir !== 'string' || !dir)) return res.status(400).json({ error: 'bad request' });
     try {
-      const out = await previews.register(hasPort ? { name, port } : { name, dir });
+      const dynamic = { name, port };
+      if (protocol !== undefined) dynamic.protocol = protocol;
+      const out = await previews.register(hasPort ? dynamic : { name, dir });
       if (out.error) return res.status(out.status).json({ error: out.error });
       const url = out.kind === 'dynamic'
         ? `https://${encodeURIComponent(out.name)}.${previewDomain}/?token=${encodeURIComponent(token)}`

package/src/routes/push.js

@@ -1,6 +1,7 @@
 // Web Push routes: hand the client the VAPID key, store/update/remove a browser PushSubscription, and
 // the local script-push send entry. The push module owns the delivery contract (TTL/topic/prune).
 import express from 'express';
+import { sanitizeNotificationUrl } from '../urlPolicy.js';
 
 export function pushRoutes({ push, notifications }) {
   const r = express.Router();
@@ -55,6 +56,8 @@ export function pushRoutes({ push, notifications }) {
     const { sessions, devices, title, body, tag, url } = req.body || {};
     if (typeof title !== 'string' || !title.trim()) return res.status(400).json({ error: 'title required' });
     if (typeof body !== 'string' || !body.trim()) return res.status(400).json({ error: 'body required' });
+    const safeUrl = url == null ? null : sanitizeNotificationUrl(url);
+    if (url != null && !safeUrl) return res.status(400).json({ error: 'url must be http(s) or relative' });
     const hasSessions = Array.isArray(sessions) && sessions.length > 0;
     const hasDevices = Array.isArray(devices) && devices.length > 0;
     if (hasSessions && hasDevices) return res.status(400).json({ error: 'use --session or --device, not both' });
@@ -66,7 +69,7 @@ export function pushRoutes({ push, notifications }) {
     // is stored on the record (surfaced in the detail), NOT used as the tap target.
     if (notifications) {
       const targetKeys = push.resolveTargetKeys({ devices: hasDevices ? devices : null, sessions: hasSessions ? sessions : null });
-      const rec = notifications.record(targetKeys, { title, body, tag: payload.tag, url });
+      const rec = notifications.record(targetKeys, { title, body, tag: payload.tag, url: safeUrl });
       payload.data = { inboxId: rec.id };
     }
     try {

package/src/routes/transcript.js

@@ -23,11 +23,24 @@ import { readClaudeContext } from '../usage.js';
 export function transcriptRoutes({ commands, claudeEvents }) {
   const r = express.Router();
 
+  // These three endpoints are one Claude-specific lens surface. Gate them together so a future endpoint
+  // cannot accidentally skip the invariant: explicit non-Claude requests and panes already bound to a
+  // non-Claude hook record are rejected before any cwd→newest-Claude-session fallback or screen scraping.
+  r.use(['/pending-prompt', '/context', '/transcript'], (req, res, next) => {
+    const pane = req.query.pane;
+    if (!isPaneId(pane)) return res.status(400).json({ error: 'bad pane id' });
+    const requested = req.query.agent;
+    const bound = claudeEvents && claudeEvents.paneAgent ? claudeEvents.paneAgent(pane) : null;
+    if ((requested != null && requested !== '' && requested !== 'claude') || (bound && bound !== 'claude')) {
+      return res.status(409).json({ error: 'chat lens unsupported for this agent' });
+    }
+    next();
+  });
+
   // The pending interactive PROMPT on the pane's screen — an AskUserQuestion menu or a tool-permission
   // menu — scraped from `capture-pane` (its options are NOT in the .jsonl while pending; see pendingPrompt.js).
   // Returns { prompt: {kind,title,options,cursor} | null }. Polled by the 对话 lens only while a gate is up.
   r.get('/pending-prompt', async (req, res, next) => {
-    if (!isPaneId(req.query.pane)) return res.status(400).json({ error: 'bad pane id' });
     try {
       const text = await commands.capturePlain(req.query.pane);
       return res.json({ prompt: parsePendingPrompt(text) });
@@ -39,7 +52,6 @@ export function transcriptRoutes({ commands, claudeEvents }) {
   // { model, usedPercent } (either may be null: capturer not opted in / session hasn't rendered / no hooks).
   // The 对话 composer polls this to show a small "模型 · 24%" chip. Best-effort: never 500 on a missing file.
   r.get('/context', (req, res, next) => {
-    if (!isPaneId(req.query.pane)) return res.status(400).json({ error: 'bad pane id' });
     try {
       const hooked = claudeEvents && claudeEvents.paneSession ? claudeEvents.paneSession(req.query.pane) : null;
       const sid = hooked && (hooked.sessionId || (hooked.transcriptPath ? path.basename(hooked.transcriptPath).replace(/\.jsonl$/, '') : null));
@@ -49,7 +61,6 @@ export function transcriptRoutes({ commands, claudeEvents }) {
   });
 
   r.get('/transcript', async (req, res, next) => {
-    if (!isPaneId(req.query.pane)) return res.status(400).json({ error: 'bad pane id' });
     const limit = Math.min(Math.max(Number(req.query.limit) || 10, 1), 100);
     const before = req.query.before != null && req.query.before !== '' ? Number(req.query.before) : null;
     try {

package/src/tmux/commands.js

@@ -78,10 +78,10 @@ export async function listPaneIds(target) {
 // per-pane display-message. The hook only records the pane id; location comes from here, always fresh.
 export async function listLivePanes() {
   return lines(await runTmux(['list-panes', '-a', '-F',
-    '#{pane_id}\t#{pane_current_command}\t#{session_name}\t#{window_id}\t#{window_name}']))
+    '#{pane_id}\t#{pane_current_command}\t#{pane_tty}\t#{session_name}\t#{window_id}\t#{window_name}']))
     .map((l) => {
-      const [id, cmd, session, window, windowName] = l.split('\t');
-      return { id, cmd, session, window, windowName };
+      const [id, cmd, tty, session, window, windowName] = l.split('\t');
+      return { id, cmd, tty, session, window, windowName };
     });
 }
 

package/src/urlPolicy.js

@@ -0,0 +1,14 @@
+// Notification links are user-supplied by `handmux push --url`. Keep relative in-app links, but reject
+// executable/non-web schemes (javascript:, data:, file:, …) before they reach storage or an <a href>.
+export function sanitizeNotificationUrl(value) {
+  if (typeof value !== 'string') return null;
+  const raw = value.trim();
+  if (!raw) return null;
+  try {
+    const parsed = new URL(raw, 'https://handmux.invalid/');
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return null;
+    return raw;
+  } catch {
+    return null;
+  }
+}