termdock 1.4.347 → 1.4.348

package/dist/server/agent/integrationServer.js

@@ -307,6 +307,7 @@ export class IntegrationRuntime {
             session_launch_reload_fence: true, session_launch_reload_fence_min_version: '1.4.346',
             session_shell_startup_wait: true, session_shell_startup_wait_min_version: '1.4.346',
             session_profile_native_identity: process.platform === 'linux', session_profile_native_identity_min_version: '1.4.346',
+            session_profile_native_identity_home_aliases: process.platform === 'linux', session_profile_native_identity_home_aliases_min_version: '1.4.348',
             session_launch_diagnostics: true, session_launch_diagnostics_min_version: '1.4.314',
             session_cold_retry: true, session_cold_retry_min_version: '1.4.314',
             session_rename: true, session_rename_min_version: '1.4.315',
@@ -570,7 +571,7 @@ export class IntegrationRuntime {
         const key = `${p.id}:${p.groupId}:${consumer}`;
         // Resolve the initial cursor before sending headers so retention gaps
         // and bad consumer names are ordinary machine-readable HTTP errors.
-        const initial = this.store.page(p, consumer);
+        const initial = this.store.streamPage(p, consumer);
         cursor = initial.cursor;
         res.setHeader('Content-Type', 'application/x-ndjson');
         res.setHeader('Cache-Control', 'no-store');
@@ -585,13 +586,13 @@ export class IntegrationRuntime {
             try {
                 this.authorize(p, 'events.read');
                 for (;;) {
-                    const page = this.store.page(p, consumer, cursor);
+                    const page = this.store.streamPage(p, consumer, cursor);
                     if (!page.events.length)
                         break;
                     for (const event of page.events) {
                         if (res.writableLength > 1024 * 1024)
                             integrationError('EVENT_CONSUMER_SLOW', 'Reconnect from the last acknowledged cursor', 503);
-                        res.write(`${JSON.stringify({ type: 'event', ...event })}\n`);
+                        res.write(event.line);
                         cursor = event.cursor;
                         this.sent.set(key, Math.max(this.sent.get(key) ?? 0, event.sequence));
                     }

package/dist/server/agent/integrationSessions.js

@@ -714,10 +714,12 @@ export class IntegrationSessions {
             return record;
         }));
     }
-    async refresh(id, allowBindingReconciliation = true) {
+    async refresh(id, allowBindingReconciliation = true, presence) {
         const record = structuredClone(this.doc.sessions.find(s => s.session_id === id));
         if (!record)
             return;
+        const runtimePresent = () => presence && JSON.stringify(record) === JSON.stringify(presence.record)
+            ? Promise.resolve(presence.present) : this.adapter.runtimePresent?.(record);
         if (record.rename_pending) {
             if (this.lifecycle.active(id))
                 return;
@@ -744,7 +746,7 @@ export class IntegrationSessions {
                         integrationError('SESSION_CLOSE_UNSUPPORTED', 'Close reconciliation is unavailable', 409);
                     await this.adapter.closeRuntime(record, true);
                 }
-                if (!this.adapter.runtimePresent || await this.adapter.runtimePresent(record))
+                if (!this.adapter.runtimePresent || await runtimePresent())
                     integrationError('OPERATION_OUTCOME_UNCONFIRMED', 'Runtime exists for a closed or closing session', 409);
                 const next = { ...record, state: 'closed', runtime_present: false, terminal_binding: null, close_intent: undefined,
                     operation_uncertain: false, error_code: null, startup_input: undefined };
@@ -772,7 +774,7 @@ export class IntegrationSessions {
             try {
                 if (record.state !== 'released')
                     await this.adapter.release?.(record, true);
-                const present = await this.adapter.runtimePresent?.(record);
+                const present = await runtimePresent();
                 if (present === undefined)
                     integrationError('SESSION_RELEASE_UNSUPPORTED', 'Runtime presence is unavailable', 409);
                 if (record.state !== 'released') {
@@ -998,8 +1000,21 @@ export class IntegrationSessions {
         this.observing = true;
         this.observeAgain = false;
         try {
-            for (const record of this.snapshot())
-                await this.refresh(record.session_id);
+            const records = this.snapshot();
+            const dormant = records.filter(record => ['closed', 'released'].includes(record.state) && record.runtime_present === false
+                && !record.operation_uncertain && !record.close_intent && !record.rename_pending && !record.cold_retry_pending);
+            let presence;
+            if (dormant.length && this.adapter.runtimePresenceBatch) {
+                try {
+                    presence = await this.adapter.runtimePresenceBatch(dormant);
+                }
+                catch { /* Failed batch observations fall back to fresh per-record checks. */ }
+            }
+            const candidates = new Map(dormant.map(record => [record.session_id, record]));
+            for (const record of records) {
+                const candidate = candidates.get(record.session_id), present = presence?.get(record.session_id);
+                await this.refresh(record.session_id, true, candidate && typeof present === 'boolean' ? { record: candidate, present } : undefined);
+            }
         }
         finally {
             this.observing = false;

package/dist/server/agent/integrationStore.js

@@ -7,12 +7,18 @@ export const INTEGRATION_PROTOCOL = 1;
 export const INTEGRATION_OPERATIONS = ['message.send', 'message.read', 'task.read', 'task.create', 'task.configure', 'task.assign', 'task.comment', 'task.revise', 'task.answer', 'events.read', 'session.create', 'session.read', 'session.restore', 'session.release', 'session.rename', 'session.close'];
 export function integrationError(code, message, status = 400) { throw new CollaborationError(code, message, status); }
 export function atomicJson(file, value) {
+    atomicJsonText(file, JSON.stringify(value));
+}
+function atomicJsonText(file, serialized) {
+    atomicJsonWrite(file, descriptor => fs.writeFileSync(descriptor, serialized));
+}
+function atomicJsonWrite(file, write) {
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
     const temporary = `${file}.${process.pid}.tmp`;
     const descriptor = fs.openSync(temporary, 'w', 0o600);
     try {
         fs.fchmodSync(descriptor, 0o600);
-        fs.writeFileSync(descriptor, JSON.stringify(value));
+        write(descriptor);
         fs.fsyncSync(descriptor);
     }
     finally {
@@ -27,6 +33,42 @@ export function atomicJson(file, value) {
         fs.closeSync(directory);
     }
 }
+function atomicJsonBuffers(file, parts) {
+    atomicJsonWrite(file, descriptor => {
+        let index = 0, offset = 0;
+        while (index < parts.length) {
+            // Bound vectors below platform IOV_MAX, and handle short writes without
+            // replaying or dropping any byte of the checked JSON document.
+            const vectors = parts.slice(index, index + 512);
+            if (offset)
+                vectors[0] = vectors[0].subarray(offset);
+            let written;
+            try {
+                written = fs.writevSync(descriptor, vectors);
+            }
+            catch (error) {
+                if (error.code === 'EINTR')
+                    continue;
+                throw error;
+            }
+            if (written <= 0)
+                throw new Error('Integration journal write made no progress');
+            while (index < parts.length) {
+                const available = parts[index].length - offset;
+                if (written < available) {
+                    offset += written;
+                    break;
+                }
+                written -= available;
+                index++;
+                offset = 0;
+                if (!written)
+                    break;
+            }
+        }
+    });
+}
+const JSON_OPEN = Buffer.from('{'), JSON_CLOSE = Buffer.from('}'), JSON_COMMA = Buffer.from(','), ARRAY_OPEN = Buffer.from('['), ARRAY_CLOSE = Buffer.from(']'), EVENT_PREFIX = Buffer.from('{"type":"event",'), NEWLINE = Buffer.from('\n');
 const hash = (value) => createHash('sha256').update(value).digest('hex');
 function identifier(value, label) {
     if (typeof value !== 'string' || !/^[a-zA-Z0-9._-]{1,80}$/.test(value))
@@ -77,6 +119,11 @@ export class IntegrationStore {
     retention;
     doc = { version: 1, principals: [], events: [], sequences: {}, prunedThrough: {}, sources: {}, consumers: {} };
     listeners = new Set();
+    // Committed events and metadata are immutable inside the store. Keep the
+    // encoded event fragments, not another deep copy of their payloads. Pruned
+    // objects become collectible with their encodings.
+    encoded = new WeakMap();
+    groupEvents = new Map();
     constructor(file, retention = 10000) {
         this.file = file;
         this.retention = retention;
@@ -90,12 +137,52 @@ export class IntegrationStore {
             if (error.code !== 'ENOENT')
                 throw error;
         }
+        this.indexEvents();
+    }
+    indexEvents() {
+        this.groupEvents = new Map();
+        for (const event of this.doc.events) {
+            const events = this.groupEvents.get(event.group_id) ?? [];
+            events.push(event);
+            this.groupEvents.set(event.group_id, events);
+        }
+    }
+    encode(value) {
+        if (!value || typeof value !== 'object')
+            return Buffer.from(JSON.stringify(value));
+        const cached = this.encoded.get(value);
+        if (cached !== undefined)
+            return cached;
+        const serialized = Buffer.from(JSON.stringify(value));
+        this.encoded.set(value, serialized);
+        return serialized;
     }
     write(next) {
-        if (Buffer.byteLength(JSON.stringify(next)) > 64 * 1024 * 1024)
+        const parts = [JSON_OPEN];
+        for (const [index, [key, value]] of Object.entries(next).entries()) {
+            if (index)
+                parts.push(JSON_COMMA);
+            parts.push(Buffer.from(`${JSON.stringify(key)}:`));
+            if (key === 'events') {
+                parts.push(ARRAY_OPEN);
+                for (const [index, event] of next.events.entries()) {
+                    if (index)
+                        parts.push(JSON_COMMA);
+                    parts.push(this.encode(event));
+                }
+                parts.push(ARRAY_CLOSE);
+            }
+            else
+                parts.push(this.encode(value));
+        }
+        parts.push(JSON_CLOSE);
+        if (parts.reduce((bytes, part) => bytes + part.length, 0) > 64 * 1024 * 1024)
             integrationError('EVENT_STORAGE_FULL', 'Integration journal is full; no event was acknowledged', 503);
-        atomicJson(this.file, next);
+        atomicJsonBuffers(this.file, parts);
+        const eventsChanged = next.events !== this.doc.events;
         this.doc = next;
+        if (eventsChanged)
+            this.indexEvents();
         for (const listener of this.listeners) {
             try {
                 listener();
@@ -110,13 +197,12 @@ export class IntegrationStore {
         if (this.doc.principals.some(p => p.id === checked.id))
             integrationError('INTEGRATION_EXISTS', 'Use a new id; credentials cannot be silently replaced', 409);
         const token = randomBytes(32).toString('base64url');
-        const next = structuredClone(this.doc);
-        next.principals.push({ ...checked, tokenHash: hash(token), revoked: false });
+        const next = { ...this.doc, principals: [...this.doc.principals, { ...checked, tokenHash: hash(token), revoked: false }] };
         this.write(next);
-        return { principal: checked, token };
+        return { principal: structuredClone(checked), token };
     }
     update(policy) {
-        const checked = validatePolicy(policy), next = structuredClone(this.doc);
+        const checked = validatePolicy(policy), next = { ...this.doc, principals: [...this.doc.principals] };
         const index = next.principals.findIndex(principal => principal.id === checked.id);
         if (index < 0)
             integrationError('INTEGRATION_NOT_FOUND', 'Integration does not exist', 404);
@@ -129,11 +215,12 @@ export class IntegrationStore {
         this.write(next);
     }
     revoke(id) {
-        const next = structuredClone(this.doc), principal = next.principals.find(p => p.id === id);
+        const principal = this.doc.principals.find(p => p.id === id);
         if (!principal)
             integrationError('INTEGRATION_NOT_FOUND', 'Integration does not exist', 404);
-        principal.revoked = true;
-        this.write(next);
+        if (principal.revoked)
+            return;
+        this.write({ ...this.doc, principals: this.doc.principals.map(p => p.id === id ? { ...p, revoked: true } : p) });
     }
     authenticate(id, token) {
         const principal = this.doc.principals.find(p => p.id === id);
@@ -158,9 +245,10 @@ export class IntegrationStore {
         for (const update of updates) {
             if ((next ?? this.doc).sources[update.sourceKey] === update.sourceVersion)
                 continue;
-            next ??= structuredClone(this.doc);
+            next ??= { ...this.doc, events: [...this.doc.events], sequences: { ...this.doc.sequences },
+                sources: { ...this.doc.sources }, prunedThrough: { ...this.doc.prunedThrough } };
             const group = update.event.group_id, sequence = (next.sequences[group] ?? 0) + 1;
-            next.events.push({ ...update.event, event_id: update.eventId ?? randomUUID(), sequence, cursor: this.cursor(group, sequence) });
+            next.events.push({ ...structuredClone(update.event), event_id: update.eventId ?? randomUUID(), sequence, cursor: this.cursor(group, sequence) });
             next.sequences[group] = sequence;
             next.sources[update.sourceKey] = update.sourceVersion;
         }
@@ -191,21 +279,39 @@ export class IntegrationStore {
         return value.sequence;
     }
     key(principal, consumer) { identifier(consumer, 'consumer'); return `${principal.id}:${principal.groupId}:${consumer}`; }
-    page(principal, consumer, cursor) {
+    selectPage(principal, consumer, cursor) {
         this.authorize(principal, 'events.read');
         const key = this.key(principal, consumer), group = principal.groupId;
         const floor = this.doc.prunedThrough[group] ?? 0;
         // A new consumer explicitly starts at the earliest retained fact. Existing
         // consumers never silently skip a retention gap.
         if (this.doc.consumers[key] === undefined) {
-            const next = structuredClone(this.doc);
-            next.consumers[key] = floor;
-            this.write(next);
+            this.write({ ...this.doc, consumers: { ...this.doc.consumers, [key]: floor } });
         }
         const after = cursor ? this.decode(group, cursor) : this.doc.consumers[key];
         if (after < floor)
             integrationError('EVENT_RETENTION_GAP', 'Confirmed cursor is older than retained history; reconcile task/session snapshots and use a new consumer', 409);
-        return { events: structuredClone(this.doc.events.filter(e => e.group_id === group && e.sequence > after).slice(0, 100)), cursor: this.cursor(group, after) };
+        const events = this.groupEvents.get(group) ?? [];
+        let lo = 0, hi = events.length;
+        while (lo < hi) {
+            const mid = (lo + hi) >>> 1;
+            if (events[mid].sequence <= after)
+                lo = mid + 1;
+            else
+                hi = mid;
+        }
+        return { events: events.slice(lo, lo + 100), cursor: this.cursor(group, after) };
+    }
+    page(principal, consumer, cursor) {
+        return structuredClone(this.selectPage(principal, consumer, cursor));
+    }
+    /** Push uses immutable encoded facts rather than copying and re-encoding
+     * every retained payload for each consumer. No mutable record escapes. */
+    streamPage(principal, consumer, cursor) {
+        const page = this.selectPage(principal, consumer, cursor);
+        return { cursor: page.cursor, events: page.events.map(event => ({ sequence: event.sequence, cursor: event.cursor,
+                line: Object.hasOwn(event, 'type') ? Buffer.from(`${JSON.stringify({ type: 'event', ...event })}\n`)
+                    : Buffer.concat([EVENT_PREFIX, this.encode(event).subarray(1), NEWLINE]) })) };
     }
     ack(principal, consumer, cursor) {
         this.authorize(principal, 'events.read');
@@ -218,9 +324,8 @@ export class IntegrationStore {
             integrationError('EVENT_RETENTION_GAP', 'Consumer has a retention gap', 409);
         // Cursor is a cumulative declaration that every preceding event is safely
         // in the bridge inbox. The subscription server separately checks it was sent.
-        const next = structuredClone(this.doc);
-        next.consumers[key] = sequence;
-        this.write(next);
+        if (sequence !== confirmed)
+            this.write({ ...this.doc, consumers: { ...this.doc.consumers, [key]: sequence } });
         return { cursor, ack_semantics: 'durable_received' };
     }
     cursorSequence(group, cursor) { return this.decode(group, cursor); }

package/dist/server/agent/nativeProcessIdentity.js

@@ -11,8 +11,23 @@ export function nativeIdentityDirectory(config) {
     const expanded = c.directory.startsWith('~/') ? path.join(os.homedir(), c.directory.slice(2)) : c.directory;
     if (!path.isAbsolute(expanded))
         return null;
-    const directory = path.resolve(expanded), relative = path.relative(os.homedir(), directory);
-    return relative && relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative) ? directory : null;
+    const directory = path.resolve(expanded), home = os.homedir();
+    const within = (root) => {
+        const relative = path.relative(root, directory);
+        return !!relative && relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+    };
+    if (within(home))
+        return directory;
+    // cwd is canonicalized before launch. A symlinked home may therefore have
+    // two legitimate spellings even before the lock directory is created.
+    // Accept only the real home alias; the live provider still verifies the
+    // actual directory ownership, realpath, FD/inode, starttime and kernel lock.
+    try {
+        return within(fs.realpathSync(home)) ? directory : null;
+    }
+    catch {
+        return null;
+    }
 }
 /** Administrator-declared profile scope, never inferred from process env.
  * {cwd} is permitted only as a leading directory anchor and cannot escape it. */

package/dist/server/routes/terminal.js

@@ -77,6 +77,7 @@ import { CollaborationError } from '../agent/collaborationProtocol.js';
 import { resolveCollaborationBackend, resolveCollaborationSessionId } from '../agent/sessionBindingRecovery.js';
 import { CollaborationRoutingStore, selectCollaborationPane, selectDrivePane, assessCollaborationRouteIdentity } from '../agent/collaborationRouting.js';
 import { selectRecoveredIntegrationBinding } from '../agent/integrationRecoveryBinding.js';
+import { readTmuxLayout, readTmuxLayouts } from '../utils/tmuxLayoutReader.js';
 import { CollaborationDeliveryWorker } from '../agent/collaborationDeliveryWorker.js';
 import { approveCollaborationDialog, captureTmuxPaneHistory, captureTmuxPaneText, sendTmuxPaneKey, writeCollaborationTmuxPane } from '../agent/collaborationTmuxDelivery.js';
 import { listAllHookAgents, refreshStaleHooksAtLaunch, installHooksForSlug, uninstallHooksForSlug, } from '../agent/installers.js';
@@ -1724,9 +1725,9 @@ function formatLocalCollaborationMessages(frontendSessionId, messages) {
 async function inspectCollaborationTmux(binding, requestedPane, allowPlainPane = false, nativeProcessIdentity = false, freshProcess = false, describeNativeFailure = false, identityOverride) {
     if (!binding.tmuxSessionName)
         return { state: 'offline', reason: 'TMUX_BINDING_MISSING' };
-    const name = `=${binding.tmuxSessionName}`;
+    let layout;
     try {
-        await runTmux(['has-session', '-t', name]);
+        layout = await getTmuxLayout(binding.tmuxSessionName);
     }
     catch (error) {
         if (/can't find session|no server running|no sessions|error connecting.*No such file/i.test(getErrorMessage(error))) {
@@ -1734,10 +1735,9 @@ async function inspectCollaborationTmux(binding, requestedPane, allowPlainPane =
         }
         throw error;
     }
-    const layout = await getTmuxLayout(binding.tmuxSessionName);
     if (layout.sessionName !== binding.tmuxSessionName)
         throw new Error('TMUX_SESSION_IDENTITY_CHANGED');
-    const serverPid = Number((await runTmux(['display-message', '-p', '#{pid}'])).trim());
+    const serverPid = Number(layout.serverPid);
     if (!Number.isInteger(serverPid) || serverPid <= 0)
         throw new Error('TMUX_SERVER_IDENTITY_UNAVAILABLE');
     if ((nativeProcessIdentity || freshProcess) && process.platform === 'linux')
@@ -2150,6 +2150,11 @@ async function integrationTmuxPresent(record) {
         throw error;
     }
 }
+function integrationRuntimeRegistered(record) {
+    return !!integrationTerminalRecord(record)
+        || [...terminalSessions.values()].some(s => s.mode === 'tmux' && s.tmuxSessionName === `wt-integration-${record.session_id}`)
+        || !!collaborationStore.getGroup(record.group_id)?.sessionIds.includes(record.session_id);
+}
 async function verifyIntegrationRuntimeOwnership(record) {
     await integrationSessionAdapter.prepareRelease(record);
     const terminal = integrationTerminalRecord(record);
@@ -2290,14 +2295,22 @@ export const integrationSessionAdapter = {
             resume: getPluginResumeConfig(agent.slug) ?? command, nativeIdentity: integrationNativeIdentity(record) ?? getPluginNativeIdentityConfig(agent.slug) ?? null };
     },
     async runtimePresent(record) {
-        if (integrationTerminalRecord(record))
-            return true;
-        if ([...terminalSessions.values()].some(s => s.mode === 'tmux' && s.tmuxSessionName === `wt-integration-${record.session_id}`))
-            return true;
-        if (collaborationStore.getGroup(record.group_id)?.sessionIds.includes(record.session_id))
+        if (integrationRuntimeRegistered(record))
             return true;
         return integrationTmuxPresent(record);
     },
+    async runtimePresenceBatch(records) {
+        let names;
+        try {
+            names = new Set((await runTmux(['list-sessions', '-F', '#{session_name}'])).trimEnd().split('\n'));
+        }
+        catch (error) {
+            if (!/no server running|no sessions|error connecting.*No such file/i.test(getErrorMessage(error)))
+                throw error;
+            names = new Set();
+        }
+        return new Map(records.map(record => [record.session_id, integrationRuntimeRegistered(record) || names.has(`wt-integration-${record.session_id}`)]));
+    },
     async release(record, reconcile) {
         await releaseSessionRuntime({
             barrier: action => collaborationDeliveryWorker.reconfigure(record.session_id, action),
@@ -5069,166 +5082,12 @@ async function prepareManagedTmuxSession(sessionName, cwd) {
     await tmuxLifecycle.run(`prepare:${sessionName}`, () => prepareManagedTmuxSessionUnlocked(sessionName, cwd));
 }
 async function getTmuxLayout(sessionName) {
-    const sessionInfoRaw = (await runTmux([
-        'display-message',
-        '-t',
-        sessionName,
-        '-p',
-        `#{session_id}${TMUX_DELIMITER}#{session_name}${TMUX_DELIMITER}#{window_id}${TMUX_DELIMITER}#{pane_id}${TMUX_DELIMITER}#{pane_in_mode}`,
-    ])).trim();
-    const sessionInfo = parseDelimitedRow(sessionInfoRaw, 5);
-    if (!sessionInfo) {
-        throw new Error(`Failed to parse tmux session info: ${sessionInfoRaw}`);
-    }
-    const [sessionId, resolvedSessionName, activeWindowId, activePaneId, paneInMode] = sessionInfo;
-    const windowsRaw = await runTmux([
-        'list-windows',
-        '-t',
-        sessionName,
-        '-F',
-        `#{window_id}${TMUX_DELIMITER}#{window_name}${TMUX_DELIMITER}#{window_index}${TMUX_DELIMITER}#{window_active}`,
-    ]);
-    const windows = [];
-    for (const line of windowsRaw.trim().split('\n')) {
-        if (!line) {
-            continue;
-        }
-        const row = parseDelimitedRow(line, 4);
-        if (!row) {
-            continue;
-        }
-        const [windowId, windowName, windowIndexRaw, windowActiveRaw] = row;
-        const panesRaw = await runTmux([
-            'list-panes',
-            '-t',
-            windowId,
-            '-F',
-            `#{pane_id}${TMUX_DELIMITER}#{pane_index}${TMUX_DELIMITER}#{pane_active}${TMUX_DELIMITER}#{pane_width}${TMUX_DELIMITER}#{pane_height}${TMUX_DELIMITER}#{pane_top}${TMUX_DELIMITER}#{pane_left}${TMUX_DELIMITER}#{pane_current_command}${TMUX_DELIMITER}#{pane_pid}${TMUX_DELIMITER}#{pane_tty}${TMUX_DELIMITER}#{pane_title}${TMUX_DELIMITER}#{pane_current_path}`,
-        ]);
-        const panes = panesRaw.trim().split('\n').filter(Boolean).map((paneLine) => {
-            const paneRow = parseDelimitedRow(paneLine, 12);
-            if (!paneRow) {
-                return null;
-            }
-            const [paneId, paneIndexRaw, paneActiveRaw, widthRaw, heightRaw, topRaw, leftRaw, command, pidRaw, tty, title, currentPath] = paneRow;
-            return {
-                id: paneId,
-                index: parseInt(paneIndexRaw || '0', 10),
-                active: paneActiveRaw === '1',
-                width: parseInt(widthRaw || '0', 10),
-                height: parseInt(heightRaw || '0', 10),
-                top: parseInt(topRaw || '0', 10),
-                left: parseInt(leftRaw || '0', 10),
-                command: command || '',
-                pid: parseInt(pidRaw || '0', 10) || 0,
-                tty: tty || '',
-                title: title || '',
-                currentPath: currentPath || '',
-            };
-        }).filter((pane) => pane !== null);
-        windows.push({
-            id: windowId,
-            name: windowName || '',
-            index: parseInt(windowIndexRaw || '0', 10),
-            active: windowActiveRaw === '1',
-            panes,
-        });
-    }
-    return {
-        sessionId,
-        sessionName: resolvedSessionName,
-        windows,
-        activeWindowId,
-        activePaneId,
-        inCopyMode: paneInMode === '1',
-    };
+    return readTmuxLayout(runTmux, sessionName);
 }
 let tmuxLayoutsSnapshot = null;
 let tmuxLayoutsSnapshotPromise = null;
 async function buildTmuxLayoutsSnapshot() {
-    const [sessionsRaw, windowsRaw, panesRaw] = await Promise.all([
-        runTmux([
-            'list-sessions',
-            '-F',
-            `#{session_id}${TMUX_DELIMITER}#{session_name}${TMUX_DELIMITER}#{window_id}${TMUX_DELIMITER}#{pane_id}${TMUX_DELIMITER}#{pane_in_mode}`,
-        ]),
-        runTmux([
-            'list-windows',
-            '-a',
-            '-F',
-            `#{session_name}${TMUX_DELIMITER}#{window_id}${TMUX_DELIMITER}#{window_name}${TMUX_DELIMITER}#{window_index}${TMUX_DELIMITER}#{window_active}`,
-        ]),
-        runTmux([
-            'list-panes',
-            '-a',
-            '-F',
-            `#{session_name}${TMUX_DELIMITER}#{window_id}${TMUX_DELIMITER}#{pane_id}${TMUX_DELIMITER}#{pane_index}${TMUX_DELIMITER}#{pane_active}${TMUX_DELIMITER}#{pane_width}${TMUX_DELIMITER}#{pane_height}${TMUX_DELIMITER}#{pane_top}${TMUX_DELIMITER}#{pane_left}${TMUX_DELIMITER}#{pane_current_command}${TMUX_DELIMITER}#{pane_pid}${TMUX_DELIMITER}#{pane_tty}${TMUX_DELIMITER}#{pane_title}${TMUX_DELIMITER}#{pane_current_path}`,
-        ]),
-    ]);
-    const layouts = new Map();
-    for (const line of sessionsRaw.trim().split('\n')) {
-        if (!line)
-            continue;
-        const row = parseDelimitedRow(line, 5);
-        if (!row)
-            continue;
-        const [sessionId, sessionName, activeWindowId, activePaneId, paneInMode] = row;
-        layouts.set(sessionName, {
-            sessionId,
-            sessionName,
-            windows: [],
-            activeWindowId,
-            activePaneId,
-            inCopyMode: paneInMode === '1',
-        });
-    }
-    const windowsById = new Map();
-    for (const line of windowsRaw.trim().split('\n')) {
-        if (!line)
-            continue;
-        const row = parseDelimitedRow(line, 5);
-        if (!row)
-            continue;
-        const [sessionName, windowId, windowName, windowIndexRaw, windowActiveRaw] = row;
-        const layout = layouts.get(sessionName);
-        if (!layout)
-            continue;
-        const window = {
-            id: windowId,
-            name: windowName || '',
-            index: parseInt(windowIndexRaw || '0', 10),
-            active: windowActiveRaw === '1',
-            panes: [],
-        };
-        layout.windows.push(window);
-        windowsById.set(`${sessionName}\0${windowId}`, window);
-    }
-    for (const line of panesRaw.trim().split('\n')) {
-        if (!line)
-            continue;
-        const row = parseDelimitedRow(line, 14);
-        if (!row)
-            continue;
-        const [sessionName, windowId, paneId, paneIndexRaw, paneActiveRaw, widthRaw, heightRaw, topRaw, leftRaw, command, pidRaw, tty, title, currentPath] = row;
-        const window = windowsById.get(`${sessionName}\0${windowId}`);
-        if (!window)
-            continue;
-        window.panes.push({
-            id: paneId,
-            index: parseInt(paneIndexRaw || '0', 10),
-            active: paneActiveRaw === '1',
-            width: parseInt(widthRaw || '0', 10),
-            height: parseInt(heightRaw || '0', 10),
-            top: parseInt(topRaw || '0', 10),
-            left: parseInt(leftRaw || '0', 10),
-            command: command || '',
-            pid: parseInt(pidRaw || '0', 10) || 0,
-            tty: tty || '',
-            title: title || '',
-            currentPath: currentPath || '',
-        });
-    }
-    return layouts;
+    return readTmuxLayouts(runTmux);
 }
 async function getCachedTmuxLayout(sessionName) {
     if (tmuxLayoutsSnapshot && Date.now() - tmuxLayoutsSnapshot.fetchedAt < TMUX_LAYOUT_CACHE_TTL_MS) {

package/dist/server/utils/tmuxLayoutReader.js

@@ -0,0 +1,74 @@
+const separator = '\x1f';
+export const TMUX_LAYOUT_FORMAT = [
+    'pid', 'session_id', 'session_name', 'window_id', 'window_name', 'window_index', 'window_active',
+    'pane_id', 'pane_index', 'pane_active', 'pane_width', 'pane_height', 'pane_top', 'pane_left',
+    'pane_current_command', 'pane_pid', 'pane_tty', 'pane_title', 'pane_in_mode', 'pane_current_path',
+].map(field => `#{${field}}`).join(separator);
+export function parseTmuxLayout(stdout, requestedName) {
+    let layout;
+    const windows = new Map(), ids = new Set();
+    for (const line of stdout.trimEnd().split('\n')) {
+        if (!line)
+            continue;
+        const columns = line.replaceAll('\\037', separator).replaceAll('\\x1f', separator).split(separator);
+        if (columns.length < 20)
+            throw new Error('TMUX_LAYOUT_UNAVAILABLE');
+        const [server, sessionId, sessionName, windowId, name, windowIndex, windowActive, id, index, active, width, height, top, left, command, pid, tty, title, inMode] = columns;
+        const serverPid = Number(server);
+        if (!Number.isSafeInteger(serverPid) || serverPid <= 0 || sessionName !== requestedName || !sessionId || !windowId || !id
+            || ids.has(id) || layout && (layout.serverPid !== serverPid || layout.sessionId !== sessionId))
+            throw new Error('TMUX_SESSION_IDENTITY_CHANGED');
+        ids.add(id);
+        layout ??= { serverPid, sessionId, sessionName, windows: [], activeWindowId: '', activePaneId: '', inCopyMode: false };
+        let window = windows.get(windowId);
+        if (!window) {
+            window = { id: windowId, name, index: Number(windowIndex), active: windowActive === '1', panes: [] };
+            windows.set(windowId, window);
+            layout.windows.push(window);
+        }
+        else if (window.name !== name || window.index !== Number(windowIndex) || window.active !== (windowActive === '1')) {
+            throw new Error('TMUX_SESSION_IDENTITY_CHANGED');
+        }
+        const pane = { id, index: Number(index), active: active === '1', width: Number(width), height: Number(height),
+            top: Number(top), left: Number(left), command, pid: Number(pid), tty, title, currentPath: columns.slice(19).join(separator) };
+        if (![window.index, pane.index, pane.width, pane.height, pane.top, pane.left, pane.pid].every(Number.isSafeInteger)
+            || pane.pid <= 0)
+            throw new Error('TMUX_LAYOUT_UNAVAILABLE');
+        window.panes.push(pane);
+        if (window.active && pane.active) {
+            if (layout.activePaneId)
+                throw new Error('TMUX_SESSION_IDENTITY_CHANGED');
+            layout.activeWindowId = window.id;
+            layout.activePaneId = pane.id;
+            layout.inCopyMode = inMode === '1';
+        }
+    }
+    if (!layout || !layout.activePaneId)
+        throw new Error('TMUX_LAYOUT_UNAVAILABLE');
+    layout.windows.sort((a, b) => a.index - b.index);
+    for (const window of layout.windows)
+        window.panes.sort((a, b) => a.index - b.index);
+    return layout;
+}
+export async function readTmuxLayout(run, sessionName) {
+    return parseTmuxLayout(await run(['list-panes', '-s', '-t', `=${sessionName}:`, '-F', TMUX_LAYOUT_FORMAT]), sessionName);
+}
+export async function readTmuxLayouts(run) {
+    const rows = new Map();
+    for (const row of (await run(['list-panes', '-a', '-F', TMUX_LAYOUT_FORMAT])).trimEnd().split('\n')) {
+        const name = row.replaceAll('\\037', separator).replaceAll('\\x1f', separator).split(separator)[2];
+        if (!name)
+            continue;
+        const lines = rows.get(name) ?? [];
+        lines.push(row);
+        rows.set(name, lines);
+    }
+    const layouts = new Map();
+    for (const [name, lines] of rows) {
+        try {
+            layouts.set(name, parseTmuxLayout(lines.join('\n'), name));
+        }
+        catch { /* UI discovery can fall back to an exact fresh read of that session. */ }
+    }
+    return layouts;
+}

package/docs/integrations.md

@@ -1394,3 +1394,20 @@ wrapper 负责实际设置 Agent 自己的数据目录、准备 hooks/参数，
 - 终端输出触发的后台会话观察按 250ms 窗口合并；一轮观察期间的新通知安排到后续一轮，不连续抢占。显式 `session get`、生命周期操作及投递前核验保留原路径，不以此窗口判断 Agent 可输入；不延迟业务输入来猜测应用状态。同一次 integration 观察复用其新鲜 tmux layout，下一次观察重新读取，不把缓存用作身份写入凭据。
 
 无删除消息/事件、缩短历史、停用消费者、额外 Enter 或正文重发。`pty_written` 仍只代表终端写入调用完成，不代表应用提交或任务完成。回归包含约 26 MB journal 的空/重复追加零克隆、相同群同步零写入、真实变化/持久化失败重试、授权后历史补收、通知洪峰合并、换 pane/原生身份冲突拒绝。生产 CPU、事件循环延迟和 health 改善须在实际维护窗升级后对比采样，不能用隔离基准代替实机验收。
+
+## 1.4.348：真实提交、事件推送与 tmux 查询
+
+本轮透明性能优化不改变现有接口、JSON journal 格式、保留策略、权限、消息/ACK 语义或默认交互。实际运行服务需升级到 **1.4.348**；不是仅替换 CLI 文件。性能修复无新增权限或配置。
+
+- 真实事件/ACK/授权变更采用 copy-on-write，仅复制发生变化的容器与新事件，不再深拷贝整个 journal。内部已提交事实由 store 独占且不修改，公共 page/policy 返回独立副本；调用者修改输入或返回值不影响历史或编码缓存。
+- 未变化事件与元数据复用 UTF-8 编码，按有界向量写入临时文件，不再为大小检查和落盘重复生成全库 JSON，也避免临时巨型 UTF-16 字符串。64 MiB 上限检查覆盖实际待写全部字节。短写、Unicode 字节边界与 EINTR 均保留位置；文件 fsync → 原子 rename → 目录 fsync 后才发布提交结果。中途失败不推进内存 source/consumer 状态，不向订阅者报告成功；重试仍沿原来源/游标。
+- 同 cursor 重复 ACK 在权限、consumer、cursor、rewind、retention 检查后 no-op；HTTP 的已发送连续前缀检查仍先执行。此前已持久确认的进度不再次克隆/写盘/fsync，不能借相等游标绕过撤权或保留缺口。重复 revoke 也不重写未变化状态。
+- 事件按组建引用索引，并按 sequence 二分定位 page；仅公开 page 复制最多 100 条返回事实。主动推送复用已编码事实，不为每个 consumer 重复制/重编码历史 payload，保留原 NDJSON 字段、顺序、背压、授权复核及断线重放边界。
+- 新鲜 session layout 由一次只读 `list-panes -s` 获取 server/session/window/pane 元数据；常见单窗口的 integration 观察从 5 次 tmux 命令降到 1 次，另行原生进程/锁核验保持。侧栏原有多会话 layout 缓存的数据获取也由 3 次全局查询改为 1 次；缓存仍只服务原有发现用途。没有启用持久 attach/control client，不新增 client、改尺寸、焦点、copy-mode 或发送输入。
+- 同轮已关闭/释放且已确认零承载的后台存在性观察用一次新鲜会话名查询合并。结果仅用于该轮、且 descriptor 完整快照不变时才复用；批量查询失败、记录改变、操作不确定或进行中的生命周期走原逐项核验。显式 get、close/release/restore、实际投递前身份核验不使用该后台结果。
+
+仍是兼容的全量 JSON 快照落盘：真实提交的物理写入量和同步 fsync 等待未变为增量日志或异步存储，慢磁盘仍可能阻塞。不能把隔离基准解释为所有 HTTPS 长尾已解决。服务重启会重建内存索引/编码缓存，首次提交需编码保留事实；不会删除历史换取速度，也不会暂停业务消费者。
+
+回归覆盖重复 ACK 零克隆/编码/写入、真实持久提交与中途写入/fsync 失败后重试、短写与 Unicode、64 MiB 精确字节上限、输入/输出不可修改历史、分页/保留缺口/撤权、推送事实等价，以及隔离真实 tmux 的多窗口/分屏/激活 pane/copy-mode 与 client/PID/尺寸不变。Linux 维护机验证不代替 macOS 实机或私有 Agent 的业务验收。生产升级须与共享服务的在途任务和维护窗协调，不能因为收到版本通知就自动重启别人的实验。
+
+同时修复独立 profile 目录的 home 别名误拒：当逻辑 home 指向真实 home，规范化 cwd 下的 `{cwd}` 路径可匹配逻辑 home 或 `realpath(home)` 的严格子目录；不会将同名前缀兄弟目录视为 home，不创建尚不存在的锁目录。实际 provider 继续核验 canonicalHome、目录权限、精确进程实例、FD/inode 和内核持锁关系。Linux capabilities 新增 `session_profile_native_identity_home_aliases=true` 及 `session_profile_native_identity_home_aliases_min_version="1.4.348"`。旧 profile 快照不迁移，不自动 retry/create；347 的 `~/` 每 job 精确路径声明仍可沿原契约使用，更新同一 profile 与捕获快照需要由接入方串行协调。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.347",
+  "version": "1.4.348",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.347",
+  "version": "1.4.348",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-ObG1OGq7e7fMFQmYoPxPp3jRodEusYHulVNa5mT1aW8=",
-  "serverBundleHash": "sha256-FXUdT0eV3/+rgHBnc0Jg9dn2sAb4hcLY83xScGapcKQ=",
+  "serverBundleHash": "sha256-Jai7Kpw3RvG8IR/qVeAVGADGQlxRldYgpIR5+wLY9so=",
   "clientBundleHash": "sha256-kn3Tg+BTj+H4rZe0g9OE5JUEQNsBGiUSGew8Epm5A38=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"