tmux-ide 2.1.5 → 2.6.1

package/packages/daemon/src/lib/daemon-watchdog.ts

@@ -0,0 +1,111 @@
+/**
+ * Orphaned legacy crash-recovery watchdog for the old per-session daemon.
+ *
+ * The canonical daemon is now owned by Electron or `tmux-ide --headless`.
+ * No supported code path should spawn this file.
+ *
+ * Minimal crash-recovery watchdog for the tmux-ide daemon.
+ * Respawns daemon.ts on unexpected exits with exponential backoff.
+ * Gives up after 5 crashes within 60 seconds.
+ *
+ * Entry: bun src/lib/daemon-watchdog.ts <session> [port]
+ *
+ * ZERO imports from business logic — this file must never crash
+ * due to broken application code.
+ */
+
+import { spawn, type ChildProcess } from "node:child_process";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { appendFileSync, mkdirSync, existsSync } from "node:fs";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const sessionArg = process.argv[2];
+const port = process.argv[3] ?? "0";
+
+if (!sessionArg) {
+  console.error("Usage: daemon-watchdog.ts <session> [port]");
+  process.exit(1);
+}
+
+const session: string = sessionArg;
+
+const daemonScript = resolve(__dirname, "daemon.ts");
+
+let backoffMs = 1000;
+let crashCount = 0;
+let lastCrashTime = 0;
+let child: ChildProcess | null = null;
+
+function logError(msg: string): void {
+  try {
+    const tasksDir = resolve(process.cwd(), ".tasks");
+    if (!existsSync(tasksDir)) mkdirSync(tasksDir, { recursive: true });
+    const entry = JSON.stringify({
+      timestamp: new Date().toISOString(),
+      type: "error",
+      source: "daemon-watchdog",
+      message: msg,
+    });
+    appendFileSync(resolve(tasksDir, "events.log"), entry + "\n");
+  } catch {
+    // If even logging fails, silently continue
+  }
+}
+
+function spawnDaemon(): void {
+  // The daemon MUST run under node/tsx, never bun: node-pty's `onData`
+  // callback never fires under bun (PTY spawns + exits silently). See T085
+  // for the diagnostic story and T087 for the PtyAdapter abstraction this
+  // pins down. Prod swaps this for `node dist/lib/daemon.js`.
+  child = spawn("tsx", [daemonScript, session, port], {
+    cwd: process.cwd(),
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+
+  // Pipe child stdout/stderr to our own so logs are visible in the detached process
+  child.stdout?.pipe(process.stdout);
+  child.stderr?.pipe(process.stderr);
+
+  child.on("exit", (code) => {
+    child = null;
+
+    // Clean shutdown (code 0) — don't respawn
+    if (code === 0) {
+      process.exit(0);
+    }
+
+    const now = Date.now();
+
+    // Reset crash counter if the last crash was more than 60s ago
+    if (now - lastCrashTime > 60_000) {
+      crashCount = 0;
+      backoffMs = 1000;
+    }
+
+    crashCount++;
+    lastCrashTime = now;
+
+    if (crashCount > 5) {
+      logError(`Daemon crashed ${crashCount} times in 60s — giving up`);
+      process.exit(1);
+    }
+
+    logError(`Daemon exited with code ${code}, respawning in ${backoffMs}ms`);
+    setTimeout(spawnDaemon, backoffMs);
+    backoffMs = Math.min(backoffMs * 2, 30_000);
+  });
+}
+
+// Forward termination signals to the child daemon
+process.on("SIGTERM", () => {
+  if (child) child.kill("SIGTERM");
+  else process.exit(0);
+});
+
+process.on("SIGINT", () => {
+  if (child) child.kill("SIGTERM");
+  else process.exit(0);
+});
+
+spawnDaemon();

package/packages/daemon/src/lib/daemon.ts

@@ -0,0 +1,79 @@
+/**
+ * Orphaned legacy daemon entrypoint.
+ *
+ * The per-session daemon spawn path is removed. This file is retained only
+ * for stale external invocations and starts the canonical headless daemon in
+ * this process. Prefer `tmux-ide --headless`.
+ */
+
+import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
+import { startEmbeddedDaemon, type EmbeddedDaemonHandle } from "./daemon-embed.ts";
+
+async function main(): Promise<void> {
+  // Accept the legacy `node daemon.ts <session> <port>` invocation: the
+  // first positional may be a session name OR (when omitted) a port. We
+  // sniff by digit-shape and forward both. Without this, an explicit
+  // session name was silently dropped on the floor and the daemon booted
+  // as `__embedded__` — leaving the workspace registry empty for live
+  // tmux sessions the operator clearly meant to expose.
+  const arg2 = process.argv[2];
+  const arg3 = process.argv[3];
+  const arg2IsPort = arg2 != null && /^\d+$/.test(arg2);
+  const sessionName = arg2IsPort ? undefined : arg2;
+  const rawPort = arg2IsPort ? arg2 : arg3;
+  const port = rawPort === undefined || rawPort === "0" ? undefined : Number.parseInt(rawPort, 10);
+  let handle: EmbeddedDaemonHandle;
+  try {
+    handle = await startEmbeddedDaemon({
+      port,
+      bindHostname: "127.0.0.1",
+      ...(sessionName ? { sessionName } : {}),
+    });
+  } catch (err) {
+    console.error("[daemon] failed to start:", err);
+    process.exit(1);
+  }
+
+  let stopping = false;
+  const exitAfterStop = (code: number): void => {
+    if (stopping) return;
+    stopping = true;
+    // Defer one tick so any awaiter of handle.stop() observes the resolved
+    // promise before we tear the process down.
+    process.nextTick(() => process.exit(code));
+  };
+  const shutdown = async (): Promise<void> => {
+    if (stopping) return;
+    try {
+      await handle.stop();
+      exitAfterStop(0);
+    } catch (err) {
+      console.error("[daemon] failed to stop:", err);
+      exitAfterStop(1);
+    }
+  };
+
+  // Wrap handle.stop so non-signal stop paths terminate the process. Without
+  // this, the canonical-daemon takeover action (POST /api/v2/action/daemon.shutdown
+  // from a competing launcher), the tick() that calls stopSelf when the
+  // tmux session disappears, and the remote-access restart backend all
+  // close the HTTP listener but leave the Node event loop spinning on
+  // task-store WAL timers and other handles. The visible symptom is a
+  // ghost daemon: process alive, port 6060 dead, takeover falls back to
+  // its 10s SIGTERM/SIGKILL deadline before the next launch can bind.
+  const origStop = handle.stop.bind(handle);
+  handle.stop = async (opts) => {
+    try {
+      await origStop(opts);
+    } finally {
+      exitAfterStop(0);
+    }
+  };
+
+  process.on("SIGTERM", () => void shutdown());
+  process.on("SIGINT", () => void shutdown());
+}
+
+const isMainModule = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMainModule) void main();

package/packages/daemon/src/lib/errors.ts

@@ -0,0 +1,67 @@
+export class IdeError extends Error {
+  code: string | undefined;
+  exitCode: number;
+
+  constructor(
+    message: string,
+    { code, exitCode = 1, cause }: { code?: string; exitCode?: number; cause?: Error } = {},
+  ) {
+    super(message, { cause });
+    this.name = "IdeError";
+    this.code = code;
+    this.exitCode = exitCode;
+  }
+
+  toJSON(): { error: string; code: string | undefined; cause?: string } {
+    const obj: { error: string; code: string | undefined; cause?: string } = {
+      error: this.message,
+      code: this.code,
+    };
+    if (this.cause) obj.cause = (this.cause as Error).message;
+    return obj;
+  }
+}
+
+export class ConfigError extends IdeError {
+  constructor(message: string, code: string, { cause }: { cause?: Error } = {}) {
+    super(message, { code, exitCode: 1, cause });
+    this.name = "ConfigError";
+  }
+}
+
+// TmuxError now lives in @tmux-ide/tmux-bridge. Re-exported here so the
+// existing `import { TmuxError } from "./errors.ts"` paths keep working
+// across the daemon. The bridge's class extends Error directly (not IdeError);
+// the CLI's printCommandError handles both via duck-typing on `code`/`exitCode`.
+export { TmuxError } from "@tmux-ide/tmux-bridge";
+
+export class SessionError extends IdeError {
+  constructor(message: string, code: string, { cause }: { cause?: Error } = {}) {
+    super(message, { code, exitCode: 1, cause });
+    this.name = "SessionError";
+  }
+}
+
+export type DaemonStartupReason =
+  | "port_in_use"
+  | "port_invalid"
+  | "bind_failed"
+  | "tmux_session_missing"
+  | "canonical_already_running";
+
+export class DaemonStartupError extends IdeError {
+  readonly reason: DaemonStartupReason;
+
+  constructor(message: string, reason: DaemonStartupReason, { cause }: { cause?: Error } = {}) {
+    super(message, { code: `DAEMON_${reason.toUpperCase()}`, exitCode: 1, cause });
+    this.name = "DaemonStartupError";
+    this.reason = reason;
+  }
+}
+
+export class DaemonShutdownError extends IdeError {
+  constructor(message: string, { cause }: { cause?: Error } = {}) {
+    super(message, { code: "DAEMON_SHUTDOWN_FAILED", exitCode: 1, cause });
+    this.name = "DaemonShutdownError";
+  }
+}

package/packages/daemon/src/lib/filesystem-browser.ts

@@ -0,0 +1,292 @@
+/**
+ * Filesystem browsing for the dashboard's directory picker.
+ *
+ * Two responsibilities:
+ *   1. Sandbox enforcement — the daemon refuses to list anything outside the
+ *      user's home or the platform-conventional roots (/Users, /home,
+ *      /Volumes). Never trust the client to limit paths.
+ *   2. Entry classification — directories first, then files; alphabetical
+ *      within group; symlinks resolved once to determine target kind.
+ *
+ * The io functions are pluggable for tests so we don't need a full mock
+ * filesystem.
+ */
+
+import { realpathSync, readdirSync, statSync, type Dirent } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve, sep } from "node:path";
+
+import type { FilesystemBrowseResult, FilesystemEntry } from "../schemas/filesystem.ts";
+
+/** Root directories the sandbox allows in addition to the user's home. */
+const ALLOWED_PLATFORM_ROOTS = ["/Users", "/home", "/Volumes"] as const;
+
+/** Per-entry stat budget. Slow network mounts get skipped silently. */
+const STAT_BUDGET_MS = 100;
+
+export class SandboxViolationError extends Error {
+  readonly code = "outside-sandbox";
+  constructor(path: string) {
+    super(`Path "${path}" is outside the allowed sandbox`);
+    this.name = "SandboxViolationError";
+  }
+}
+
+export class PathNotFoundError extends Error {
+  readonly code = "not-found";
+  constructor(path: string) {
+    super(`Path "${path}" does not exist`);
+    this.name = "PathNotFoundError";
+  }
+}
+
+export class InvalidPathError extends Error {
+  readonly code = "invalid-path";
+  constructor(message: string) {
+    super(message);
+    this.name = "InvalidPathError";
+  }
+}
+
+export interface BrowseIo {
+  /** `fs.realpathSync`. Throws if the path doesn't exist. */
+  realpath(path: string): string;
+  /** `fs.statSync`. Used to follow symlinks once when classifying. */
+  stat(path: string): { isDirectory(): boolean };
+  /** `fs.readdirSync(path, { withFileTypes: true })`. */
+  readdir(path: string): Dirent[];
+  /** `os.homedir()`. */
+  home(): string;
+  /** Wall-clock; injectable for tests and for the per-entry stat budget. */
+  now(): number;
+}
+
+/**
+ * Resolve the user's home directory. Honors `TMUX_IDE_HOME_OVERRIDE` so
+ * tests can pin a temp directory without depending on `os.homedir()` (some
+ * runtimes — bun in particular — cache the value at startup and do not
+ * pick up later `process.env.HOME` mutations).
+ */
+function resolveHome(): string {
+  const override = process.env.TMUX_IDE_HOME_OVERRIDE;
+  if (override && override.trim().length > 0) return override;
+  return homedir();
+}
+
+const realIo: BrowseIo = {
+  realpath: realpathSync,
+  stat: statSync,
+  readdir: (path) => readdirSync(path, { withFileTypes: true }),
+  home: resolveHome,
+  now: () => Date.now(),
+};
+
+export interface BrowseInput {
+  /** Absolute path to list. Empty/missing → home. */
+  path?: string | null | undefined;
+  /** When true, return entries whose names start with `.`. */
+  showHidden?: boolean;
+}
+
+/**
+ * Validate an input path before passing to realpath. We reject obvious
+ * traversal attempts and non-absolute paths so error messages stay clean.
+ * `~` and `~/...` expand to the user's home directory so the dialog's
+ * "Home" quick-jump (and any caller that hands us a tilde-prefixed path)
+ * doesn't trip the absolute-path check.
+ */
+function preflight(rawPath: string, io: BrowseIo): string {
+  const trimmed = rawPath.trim();
+  if (!trimmed) {
+    throw new InvalidPathError("Path must not be empty");
+  }
+  if (trimmed.includes("\0")) {
+    throw new InvalidPathError("Path contains a null byte");
+  }
+  let candidate = trimmed;
+  if (candidate === "~") {
+    candidate = io.home();
+  } else if (candidate.startsWith("~/")) {
+    candidate = join(io.home(), candidate.slice(2));
+  }
+  if (!isAbsolute(candidate)) {
+    throw new InvalidPathError("Path must be absolute");
+  }
+  // Collapse `..` and `.` early so the realpath call has a clean input.
+  return resolve(candidate);
+}
+
+/**
+ * Returns true iff `canonical` is the allowed root or strictly under it.
+ * Both arguments must be canonical (already realpath'd) and absolute.
+ */
+function isUnderRoot(canonical: string, root: string): boolean {
+  if (canonical === root) return true;
+  const prefix = root.endsWith(sep) ? root : root + sep;
+  return canonical.startsWith(prefix);
+}
+
+/**
+ * Sandbox check: the canonical path must live inside the user's home OR
+ * one of the platform-conventional public roots. Anything else throws.
+ *
+ * Exposed for tests; do NOT skip this from the route handler.
+ */
+export function assertInsideSandbox(canonical: string, home: string): void {
+  if (isUnderRoot(canonical, home)) return;
+  for (const root of ALLOWED_PLATFORM_ROOTS) {
+    if (isUnderRoot(canonical, root)) return;
+  }
+  throw new SandboxViolationError(canonical);
+}
+
+/**
+ * Compute the parent directory path for browse navigation. Returns null
+ * when the parent would escape the sandbox, so the UI can disable the
+ * back button.
+ */
+export function computeParentPath(canonical: string, home: string): string | null {
+  // `path.resolve` collapses trailing separators; never returns an empty
+  // string, which means "/" maps to "/".
+  if (canonical === "/" || canonical === sep) return null;
+
+  const parent = resolve(canonical, "..");
+  if (parent === canonical) return null;
+
+  try {
+    assertInsideSandbox(parent, home);
+  } catch {
+    return null;
+  }
+  return parent;
+}
+
+/**
+ * Sort dirs first, files second; case-insensitive alphabetical within group.
+ * Stable: returns a new array, doesn't mutate input.
+ */
+export function sortEntries(entries: ReadonlyArray<FilesystemEntry>): FilesystemEntry[] {
+  return [...entries].sort((a, b) => {
+    if (a.isDir !== b.isDir) return a.isDir ? -1 : 1;
+    return a.name.localeCompare(b.name, undefined, { sensitivity: "base" });
+  });
+}
+
+interface ClassifyResult {
+  entry: FilesystemEntry | null;
+}
+
+/**
+ * Convert a single dirent to a `FilesystemEntry`. Symlinks are followed
+ * exactly once via `stat` so we can mark `isDir` correctly. Per-entry stat
+ * is bounded by `STAT_BUDGET_MS`; entries that exceed it are dropped.
+ *
+ * Exposed for tests.
+ */
+export function classifyDirent(dirent: Dirent, fullPath: string, io: BrowseIo): ClassifyResult {
+  const isSymlink = dirent.isSymbolicLink();
+  if (!isSymlink) {
+    return {
+      entry: {
+        name: dirent.name,
+        fullPath,
+        isDir: dirent.isDirectory(),
+        isSymlink: false,
+      },
+    };
+  }
+
+  // Follow symlinks once. Slow network mounts get a short stat budget and
+  // skip silently if exceeded.
+  const start = io.now();
+  let isDir: boolean;
+  try {
+    const stat = io.stat(fullPath);
+    if (io.now() - start > STAT_BUDGET_MS) {
+      return { entry: null };
+    }
+    isDir = stat.isDirectory();
+  } catch {
+    // Broken symlink — keep it as a non-directory entry so the UI can
+    // still show it, but mark accordingly.
+    return {
+      entry: {
+        name: dirent.name,
+        fullPath,
+        isDir: false,
+        isSymlink: true,
+      },
+    };
+  }
+
+  return {
+    entry: {
+      name: dirent.name,
+      fullPath,
+      isDir,
+      isSymlink: true,
+    },
+  };
+}
+
+/**
+ * Browse a directory. Returns canonical path + entries + parent.
+ *
+ * @throws {InvalidPathError}  Bad input (empty, relative, null bytes).
+ * @throws {PathNotFoundError} Path doesn't exist (realpath failed).
+ * @throws {SandboxViolationError} Path resolves outside the allowed sandbox.
+ */
+export function browseDirectory(input: BrowseInput, io: BrowseIo = realIo): FilesystemBrowseResult {
+  const home = io.home();
+  const requestedPath = input.path?.trim() ? input.path.trim() : home;
+
+  let preflightPath: string;
+  try {
+    preflightPath = preflight(requestedPath, io);
+  } catch (err) {
+    if (err instanceof InvalidPathError) throw err;
+    throw new InvalidPathError("Invalid path");
+  }
+
+  let canonical: string;
+  try {
+    canonical = io.realpath(preflightPath);
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      throw new PathNotFoundError(preflightPath);
+    }
+    throw err;
+  }
+
+  assertInsideSandbox(canonical, home);
+
+  let dirents: Dirent[];
+  try {
+    dirents = io.readdir(canonical);
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === "ENOENT") {
+      throw new PathNotFoundError(canonical);
+    }
+    if (code === "ENOTDIR") {
+      throw new InvalidPathError(`"${canonical}" is not a directory`);
+    }
+    throw err;
+  }
+
+  const showHidden = Boolean(input.showHidden);
+  const entries: FilesystemEntry[] = [];
+  for (const dirent of dirents) {
+    if (!showHidden && dirent.name.startsWith(".")) continue;
+    const fullPath = join(canonical, dirent.name);
+    const { entry } = classifyDirent(dirent, fullPath, io);
+    if (entry !== null) entries.push(entry);
+  }
+
+  return {
+    path: canonical,
+    parentPath: computeParentPath(canonical, home),
+    entries: sortEntries(entries),
+  };
+}

package/packages/daemon/src/lib/log.ts

@@ -0,0 +1,134 @@
+/** Minimal structured logger for tmux-ide daemon processes. */
+
+type Level = "debug" | "info" | "warn" | "error";
+
+const LEVEL_RANK: Record<Level, number> = { debug: 0, info: 1, warn: 2, error: 3 };
+
+let minLevel: Level = (process.env.LOG_LEVEL as Level) ?? "info";
+
+export function setLogLevel(level: Level): void {
+  minLevel = level;
+}
+
+// ---------------------------------------------------------------------------
+// Ring buffer + subscriber bus
+//
+// Every structured log entry is also captured in an in-memory ring (last
+// `LOG_BUFFER_SIZE` entries) and broadcast to any subscriber. Used by the
+// command-center's `/api/logs/:channel` SSE endpoint so the dashboard
+// BottomPanel Output tab can stream daemon logs without scraping stderr.
+// ---------------------------------------------------------------------------
+
+export interface LogEntry {
+  ts: string;
+  level: Level;
+  component: string;
+  msg: string;
+  data?: Record<string, unknown>;
+}
+
+const LOG_BUFFER_SIZE = 1_000;
+const logBuffer: LogEntry[] = [];
+type Subscriber = (entry: LogEntry) => void;
+const subscribers = new Set<Subscriber>();
+
+/** Snapshot the current ring buffer; useful for SSE backfill. */
+export function getLogBuffer(): ReadonlyArray<LogEntry> {
+  return logBuffer.slice();
+}
+
+/**
+ * Subscribe to live log entries. Returns an unsubscribe function. The
+ * handler runs synchronously inside the writer — keep it cheap; throw
+ * inside the handler is caught + logged once so one bad subscriber
+ * can't stall the daemon.
+ */
+export function subscribeLogs(handler: Subscriber): () => void {
+  subscribers.add(handler);
+  return () => {
+    subscribers.delete(handler);
+  };
+}
+
+function writeStructuredLog(
+  level: Level,
+  component: string,
+  message: string,
+  data?: Record<string, unknown>,
+): void {
+  if (LEVEL_RANK[level] < LEVEL_RANK[minLevel]) return;
+  const entry: LogEntry = {
+    ts: new Date().toISOString(),
+    level,
+    component,
+    msg: message,
+    ...(data ? { data } : {}),
+  };
+  // Push to ring + drop oldest when over budget.
+  logBuffer.push(entry);
+  if (logBuffer.length > LOG_BUFFER_SIZE) logBuffer.shift();
+  // Fan out to subscribers; isolate failures.
+  for (const sub of subscribers) {
+    try {
+      sub(entry);
+    } catch (err) {
+      // Avoid recursion via the logger; write directly to stderr.
+      process.stderr.write(
+        `[log.ts] subscriber threw: ${err instanceof Error ? err.message : String(err)}\n`,
+      );
+    }
+  }
+  // Stream form for humans tailing the process. The data field is
+  // serialized inline (matches the previous wire shape).
+  const wire: Record<string, unknown> = {
+    ts: entry.ts,
+    level: entry.level,
+    component: entry.component,
+    msg: entry.msg,
+  };
+  if (data) Object.assign(wire, data);
+  const out = level === "error" ? process.stderr : process.stdout;
+  out.write(JSON.stringify(wire) + "\n");
+}
+
+export const logger = {
+  debug: (component: string, msg: string, data?: Record<string, unknown>) =>
+    writeStructuredLog("debug", component, msg, data),
+  info: (component: string, msg: string, data?: Record<string, unknown>) =>
+    writeStructuredLog("info", component, msg, data),
+  warn: (component: string, msg: string, data?: Record<string, unknown>) =>
+    writeStructuredLog("warn", component, msg, data),
+  error: (component: string, msg: string, data?: Record<string, unknown>) =>
+    writeStructuredLog("error", component, msg, data),
+};
+
+/**
+ * Thin logger shim compatible with VibeTunnel's module logger API (`createLogger`-style methods).
+ * Wraps `console.*` (distinct from structured JSON `logger` above).
+ */
+export type LogMethod = (...args: unknown[]) => void;
+
+export const log = {
+  /** Alias for `info` / console.log (VibeTunnel `createLogger` compatibility). */
+  log: (...args: unknown[]) => {
+    console.log(...args);
+  },
+  info: (...args: unknown[]) => {
+    console.log(...args);
+  },
+  warn: (...args: unknown[]) => {
+    console.warn(...args);
+  },
+  error: (...args: unknown[]) => {
+    console.error(...args);
+  },
+  debug: (...args: unknown[]) => {
+    console.debug(...args);
+  },
+} satisfies {
+  log: LogMethod;
+  info: LogMethod;
+  warn: LogMethod;
+  error: LogMethod;
+  debug: LogMethod;
+};