tmux-ide 2.8.0 → 2.9.0-beta.6

package/packages/daemon/src/lib/onboarding-marker.ts

@@ -0,0 +1,51 @@
+/**
+ * The first-run onboarding marker — a machine-local record that the desktop
+ * app's gentle intro layer has been dismissed, so it shows exactly once and
+ * never returns.
+ *
+ * It lives in the shared state home (`TMUX_IDE_HOME` when set, else
+ * `~/.tmux-ide`) alongside the welcome and update-check markers, and follows the
+ * same discipline: the read is offline/error-safe and degrades to "not yet
+ * acknowledged" on anything unreadable; the write is best-effort and never
+ * throws. Nothing here is on a hot path.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { stateHome } from "./state-home.ts";
+
+/** Absolute path to the marker file: `<state-home>/onboarding.json`. */
+export function onboardingMarkerPath(): string {
+  return join(stateHome(), "onboarding.json");
+}
+
+/**
+ * Has the first-run intro been acknowledged? False (never throws) when the
+ * marker is absent, unreadable, malformed, or explicitly not acknowledged.
+ */
+export function readOnboardingIntroAcknowledged(): boolean {
+  const path = onboardingMarkerPath();
+  if (!existsSync(path)) return false;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8")) as unknown;
+    if (!parsed || typeof parsed !== "object") return false;
+    return (parsed as { introAcknowledged?: unknown }).introAcknowledged === true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Persist that the first-run intro was dismissed. Idempotent and best-effort:
+ * an unwritable state home simply means the intro may show again next launch,
+ * never a crash.
+ */
+export function acknowledgeOnboardingIntro(): void {
+  const path = onboardingMarkerPath();
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify({ introAcknowledged: true }));
+  } catch {
+    // A failed write only costs us the one-time guarantee, never correctness.
+  }
+}

package/packages/daemon/src/lib/pane-chrome.ts

@@ -0,0 +1,14 @@
+/**
+ * Shared tmux pane-chrome contract.
+ *
+ * This is deliberately engine-neutral: launch/promotion reserve the row, the
+ * TUI updater fills the chip option, and the GUI paints its interactive header
+ * over exactly the same row. Keeping the wire-format constants here prevents
+ * either presentation adapter from becoming the other's dependency.
+ */
+
+/** Per-pane chip rendered by native tmux when the GUI is not covering the row. */
+export const PANE_CHROME_CHIP_OPTION = "@tmux_ide_chip";
+
+/** One information-bearing tmux row shared by native tmux and browser chrome. */
+export const PANE_CHROME_BORDER_FORMAT = ` #{?#{${PANE_CHROME_CHIP_OPTION}},#{${PANE_CHROME_CHIP_OPTION}},#{pane_title}} `;

package/packages/daemon/src/lib/pane-source-credentials.ts

@@ -0,0 +1,200 @@
+import { randomBytes } from "node:crypto";
+
+export const PANE_SOURCE_CREDENTIAL_OPTION = "@tmux_ide_source_credential_v1";
+export const PANE_SOURCE_CREDENTIAL_HEADER = "X-Tmux-Ide-Pane-Source-Credential";
+export const STARTUP_PANE_CREDENTIAL_TIMEOUT_MS = 2_000;
+
+export interface PaneSourceCredentialTmux {
+  run(args: readonly string[]): string;
+  runAsync?: (args: readonly string[], signal?: AbortSignal) => Promise<string>;
+}
+
+interface CredentialGrant {
+  readonly session: string;
+  readonly runtimePaneId: string;
+  readonly semanticPaneId: string;
+}
+
+/**
+ * Daemon-generation-only source attribution capabilities for local tmux panes.
+ *
+ * Threat boundary: tmux is controlled by the local OS user. Another process
+ * running as that same user can inspect or replace pane options, so this is not
+ * cryptographic isolation from hostile same-user code. The capability proves
+ * product transport provenance against untrusted renderer/request-body claims
+ * and is continuously reconciled with daemon-owned state.
+ */
+export class PaneSourceCredentialAuthority {
+  readonly #tmux: PaneSourceCredentialTmux;
+  readonly #grants = new Map<string, CredentialGrant>();
+  readonly #tokensByPane = new Map<string, string>();
+  readonly #sessionRevisions = new Map<string, number>();
+
+  constructor(tmux: PaneSourceCredentialTmux) {
+    this.#tmux = tmux;
+  }
+
+  rotateSession(session: string): void {
+    for (const [token, grant] of this.#grants) {
+      if (grant.session === session) this.#grants.delete(token);
+    }
+    for (const key of this.#tokensByPane.keys()) {
+      if (key.startsWith(`${session}\0`)) this.#tokensByPane.delete(key);
+    }
+    this.reconcileSession(session);
+  }
+
+  reconcileSession(session: string): void {
+    this.#sessionRevisions.set(session, (this.#sessionRevisions.get(session) ?? 0) + 1);
+    const rows = this.#tmux.run([
+      "list-panes",
+      "-s",
+      "-t",
+      `=${session}`,
+      "-F",
+      `#{pane_id}\t#{@tmux_ide_pane_id}\t#{${PANE_SOURCE_CREDENTIAL_OPTION}}`,
+    ]);
+    const live = new Set<string>();
+    for (const row of rows.split("\n")) {
+      const [runtimePaneId, semanticPaneId, installedToken = ""] = row.split("\t");
+      if (!runtimePaneId || !semanticPaneId) continue;
+      const paneKey = `${session}\0${runtimePaneId}`;
+      live.add(paneKey);
+      const existingToken = this.#tokensByPane.get(paneKey);
+      const existing = existingToken ? this.#grants.get(existingToken) : undefined;
+      if (existing?.semanticPaneId === semanticPaneId && installedToken === existingToken) continue;
+      if (existingToken) this.#grants.delete(existingToken);
+      const token = randomBytes(32).toString("base64url");
+      this.#tmux.run([
+        "set-option",
+        "-p",
+        "-t",
+        runtimePaneId,
+        PANE_SOURCE_CREDENTIAL_OPTION,
+        token,
+      ]);
+      this.#tokensByPane.set(paneKey, token);
+      this.#grants.set(token, { session, runtimePaneId, semanticPaneId });
+    }
+    for (const [paneKey, token] of this.#tokensByPane) {
+      if (!paneKey.startsWith(`${session}\0`) || live.has(paneKey)) continue;
+      this.#tokensByPane.delete(paneKey);
+      this.#grants.delete(token);
+    }
+  }
+
+  /**
+   * Reconcile credentials without blocking the daemon event loop. A synchronous
+   * request-time reconciliation may race an awaited tmux child; the revision
+   * check retries from live tmux state so the installed option and grant table
+   * cannot settle on different tokens.
+   */
+  async reconcileSessionAsync(session: string, signal?: AbortSignal): Promise<void> {
+    const runAsync = this.#tmux.runAsync;
+    if (!runAsync) {
+      this.reconcileSession(session);
+      return;
+    }
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      signal?.throwIfAborted();
+      const revision = this.#sessionRevisions.get(session) ?? 0;
+      const rows = await runAsync(
+        [
+          "list-panes",
+          "-s",
+          "-t",
+          `=${session}`,
+          "-F",
+          `#{pane_id}\t#{@tmux_ide_pane_id}\t#{${PANE_SOURCE_CREDENTIAL_OPTION}}`,
+        ],
+        signal,
+      );
+      signal?.throwIfAborted();
+      if ((this.#sessionRevisions.get(session) ?? 0) !== revision) continue;
+
+      const live = new Set<string>();
+      let raced = false;
+      for (const row of rows.split("\n")) {
+        const [runtimePaneId, semanticPaneId, installedToken = ""] = row.split("\t");
+        if (!runtimePaneId || !semanticPaneId) continue;
+        const paneKey = `${session}\0${runtimePaneId}`;
+        live.add(paneKey);
+        const existingToken = this.#tokensByPane.get(paneKey);
+        const existing = existingToken ? this.#grants.get(existingToken) : undefined;
+        if (existing?.semanticPaneId === semanticPaneId && installedToken === existingToken)
+          continue;
+
+        const token = randomBytes(32).toString("base64url");
+        await runAsync(
+          ["set-option", "-p", "-t", runtimePaneId, PANE_SOURCE_CREDENTIAL_OPTION, token],
+          signal,
+        );
+        signal?.throwIfAborted();
+        if ((this.#sessionRevisions.get(session) ?? 0) !== revision) {
+          raced = true;
+          break;
+        }
+        if (existingToken) this.#grants.delete(existingToken);
+        this.#tokensByPane.set(paneKey, token);
+        this.#grants.set(token, { session, runtimePaneId, semanticPaneId });
+      }
+      if (raced) continue;
+      for (const [paneKey, token] of this.#tokensByPane) {
+        if (!paneKey.startsWith(`${session}\0`) || live.has(paneKey)) continue;
+        this.#tokensByPane.delete(paneKey);
+        this.#grants.delete(token);
+      }
+      return;
+    }
+  }
+
+  resolve(
+    credential: string | undefined,
+    session: string,
+    claimedSemanticPaneId: string | undefined,
+  ): string | null {
+    try {
+      this.reconcileSession(session);
+    } catch {
+      // A missing/churning session is absence of authority, never a reason to
+      // retain or fall back from a previously minted credential.
+      return null;
+    }
+    if (!credential || credential.length > 128 || /[\0\r\n]/u.test(credential)) return null;
+    const grant = this.#grants.get(credential);
+    if (!grant || grant.session !== session) return null;
+    if (claimedSemanticPaneId !== undefined && claimedSemanticPaneId !== grant.semanticPaneId) {
+      return null;
+    }
+    return grant.semanticPaneId;
+  }
+
+  dispose(): void {
+    this.#grants.clear();
+    this.#tokensByPane.clear();
+    this.#sessionRevisions.clear();
+  }
+}
+
+export async function reconcilePaneSourceCredentialsAtStartup(
+  authority: PaneSourceCredentialAuthority,
+  sessions: readonly string[],
+  timeoutMs = STARTUP_PANE_CREDENTIAL_TIMEOUT_MS,
+): Promise<"complete" | "timed-out"> {
+  const uniqueSessions = [...new Set(sessions)];
+  if (uniqueSessions.length === 0) return "complete";
+  const controller = new AbortController();
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  const reconciliation = Promise.allSettled(
+    uniqueSessions.map((session) => authority.reconcileSessionAsync(session, controller.signal)),
+  );
+  const deadline = new Promise<"timed-out">((resolve) => {
+    timeout = setTimeout(() => {
+      controller.abort();
+      resolve("timed-out");
+    }, timeoutMs);
+  });
+  const result = await Promise.race([reconciliation.then(() => "complete" as const), deadline]);
+  if (timeout !== undefined) clearTimeout(timeout);
+  return result;
+}

package/packages/daemon/src/lib/pane-widget.ts

@@ -0,0 +1,182 @@
+import { basename, extname } from "node:path";
+
+import {
+  RichCardWidgetArgsSchemaZ,
+  WIDGET_MARKER_MAX_PAYLOAD_CHARACTERS,
+  WidgetAssetIdSchemaZ,
+  widgetMarkerAnnouncement,
+  type RichCardWidgetArgs,
+} from "@tmux-ide/contracts";
+
+/**
+ * `tmux-ide widget` — the helper that opts a pane into rich rendering.
+ *
+ * PURE. Everything here turns bytes the caller already read into the exact
+ * string the pane should print; the CLI does the reading, the writing and the
+ * signal handling. See apps/desktop-renderer/src/terminal/widgets/WIDGETS.md
+ * for the grammar and the refusals.
+ */
+
+export type PaneWidgetRefusalReason =
+  | "unsupported-media"
+  | "too-large"
+  | "empty"
+  | "unknown-widget"
+  | "unsupported-source";
+
+export class PaneWidgetRefusal extends Error {
+  constructor(
+    readonly reason: PaneWidgetRefusalReason,
+    message: string,
+  ) {
+    super(message);
+    this.name = "PaneWidgetRefusal";
+  }
+}
+
+/** Extensions the image widget can render, mapped to the media type it declares. */
+const IMAGE_MEDIA_BY_EXTENSION = new Map<string, string>([
+  [".png", "image/png"],
+  [".jpg", "image/jpeg"],
+  [".jpeg", "image/jpeg"],
+  [".gif", "image/gif"],
+  [".webp", "image/webp"],
+  [".avif", "image/avif"],
+]);
+
+export function imageMediaTypeFor(fileName: string): string | null {
+  return IMAGE_MEDIA_BY_EXTENSION.get(extname(fileName).toLowerCase()) ?? null;
+}
+
+/**
+ * The largest file the image widget can carry.
+ *
+ * The bytes ride inside the marker line, so the ceiling is the marker's — less
+ * TWO encoding steps, which is the part that is easy to miscount: the file is
+ * base64 into the JSON argument object, and then the whole object is base64url
+ * into the payload field. Each costs 4/3, so the round trip is 1.78, and the
+ * 0.94 covers the JSON envelope and the field names.
+ *
+ * 98,304 / 1.78 x 0.94 = 51,913 bytes (~50 KB). Sizing this at 96 KB instead —
+ * the figure that falls out if only one encoding step is counted — would
+ * produce a 174,816-character payload, or 2,186 wrapped rows at 80 columns,
+ * which overflows the 2,000-row mirror seed window and would silently break
+ * re-detection after every reconnect. The full derivation, including the
+ * ~50-column floor below which even a legal marker can be truncated, is the
+ * table in apps/desktop-renderer/src/terminal/widgets/WIDGETS.md.
+ *
+ * Serving image bytes over a daemon route instead — which lifts this entirely —
+ * is the documented follow-up.
+ */
+export const PANE_WIDGET_IMAGE_MAX_BYTES = Math.floor(
+  (WIDGET_MARKER_MAX_PAYLOAD_CHARACTERS / 1.78) * 0.94,
+);
+
+export function buildMarkdownAnnouncement(text: string, title?: string): string {
+  if (text.trim().length === 0) {
+    throw new PaneWidgetRefusal("empty", "There is no markdown to render: the input was empty.");
+  }
+  try {
+    return widgetMarkerAnnouncement("markdown", title === undefined ? { text } : { text, title });
+  } catch {
+    throw new PaneWidgetRefusal(
+      "too-large",
+      `The markdown is too large to render in a pane (the marker holds about ` +
+        `${Math.floor(WIDGET_MARKER_MAX_PAYLOAD_CHARACTERS / 1_024)} KB of encoded arguments).`,
+    );
+  }
+}
+
+export function buildImageAnnouncement(bytes: Uint8Array, filePath: string): string {
+  const name = basename(filePath);
+  const media = imageMediaTypeFor(name);
+  if (media === null) {
+    throw new PaneWidgetRefusal(
+      "unsupported-media",
+      `"${name}" is not an image this pane can render. Supported: ` +
+        `${[...IMAGE_MEDIA_BY_EXTENSION.keys()].join(", ")}. SVG is deliberately excluded — it is ` +
+        `a document that can carry script, not a picture.`,
+    );
+  }
+  if (bytes.byteLength === 0) {
+    throw new PaneWidgetRefusal("empty", `"${name}" is empty.`);
+  }
+  if (bytes.byteLength > PANE_WIDGET_IMAGE_MAX_BYTES) {
+    throw new PaneWidgetRefusal(
+      "too-large",
+      `"${name}" is ${Math.round(bytes.byteLength / 1_024)} KB, over the ` +
+        `${Math.round(PANE_WIDGET_IMAGE_MAX_BYTES / 1_024)} KB limit for an in-pane image. The ` +
+        `bytes travel inside the pane's own output, so the ceiling is the marker's.`,
+    );
+  }
+  return widgetMarkerAnnouncement("image", {
+    media,
+    data: Buffer.from(bytes).toString("base64"),
+    name,
+  });
+}
+
+export function buildMarkdownAssetAnnouncement(assetId: string, title?: string): string {
+  const id = WidgetAssetIdSchemaZ.parse(assetId);
+  return widgetMarkerAnnouncement(
+    "markdown",
+    title === undefined ? { assetId: id } : { assetId: id, title },
+  );
+}
+
+export function buildImageAssetAnnouncement(
+  assetId: string,
+  options: { readonly name?: string; readonly alt?: string } = {},
+): string {
+  const id = WidgetAssetIdSchemaZ.parse(assetId);
+  return widgetMarkerAnnouncement("image", {
+    assetId: id,
+    ...(options.name === undefined ? {} : { name: options.name }),
+    ...(options.alt === undefined ? {} : { alt: options.alt }),
+  });
+}
+
+export function buildCardAnnouncement(value: unknown): string {
+  const card = RichCardWidgetArgsSchemaZ.parse(value) satisfies RichCardWidgetArgs;
+  return widgetMarkerAnnouncement("card", card);
+}
+
+export const PANE_WIDGET_IDS = ["markdown", "image", "card"] as const;
+export type PaneWidgetId = (typeof PANE_WIDGET_IDS)[number];
+
+export function paneWidgetId(value: string): PaneWidgetId {
+  if ((PANE_WIDGET_IDS as readonly string[]).includes(value)) return value as PaneWidgetId;
+  throw new PaneWidgetRefusal(
+    "unknown-widget",
+    `"${value}" is not a widget. Available: ${PANE_WIDGET_IDS.join(", ")}.`,
+  );
+}
+
+/**
+ * Resolve the friendly `tmux-ide show <file>` surface by the file itself.
+ * `widget` remains the low-level explicit protocol; humans should not have to
+ * remember a renderer name that the extension already states unambiguously.
+ */
+export function paneWidgetIdForFile(fileName: string): PaneWidgetId {
+  const extension = extname(fileName).toLowerCase();
+  if ([".md", ".markdown"].includes(extension)) return "markdown";
+  if (IMAGE_MEDIA_BY_EXTENSION.has(extension)) return "image";
+  if (extension === ".json") return "card";
+  const name = basename(fileName) || fileName || "input";
+  throw new PaneWidgetRefusal(
+    "unsupported-source",
+    `tmux-ide cannot infer how to show "${name}". Supported: Markdown ` +
+      `(.md, .markdown), raster images (${[...IMAGE_MEDIA_BY_EXTENSION.keys()].join(", ")}), ` +
+      `and declarative cards (.json).`,
+  );
+}
+
+/**
+ * What the helper prints on SIGINT: erase the screen and park the cursor.
+ *
+ * Clearing is what actually restores the pane. The renderer keeps showing a
+ * widget for exactly as long as the marker is somewhere in the grid, so wiping
+ * the grid — not exiting, not any message to the app — is the signal that this
+ * pane is an ordinary terminal again.
+ */
+export const PANE_WIDGET_RESTORE_SEQUENCE = "\u001b[2J\u001b[3J\u001b[H";

package/packages/daemon/src/lib/project-inspect.ts

@@ -73,6 +73,10 @@ export async function inspectProject(dir: string, io: InspectIo = {}): Promise<P
     name: probe.name,
     dir: probe.dir,
     hasIdeYml: probe.hasIdeYml,
+    hasWorkspaceConfig: probe.hasWorkspaceConfig,
+    configKind: probe.configKind,
+    configPath: probe.configPath,
+    ideConfigPath: probe.ideConfigPath,
     gitOrigin: probe.gitOrigin,
     gitBranch: probe.gitBranch,
     detected,

package/packages/daemon/src/lib/project-onboard.ts

@@ -10,15 +10,15 @@
  */
 
 import yaml from "js-yaml";
-import { existsSync } from "node:fs";
-import { join } from "node:path";
 import type { Pane, Row, IdeConfig } from "../schemas/ide-config.ts";
+import { resolveProject, type ProjectResolution } from "./project-resolver.ts";
 
 export class OnboardConflictError extends Error {
-  readonly code = "IDE_YML_EXISTS";
-  constructor(path: string) {
-    super(`ide.yml already exists at ${path}`);
+  readonly code: string;
+  constructor(path: string, code = "IDE_YML_EXISTS") {
+    super(`project config already exists at ${path}`);
     this.name = "OnboardConflictError";
+    this.code = code;
   }
 }
 
@@ -54,8 +54,7 @@ export interface ComposeIdeYmlInput {
  * same output, no io.
  *
  * Layout shape:
- *   - Row 0 (70%): N Claude panes, first focused. When `agents > 1`, the
- *     `team:` block is added so Claude Code launches with team mode.
+ *   - Row 0 (70%): N Claude panes, first focused.
  *   - Row 1 (30%): Dev pane (if `devCommand` set) + Shell pane.
  */
 export function composeIdeYmlConfig(input: ComposeIdeYmlInput): IdeConfig {
@@ -70,7 +69,6 @@ export function composeIdeYmlConfig(input: ComposeIdeYmlInput): IdeConfig {
   }
 
   const agentsCount = input.agents;
-  const useTeam = agentsCount > 1;
 
   const customNames = input.agentNames;
   if (customNames !== undefined) {
@@ -88,15 +86,13 @@ export function composeIdeYmlConfig(input: ComposeIdeYmlInput): IdeConfig {
 
   const topPanes: Pane[] = [];
   for (let i = 0; i < agentsCount; i++) {
-    const fallback = useTeam ? (i === 0 ? "Lead" : `Teammate ${i}`) : `Claude ${i + 1}`;
+    const fallback = agentsCount > 1 ? (i === 0 ? "Lead" : `Teammate ${i}`) : `Claude ${i + 1}`;
     const customTitle = customNames?.[i]?.trim();
     const pane: Pane = {
+      id: `agent-${i + 1}`,
       title: customTitle && customTitle.length > 0 ? customTitle : fallback,
       command: "claude",
     };
-    if (useTeam) {
-      pane.role = i === 0 ? "lead" : "teammate";
-    }
     if (i === 0) {
       pane.focus = true;
     }
@@ -106,9 +102,9 @@ export function composeIdeYmlConfig(input: ComposeIdeYmlInput): IdeConfig {
   const bottomPanes: Pane[] = [];
   const devCommand = input.devCommand?.trim();
   if (devCommand) {
-    bottomPanes.push({ title: "Dev", command: devCommand });
+    bottomPanes.push({ id: "dev", title: "Dev", command: devCommand });
   }
-  bottomPanes.push({ title: "Shell" });
+  bottomPanes.push({ id: "shell", title: "Shell" });
 
   const rows: Row[] = [{ size: "70%", panes: topPanes }, { panes: bottomPanes }];
 
@@ -117,10 +113,6 @@ export function composeIdeYmlConfig(input: ComposeIdeYmlInput): IdeConfig {
     rows,
   };
 
-  if (useTeam) {
-    config.team = { name: cleanName };
-  }
-
   return config;
 }
 
@@ -138,12 +130,15 @@ export function composeIdeYml(input: ComposeIdeYmlInput): string {
  * file separately via `writeConfig`; this helper exists so the route can
  * 409 cleanly without ever overwriting user content.
  */
-export function assertNoExistingIdeYml(
+export async function assertNoExistingIdeYml(
   dir: string,
-  exists: (path: string) => boolean = existsSync,
-): void {
-  const path = join(dir, "ide.yml");
-  if (exists(path)) {
-    throw new OnboardConflictError(path);
+  resolver: (dir: string) => Promise<ProjectResolution> = resolveProject,
+): Promise<void> {
+  const resolution = await resolver(dir);
+  if (resolution.config.kind === "legacy") {
+    throw new OnboardConflictError(resolution.config.path, "IDE_YML_EXISTS");
+  }
+  if (resolution.config.kind === "workspace") {
+    throw new OnboardConflictError(resolution.config.path, "WORKSPACE_CONFIG_EXISTS");
   }
 }

package/packages/daemon/src/lib/project-probe.ts

@@ -1,23 +1,29 @@
 /**
  * Project probe — inspects a directory and returns identity facts (name from
- * basename, ide.yml presence, git origin/branch). Pure-ish wrapper over a few
- * filesystem and git child-process calls; the io functions are pluggable for
- * tests so we don't need a full mock filesystem.
+ * basename, legacy ide.yml presence, git origin/branch). Canonical path and
+ * config facts delegate to project-resolver; the io functions remain
+ * pluggable so tests don't need a full mock filesystem.
  *
  * All git invocations are hard-bounded by a 2s timeout — we never want a
  * single misbehaving repo to hang an HTTP request.
  */
 
-import { execFile } from "node:child_process";
-import { existsSync } from "node:fs";
 import { basename, isAbsolute, resolve } from "node:path";
-
-const GIT_TIMEOUT_MS = 2_000;
+import {
+  defaultProjectResolverIo,
+  resolveProject,
+  type ProjectConfigKind,
+  type ProjectResolverIo,
+} from "./project-resolver.ts";
 
 export interface ProjectProbe {
   name: string;
   dir: string;
   hasIdeYml: boolean;
+  hasWorkspaceConfig: boolean;
+  configKind: ProjectConfigKind;
+  configPath: string | null;
+  ideConfigPath: string | null;
   gitOrigin: string | null;
   gitBranch: string | null;
 }
@@ -29,26 +35,10 @@ export interface ProjectProbe {
 export interface ProbeIo {
   exists(path: string): boolean;
   runGit(args: string[], cwd: string): Promise<string | null>;
+  realpath?: ProjectResolverIo["realpath"];
 }
 
-const realIo: ProbeIo = {
-  exists: existsSync,
-  runGit: (args, cwd) =>
-    new Promise((resolveResult) => {
-      execFile(
-        "git",
-        ["-C", cwd, ...args],
-        { timeout: GIT_TIMEOUT_MS, encoding: "utf-8" },
-        (err, stdout) => {
-          if (err) {
-            resolveResult(null);
-            return;
-          }
-          resolveResult(stdout.trim());
-        },
-      );
-    }),
-};
+const realIo: ProbeIo = defaultProjectResolverIo;
 
 /**
  * Replace dangerous filename characters and collapse whitespace so the
@@ -69,24 +59,42 @@ export function sanitizeName(raw: string): string {
  */
 export async function probeProject(dir: string, io: ProbeIo = realIo): Promise<ProjectProbe> {
   const absoluteDir = isAbsolute(dir) ? dir : resolve(dir);
+  const resolution = await resolveProject(dir, {
+    // Existing injected ProbeIo values predate canonicalization. Treat their
+    // paths as canonical unless they explicitly provide a realpath operation,
+    // so the probe remains a fully injected seam rather than touching real fs.
+    io: { ...io, realpath: io.realpath ?? ((path) => path) },
+  });
   const rawName = basename(absoluteDir);
   const sanitized = sanitizeName(rawName);
   const name = sanitized.length > 0 ? sanitized : "project";
 
-  const hasIdeYml = io.exists(`${absoluteDir}/ide.yml`);
-
   const [gitOrigin, gitBranch] = await Promise.all([
-    io.runGit(["config", "--get", "remote.origin.url"], absoluteDir),
-    io.runGit(["branch", "--show-current"], absoluteDir),
+    runGitSafely(io, ["config", "--get", "remote.origin.url"], absoluteDir),
+    runGitSafely(io, ["branch", "--show-current"], absoluteDir),
   ]);
 
   return {
     name,
+    // Preserve the public probe/command-center contract: this is the absolute
+    // caller path, while canonical roots live on ProjectResolution.
     dir: absoluteDir,
-    hasIdeYml,
+    hasIdeYml: resolution.hasLegacyConfigAtInput,
+    hasWorkspaceConfig: resolution.config.kind === "workspace",
+    configKind: resolution.config.kind,
+    configPath: resolution.config.path,
+    ideConfigPath: resolution.legacyConfigPath,
     // Treat empty string as null — branch --show-current returns "" on a
     // detached HEAD.
     gitOrigin: gitOrigin && gitOrigin.length > 0 ? gitOrigin : null,
     gitBranch: gitBranch && gitBranch.length > 0 ? gitBranch : null,
   };
 }
+
+async function runGitSafely(io: ProbeIo, args: string[], cwd: string): Promise<string | null> {
+  try {
+    return await io.runGit(args, cwd);
+  } catch {
+    return null;
+  }
+}