tmux-ide 2.1.5 → 2.6.1

package/packages/daemon/dist/lib/daemon-watchdog.js

@@ -0,0 +1,98 @@
+/**
+ * Orphaned legacy crash-recovery watchdog for the old per-session daemon.
+ *
+ * The canonical daemon is now owned by Electron or `tmux-ide --headless`.
+ * No supported code path should spawn this file.
+ *
+ * Minimal crash-recovery watchdog for the tmux-ide daemon.
+ * Respawns daemon.ts on unexpected exits with exponential backoff.
+ * Gives up after 5 crashes within 60 seconds.
+ *
+ * Entry: bun src/lib/daemon-watchdog.ts <session> [port]
+ *
+ * ZERO imports from business logic — this file must never crash
+ * due to broken application code.
+ */
+import { spawn } from "node:child_process";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { appendFileSync, mkdirSync, existsSync } from "node:fs";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const sessionArg = process.argv[2];
+const port = process.argv[3] ?? "0";
+if (!sessionArg) {
+    console.error("Usage: daemon-watchdog.ts <session> [port]");
+    process.exit(1);
+}
+const session = sessionArg;
+const daemonScript = resolve(__dirname, "daemon.ts");
+let backoffMs = 1000;
+let crashCount = 0;
+let lastCrashTime = 0;
+let child = null;
+function logError(msg) {
+    try {
+        const tasksDir = resolve(process.cwd(), ".tasks");
+        if (!existsSync(tasksDir))
+            mkdirSync(tasksDir, { recursive: true });
+        const entry = JSON.stringify({
+            timestamp: new Date().toISOString(),
+            type: "error",
+            source: "daemon-watchdog",
+            message: msg,
+        });
+        appendFileSync(resolve(tasksDir, "events.log"), entry + "\n");
+    }
+    catch {
+        // If even logging fails, silently continue
+    }
+}
+function spawnDaemon() {
+    // The daemon MUST run under node/tsx, never bun: node-pty's `onData`
+    // callback never fires under bun (PTY spawns + exits silently). See T085
+    // for the diagnostic story and T087 for the PtyAdapter abstraction this
+    // pins down. Prod swaps this for `node dist/lib/daemon.js`.
+    child = spawn("tsx", [daemonScript, session, port], {
+        cwd: process.cwd(),
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    // Pipe child stdout/stderr to our own so logs are visible in the detached process
+    child.stdout?.pipe(process.stdout);
+    child.stderr?.pipe(process.stderr);
+    child.on("exit", (code) => {
+        child = null;
+        // Clean shutdown (code 0) — don't respawn
+        if (code === 0) {
+            process.exit(0);
+        }
+        const now = Date.now();
+        // Reset crash counter if the last crash was more than 60s ago
+        if (now - lastCrashTime > 60_000) {
+            crashCount = 0;
+            backoffMs = 1000;
+        }
+        crashCount++;
+        lastCrashTime = now;
+        if (crashCount > 5) {
+            logError(`Daemon crashed ${crashCount} times in 60s — giving up`);
+            process.exit(1);
+        }
+        logError(`Daemon exited with code ${code}, respawning in ${backoffMs}ms`);
+        setTimeout(spawnDaemon, backoffMs);
+        backoffMs = Math.min(backoffMs * 2, 30_000);
+    });
+}
+// Forward termination signals to the child daemon
+process.on("SIGTERM", () => {
+    if (child)
+        child.kill("SIGTERM");
+    else
+        process.exit(0);
+});
+process.on("SIGINT", () => {
+    if (child)
+        child.kill("SIGTERM");
+    else
+        process.exit(0);
+});
+spawnDaemon();

package/packages/daemon/dist/lib/daemon.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Orphaned legacy daemon entrypoint.
+ *
+ * The per-session daemon spawn path is removed. This file is retained only
+ * for stale external invocations and starts the canonical headless daemon in
+ * this process. Prefer `tmux-ide --headless`.
+ */
+export {};

package/packages/daemon/dist/lib/daemon.js

@@ -0,0 +1,79 @@
+/**
+ * Orphaned legacy daemon entrypoint.
+ *
+ * The per-session daemon spawn path is removed. This file is retained only
+ * for stale external invocations and starts the canonical headless daemon in
+ * this process. Prefer `tmux-ide --headless`.
+ */
+import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
+import { startEmbeddedDaemon } from "./daemon-embed.js";
+async function main() {
+    // Accept the legacy `node daemon.ts <session> <port>` invocation: the
+    // first positional may be a session name OR (when omitted) a port. We
+    // sniff by digit-shape and forward both. Without this, an explicit
+    // session name was silently dropped on the floor and the daemon booted
+    // as `__embedded__` — leaving the workspace registry empty for live
+    // tmux sessions the operator clearly meant to expose.
+    const arg2 = process.argv[2];
+    const arg3 = process.argv[3];
+    const arg2IsPort = arg2 != null && /^\d+$/.test(arg2);
+    const sessionName = arg2IsPort ? undefined : arg2;
+    const rawPort = arg2IsPort ? arg2 : arg3;
+    const port = rawPort === undefined || rawPort === "0" ? undefined : Number.parseInt(rawPort, 10);
+    let handle;
+    try {
+        handle = await startEmbeddedDaemon({
+            port,
+            bindHostname: "127.0.0.1",
+            ...(sessionName ? { sessionName } : {}),
+        });
+    }
+    catch (err) {
+        console.error("[daemon] failed to start:", err);
+        process.exit(1);
+    }
+    let stopping = false;
+    const exitAfterStop = (code) => {
+        if (stopping)
+            return;
+        stopping = true;
+        // Defer one tick so any awaiter of handle.stop() observes the resolved
+        // promise before we tear the process down.
+        process.nextTick(() => process.exit(code));
+    };
+    const shutdown = async () => {
+        if (stopping)
+            return;
+        try {
+            await handle.stop();
+            exitAfterStop(0);
+        }
+        catch (err) {
+            console.error("[daemon] failed to stop:", err);
+            exitAfterStop(1);
+        }
+    };
+    // Wrap handle.stop so non-signal stop paths terminate the process. Without
+    // this, the canonical-daemon takeover action (POST /api/v2/action/daemon.shutdown
+    // from a competing launcher), the tick() that calls stopSelf when the
+    // tmux session disappears, and the remote-access restart backend all
+    // close the HTTP listener but leave the Node event loop spinning on
+    // task-store WAL timers and other handles. The visible symptom is a
+    // ghost daemon: process alive, port 6060 dead, takeover falls back to
+    // its 10s SIGTERM/SIGKILL deadline before the next launch can bind.
+    const origStop = handle.stop.bind(handle);
+    handle.stop = async (opts) => {
+        try {
+            await origStop(opts);
+        }
+        finally {
+            exitAfterStop(0);
+        }
+    };
+    process.on("SIGTERM", () => void shutdown());
+    process.on("SIGINT", () => void shutdown());
+}
+const isMainModule = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMainModule)
+    void main();

package/packages/daemon/dist/lib/dot-path.d.ts

@@ -0,0 +1,2 @@
+export declare function getByPath(obj: Record<string, any>, path: string): unknown;
+export declare function setByPath(obj: Record<string, any>, path: string, value: unknown): void;

package/packages/daemon/dist/lib/dot-path.js

@@ -0,0 +1,17 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+export function getByPath(obj, path) {
+    return path.split(".").reduce((o, k) => o?.[k], obj);
+}
+export function setByPath(obj, path, value) {
+    const keys = path.split(".");
+    const last = keys.pop();
+    let i = 0;
+    const target = keys.reduce((o, k) => {
+        const nextKey = keys[i + 1] ?? last;
+        if (o[k] === undefined)
+            o[k] = /^\d+$/.test(nextKey) ? [] : {};
+        i++;
+        return o[k];
+    }, obj);
+    target[last] = value;
+}

package/packages/daemon/dist/lib/errors.d.ts

@@ -0,0 +1,37 @@
+export declare class IdeError extends Error {
+    code: string | undefined;
+    exitCode: number;
+    constructor(message: string, { code, exitCode, cause }?: {
+        code?: string;
+        exitCode?: number;
+        cause?: Error;
+    });
+    toJSON(): {
+        error: string;
+        code: string | undefined;
+        cause?: string;
+    };
+}
+export declare class ConfigError extends IdeError {
+    constructor(message: string, code: string, { cause }?: {
+        cause?: Error;
+    });
+}
+export { TmuxError } from "@tmux-ide/tmux-bridge";
+export declare class SessionError extends IdeError {
+    constructor(message: string, code: string, { cause }?: {
+        cause?: Error;
+    });
+}
+export type DaemonStartupReason = "port_in_use" | "port_invalid" | "bind_failed" | "tmux_session_missing" | "canonical_already_running";
+export declare class DaemonStartupError extends IdeError {
+    readonly reason: DaemonStartupReason;
+    constructor(message: string, reason: DaemonStartupReason, { cause }?: {
+        cause?: Error;
+    });
+}
+export declare class DaemonShutdownError extends IdeError {
+    constructor(message: string, { cause }?: {
+        cause?: Error;
+    });
+}

package/packages/daemon/dist/lib/errors.js

@@ -0,0 +1,50 @@
+export class IdeError extends Error {
+    code;
+    exitCode;
+    constructor(message, { code, exitCode = 1, cause } = {}) {
+        super(message, { cause });
+        this.name = "IdeError";
+        this.code = code;
+        this.exitCode = exitCode;
+    }
+    toJSON() {
+        const obj = {
+            error: this.message,
+            code: this.code,
+        };
+        if (this.cause)
+            obj.cause = this.cause.message;
+        return obj;
+    }
+}
+export class ConfigError extends IdeError {
+    constructor(message, code, { cause } = {}) {
+        super(message, { code, exitCode: 1, cause });
+        this.name = "ConfigError";
+    }
+}
+// TmuxError now lives in @tmux-ide/tmux-bridge. Re-exported here so the
+// existing `import { TmuxError } from "./errors.ts"` paths keep working
+// across the daemon. The bridge's class extends Error directly (not IdeError);
+// the CLI's printCommandError handles both via duck-typing on `code`/`exitCode`.
+export { TmuxError } from "@tmux-ide/tmux-bridge";
+export class SessionError extends IdeError {
+    constructor(message, code, { cause } = {}) {
+        super(message, { code, exitCode: 1, cause });
+        this.name = "SessionError";
+    }
+}
+export class DaemonStartupError extends IdeError {
+    reason;
+    constructor(message, reason, { cause } = {}) {
+        super(message, { code: `DAEMON_${reason.toUpperCase()}`, exitCode: 1, cause });
+        this.name = "DaemonStartupError";
+        this.reason = reason;
+    }
+}
+export class DaemonShutdownError extends IdeError {
+    constructor(message, { cause } = {}) {
+        super(message, { code: "DAEMON_SHUTDOWN_FAILED", exitCode: 1, cause });
+        this.name = "DaemonShutdownError";
+    }
+}

package/packages/daemon/dist/lib/filesystem-browser.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Filesystem browsing for the dashboard's directory picker.
+ *
+ * Two responsibilities:
+ *   1. Sandbox enforcement — the daemon refuses to list anything outside the
+ *      user's home or the platform-conventional roots (/Users, /home,
+ *      /Volumes). Never trust the client to limit paths.
+ *   2. Entry classification — directories first, then files; alphabetical
+ *      within group; symlinks resolved once to determine target kind.
+ *
+ * The io functions are pluggable for tests so we don't need a full mock
+ * filesystem.
+ */
+import { type Dirent } from "node:fs";
+import type { FilesystemBrowseResult, FilesystemEntry } from "../schemas/filesystem.ts";
+export declare class SandboxViolationError extends Error {
+    readonly code = "outside-sandbox";
+    constructor(path: string);
+}
+export declare class PathNotFoundError extends Error {
+    readonly code = "not-found";
+    constructor(path: string);
+}
+export declare class InvalidPathError extends Error {
+    readonly code = "invalid-path";
+    constructor(message: string);
+}
+export interface BrowseIo {
+    /** `fs.realpathSync`. Throws if the path doesn't exist. */
+    realpath(path: string): string;
+    /** `fs.statSync`. Used to follow symlinks once when classifying. */
+    stat(path: string): {
+        isDirectory(): boolean;
+    };
+    /** `fs.readdirSync(path, { withFileTypes: true })`. */
+    readdir(path: string): Dirent[];
+    /** `os.homedir()`. */
+    home(): string;
+    /** Wall-clock; injectable for tests and for the per-entry stat budget. */
+    now(): number;
+}
+export interface BrowseInput {
+    /** Absolute path to list. Empty/missing → home. */
+    path?: string | null | undefined;
+    /** When true, return entries whose names start with `.`. */
+    showHidden?: boolean;
+}
+/**
+ * Sandbox check: the canonical path must live inside the user's home OR
+ * one of the platform-conventional public roots. Anything else throws.
+ *
+ * Exposed for tests; do NOT skip this from the route handler.
+ */
+export declare function assertInsideSandbox(canonical: string, home: string): void;
+/**
+ * Compute the parent directory path for browse navigation. Returns null
+ * when the parent would escape the sandbox, so the UI can disable the
+ * back button.
+ */
+export declare function computeParentPath(canonical: string, home: string): string | null;
+/**
+ * Sort dirs first, files second; case-insensitive alphabetical within group.
+ * Stable: returns a new array, doesn't mutate input.
+ */
+export declare function sortEntries(entries: ReadonlyArray<FilesystemEntry>): FilesystemEntry[];
+interface ClassifyResult {
+    entry: FilesystemEntry | null;
+}
+/**
+ * Convert a single dirent to a `FilesystemEntry`. Symlinks are followed
+ * exactly once via `stat` so we can mark `isDir` correctly. Per-entry stat
+ * is bounded by `STAT_BUDGET_MS`; entries that exceed it are dropped.
+ *
+ * Exposed for tests.
+ */
+export declare function classifyDirent(dirent: Dirent, fullPath: string, io: BrowseIo): ClassifyResult;
+/**
+ * Browse a directory. Returns canonical path + entries + parent.
+ *
+ * @throws {InvalidPathError}  Bad input (empty, relative, null bytes).
+ * @throws {PathNotFoundError} Path doesn't exist (realpath failed).
+ * @throws {SandboxViolationError} Path resolves outside the allowed sandbox.
+ */
+export declare function browseDirectory(input: BrowseInput, io?: BrowseIo): FilesystemBrowseResult;
+export {};

package/packages/daemon/dist/lib/filesystem-browser.js

@@ -0,0 +1,257 @@
+/**
+ * Filesystem browsing for the dashboard's directory picker.
+ *
+ * Two responsibilities:
+ *   1. Sandbox enforcement — the daemon refuses to list anything outside the
+ *      user's home or the platform-conventional roots (/Users, /home,
+ *      /Volumes). Never trust the client to limit paths.
+ *   2. Entry classification — directories first, then files; alphabetical
+ *      within group; symlinks resolved once to determine target kind.
+ *
+ * The io functions are pluggable for tests so we don't need a full mock
+ * filesystem.
+ */
+import { realpathSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve, sep } from "node:path";
+/** Root directories the sandbox allows in addition to the user's home. */
+const ALLOWED_PLATFORM_ROOTS = ["/Users", "/home", "/Volumes"];
+/** Per-entry stat budget. Slow network mounts get skipped silently. */
+const STAT_BUDGET_MS = 100;
+export class SandboxViolationError extends Error {
+    code = "outside-sandbox";
+    constructor(path) {
+        super(`Path "${path}" is outside the allowed sandbox`);
+        this.name = "SandboxViolationError";
+    }
+}
+export class PathNotFoundError extends Error {
+    code = "not-found";
+    constructor(path) {
+        super(`Path "${path}" does not exist`);
+        this.name = "PathNotFoundError";
+    }
+}
+export class InvalidPathError extends Error {
+    code = "invalid-path";
+    constructor(message) {
+        super(message);
+        this.name = "InvalidPathError";
+    }
+}
+/**
+ * Resolve the user's home directory. Honors `TMUX_IDE_HOME_OVERRIDE` so
+ * tests can pin a temp directory without depending on `os.homedir()` (some
+ * runtimes — bun in particular — cache the value at startup and do not
+ * pick up later `process.env.HOME` mutations).
+ */
+function resolveHome() {
+    const override = process.env.TMUX_IDE_HOME_OVERRIDE;
+    if (override && override.trim().length > 0)
+        return override;
+    return homedir();
+}
+const realIo = {
+    realpath: realpathSync,
+    stat: statSync,
+    readdir: (path) => readdirSync(path, { withFileTypes: true }),
+    home: resolveHome,
+    now: () => Date.now(),
+};
+/**
+ * Validate an input path before passing to realpath. We reject obvious
+ * traversal attempts and non-absolute paths so error messages stay clean.
+ * `~` and `~/...` expand to the user's home directory so the dialog's
+ * "Home" quick-jump (and any caller that hands us a tilde-prefixed path)
+ * doesn't trip the absolute-path check.
+ */
+function preflight(rawPath, io) {
+    const trimmed = rawPath.trim();
+    if (!trimmed) {
+        throw new InvalidPathError("Path must not be empty");
+    }
+    if (trimmed.includes("\0")) {
+        throw new InvalidPathError("Path contains a null byte");
+    }
+    let candidate = trimmed;
+    if (candidate === "~") {
+        candidate = io.home();
+    }
+    else if (candidate.startsWith("~/")) {
+        candidate = join(io.home(), candidate.slice(2));
+    }
+    if (!isAbsolute(candidate)) {
+        throw new InvalidPathError("Path must be absolute");
+    }
+    // Collapse `..` and `.` early so the realpath call has a clean input.
+    return resolve(candidate);
+}
+/**
+ * Returns true iff `canonical` is the allowed root or strictly under it.
+ * Both arguments must be canonical (already realpath'd) and absolute.
+ */
+function isUnderRoot(canonical, root) {
+    if (canonical === root)
+        return true;
+    const prefix = root.endsWith(sep) ? root : root + sep;
+    return canonical.startsWith(prefix);
+}
+/**
+ * Sandbox check: the canonical path must live inside the user's home OR
+ * one of the platform-conventional public roots. Anything else throws.
+ *
+ * Exposed for tests; do NOT skip this from the route handler.
+ */
+export function assertInsideSandbox(canonical, home) {
+    if (isUnderRoot(canonical, home))
+        return;
+    for (const root of ALLOWED_PLATFORM_ROOTS) {
+        if (isUnderRoot(canonical, root))
+            return;
+    }
+    throw new SandboxViolationError(canonical);
+}
+/**
+ * Compute the parent directory path for browse navigation. Returns null
+ * when the parent would escape the sandbox, so the UI can disable the
+ * back button.
+ */
+export function computeParentPath(canonical, home) {
+    // `path.resolve` collapses trailing separators; never returns an empty
+    // string, which means "/" maps to "/".
+    if (canonical === "/" || canonical === sep)
+        return null;
+    const parent = resolve(canonical, "..");
+    if (parent === canonical)
+        return null;
+    try {
+        assertInsideSandbox(parent, home);
+    }
+    catch {
+        return null;
+    }
+    return parent;
+}
+/**
+ * Sort dirs first, files second; case-insensitive alphabetical within group.
+ * Stable: returns a new array, doesn't mutate input.
+ */
+export function sortEntries(entries) {
+    return [...entries].sort((a, b) => {
+        if (a.isDir !== b.isDir)
+            return a.isDir ? -1 : 1;
+        return a.name.localeCompare(b.name, undefined, { sensitivity: "base" });
+    });
+}
+/**
+ * Convert a single dirent to a `FilesystemEntry`. Symlinks are followed
+ * exactly once via `stat` so we can mark `isDir` correctly. Per-entry stat
+ * is bounded by `STAT_BUDGET_MS`; entries that exceed it are dropped.
+ *
+ * Exposed for tests.
+ */
+export function classifyDirent(dirent, fullPath, io) {
+    const isSymlink = dirent.isSymbolicLink();
+    if (!isSymlink) {
+        return {
+            entry: {
+                name: dirent.name,
+                fullPath,
+                isDir: dirent.isDirectory(),
+                isSymlink: false,
+            },
+        };
+    }
+    // Follow symlinks once. Slow network mounts get a short stat budget and
+    // skip silently if exceeded.
+    const start = io.now();
+    let isDir;
+    try {
+        const stat = io.stat(fullPath);
+        if (io.now() - start > STAT_BUDGET_MS) {
+            return { entry: null };
+        }
+        isDir = stat.isDirectory();
+    }
+    catch {
+        // Broken symlink — keep it as a non-directory entry so the UI can
+        // still show it, but mark accordingly.
+        return {
+            entry: {
+                name: dirent.name,
+                fullPath,
+                isDir: false,
+                isSymlink: true,
+            },
+        };
+    }
+    return {
+        entry: {
+            name: dirent.name,
+            fullPath,
+            isDir,
+            isSymlink: true,
+        },
+    };
+}
+/**
+ * Browse a directory. Returns canonical path + entries + parent.
+ *
+ * @throws {InvalidPathError}  Bad input (empty, relative, null bytes).
+ * @throws {PathNotFoundError} Path doesn't exist (realpath failed).
+ * @throws {SandboxViolationError} Path resolves outside the allowed sandbox.
+ */
+export function browseDirectory(input, io = realIo) {
+    const home = io.home();
+    const requestedPath = input.path?.trim() ? input.path.trim() : home;
+    let preflightPath;
+    try {
+        preflightPath = preflight(requestedPath, io);
+    }
+    catch (err) {
+        if (err instanceof InvalidPathError)
+            throw err;
+        throw new InvalidPathError("Invalid path");
+    }
+    let canonical;
+    try {
+        canonical = io.realpath(preflightPath);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT" || code === "ENOTDIR") {
+            throw new PathNotFoundError(preflightPath);
+        }
+        throw err;
+    }
+    assertInsideSandbox(canonical, home);
+    let dirents;
+    try {
+        dirents = io.readdir(canonical);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT") {
+            throw new PathNotFoundError(canonical);
+        }
+        if (code === "ENOTDIR") {
+            throw new InvalidPathError(`"${canonical}" is not a directory`);
+        }
+        throw err;
+    }
+    const showHidden = Boolean(input.showHidden);
+    const entries = [];
+    for (const dirent of dirents) {
+        if (!showHidden && dirent.name.startsWith("."))
+            continue;
+        const fullPath = join(canonical, dirent.name);
+        const { entry } = classifyDirent(dirent, fullPath, io);
+        if (entry !== null)
+            entries.push(entry);
+    }
+    return {
+        path: canonical,
+        parentPath: computeParentPath(canonical, home),
+        entries: sortEntries(entries),
+    };
+}

package/packages/daemon/dist/lib/launch-plan.d.ts

@@ -0,0 +1,6 @@
+import type { Pane, Row, PaneAction } from "../types.ts";
+export declare function buildPaneCommand(pane: Pane): string | null;
+export declare function collectPaneStartupPlan(rows: Row[], paneMap: string[][], firstPanesOfRows: Set<string>, dir: string): {
+    focusPane: string;
+    paneActions: PaneAction[];
+};