tmux-ide 2.6.0 → 2.6.1

package/packages/daemon/src/lib/daemon-watchdog.ts

@@ -0,0 +1,111 @@
+/**
+ * Orphaned legacy crash-recovery watchdog for the old per-session daemon.
+ *
+ * The canonical daemon is now owned by Electron or `tmux-ide --headless`.
+ * No supported code path should spawn this file.
+ *
+ * Minimal crash-recovery watchdog for the tmux-ide daemon.
+ * Respawns daemon.ts on unexpected exits with exponential backoff.
+ * Gives up after 5 crashes within 60 seconds.
+ *
+ * Entry: bun src/lib/daemon-watchdog.ts <session> [port]
+ *
+ * ZERO imports from business logic — this file must never crash
+ * due to broken application code.
+ */
+
+import { spawn, type ChildProcess } from "node:child_process";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { appendFileSync, mkdirSync, existsSync } from "node:fs";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const sessionArg = process.argv[2];
+const port = process.argv[3] ?? "0";
+
+if (!sessionArg) {
+  console.error("Usage: daemon-watchdog.ts <session> [port]");
+  process.exit(1);
+}
+
+const session: string = sessionArg;
+
+const daemonScript = resolve(__dirname, "daemon.ts");
+
+let backoffMs = 1000;
+let crashCount = 0;
+let lastCrashTime = 0;
+let child: ChildProcess | null = null;
+
+function logError(msg: string): void {
+  try {
+    const tasksDir = resolve(process.cwd(), ".tasks");
+    if (!existsSync(tasksDir)) mkdirSync(tasksDir, { recursive: true });
+    const entry = JSON.stringify({
+      timestamp: new Date().toISOString(),
+      type: "error",
+      source: "daemon-watchdog",
+      message: msg,
+    });
+    appendFileSync(resolve(tasksDir, "events.log"), entry + "\n");
+  } catch {
+    // If even logging fails, silently continue
+  }
+}
+
+function spawnDaemon(): void {
+  // The daemon MUST run under node/tsx, never bun: node-pty's `onData`
+  // callback never fires under bun (PTY spawns + exits silently). See T085
+  // for the diagnostic story and T087 for the PtyAdapter abstraction this
+  // pins down. Prod swaps this for `node dist/lib/daemon.js`.
+  child = spawn("tsx", [daemonScript, session, port], {
+    cwd: process.cwd(),
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+
+  // Pipe child stdout/stderr to our own so logs are visible in the detached process
+  child.stdout?.pipe(process.stdout);
+  child.stderr?.pipe(process.stderr);
+
+  child.on("exit", (code) => {
+    child = null;
+
+    // Clean shutdown (code 0) — don't respawn
+    if (code === 0) {
+      process.exit(0);
+    }
+
+    const now = Date.now();
+
+    // Reset crash counter if the last crash was more than 60s ago
+    if (now - lastCrashTime > 60_000) {
+      crashCount = 0;
+      backoffMs = 1000;
+    }
+
+    crashCount++;
+    lastCrashTime = now;
+
+    if (crashCount > 5) {
+      logError(`Daemon crashed ${crashCount} times in 60s — giving up`);
+      process.exit(1);
+    }
+
+    logError(`Daemon exited with code ${code}, respawning in ${backoffMs}ms`);
+    setTimeout(spawnDaemon, backoffMs);
+    backoffMs = Math.min(backoffMs * 2, 30_000);
+  });
+}
+
+// Forward termination signals to the child daemon
+process.on("SIGTERM", () => {
+  if (child) child.kill("SIGTERM");
+  else process.exit(0);
+});
+
+process.on("SIGINT", () => {
+  if (child) child.kill("SIGTERM");
+  else process.exit(0);
+});
+
+spawnDaemon();

package/packages/daemon/src/lib/daemon.ts

@@ -0,0 +1,79 @@
+/**
+ * Orphaned legacy daemon entrypoint.
+ *
+ * The per-session daemon spawn path is removed. This file is retained only
+ * for stale external invocations and starts the canonical headless daemon in
+ * this process. Prefer `tmux-ide --headless`.
+ */
+
+import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
+import { startEmbeddedDaemon, type EmbeddedDaemonHandle } from "./daemon-embed.ts";
+
+async function main(): Promise<void> {
+  // Accept the legacy `node daemon.ts <session> <port>` invocation: the
+  // first positional may be a session name OR (when omitted) a port. We
+  // sniff by digit-shape and forward both. Without this, an explicit
+  // session name was silently dropped on the floor and the daemon booted
+  // as `__embedded__` — leaving the workspace registry empty for live
+  // tmux sessions the operator clearly meant to expose.
+  const arg2 = process.argv[2];
+  const arg3 = process.argv[3];
+  const arg2IsPort = arg2 != null && /^\d+$/.test(arg2);
+  const sessionName = arg2IsPort ? undefined : arg2;
+  const rawPort = arg2IsPort ? arg2 : arg3;
+  const port = rawPort === undefined || rawPort === "0" ? undefined : Number.parseInt(rawPort, 10);
+  let handle: EmbeddedDaemonHandle;
+  try {
+    handle = await startEmbeddedDaemon({
+      port,
+      bindHostname: "127.0.0.1",
+      ...(sessionName ? { sessionName } : {}),
+    });
+  } catch (err) {
+    console.error("[daemon] failed to start:", err);
+    process.exit(1);
+  }
+
+  let stopping = false;
+  const exitAfterStop = (code: number): void => {
+    if (stopping) return;
+    stopping = true;
+    // Defer one tick so any awaiter of handle.stop() observes the resolved
+    // promise before we tear the process down.
+    process.nextTick(() => process.exit(code));
+  };
+  const shutdown = async (): Promise<void> => {
+    if (stopping) return;
+    try {
+      await handle.stop();
+      exitAfterStop(0);
+    } catch (err) {
+      console.error("[daemon] failed to stop:", err);
+      exitAfterStop(1);
+    }
+  };
+
+  // Wrap handle.stop so non-signal stop paths terminate the process. Without
+  // this, the canonical-daemon takeover action (POST /api/v2/action/daemon.shutdown
+  // from a competing launcher), the tick() that calls stopSelf when the
+  // tmux session disappears, and the remote-access restart backend all
+  // close the HTTP listener but leave the Node event loop spinning on
+  // task-store WAL timers and other handles. The visible symptom is a
+  // ghost daemon: process alive, port 6060 dead, takeover falls back to
+  // its 10s SIGTERM/SIGKILL deadline before the next launch can bind.
+  const origStop = handle.stop.bind(handle);
+  handle.stop = async (opts) => {
+    try {
+      await origStop(opts);
+    } finally {
+      exitAfterStop(0);
+    }
+  };
+
+  process.on("SIGTERM", () => void shutdown());
+  process.on("SIGINT", () => void shutdown());
+}
+
+const isMainModule = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMainModule) void main();

package/packages/daemon/src/lib/dot-path.ts

@@ -0,0 +1,17 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+export function getByPath(obj: Record<string, any>, path: string): unknown {
+  return path.split(".").reduce((o: any, k) => o?.[k], obj);
+}
+
+export function setByPath(obj: Record<string, any>, path: string, value: unknown): void {
+  const keys = path.split(".");
+  const last = keys.pop()!;
+  let i = 0;
+  const target = keys.reduce((o: any, k) => {
+    const nextKey = keys[i + 1] ?? last;
+    if (o[k] === undefined) o[k] = /^\d+$/.test(nextKey) ? [] : {};
+    i++;
+    return o[k];
+  }, obj);
+  target[last] = value;
+}

package/packages/daemon/src/lib/errors.ts

@@ -0,0 +1,67 @@
+export class IdeError extends Error {
+  code: string | undefined;
+  exitCode: number;
+
+  constructor(
+    message: string,
+    { code, exitCode = 1, cause }: { code?: string; exitCode?: number; cause?: Error } = {},
+  ) {
+    super(message, { cause });
+    this.name = "IdeError";
+    this.code = code;
+    this.exitCode = exitCode;
+  }
+
+  toJSON(): { error: string; code: string | undefined; cause?: string } {
+    const obj: { error: string; code: string | undefined; cause?: string } = {
+      error: this.message,
+      code: this.code,
+    };
+    if (this.cause) obj.cause = (this.cause as Error).message;
+    return obj;
+  }
+}
+
+export class ConfigError extends IdeError {
+  constructor(message: string, code: string, { cause }: { cause?: Error } = {}) {
+    super(message, { code, exitCode: 1, cause });
+    this.name = "ConfigError";
+  }
+}
+
+// TmuxError now lives in @tmux-ide/tmux-bridge. Re-exported here so the
+// existing `import { TmuxError } from "./errors.ts"` paths keep working
+// across the daemon. The bridge's class extends Error directly (not IdeError);
+// the CLI's printCommandError handles both via duck-typing on `code`/`exitCode`.
+export { TmuxError } from "@tmux-ide/tmux-bridge";
+
+export class SessionError extends IdeError {
+  constructor(message: string, code: string, { cause }: { cause?: Error } = {}) {
+    super(message, { code, exitCode: 1, cause });
+    this.name = "SessionError";
+  }
+}
+
+export type DaemonStartupReason =
+  | "port_in_use"
+  | "port_invalid"
+  | "bind_failed"
+  | "tmux_session_missing"
+  | "canonical_already_running";
+
+export class DaemonStartupError extends IdeError {
+  readonly reason: DaemonStartupReason;
+
+  constructor(message: string, reason: DaemonStartupReason, { cause }: { cause?: Error } = {}) {
+    super(message, { code: `DAEMON_${reason.toUpperCase()}`, exitCode: 1, cause });
+    this.name = "DaemonStartupError";
+    this.reason = reason;
+  }
+}
+
+export class DaemonShutdownError extends IdeError {
+  constructor(message: string, { cause }: { cause?: Error } = {}) {
+    super(message, { code: "DAEMON_SHUTDOWN_FAILED", exitCode: 1, cause });
+    this.name = "DaemonShutdownError";
+  }
+}

package/packages/daemon/src/lib/filesystem-browser.ts

@@ -0,0 +1,292 @@
+/**
+ * Filesystem browsing for the dashboard's directory picker.
+ *
+ * Two responsibilities:
+ *   1. Sandbox enforcement — the daemon refuses to list anything outside the
+ *      user's home or the platform-conventional roots (/Users, /home,
+ *      /Volumes). Never trust the client to limit paths.
+ *   2. Entry classification — directories first, then files; alphabetical
+ *      within group; symlinks resolved once to determine target kind.
+ *
+ * The io functions are pluggable for tests so we don't need a full mock
+ * filesystem.
+ */
+
+import { realpathSync, readdirSync, statSync, type Dirent } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve, sep } from "node:path";
+
+import type { FilesystemBrowseResult, FilesystemEntry } from "../schemas/filesystem.ts";
+
+/** Root directories the sandbox allows in addition to the user's home. */
+const ALLOWED_PLATFORM_ROOTS = ["/Users", "/home", "/Volumes"] as const;
+
+/** Per-entry stat budget. Slow network mounts get skipped silently. */
+const STAT_BUDGET_MS = 100;
+
+export class SandboxViolationError extends Error {
+  readonly code = "outside-sandbox";
+  constructor(path: string) {
+    super(`Path "${path}" is outside the allowed sandbox`);
+    this.name = "SandboxViolationError";
+  }
+}
+
+export class PathNotFoundError extends Error {
+  readonly code = "not-found";
+  constructor(path: string) {
+    super(`Path "${path}" does not exist`);
+    this.name = "PathNotFoundError";
+  }
+}
+
+export class InvalidPathError extends Error {
+  readonly code = "invalid-path";
+  constructor(message: string) {
+    super(message);
+    this.name = "InvalidPathError";
+  }
+}
+
+export interface BrowseIo {
+  /** `fs.realpathSync`. Throws if the path doesn't exist. */
+  realpath(path: string): string;
+  /** `fs.statSync`. Used to follow symlinks once when classifying. */
+  stat(path: string): { isDirectory(): boolean };
+  /** `fs.readdirSync(path, { withFileTypes: true })`. */
+  readdir(path: string): Dirent[];
+  /** `os.homedir()`. */
+  home(): string;
+  /** Wall-clock; injectable for tests and for the per-entry stat budget. */
+  now(): number;
+}
+
+/**
+ * Resolve the user's home directory. Honors `TMUX_IDE_HOME_OVERRIDE` so
+ * tests can pin a temp directory without depending on `os.homedir()` (some
+ * runtimes — bun in particular — cache the value at startup and do not
+ * pick up later `process.env.HOME` mutations).
+ */
+function resolveHome(): string {
+  const override = process.env.TMUX_IDE_HOME_OVERRIDE;
+  if (override && override.trim().length > 0) return override;
+  return homedir();
+}
+
+const realIo: BrowseIo = {
+  realpath: realpathSync,
+  stat: statSync,
+  readdir: (path) => readdirSync(path, { withFileTypes: true }),
+  home: resolveHome,
+  now: () => Date.now(),
+};
+
+export interface BrowseInput {
+  /** Absolute path to list. Empty/missing → home. */
+  path?: string | null | undefined;
+  /** When true, return entries whose names start with `.`. */
+  showHidden?: boolean;
+}
+
+/**
+ * Validate an input path before passing to realpath. We reject obvious
+ * traversal attempts and non-absolute paths so error messages stay clean.
+ * `~` and `~/...` expand to the user's home directory so the dialog's
+ * "Home" quick-jump (and any caller that hands us a tilde-prefixed path)
+ * doesn't trip the absolute-path check.
+ */
+function preflight(rawPath: string, io: BrowseIo): string {
+  const trimmed = rawPath.trim();
+  if (!trimmed) {
+    throw new InvalidPathError("Path must not be empty");
+  }
+  if (trimmed.includes("\0")) {
+    throw new InvalidPathError("Path contains a null byte");
+  }
+  let candidate = trimmed;
+  if (candidate === "~") {
+    candidate = io.home();
+  } else if (candidate.startsWith("~/")) {
+    candidate = join(io.home(), candidate.slice(2));
+  }
+  if (!isAbsolute(candidate)) {
+    throw new InvalidPathError("Path must be absolute");
+  }
+  // Collapse `..` and `.` early so the realpath call has a clean input.
+  return resolve(candidate);
+}
+
+/**
+ * Returns true iff `canonical` is the allowed root or strictly under it.
+ * Both arguments must be canonical (already realpath'd) and absolute.
+ */
+function isUnderRoot(canonical: string, root: string): boolean {
+  if (canonical === root) return true;
+  const prefix = root.endsWith(sep) ? root : root + sep;
+  return canonical.startsWith(prefix);
+}
+
+/**
+ * Sandbox check: the canonical path must live inside the user's home OR
+ * one of the platform-conventional public roots. Anything else throws.
+ *
+ * Exposed for tests; do NOT skip this from the route handler.
+ */
+export function assertInsideSandbox(canonical: string, home: string): void {
+  if (isUnderRoot(canonical, home)) return;
+  for (const root of ALLOWED_PLATFORM_ROOTS) {
+    if (isUnderRoot(canonical, root)) return;
+  }
+  throw new SandboxViolationError(canonical);
+}
+
+/**
+ * Compute the parent directory path for browse navigation. Returns null
+ * when the parent would escape the sandbox, so the UI can disable the
+ * back button.
+ */
+export function computeParentPath(canonical: string, home: string): string | null {
+  // `path.resolve` collapses trailing separators; never returns an empty
+  // string, which means "/" maps to "/".
+  if (canonical === "/" || canonical === sep) return null;
+
+  const parent = resolve(canonical, "..");
+  if (parent === canonical) return null;
+
+  try {
+    assertInsideSandbox(parent, home);
+  } catch {
+    return null;
+  }
+  return parent;
+}
+
+/**
+ * Sort dirs first, files second; case-insensitive alphabetical within group.
+ * Stable: returns a new array, doesn't mutate input.
+ */
+export function sortEntries(entries: ReadonlyArray<FilesystemEntry>): FilesystemEntry[] {
+  return [...entries].sort((a, b) => {
+    if (a.isDir !== b.isDir) return a.isDir ? -1 : 1;
+    return a.name.localeCompare(b.name, undefined, { sensitivity: "base" });
+  });
+}
+
+interface ClassifyResult {
+  entry: FilesystemEntry | null;
+}
+
+/**
+ * Convert a single dirent to a `FilesystemEntry`. Symlinks are followed
+ * exactly once via `stat` so we can mark `isDir` correctly. Per-entry stat
+ * is bounded by `STAT_BUDGET_MS`; entries that exceed it are dropped.
+ *
+ * Exposed for tests.
+ */
+export function classifyDirent(dirent: Dirent, fullPath: string, io: BrowseIo): ClassifyResult {
+  const isSymlink = dirent.isSymbolicLink();
+  if (!isSymlink) {
+    return {
+      entry: {
+        name: dirent.name,
+        fullPath,
+        isDir: dirent.isDirectory(),
+        isSymlink: false,
+      },
+    };
+  }
+
+  // Follow symlinks once. Slow network mounts get a short stat budget and
+  // skip silently if exceeded.
+  const start = io.now();
+  let isDir: boolean;
+  try {
+    const stat = io.stat(fullPath);
+    if (io.now() - start > STAT_BUDGET_MS) {
+      return { entry: null };
+    }
+    isDir = stat.isDirectory();
+  } catch {
+    // Broken symlink — keep it as a non-directory entry so the UI can
+    // still show it, but mark accordingly.
+    return {
+      entry: {
+        name: dirent.name,
+        fullPath,
+        isDir: false,
+        isSymlink: true,
+      },
+    };
+  }
+
+  return {
+    entry: {
+      name: dirent.name,
+      fullPath,
+      isDir,
+      isSymlink: true,
+    },
+  };
+}
+
+/**
+ * Browse a directory. Returns canonical path + entries + parent.
+ *
+ * @throws {InvalidPathError}  Bad input (empty, relative, null bytes).
+ * @throws {PathNotFoundError} Path doesn't exist (realpath failed).
+ * @throws {SandboxViolationError} Path resolves outside the allowed sandbox.
+ */
+export function browseDirectory(input: BrowseInput, io: BrowseIo = realIo): FilesystemBrowseResult {
+  const home = io.home();
+  const requestedPath = input.path?.trim() ? input.path.trim() : home;
+
+  let preflightPath: string;
+  try {
+    preflightPath = preflight(requestedPath, io);
+  } catch (err) {
+    if (err instanceof InvalidPathError) throw err;
+    throw new InvalidPathError("Invalid path");
+  }
+
+  let canonical: string;
+  try {
+    canonical = io.realpath(preflightPath);
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      throw new PathNotFoundError(preflightPath);
+    }
+    throw err;
+  }
+
+  assertInsideSandbox(canonical, home);
+
+  let dirents: Dirent[];
+  try {
+    dirents = io.readdir(canonical);
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === "ENOENT") {
+      throw new PathNotFoundError(canonical);
+    }
+    if (code === "ENOTDIR") {
+      throw new InvalidPathError(`"${canonical}" is not a directory`);
+    }
+    throw err;
+  }
+
+  const showHidden = Boolean(input.showHidden);
+  const entries: FilesystemEntry[] = [];
+  for (const dirent of dirents) {
+    if (!showHidden && dirent.name.startsWith(".")) continue;
+    const fullPath = join(canonical, dirent.name);
+    const { entry } = classifyDirent(dirent, fullPath, io);
+    if (entry !== null) entries.push(entry);
+  }
+
+  return {
+    path: canonical,
+    parentPath: computeParentPath(canonical, home),
+    entries: sortEntries(entries),
+  };
+}

package/packages/daemon/src/lib/launch-plan.ts

@@ -0,0 +1,90 @@
+import { resolve } from "node:path";
+import type { Pane, Row, PaneAction } from "../types.ts";
+import { shellEscape } from "./shell.ts";
+
+export function buildPaneCommand(pane: Pane): string | null {
+  if (!pane.command) return null;
+  return pane.command;
+}
+
+export function collectPaneStartupPlan(
+  rows: Row[],
+  paneMap: string[][],
+  firstPanesOfRows: Set<string>,
+  dir: string,
+): { focusPane: string; paneActions: PaneAction[] } {
+  let focusPane = paneMap[0]![0]!;
+  const paneActions: PaneAction[] = [];
+
+  for (let rowIdx = 0; rowIdx < rows.length; rowIdx++) {
+    const row = rows[rowIdx]!;
+    const panes = row.panes ?? [];
+
+    for (let paneIdx = 0; paneIdx < panes.length; paneIdx++) {
+      const pane = panes[paneIdx]!;
+      const tmuxPane = paneMap[rowIdx]![paneIdx]!;
+      // Derive @ide_role from pane config
+      let paneRole: string;
+      if (pane.role === "lead") {
+        paneRole = "lead";
+      } else if (pane.role === "teammate" || pane.role === "planner") {
+        paneRole = "teammate";
+      } else if (pane.type) {
+        paneRole = "widget";
+      } else {
+        paneRole = "shell";
+      }
+
+      // Derive @ide_type from pane config
+      let paneType: string;
+      if (pane.type) {
+        paneType = pane.type;
+      } else if (pane.command && /claude|codex/i.test(pane.command)) {
+        paneType = "agent";
+      } else {
+        paneType = "shell";
+      }
+
+      const action: PaneAction = {
+        targetPane: tmuxPane,
+        title: pane.title ?? null,
+        chdir: null,
+        exports: [],
+        command: null,
+        widgetType: pane.type ?? null,
+        widgetTarget: pane.target ?? null,
+        paneRole,
+        paneType,
+      };
+
+      if (pane.dir && firstPanesOfRows.has(tmuxPane)) {
+        action.chdir = resolve(dir, pane.dir);
+      }
+
+      if (pane.env && typeof pane.env === "object") {
+        action.exports = Object.entries(pane.env).map(
+          ([key, value]) => `export ${shellEscape(key)}=${shellEscape(String(value))}`,
+        );
+      }
+
+      let command = buildPaneCommand(pane);
+      // Inject --name flag into Claude/Codex commands so the agent
+      // sets its own pane title to match the configured name.
+      // This is agent-agnostic: any CLI that respects --name will work.
+      if (command && pane.title && /claude|codex/i.test(command) && !command.includes("--name")) {
+        command = `${command} --name ${shellEscape(pane.title)}`;
+      }
+      if (command) {
+        action.command = command;
+      }
+
+      if (pane.focus) {
+        focusPane = tmuxPane;
+      }
+
+      paneActions.push(action);
+    }
+  }
+
+  return { focusPane, paneActions };
+}