termdock 1.4.365 → 1.4.367

package/dist/server/shared/chatDelivery.js

@@ -0,0 +1,31 @@
+import { hasUnconfirmedTerminalWrite } from '../agent/collaborationProtocol.js';
+export function chatDelivery(status, diagnostic, sessionId, fullService) {
+    if (status !== 'pending' || !diagnostic?.last_error)
+        return;
+    // Intermediate paste/submit stages belong to a live attempt. Only a
+    // failed attempt or restart reconciliation can make its outcome uncertain.
+    if (diagnostic.last_error === 'DELIVERY_IN_PROGRESS')
+        return;
+    if (/TERMINAL_INPUT_ECHO_UNCONFIRMED|TERMINAL_INPUT_UNAVAILABLE/.test(diagnostic.last_error)) {
+        // Cached clients still understand these existing states and recovery
+        // actions; newer clients add the specific check/cleanup guidance.
+        return hasUnconfirmedTerminalWrite(diagnostic)
+            ? { state: 'outcome-unknown', inputCheckFailed: true, ...(fullService ? { attemptCount: diagnostic.attempt_count } : {}) }
+            : { state: 'retrying', inputCheckFailed: true };
+    }
+    if (hasUnconfirmedTerminalWrite(diagnostic))
+        return { state: 'outcome-unknown', ...(fullService ? { attemptCount: diagnostic.attempt_count } : {}) };
+    if (diagnostic.route_state === 'identity-mismatch') {
+        // An unknown write outcome cannot be fixed by reconnecting and replaying.
+        const canRebind = diagnostic.route_diagnostics?.recovery === 'confirmation-required'
+            && diagnostic.route_diagnostics.reason !== 'DELIVERY_OUTCOME_UNCONFIRMED'
+            && /^[a-zA-Z0-9-]+$/.test(sessionId);
+        return { state: 'binding-required', ...(fullService && canRebind ? { canReconnect: true } : {}) };
+    }
+    if (diagnostic.last_error.startsWith('SHELL_CONFIRMATION_REQUIRED'))
+        return { state: 'shell-confirmation-required' };
+    if (/AGENT_LAUNCH_|SESSION_STARTUP_/.test(diagnostic.last_error))
+        return { state: 'starting' };
+    if (diagnostic.last_error !== 'DELIVERY_IN_PROGRESS')
+        return { state: 'retrying' };
+}

package/dist/server/shared/chatProgramPolicy.js

@@ -0,0 +1,26 @@
+export const NON_AGENT_PROGRAMS = new Set(['bash', 'zsh', 'fish', 'sh', 'dash', 'ksh', 'tcsh', 'csh', 'nu', 'node', 'nodejs', 'python', 'python3', 'ruby', 'perl', 'java', 'bun', 'deno', 'npm', 'npx', 'pnpm', 'yarn', 'uv', 'uvx', 'env']);
+const basename = (value) => value.split(/[/\\]/).pop()?.toLowerCase() || '';
+export function validChatProgramName(value, excluded = []) {
+    return /^[\p{L}\p{N}_.+-]{1,120}$/u.test(value) && !NON_AGENT_PROGRAMS.has(value.toLowerCase()) && !excluded.includes(value.toLowerCase());
+}
+export function chatProgramName(command) {
+    const tokens = (command.match(/"[^"\n]*"|'[^'\n]*'|[^\s]+/g) || []).map(token => token.replace(/^(["'])(.*)\1$/, '$2'));
+    return chatProgramNameFromArgv(tokens);
+}
+export function chatProgramNameFromArgv(argv) {
+    const tokens = [...argv];
+    while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0] || ''))
+        tokens.shift();
+    if (basename(tokens[0] || '') === 'env')
+        tokens.shift();
+    while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0] || ''))
+        tokens.shift();
+    let program = basename(tokens[0] || '');
+    if (['node', 'nodejs', 'python', 'python3', 'ruby', 'perl', 'bun', 'deno', 'npx', 'uvx', 'bash', 'zsh', 'sh', 'fish'].includes(program)) {
+        // Only a direct script/package operand is identifiable; flags may consume operands.
+        if (!tokens[1] || tokens[1].startsWith('-'))
+            return null;
+        program = basename(tokens[1]);
+    }
+    return validChatProgramName(program) ? program : null;
+}

package/dist/server/shared/chatReplyContext.js

@@ -0,0 +1,23 @@
+/** A short question excerpt without attachment envelopes or quoted earlier text. */
+export function chatReplyExcerpt(content) {
+    let text = content;
+    let files = [];
+    const marker = '```termdock-context\n', at = content.lastIndexOf(marker);
+    if (at >= 0 && (at === 0 || content.slice(0, at).endsWith('\n\n')) && content.endsWith('\n```')) {
+        try {
+            const value = JSON.parse(content.slice(at + marker.length, -4));
+            if (Array.isArray(value?.attachments) && Array.isArray(value?.mentions)
+                && value.attachments.every((file) => !!file && typeof file === 'object' && typeof file.name === 'string' && typeof file.path === 'string')) {
+                files = value.attachments;
+                text = content.slice(0, at ? at - 2 : 0);
+            }
+        }
+        catch { /* Literal or malformed code remains ordinary message text. */ }
+    }
+    text = text.replace(/^> [^\n]+ · \d{2}:\d{2}\n(?:>[^\n]*\n)+\n/, '');
+    text = text.replace(/【([^】@]+)@[^】]+】/g, '【$1】').replace(/\s+/g, ' ').trim();
+    if (!text)
+        text = files.map(file => file.reference || file.name).join('、') || '原消息';
+    const letters = Array.from(text);
+    return letters.length > 160 ? letters.slice(0, 159).join('') + '…' : text;
+}

package/dist/server/shared/codexLaunchCommand.js

@@ -0,0 +1,72 @@
+/** Restrict preparation to direct, prompt-free Codex launches. Shell programs,
+ * remote servers and existing conversation commands keep their own semantics. */
+export function codexColdLaunchArgv(command) {
+    if (!command || /[\r\n\x00$`]/.test(command))
+        return null;
+    const tokens = [];
+    let token = '', quote = '', escaped = false, started = false;
+    for (const char of command.trim()) {
+        if (escaped) {
+            token += char;
+            escaped = false;
+            started = true;
+            continue;
+        }
+        if (char === '\\' && quote !== "'") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (char === quote)
+                quote = '';
+            else
+                token += char;
+            started = true;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            started = true;
+            continue;
+        }
+        if (/\s/.test(char)) {
+            if (started)
+                tokens.push(token);
+            token = '';
+            started = false;
+            continue;
+        }
+        if (/[;&|<>$`(){}]/.test(char))
+            return null;
+        token += char;
+        started = true;
+    }
+    if (escaped || quote)
+        return null;
+    if (started)
+        tokens.push(token);
+    if (!tokens.length || tokens[0].split(/[\\/]/).at(-1) !== 'codex')
+        return null;
+    const switches = new Set(['--dangerously-bypass-approvals-and-sandbox', '--full-auto', '--no-alt-screen', '--search']);
+    const values = new Set(['-m', '--model', '-c', '--config', '-p', '--profile', '-s', '--sandbox', '-a', '--ask-for-approval', '--enable', '--disable']);
+    for (let i = 1; i < tokens.length; i++) {
+        const flag = tokens[i];
+        if (switches.has(flag))
+            continue;
+        if (values.has(flag) && i + 1 < tokens.length) {
+            i++;
+            continue;
+        }
+        const equal = flag.indexOf('=');
+        if (equal > 0 && values.has(flag.slice(0, equal)))
+            continue;
+        return null;
+    }
+    return tokens;
+}
+const shellQuote = (value) => `'${value.replace(/'/g, "'\\''")}'`;
+export function codexPreparedResumeCommand(argv, nativeId) {
+    if (!/^[a-zA-Z0-9._-]{8,160}$/.test(nativeId))
+        throw new Error('INVALID_CODEX_THREAD_ID');
+    return [...argv, 'resume', nativeId].map(shellQuote).join(' ');
+}

package/dist/server/shared/programStatus.js

@@ -67,7 +67,7 @@ export class ProgramStatusTracker {
     records = new Map();
     legacy = null;
     current = null;
-    feed(data) {
+    feed(data, namespace) {
         const previouslyActive = this.activeApps();
         const explicitEnd = new Set();
         const buffer = this.remaining + data;
@@ -89,6 +89,8 @@ export class ProgramStatusTracker {
                 const record = parseProgramStatus(match[2]);
                 if (!record)
                     continue;
+                if (namespace)
+                    record.id = record.id ? `${namespace}/${record.id}` : namespace;
                 this.native = true;
                 if (record.app && ['idle', 'done', 'error', 'clear'].includes(record.state))
                     explicitEnd.add(record.app);
@@ -98,6 +100,10 @@ export class ProgramStatusTracker {
                             this.records.delete(id);
                 }
                 else {
+                    const previous = this.records.get(record.id);
+                    if (record.state === 'done' && previous?.state === 'done' && previous.reviewed
+                        && previous.app === record.app && previous.msg === record.msg && previous.title === record.title)
+                        record.reviewed = true;
                     this.records.delete(record.id);
                     this.records.set(record.id, record);
                     if (this.records.size > 256)
@@ -106,7 +112,7 @@ export class ProgramStatusTracker {
             }
             else if (match[1] === '133' && /^(?:A|P)(?:;|$)/.test(match[2])) {
                 this.legacy = null;
-                this.dropActive();
+                this.dropActive(namespace);
             }
             else if (match[1] === '9' && !this.native) {
                 const progress = parseLegacyProgress(match[2]);
@@ -142,9 +148,16 @@ export class ProgramStatusTracker {
         this.legacy = null;
         return this.update();
     }
-    dropActive() {
+    acknowledgeCompletion() {
+        for (const record of this.records.values())
+            if (record.state === 'done')
+                record.reviewed = true;
+        return this.update();
+    }
+    dropActive(namespace) {
         for (const [id, record] of this.records)
-            if (['working', 'blocked', 'idle'].includes(record.state))
+            if (['working', 'blocked', 'idle'].includes(record.state)
+                && (!namespace || id === namespace || id.startsWith(`${namespace}/`)))
                 this.records.delete(id);
     }
     update() {
@@ -156,7 +169,8 @@ export class ProgramStatusTracker {
         if (selected) {
             const app = this.appFor(selected);
             progress = { source: 'osc7501', state: selected.state === 'working' ? selected.progress === undefined ? 'indeterminate' : 'set' : selected.state,
-                progress: selected.progress ?? null, app, message: selected.msg ?? selected.title, kind: selected.kind };
+                progress: selected.progress ?? null, app, message: selected.msg ?? selected.title, kind: selected.kind,
+                ...(selected.reviewed ? { reviewed: true } : {}) };
         }
         const changed = JSON.stringify(progress) !== JSON.stringify(this.current);
         this.current = progress;

package/dist/server/shared/sessionChatAttention.js

@@ -0,0 +1 @@
+export {};

package/dist/server/utils/autoUpdate.js

@@ -88,7 +88,8 @@ export class TermdockAutoUpdateManager {
         });
         return this.checkPromise;
     }
-    confirmRestart(expectedVersion) {
+    /** Validate every participant before a coordinated restart interrupts any of them. */
+    prepareRestart(expectedVersion) {
         if (this.state.status !== 'ready' || !hasPendingTermdockUpdate(this.state)) {
             throw new TermdockUpdateStateChangedError('No installed Termdock update is waiting for restart.');
         }
@@ -105,6 +106,10 @@ export class TermdockAutoUpdateManager {
             this.installationError(error);
             throw error;
         }
+        return this.getState();
+    }
+    confirmRestart(expectedVersion) {
+        this.prepareRestart(expectedVersion);
         this.setState({ ...this.state, status: 'restarting', error: null });
         try {
             this.dependencies.requestRestart();

package/dist/server/utils/codexSharedDaemon.js

@@ -0,0 +1,26 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+/** Codex TUIs reconnect to this user's managed daemon. Its thread writer is
+ * shared by those clients, so its open rollout is not a second terminal. */
+export function isSharedCodexDaemonCommand(executable, argv, codexHome) {
+    const releases = path.join(codexHome, 'packages', 'app-server-daemon', 'releases');
+    const relative = path.relative(releases, executable);
+    const listen = argv.indexOf('--listen');
+    return relative !== '' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)
+        && path.basename(executable) === 'codex' && argv[1] === 'app-server'
+        && argv.includes('--managed-daemon') && listen > 1 && argv[listen + 1] === 'unix://';
+}
+export async function isSharedCodexDaemon(pid, codexHome) {
+    if (process.platform !== 'linux' || !process.getuid)
+        return false;
+    try {
+        const directory = `/proc/${pid}`;
+        const [stat, executable, command, home] = await Promise.all([
+            fs.stat(directory), fs.readlink(`${directory}/exe`), fs.readFile(`${directory}/cmdline`, 'utf8'), fs.realpath(codexHome),
+        ]);
+        return stat.uid === process.getuid() && isSharedCodexDaemonCommand(executable, command.split('\0').filter(Boolean), home);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/server/utils/onboardingTheme.js

@@ -0,0 +1,23 @@
+import fs from 'node:fs';
+/** The HTTP setup page uses the same token source as the application. */
+export function buildOnboardingTheme() {
+    const source = fs.readFileSync(new URL('../../../src/index.css', import.meta.url), 'utf8');
+    const tokens = ['background', 'foreground', 'surface', 'surface-2', 'muted-foreground', 'border', 'primary', 'primary-foreground', 'warning', 'accent'];
+    const block = (selector) => {
+        const start = source.indexOf(`${selector} {`);
+        if (start < 0)
+            throw new Error(`Missing theme: ${selector}`);
+        const body = source.slice(start, source.indexOf('\n}', start));
+        return tokens.map(name => {
+            const value = body.match(new RegExp(`--${name}:\\s*([^;]+);`))?.[1];
+            if (!value)
+                throw new Error(`Missing token: ${name}`);
+            return `--${name}:${value};`;
+        }).join('');
+    };
+    return `:root{${block(':root')}}@media(prefers-color-scheme:light){:root{${block("html[data-theme='light']")}}}`;
+}
+export function loadOnboardingTheme() {
+    const built = new URL('../onboarding-theme.css', import.meta.url);
+    return fs.existsSync(built) ? fs.readFileSync(built, 'utf8') : buildOnboardingTheme();
+}

package/dist/server/utils/recoveryAgentConfirmation.js

@@ -0,0 +1,30 @@
+/** A submitted resume command is not evidence that its conversation returned. */
+export async function confirmRecoveryAgent(options) {
+    const deadline = Date.now() + (options.timeoutMs ?? 120_000);
+    let matchedAt = null, shellAt = null;
+    do {
+        const observed = await options.observe();
+        if (observed.slug === options.expectedSlug && observed.nativeId === options.expectedNativeId) {
+            matchedAt ??= Date.now();
+            if (Date.now() - matchedAt >= (options.stableForMs ?? 1000))
+                return;
+        }
+        else
+            matchedAt = null;
+        if (observed.shell) {
+            shellAt ??= Date.now();
+            if (Date.now() - shellAt >= 3000)
+                break;
+        }
+        else
+            shellAt = null;
+        if (observed.slug && (observed.slug !== options.expectedSlug
+            || observed.nativeId && observed.nativeId !== options.expectedNativeId)) {
+            throw Object.assign(new Error('A different Agent conversation is running in this terminal'), { code: 'RECOVERY_TARGET_BUSY' });
+        }
+        if (Date.now() >= deadline)
+            break;
+        await new Promise(resolve => setTimeout(resolve, options.intervalMs ?? 500));
+    } while (Date.now() <= deadline);
+    throw Object.assign(new Error('The original Agent conversation has not returned; check the terminal before retrying'), { code: 'RECOVERY_AGENT_UNCONFIRMED' });
+}

package/dist/server/utils/terminalOutputActivity.js

@@ -1,11 +1,14 @@
 /** Terminal byte activity only; no agent hooks, transcript inspection or polling. */
-export const OUTPUT_START_DELAY_MS = 2_000;
-export const OUTPUT_START_RECENCY_MS = 500;
-export const OUTPUT_IDLE_MS = 2_000;
+export const OUTPUT_START_DELAY_MS = 600;
+export const OUTPUT_START_RECENCY_MS = 1_500;
+export const OUTPUT_MIN_SPAN_MS = 150;
+// This reports recent output, not an inferred job spanning silent tool calls.
+export const OUTPUT_IDLE_MS = 3_000;
 export class TerminalOutputActivity {
     publish;
     now;
     phase = 'idle';
+    firstOutput = 0;
     lastOutput = 0;
     deadline = 0;
     timer;
@@ -27,29 +30,44 @@ export class TerminalOutputActivity {
         this.lastOutput = this.now();
         if (this.phase === 'idle') {
             this.phase = 'pending';
+            this.firstOutput = this.lastOutput;
             this.deadline = this.lastOutput + OUTPUT_START_DELAY_MS;
             this.schedule(this.deadline);
         }
+        else if (this.phase === 'pending') {
+            this.settle();
+        }
         // Active/pending windows retain one timer; packets only update this number.
     }
-    dispose() {
+    dispose(notify = false) {
+        const wasActive = this.phase === 'active';
         this.disposed = true;
         this.phase = 'idle';
         if (this.timer !== undefined)
             clearTimeout(this.timer);
         this.timer = undefined;
+        if (notify && wasActive)
+            this.publish(false);
     }
     settle() {
         if (this.disposed || this.phase === 'idle')
             return;
         const now = this.now();
         if (this.phase === 'pending') {
-            if (now < this.deadline)
+            if (now < this.firstOutput + OUTPUT_START_DELAY_MS)
                 return;
+            if (now - this.lastOutput < OUTPUT_START_RECENCY_MS && this.lastOutput - this.firstOutput < OUTPUT_MIN_SPAN_MS) {
+                // Keep a lone burst as a candidate long enough for a 1 Hz TUI timer.
+                // It still never activates without a second, sufficiently spaced write.
+                this.deadline = this.lastOutput + OUTPUT_START_RECENCY_MS;
+                return;
+            }
             if (this.timer !== undefined)
                 clearTimeout(this.timer);
             this.timer = undefined;
-            if (now - this.lastOutput > OUTPUT_START_RECENCY_MS) {
+            // Multiple chunks from one instantaneous write are still a single burst.
+            // Qualify a short span of real updates, not one exact final sampling slot.
+            if (this.lastOutput - this.firstOutput < OUTPUT_MIN_SPAN_MS || now - this.lastOutput >= OUTPUT_START_RECENCY_MS) {
                 this.phase = 'idle';
                 return;
             }
@@ -69,9 +87,13 @@ export class TerminalOutputActivity {
         this.timer = setTimeout(() => {
             this.timer = undefined;
             this.settle();
-            if (this.phase === 'active' && this.timer === undefined)
-                this.schedule(this.lastOutput + OUTPUT_IDLE_MS);
-        }, Math.max(1, deadline - this.now()));
+            if (this.timer === undefined) {
+                if (this.phase === 'pending')
+                    this.schedule(this.deadline);
+                else if (this.phase === 'active')
+                    this.schedule(this.lastOutput + OUTPUT_IDLE_MS);
+            }
+        }, Math.max(1, Math.ceil(deadline - this.now())));
         this.timer.unref?.();
     }
 }

package/dist/server/utils/tmuxConfigurationBatch.js

@@ -0,0 +1,22 @@
+/** Data ending in a semicolon must not become a tmux command separator. */
+export function batchTmuxCommands(commands) {
+    return commands.flatMap((command, index) => [
+        ...(index ? [';'] : []),
+        ...command.map(value => value.endsWith(';') ? `${value.slice(0, -1)}\\;` : value),
+    ]);
+}
+/** Only use for idempotent configuration writes, never queries or lifecycle
+ * commands. Replay the original per-command handling if a legacy tmux rejects
+ * any part of the batch; a failed batch may already have applied earlier writes. */
+export async function batchTmuxConfiguration(run, configure) {
+    const commands = [];
+    await configure(async (command) => { commands.push(command); });
+    if (!commands.length)
+        return;
+    try {
+        await run(batchTmuxCommands(commands));
+    }
+    catch {
+        await configure(run);
+    }
+}

package/dist/server/utils/tmuxPaneOutput.js

@@ -0,0 +1,173 @@
+import { spawn } from 'node:child_process';
+/** Extract only bounded status OSCs from tmux's octal-escaped output. Ordinary
+ * pane contents are never retained or forwarded to the metadata consumer. */
+class TmuxPaneStatusParser {
+    emit;
+    pending = '';
+    constructor(emit) {
+        this.emit = emit;
+    }
+    feed(bytes) {
+        const prefixes = ['\\033]7501;', '\\033]133;', '\\033]9;4;'];
+        for (let offset = 0; offset < bytes.length; offset += 16384) {
+            const buffer = this.pending + bytes.subarray(offset, offset + 16384).toString('ascii');
+            const pattern = /\\033\](?:7501;|133;|9;4;)[^\\]*(?:\\007|\\033\\134)/g;
+            let match, consumed = 0;
+            while ((match = pattern.exec(buffer))) {
+                consumed = pattern.lastIndex;
+                this.emit(match[0].replace(/\\([0-7]{3})/g, (_, code) => String.fromCharCode(parseInt(code, 8))));
+            }
+            const start = buffer.lastIndexOf('\\033]');
+            const candidate = start >= consumed ? buffer.slice(start) : '';
+            this.pending = candidate && candidate.length <= 4096 && prefixes.some(prefix => prefix.startsWith(candidate) || candidate.startsWith(prefix)) ? candidate : '';
+            if (!this.pending)
+                for (const prefix of ['\\033', '\\03', '\\0', '\\'])
+                    if (buffer.endsWith(prefix)) {
+                        this.pending = prefix;
+                        break;
+                    }
+        }
+    }
+}
+/** Consume framing in constant space, optionally extracting explicit status. */
+export class TmuxPaneOutputParser {
+    onStatus;
+    prefix = '';
+    line = 'header';
+    pane = '';
+    status = new Map();
+    constructor(onStatus) {
+        this.onStatus = onStatus;
+    }
+    statusBytes(bytes) {
+        if (!this.onStatus || !bytes.length)
+            return;
+        let parser = this.status.get(this.pane);
+        if (!parser) {
+            if (this.status.size >= 256)
+                this.status.delete(this.status.keys().next().value);
+            const pane = this.pane;
+            parser = new TmuxPaneStatusParser(sequence => this.onStatus(sequence, pane));
+            this.status.set(pane, parser);
+        }
+        parser.feed(bytes);
+    }
+    feed(bytes) {
+        let output = false;
+        for (let start = 0; start < bytes.length;) {
+            const newline = bytes.indexOf(10, start);
+            const end = newline < 0 ? bytes.length : newline;
+            if (this.line === 'header') {
+                const fragment = bytes.subarray(start, Math.min(end, start + 64 - this.prefix.length)).toString('ascii');
+                this.prefix += fragment;
+                const header = /^%output (%\d+) /.exec(this.prefix);
+                if (header) {
+                    // The protocol escapes embedded newlines and backslashes; a pane
+                    // cannot forge a second notification inside its output payload.
+                    output ||= this.prefix.length > header[0].length || end - start > fragment.length;
+                    this.pane = header[1];
+                    this.statusBytes(Buffer.from(this.prefix.slice(header[0].length), 'ascii'));
+                    this.statusBytes(bytes.subarray(start + fragment.length, end));
+                    this.line = 'output';
+                    this.prefix = '';
+                }
+                else if (this.prefix.length >= 64) {
+                    this.line = 'ignore';
+                    this.prefix = '';
+                }
+            }
+            else if (this.line === 'output' && end > start) {
+                output = true;
+                this.statusBytes(bytes.subarray(start, end));
+            }
+            if (newline < 0)
+                break;
+            this.prefix = '';
+            this.line = 'header';
+            start = newline + 1;
+        }
+        return output;
+    }
+}
+/** One read-only source per backend session, shared by every browser. Control
+ * mode reports actual pane writes, not attach snapshots or display redraws.
+ * No PTY, resize, input, capture-pane polling or command execution is involved. */
+export class TmuxPaneOutputObserver {
+    binary;
+    target;
+    onOutput;
+    onUnavailable;
+    spawnControl;
+    onStatus;
+    child = null;
+    retry;
+    disposed = false;
+    failures = 0;
+    startedAt = 0;
+    constructor(binary, target, onOutput, onUnavailable, spawnControl = (binary, args, options) => spawn(binary, args, options), onStatus) {
+        this.binary = binary;
+        this.target = target;
+        this.onOutput = onOutput;
+        this.onUnavailable = onUnavailable;
+        this.spawnControl = spawnControl;
+        this.onStatus = onStatus;
+    }
+    start() {
+        if (this.disposed || this.child || this.retry !== undefined)
+            return;
+        this.startedAt = performance.now();
+        const parser = new TmuxPaneOutputParser(this.onStatus);
+        let child;
+        try {
+            // -r is read-only,ignore-size: this client must never take ownership of
+            // the task's grid. It stays on the exact session, including hidden panes.
+            const env = { ...process.env };
+            delete env.TMUX;
+            delete env.TMUX_PANE;
+            child = this.spawnControl(this.binary, ['-u', '-C', 'attach-session', '-r', '-t', this.target], { stdio: ['pipe', 'pipe', 'ignore'], env });
+        }
+        catch {
+            this.failed();
+            return;
+        }
+        this.child = child;
+        child.stdout?.on('data', (bytes) => {
+            if (this.child === child && !this.disposed && parser.feed(bytes))
+                this.onOutput();
+        });
+        const failed = () => {
+            if (this.child !== child || this.disposed)
+                return;
+            this.child = null;
+            child.stdout?.removeAllListeners('data');
+            child.stdin?.destroy();
+            child.kill();
+            this.failed();
+        };
+        child.stdout?.once('error', failed);
+        child.once('error', failed);
+        child.once('exit', failed);
+    }
+    dispose() {
+        this.disposed = true;
+        if (this.retry !== undefined)
+            clearTimeout(this.retry);
+        this.retry = undefined;
+        const child = this.child;
+        this.child = null;
+        child?.stdout?.removeAllListeners('data');
+        child?.stdin?.destroy();
+        // Kill only this control client; never the pane, session or tmux server.
+        child?.kill();
+    }
+    failed() {
+        if (this.disposed)
+            return;
+        this.onUnavailable();
+        if (performance.now() - this.startedAt >= 5_000)
+            this.failures = 0;
+        const delay = Math.min(30_000, 1_000 * 2 ** Math.min(this.failures++, 5));
+        this.retry = setTimeout(() => { this.retry = undefined; this.start(); }, delay);
+        this.retry.unref?.();
+    }
+}

package/dist/server/utils/tmuxRecovery.js

@@ -1,3 +1,10 @@
+/** A shared server loss can reconnect known conversations once. Individual
+ * exits and unknown scans stay manual; a failed attempt is never auto-retried. */
+export function shouldAutomaticallyRecoverTmuxIncident(incident, operationIncidentIds) {
+    return Boolean(incident && incident.previousServerPid !== null
+        && incident.previousServerPid !== incident.currentServerPid
+        && !operationIncidentIds.includes(incident.id));
+}
 export function normalizeTmuxRecoveryIncident(input) {
     if (!input || typeof input !== 'object')
         return null;
@@ -25,7 +32,10 @@ export function detectTmuxRecoveryIncident(input) {
         && !input.dismissedSessionIds?.has(candidate.sessionId)
         && !input.restoredSessionIds?.has(candidate.sessionId)
         && !intentionallyDeleting.has(candidate.tmuxSessionName));
-    const missing = recoverable.filter((candidate) => !input.liveSessionNames.has(candidate.tmuxSessionName));
+    const generationChanged = input.previousServerPid !== null && input.currentServerPid !== null
+        && input.previousServerPid !== input.currentServerPid;
+    const missing = recoverable.filter((candidate) => !input.liveSessionNames.has(candidate.tmuxSessionName)
+        || (generationChanged || candidate.runtimeLost === true) && candidate.agentRunning === false);
     const existingIncident = input.existingIncident;
     if (existingIncident) {
         const eligibleIds = new Set(recoverable.map(candidate => candidate.sessionId));

package/dist/server/utils/tmuxRecoveryOperations.js

@@ -224,13 +224,13 @@ export class TmuxRecoveryOperationStore {
         }
         return this.get(id);
     }
-    async dismissPausedOperations() {
-        if (this.all().some(operation => !canDismissTmuxRecoveryOperation(operation))) {
+    async dismissPausedOperations(incidentId) {
+        const operations = this.state.operations.filter(operation => !incidentId || operation.incidentId === incidentId);
+        if (operations.some(operation => !canDismissTmuxRecoveryOperation(summarizeRecoveryOperation(operation)))) {
             throw new TmuxRecoveryOperationError('RECOVERY_OPERATION_ACTIVE', 'Pause recovery and wait for running items to finish before dismissing the incident.');
         }
-        for (const operation of this.state.operations) {
-            if (!terminalState(operation.state))
-                operation.dismissedAt = Date.now();
+        for (const operation of operations) {
+            operation.dismissedAt = Date.now();
         }
         await this.persist();
         this.emit();