termdock 1.4.301 → 1.4.303

package/dist/server/agent/nativeResumeOwner.js

@@ -0,0 +1,29 @@
+import { integrationError } from './integrationStore.js';
+/** Last-known bindings select uncertain conflicts; only process observations
+ * prove a conversation is running. The caller separately verifies its own pane. */
+export async function assertNativeResumeAvailable(target, excludedBackendSessionId, candidates, observe) {
+    let uncertain = false;
+    for (const candidate of candidates) {
+        if (candidate.backendSessionId === excludedBackendSessionId)
+            continue;
+        const cachedMatch = candidate.cachedSlug === target.slug && candidate.cachedNativeId === target.nativeSessionId;
+        let processes;
+        try {
+            processes = await observe(candidate);
+        }
+        catch {
+            if (cachedMatch)
+                uncertain = true;
+            continue;
+        }
+        for (const process of processes) {
+            if (process.confirmed && process.agentSlug === target.slug && process.nativeId === target.nativeSessionId) {
+                integrationError('NATIVE_SESSION_ALREADY_RUNNING', 'Another terminal process proves the exact native conversation is running', 409);
+            }
+            if (cachedMatch && (!process.confirmed || process.agentSlug === target.slug && !process.nativeId))
+                uncertain = true;
+        }
+    }
+    if (uncertain)
+        integrationError('NATIVE_SESSION_OWNER_UNCONFIRMED', 'A possible native owner cannot be verified; inspect its terminal before restoring', 409);
+}

package/dist/server/agent/registry.js

@@ -220,7 +220,7 @@ function replayFlags(agent, argv) {
  * the only durable source available for a future recovery.
  */
 export function inferResumeSessionId(agent, argv) {
-    const safeId = (value) => value && /^[A-Za-z0-9._-]+$/.test(value) ? value : null;
+    const safeId = (value) => value && !value.startsWith('-') && /^[A-Za-z0-9._-]+$/.test(value) ? value : null;
     let named = -1;
     for (let index = 0; index < argv.length; index += 1) {
         if (tokenNamesAgent(argv[index], agent)) {
@@ -231,6 +231,36 @@ export function inferResumeSessionId(agent, argv) {
     if (named < 0)
         return null;
     const tail = argv.slice(named + 1);
+    if (agent.isPlugin) {
+        const template = getPluginResumeConfig(agent.slug)?.command.trim().split(/\s+/);
+        if (!template || !tokenNamesAgent(template[0], agent))
+            return null;
+        const pattern = template.slice(1);
+        if (pattern.join(' ').split('{sessionId}').length !== 2)
+            return null;
+        const matches = new Set();
+        // A positional resume command must start the argument tail. Flag-based
+        // templates may follow other launch flags, as for built-in --resume.
+        const starts = pattern[0]?.startsWith('-') ? tail.map((_, index) => index) : [0];
+        for (const start of starts) {
+            let id = null;
+            const matched = pattern.every((token, index) => {
+                const value = tail[start + index];
+                if (value === undefined)
+                    return false;
+                if (!token.includes('{sessionId}'))
+                    return token === value;
+                const [prefix, suffix] = token.split('{sessionId}');
+                if (!value.startsWith(prefix) || !value.endsWith(suffix))
+                    return false;
+                id = safeId(value.slice(prefix.length, suffix ? -suffix.length : undefined));
+                return !!id;
+            });
+            if (matched && id)
+                matches.add(id);
+        }
+        return matches.size === 1 ? [...matches][0] : null;
+    }
     if (agent.slug === 'codex') {
         const resume = tail.indexOf('resume');
         return resume >= 0 ? safeId(tail[resume + 1]) : null;

package/dist/server/routes/terminal.js

@@ -1,5 +1,6 @@
 import { collaborationSessionDisplayName } from '../utils/sessionDisplayName.js';
 import { integrationError } from '../agent/integrationStore.js';
+import { assertNativeResumeAvailable } from '../agent/nativeResumeOwner.js';
 import { integrationLaunchCommand } from '../agent/integrationSessions.js';
 import { ensureTeam } from '../agent/collaborationTeam.js';
 import { androidRecordings } from '../android/recording.js';
@@ -1596,7 +1597,9 @@ async function inspectCollaborationTmux(binding, requestedPane, allowPlainPane =
     if (!Number.isInteger(serverPid) || serverPid <= 0)
         throw new Error('TMUX_SERVER_IDENTITY_UNAVAILABLE');
     const panes = await Promise.all(layout.windows.flatMap((window) => window.panes).map(async (pane) => {
-        const program = await resolveTmuxPaneProgram(pane);
+        // Native identity needs the foreground argv even for a named binary;
+        // pane_current_command alone cannot prove an exact resumed conversation.
+        const program = await resolveTmuxPaneProgram(pane, true);
         const agent = detectAgentFromCommand(program?.rawArgs ?? program?.command ?? '', agentCustomCommands());
         const nativeSessionId = agent && program?.rawArgs ? inferResumeSessionId(agent, splitCommandToArgv(program.rawArgs)) : null;
         return { serverPid, sessionId: layout.sessionId, paneId: pane.id, panePid: pane.pid,
@@ -1897,11 +1900,55 @@ export const integrationSessionAdapter = {
         const agent = agentBySlug(record.agent_slug);
         if (!record.agent_native_session_id || !agent || !buildResumeCommand(agent, record.agent_native_session_id, null))
             integrationError('EXACT_RESUME_UNSUPPORTED', 'Agent plugin must support exact native resume');
-        if (findActiveAgentResumeOwner('', { slug: record.agent_slug, nativeSessionId: record.agent_native_session_id, command: '' }))
-            integrationError('NATIVE_SESSION_ALREADY_RUNNING', 'Native Agent conversation is already running', 409);
+        await assertIntegrationNativeResumeAvailable(record);
         await launchIntegrationTerminal(record, true, prepared);
     },
 };
+async function assertIntegrationNativeResumeAvailable(record) {
+    const own = integrationTerminalRecord(record);
+    // Refresh the shared Linux process snapshot once for this restore decision.
+    // Never use a recovered hook or the last-known UUID as live-owner proof.
+    if (process.platform === 'linux')
+        await getProcessSnapshot(true);
+    const candidates = [...terminalSessions].map(([backendSessionId, backend]) => {
+        const persisted = globalSessionState.sessions.find(entry => entry.backendSessionId === backendSessionId)?.agentResume;
+        return { backendSessionId, cachedSlug: backend.agent?.slug ?? persisted?.slug ?? null,
+            cachedNativeId: backend.agentSession?.sessionId ?? persisted?.sessionId ?? null };
+    });
+    await assertNativeResumeAvailable({ slug: record.agent_slug, nativeSessionId: record.agent_native_session_id }, own?.backendSessionId ?? null, candidates, async (candidate) => {
+        const backend = terminalSessions.get(candidate.backendSessionId);
+        if (!backend)
+            return [];
+        // Duplicate inventory attachments to the original owned pane are not
+        // another process; launchIntegrationTerminal verifies that pane again.
+        if (backend.mode === 'tmux' && backend.tmuxSessionName === own?.tmuxSessionName)
+            return [];
+        if (backend.mode === 'tmux' && backend.tmuxSessionName) {
+            try {
+                await runTmux(['has-session', '-t', `=${backend.tmuxSessionName}`]);
+            }
+            catch (error) {
+                if (/can't find session|no server running|no sessions|error connecting.*No such file/i.test(getErrorMessage(error)))
+                    return [];
+                throw error;
+            }
+            const layout = await getTmuxLayout(backend.tmuxSessionName);
+            return Promise.all(layout.windows.flatMap(window => window.panes).map(async (pane) => {
+                const program = await resolveTmuxPaneProgram(pane, true, true);
+                const agent = detectAgentFromCommand(program?.rawArgs ?? program?.command ?? '', agentCustomCommands());
+                const shell = !agent && await integrationPaneIsIdleShell({ panePid: pane.pid,
+                    isShell: shellNamesBackend.has(normalizeProgramName(program?.command ?? '')?.toLowerCase() ?? '') });
+                return { confirmed: shell || program?.source === 'tmux-tty' && Boolean(program.rawArgs),
+                    agentSlug: agent?.slug ?? null,
+                    nativeId: agent && program?.rawArgs ? inferResumeSessionId(agent, splitCommandToArgv(program.rawArgs)) : null };
+            }));
+        }
+        const program = await detectShellActiveProgram(backend);
+        const agent = detectAgentFromCommand(program?.rawArgs ?? program?.command ?? '', agentCustomCommands());
+        return [{ confirmed: !!program && program.source !== 'unknown', agentSlug: agent?.slug ?? null,
+                nativeId: agent && program?.rawArgs ? inferResumeSessionId(agent, splitCommandToArgv(program.rawArgs)) : null }];
+    });
+}
 async function launchIntegrationTerminal(record, restoring, prepared) {
     await collaborationDeliveryWorker.reconfigure(record.session_id, async () => {
         const group = collaborationStore.getGroup(record.group_id);
@@ -3824,9 +3871,9 @@ function parseProcessSnapshot(stdout) {
     })
         .filter((row) => row !== null);
 }
-async function getProcessSnapshot() {
+async function getProcessSnapshot(refresh = false) {
     const now = Date.now();
-    if (processSnapshot && now - processSnapshot.fetchedAt < PROCESS_SNAPSHOT_CACHE_TTL_MS) {
+    if (!refresh && processSnapshot && now - processSnapshot.fetchedAt < PROCESS_SNAPSHOT_CACHE_TTL_MS) {
         return processSnapshot.rows;
     }
     if (processSnapshotPromise)
@@ -3844,14 +3891,14 @@ async function getProcessSnapshot() {
     });
     return processSnapshotPromise;
 }
-async function resolveTmuxPaneProgram(pane) {
+async function resolveTmuxPaneProgram(pane, requireArgs = false, refreshTty = false) {
     // If pane command is a known shell, try to find a child foreground process
     const command = normalizeProgramName(pane.command);
     const commandKey = command?.toLowerCase() ?? null;
     const isShell = commandKey ? shellNamesBackend.has(commandKey) : false;
     // If pane command is NOT a shell but also too generic (e.g. "node"), also try
     const isGeneric = commandKey ? genericProgramNames.has(commandKey) : false;
-    if (!isShell && !isGeneric) {
+    if (!isShell && !isGeneric && !requireArgs) {
         // Non-shell, non-generic command — pane_current_command is good enough
         return { command, source: 'tmux-pane', rawArgs: null };
     }
@@ -3889,7 +3936,7 @@ async function resolveTmuxPaneProgram(pane) {
                     };
                 })
                     .filter((row) => row !== null);
-            });
+            }, refreshTty);
         }
         const selected = selectTmuxForegroundProgram({
             panePid: pane.pid,

package/docs/integrations.md

@@ -2,6 +2,9 @@
 
 最低 CLI / 运行服务版本：**termdock 1.4.300**，两者都必须升级并重启服务。
 启动输入条件与保留凭据的策略更新要求 **CLI / 实际运行服务均至少 1.4.301**；协议仍为 1。
+插件原生 ID 的前台 argv 回读及服务重启后的运行中 restore 核验修复要求
+**实际运行服务至少 1.4.302**。退出后的重复原生会话检查修复要求
+**实际运行服务至少 1.4.303**；建议 CLI 与服务同步安装 1.4.303（CLI 最低仍为 1.4.301）。
 现有 `--session`、消息投递、任务报告与自动协作入口继续兼容；旧的
 `task create --integration` 仍表示代码集成子任务，新身份使用 `--principal`。
 
@@ -79,13 +82,19 @@ CLI 使用当前运行服务的端口，默认 9834。每个端口的身份、
 
 ```json
 "startupInput": {
-  "allOf": ["model: GPT-5.5 (MAX) xhigh", "❯"],
+  "allOf": ["GPT-5.5 (MAX) xhigh", "❯"],
   "noneOf": ["model: loading"],
   "stableMs": 1000,
   "timeoutMs": 120000
 }
 ```
 
+TraeX 的恢复画面可能仅在 footer 显示模型，没有 `model:` 标题；因此示例不要求
+该前缀。管理员须同时核对冷启动和恢复画面，条件不匹配时保持待投递。
+模型 footer 可能被 Git 错误或键盘提示替换，此时含模型文字的 `allOf` 条件不会
+匹配。请选择实际画面中稳定且能区分加载阶段的文字；TD 不用原生 UUID ready、
+历史模型文字或推测的忙闲状态代替配置条件，超时也不会自动放宽。
+
 `allOf` 的每个字面文本都须出现，`noneOf` 的每个文本都须缺席；区分大小写，
 连续横向空白折叠为一个空格，不使用正则或终端历史。每组最多 16 项，每项
 1–256 字符，禁止控制字符；`allOf` 不能为空。`stableMs` 默认 1000，允许
@@ -280,11 +289,25 @@ session 事件；get 也会现场核验。120 秒内未形成绑定返回 `SESSI
 显式精确恢复可以重建承载终端；这本身不证明 Agent 原生会话恢复成功。新参数/profile
 不能覆盖原启动快照，尚未确定结果的恢复拒绝另一次恢复，防止重复 Agent。
 
+1.4.302 起，绑定核验会读取原 pane 的实际前台进程 argv，即使
+`pane_current_command` 已显示具体 Agent 程序名也不省略 argv。插件按已登记的
+`resume.command` 模板回读精确 ID，支持位置参数及独立/内联 ID 标志；不使用
+`--last`、缓存的 UUID 或画面内容替代进程证明。声明模板本身不证明恢复成功。
+服务重启后，原 pane 中精确 UUID 已在运行时 get 应回读 ready，restore 返回原
+operation/pane，不启动第二个 Agent；进程携带不同 UUID 时继续拒绝。
+
+1.4.303 起，集成 restore 排除自己的已核验终端；其他已登记终端须用当前前台
+进程证明同一个 UUID 才返回 `NATIVE_SESSION_ALREADY_RUNNING`。已退出到 shell、
+已消失或实际运行另一 UUID 的终端，其缓存/last-known 记录不算运行中所有者。
+可能持有原 UUID 的终端无法核验、或相同 Agent 正在运行但没有精确 ID 证据时，
+返回 `NATIVE_SESSION_OWNER_UNCONFIRMED` 并停止恢复；应检查该终端，不绕过保护。
+此检查覆盖服务已登记终端，不声称枚举其他应用中全部原生会话。
+
 常见失败码（每项都是完整字符串）：
 
 - 配置/权限：`LAUNCH_PROFILE_DENIED`, `LAUNCHER_UNAVAILABLE`, `COLLAB_AGENT_UNAVAILABLE`, `SESSION_CWD_MISSING`, `SESSION_CWD_DENIED`, `INTEGRATION_SESSION_NOT_FOUND`, `INTEGRATION_SESSION_LIMIT`。
 - 终端/身份：`SESSION_BACKEND_UNAVAILABLE`, `SESSION_TARGET_NOT_SHELL`, `SESSION_IDENTITY_MISMATCH`, `NATIVE_SESSION_ID_MISMATCH`, `NATIVE_SESSION_ID_INVALID`, `NATIVE_SESSION_ID_MISSING`。
-- 启动/恢复：`SESSION_CREATE_OUTCOME_UNKNOWN`, `SESSION_OPERATION_IN_PROGRESS`, `SESSION_BINDING_TIMEOUT`, `EXACT_RESUME_UNSUPPORTED`, `NATIVE_SESSION_ALREADY_RUNNING`, `AGENT_NOT_RUNNING`。
+- 启动/恢复：`SESSION_CREATE_OUTCOME_UNKNOWN`, `SESSION_OPERATION_IN_PROGRESS`, `SESSION_BINDING_TIMEOUT`, `EXACT_RESUME_UNSUPPORTED`, `NATIVE_SESSION_ALREADY_RUNNING`, `NATIVE_SESSION_OWNER_UNCONFIRMED`, `AGENT_NOT_RUNNING`。
 - 未分类异常：`SESSION_LAUNCH_FAILED`, `SESSION_OBSERVATION_FAILED`；错误不包含包装器输出、密钥或原始堆栈。
 
 ## 验收边界
@@ -296,8 +319,13 @@ session 事件；get 也会现场核验。120 秒内未形成绑定返回 `SESSI
 维护机未安装 TraeX；已用真实 tmux/终端程序复现加载期间丢弃输入，并验证配置条件
 阻止早投、仅写一次，以及无原生 UUID 时仍可放行；这不冒充真实 TraeX 启动验收。
 使用方已报告 1.4.300 开发机真实 TraeX UUID 捕获与精确恢复通过，原对话记忆、
-原 UUID、TD ID、attempt 和 artifact 保持一致。**1.4.301 的冷启动门控及超时诊断
-仍须使用方升级 CLI/实际运行服务后实机复验**，维护机没有代替完成该项。
+原 UUID、TD ID、attempt 和 artifact 保持一致。使用方已报告 1.4.301 冷启动首条
+仅写一次并收到明确 complete，超时保持 pending/0 次写入，策略更新保持凭据。
+维护机另外用真实 tmux/native fixture 验证插件 argv 回读、记录重载后运行中恢复
+不重复启动、不同 UUID 拒绝，以及进程退出后缓存 UUID 不再阻挡恢复。使用方已报告
+1.4.302 真实 TraeX 服务重启回读、运行中恢复不重启、不同 UUID 拒绝通过；显式恢复
+原 UUID 也已回读 ready，但配置的模型 footer 条件被暂态提示替换，输入仍保持待投递。
+**1.4.303 的真实 TraeX 退出后恢复与稳定输入条件仍须使用方实机复验**。
 回读 capabilities 后，应核对原 TD ID、真实 TraeX UUID 与原 argv/cwd/包装器快照，
 并验证 Agent 真正加载原对话。
 先完成测试环境的创建→追问→关联答复，再验重复键、追加咨询、断线重投和精确恢复。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.301",
+  "version": "1.4.303",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.301",
+  "version": "1.4.303",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-E9GDa4nrCXADRXdyPKufusZt6IcCr4m2mGdx5h34KMQ=",
-  "serverBundleHash": "sha256-U9YIANwjHQwosOcYtOh1PeorKlMRwpJ51AdTlfY4+H0=",
+  "serverBundleHash": "sha256-+P0Zwo5Zg52vSfyTrvxcfAIAuwY0+n4i4f0kTf8BC0g=",
   "clientBundleHash": "sha256-HOoNMOYhnph9XwUhSYE5W2CdI9Vb4g0c64ubW49LnXE=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"