tmux-ide 2.9.0-beta.19 → 2.9.0-beta.21

package/packages/daemon/dist/lib/tmux-external-interaction-observer.js

@@ -1,21 +1,45 @@
 import { execFile } from "node:child_process";
 import { WorkspacePaneCreationReferenceSchemaZ } from "@tmux-ide/contracts";
 import { z } from "zod";
+import { logger } from "./log.js";
+import { boundedTmuxInteractionAppendCommand, tmuxInteractionOption, TMUX_INTERACTION_GAP_RECORD, TMUX_INTERACTION_MAX_DRAIN_BYTES, } from "./tmux-interaction-retention.js";
 import { createPinnedWorkspaceTmuxAsyncRunner } from "./workspace-pane-creation.js";
 import { getDefaultWorkspaceRegistry } from "./workspace-registry.js";
 import { AuthenticatedInternalReadVerifier, consumeInternalReadOperation, INTERNAL_READ_OPERATION_OPTION, INTERNAL_SEND_OPERATION_OPTION, } from "./tmux-interaction-options.js";
-const HOOK_MARKER = "tmux-ide-interaction-v2";
+const HOOK_MARKER = "tmux-ide-interaction-v3";
 const OWNED_HOOK_MARKER = "tmux-ide-interaction-v";
 const FIELD_SEPARATOR = "|tmux-ide-input-field-v1|";
 const EVENT_SEPARATOR = "|tmux-ide-input-event-v1|";
 const RUNTIME_PANE = /^%[0-9]+$/u;
 const RETRY_MS = 1_000;
+export const DEFAULT_HOOK_HEALTHCHECK_SCHEDULE = Object.freeze({
+    baseMs: 1_000,
+    maxMs: 30_000,
+});
+/** Pure cadence rule: healthy checks double the wait up to the cap; anything else resets it. */
+export function nextHookHealthcheckDelay(previousMs, outcome, schedule = DEFAULT_HOOK_HEALTHCHECK_SCHEDULE) {
+    const base = Math.max(1, Math.floor(schedule.baseMs));
+    const max = Math.max(base, Math.floor(schedule.maxMs));
+    if (outcome !== "healthy")
+        return base;
+    const previous = Number.isFinite(previousMs) ? Math.max(base, Math.floor(previousMs)) : base;
+    return Math.min(previous * 2, max);
+}
 /**
- * Hooks are shared tmux state. A config reload, another client, or a debugging
- * command can replace them without killing the daemon, so waiting forever on
- * the old signal channel is not a sufficient health check.
+ * True when `show-hooks` output lists an entry of `hookName` whose body carries
+ * this observer's buffer name. Output may hold several hook arrays at once
+ * (one combined `show-hooks -g a ; show-hooks -g b` client), so the check is
+ * per hook line rather than a substring search over the whole output.
  */
-const HOOK_HEALTHCHECK_MS = 1_000;
+export function ownedHookInstalled(output, hookName, bufferName) {
+    const row = new RegExp(`^${hookName}\\[([0-9]+)\\]\\s+(.+)$`, "u");
+    for (const line of output.split("\n")) {
+        const match = row.exec(line);
+        if (match && match[2].includes(bufferName))
+            return true;
+    }
+    return false;
+}
 export { INTERNAL_READ_OPERATION_OPTION, INTERNAL_SEND_OPERATION_OPTION };
 function socketArguments(authority) {
     return authority.socketSelector.kind === "path"
@@ -120,7 +144,7 @@ function hookIndexes(output, hookName) {
 /**
  * Event-driven adapter from tmux's native send/capture hooks into the semantic
  * interaction spine. Hooks write only runtime identity, operation kind, and an
- * internal-operation marker to a tmux paste buffer, then signal a blocked
+ * internal-operation marker to bounded tmux option storage, then signal a blocked
  * `wait-for` client. No terminal input or captured output crosses this boundary.
  */
 export class TmuxExternalInteractionObserver {
@@ -136,7 +160,10 @@ export class TmuxExternalInteractionObserver {
     #loop = null;
     #starting = null;
     #hookHealthcheck = null;
-    #drainSequence = 0;
+    #healthcheckSchedule;
+    #healthcheckDelayMs;
+    #lastHealthcheckOutcome = "failed";
+    #onGap;
     #tmuxWork = Promise.resolve();
     #reconcile = null;
     #diagnostics;
@@ -144,8 +171,14 @@ export class TmuxExternalInteractionObserver {
     #authenticatedInternalReads;
     constructor(options) {
         this.#daemonInstanceId = options.daemonInstanceId;
+        this.#healthcheckSchedule = Object.freeze({
+            baseMs: options.healthcheck?.baseMs ?? DEFAULT_HOOK_HEALTHCHECK_SCHEDULE.baseMs,
+            maxMs: options.healthcheck?.maxMs ?? DEFAULT_HOOK_HEALTHCHECK_SCHEDULE.maxMs,
+        });
+        this.#healthcheckDelayMs = this.#healthcheckSchedule.baseMs;
         this.#registry = options.registry ?? getDefaultWorkspaceRegistry();
         this.#onObserved = options.onObserved;
+        this.#onGap = options.onGap;
         this.#authenticatedInternalReads = new AuthenticatedInternalReadVerifier({
             daemonInstanceId: options.daemonInstanceId,
             ownerToken: options.internalReadOwnerToken,
@@ -195,7 +228,7 @@ export class TmuxExternalInteractionObserver {
         catch (error) {
             await this.#serializeTmux(async () => {
                 await this.#removeOwnedHooks();
-                await this.#deleteBuffer(this.#bufferName);
+                await this.#deleteRetention();
             });
             if (!isTmuxServerUnavailable(error)) {
                 this.#active = false;
@@ -210,31 +243,76 @@ export class TmuxExternalInteractionObserver {
         if (!this.#active || this.#abort.signal.aborted) {
             await this.#serializeTmux(async () => {
                 await this.#removeOwnedHooks();
-                await this.#deleteBuffer(this.#bufferName);
+                await this.#deleteRetention();
             });
             throw new Error("tmux external interaction observer was disposed during startup");
         }
         this.#loop = this.#run();
-        this.#hookHealthcheck = setInterval(() => void this.reconcileHooks(), HOOK_HEALTHCHECK_MS);
-        this.#hookHealthcheck.unref?.();
+        this.#scheduleHealthcheck();
+    }
+    /** Wait before the next scheduled hook health check. Exposed for tests. */
+    get healthcheckDelayMs() {
+        return this.#healthcheckDelayMs;
+    }
+    #scheduleHealthcheck() {
+        if (this.#hookHealthcheck)
+            clearTimeout(this.#hookHealthcheck);
+        this.#hookHealthcheck = null;
+        if (!this.#active || this.#abort.signal.aborted)
+            return;
+        const timer = setTimeout(() => {
+            if (this.#hookHealthcheck === timer)
+                this.#hookHealthcheck = null;
+            void this.#runScheduledHealthcheck();
+        }, this.#healthcheckDelayMs);
+        timer.unref?.();
+        this.#hookHealthcheck = timer;
+    }
+    async #runScheduledHealthcheck() {
+        const delayBefore = this.#healthcheckDelayMs;
+        let outcome;
+        try {
+            await this.reconcileHooks();
+            outcome = this.#lastHealthcheckOutcome;
+        }
+        catch {
+            if (!this.#abort.signal.aborted)
+                this.#reportGap("hook-repair-failed");
+            outcome = "failed";
+        }
+        // A signal-path reset that landed during this check wins over the outcome.
+        if (this.#healthcheckDelayMs === delayBefore) {
+            this.#healthcheckDelayMs = nextHookHealthcheckDelay(delayBefore, outcome, this.#healthcheckSchedule);
+        }
+        if (this.#hookHealthcheck === null)
+            this.#scheduleHealthcheck();
+    }
+    /** Something failed on the signal path: verify the hooks promptly again. */
+    #resetHealthcheckBackoff() {
+        const base = this.#healthcheckSchedule.baseMs;
+        if (this.#healthcheckDelayMs === base)
+            return;
+        this.#healthcheckDelayMs = base;
+        if (this.#hookHealthcheck)
+            this.#scheduleHealthcheck();
     }
     setDiagnostics(diagnostics) {
         this.#diagnostics = diagnostics;
     }
     async dispose() {
-        if (!this.#active && !this.#loop && !this.#starting)
+        if (!this.#active && !this.#loop && !this.#starting && !this.#installed)
             return;
         const starting = this.#starting;
         this.#active = false;
         this.#abort.abort();
         if (this.#hookHealthcheck)
-            clearInterval(this.#hookHealthcheck);
+            clearTimeout(this.#hookHealthcheck);
         this.#hookHealthcheck = null;
         await Promise.allSettled([starting, this.#loop]);
         this.#loop = null;
         await this.#serializeTmux(async () => {
             await this.#removeOwnedHooks();
-            await this.#deleteBuffer(this.#bufferName);
+            await this.#deleteRetention();
         });
     }
     /** Install the hook once. Public for hermetic lifecycle tests. */
@@ -245,15 +323,26 @@ export class TmuxExternalInteractionObserver {
         await this.#removeOwnedHooks(signal);
         await this.#deleteOwnedBuffers(signal);
         signal?.throwIfAborted();
+        // The small named buffer indexes retention options for crash cleanup;
+        // event data lives only in bounded options, never in this buffer.
+        await this.#io.runTmux(["set-buffer", "-b", this.#bufferName, "retention-owner"], signal);
         const hook = (operationKind, markerOption, consumeMarker) => {
-            const data = `#{pane_id}${FIELD_SEPARATOR}#{q:${markerOption}}${FIELD_SEPARATOR}${operationKind}${EVENT_SEPARATOR}`;
+            // Reject arbitrary option text before expansion into a tmux command.
+            // Bound markers at the producer, including across multibyte input.
+            const validMarker = `#{&&:#{m/r:^[A-Za-z0-9:._-]*$,#{${markerOption}}},#{e|<=:#{n:${markerOption}},160}}`;
+            const marker = `#{?${validMarker},#{${markerOption}},}`;
+            const data = `#{pane_id}${FIELD_SEPARATOR}${marker}${FIELD_SEPARATOR}${operationKind}${EVENT_SEPARATOR}`;
             // Expand pane/marker identity at hook invocation, then schedule the
             // append+signal as a background tmux-native command list. No shell and
             // no second tmux client sit on the invoking command queue. The tiny
             // synchronous native cleanup runs only after the record string has been
             // captured, so a marker is single-use without racing the async drain.
-            const publish = `run-shell -b -C "set-buffer -a -b '${this.#bufferName}' '${data}'` +
-                ` ; wait-for -S '${this.#signalChannel}'"`;
+            // Escape only the retention format for evaluation in the queued native
+            // command; capture pane and marker immediately, before consuming it.
+            const append = boundedTmuxInteractionAppendCommand(this.#bufferName, "RECORD")
+                .replace("#{=", "##{=")
+                .replace("RECORD", data);
+            const publish = `run-shell -b -C "${append} ; wait-for -S '${this.#signalChannel}'"`;
             // Hook commands inherit the triggering pane as their target, so cleanup
             // needs neither format expansion nor a nested command queue.
             const consume = consumeMarker ? ` ; set-option -pu '${markerOption}'` : "";
@@ -278,7 +367,7 @@ export class TmuxExternalInteractionObserver {
     /**
      * Restore product hooks when external tmux configuration removed them.
      * Public only so the lifecycle is hermetically testable; the production
-     * observer invokes it from a cheap one-second health check.
+     * observer invokes it from the backed-off health check.
      */
     reconcileHooks(options = {}) {
         if (!this.#active && options.allowInactive !== true)
@@ -289,9 +378,14 @@ export class TmuxExternalInteractionObserver {
             const finish = this.#beginDiagnostic("healthcheck");
             try {
                 if (await this.#ownedHooksPresent(this.#abort.signal)) {
+                    this.#lastHealthcheckOutcome = "healthy";
                     finish(true);
                     return;
                 }
+                // Hooks that were installed and are now gone dropped every interaction
+                // since their removal; the repair restores future observation only.
+                if (this.#installed)
+                    this.#reportGap("hooks-replaced");
                 this.#installed = false;
                 try {
                     await this.#install(this.#abort.signal);
@@ -299,6 +393,7 @@ export class TmuxExternalInteractionObserver {
                 catch {
                     this.#installed = false;
                 }
+                this.#lastHealthcheckOutcome = this.#installed ? "repaired" : "failed";
                 finish(this.#installed);
             }
             catch (error) {
@@ -313,31 +408,49 @@ export class TmuxExternalInteractionObserver {
         this.#reconcile = settled;
         return settled;
     }
-    /** Atomically detach and drain the current event buffer. */
+    /** Atomically detach and drain the current bounded event batch. */
     drain() {
         return this.#serializeTmux(() => this.#drain());
     }
     async #drain() {
         const finish = this.#beginDiagnostic("drain");
-        const drainName = `${this.#bufferName}-drain-${++this.#drainSequence}`;
+        const option = tmuxInteractionOption(this.#bufferName);
+        // A single reusable detached slot bounds retained storage even if deletion
+        // fails. Native synchronous commands execute consecutively in one queue.
+        const drainName = `${option}-drain`;
         try {
-            await this.#io.runTmux(["set-buffer", "-b", this.#bufferName, "-n", drainName], this.#abort.signal);
+            await this.#io.runTmux(["set-option", "-gF", drainName, `#{${option}}`, ";", "set-option", "-g", option, ""], this.#abort.signal);
         }
         catch {
+            this.#reportGap("detach-failed");
             finish(false);
             return false;
         }
         let raw;
-        try {
-            raw = await this.#io.runTmux(["show-buffer", "-b", drainName], this.#abort.signal);
+        // Retry the same immutable detached batch once. Never accumulate an
+        // unbounded collection of failed batches or spin until a server recovers.
+        for (let attempt = 0; attempt < 2 && !this.#abort.signal.aborted; attempt += 1) {
+            try {
+                raw = await this.#io.runTmux(["show-options", "-gv", drainName], this.#abort.signal);
+                break;
+            }
+            catch {
+                // Exhaustion is surfaced below, without terminal content or errors.
+            }
         }
-        catch {
+        await this.#deleteOption(drainName);
+        if (raw === undefined) {
+            this.#reportGap("read-failed");
             finish(false);
             return false;
         }
-        finally {
-            await this.#deleteBuffer(drainName);
+        if (Buffer.byteLength(raw, "utf8") > TMUX_INTERACTION_MAX_DRAIN_BYTES) {
+            this.#reportGap("overflow");
+            finish(false);
+            return false;
         }
+        if (raw.includes(TMUX_INTERACTION_GAP_RECORD))
+            this.#reportGap("overflow");
         let consumed = false;
         try {
             for (const record of parseTmuxInputHookRecords(raw)) {
@@ -345,6 +458,7 @@ export class TmuxExternalInteractionObserver {
             }
         }
         catch (error) {
+            this.#reportGap("projection-failed");
             finish(false);
             throw error;
         }
@@ -365,6 +479,7 @@ export class TmuxExternalInteractionObserver {
             }
             catch {
                 this.#installed = false;
+                this.#resetHealthcheckBackoff();
                 await this.#io.delay(RETRY_MS, this.#abort.signal);
             }
         }
@@ -430,18 +545,46 @@ export class TmuxExternalInteractionObserver {
         this.#installed = false;
     }
     async #ownedHooksPresent(signal) {
-        for (const hookName of ["after-send-keys", "after-capture-pane"]) {
-            let output;
-            try {
-                output = await this.#io.runTmux(["show-hooks", "-g", hookName], signal);
-            }
-            catch {
-                return false;
-            }
-            if (!output.includes(this.#bufferName))
-                return false;
+        // One client verifies both hook arrays: tmux runs the `;`-separated list in
+        // a single command queue and prints each array's lines in order.
+        let output;
+        try {
+            output = await this.#io.runTmux(["show-hooks", "-g", "after-send-keys", ";", "show-hooks", "-g", "after-capture-pane"], signal);
+        }
+        catch {
+            return false;
+        }
+        return (ownedHookInstalled(output, "after-send-keys", this.#bufferName) &&
+            ownedHookInstalled(output, "after-capture-pane", this.#bufferName));
+    }
+    #reportGap(reason) {
+        if (this.#abort.signal.aborted)
+            return;
+        const gap = { reason, recovery: "future-observations-only" };
+        logger.warn("tmux-interaction-observer", "Interaction observation gap; missing history cannot be replayed", {
+            daemonInstanceId: this.#daemonInstanceId,
+            ...gap,
+        });
+        try {
+            this.#onGap?.(gap);
+        }
+        catch {
+            /* Reporting cannot create operation authority. */
+        }
+    }
+    async #deleteOption(name, signal) {
+        try {
+            await this.#io.runTmux(["set-option", "-gu", name], signal);
+        }
+        catch {
+            /* Best effort. */
         }
-        return true;
+    }
+    async #deleteRetention() {
+        const option = tmuxInteractionOption(this.#bufferName);
+        await this.#deleteOption(option);
+        await this.#deleteOption(`${option}-drain`);
+        await this.#deleteBuffer(this.#bufferName);
     }
     async #deleteOwnedBuffers(signal) {
         let output;
@@ -452,8 +595,13 @@ export class TmuxExternalInteractionObserver {
             return;
         }
         for (const name of output.split("\n")) {
-            if (name.startsWith(OWNED_HOOK_MARKER))
-                await this.#deleteBuffer(name, signal);
+            if (!name.startsWith(OWNED_HOOK_MARKER) || name === this.#bufferName)
+                continue;
+            if (/^[A-Za-z0-9._-]{1,256}$/u.test(name)) {
+                await this.#deleteOption(tmuxInteractionOption(name), signal);
+                await this.#deleteOption(`${tmuxInteractionOption(name)}-drain`, signal);
+            }
+            await this.#deleteBuffer(name, signal);
         }
     }
     async #deleteBuffer(name, signal) {

package/packages/daemon/dist/lib/tmux-interaction-retention.js

@@ -0,0 +1,21 @@
+const EVENT_SEPARATOR = "|tmux-ide-input-event-v1|";
+// ASCII metadata only. The native producer retains a prefix plus the newest
+// record; truncation inserts a framed gap, never an invented interaction.
+// Keep this within tmux's supported format-width range: larger widths can
+// silently disable truncation. Live tests cover tmux 3.4 and 3.7c.
+export const TMUX_INTERACTION_RETAINED_CHARS = 8_192;
+export const TMUX_INTERACTION_GAP_RECORD = `${EVENT_SEPARATOR}gap${EVENT_SEPARATOR}`;
+export const TMUX_INTERACTION_MAX_DRAIN_BYTES = TMUX_INTERACTION_RETAINED_CHARS + TMUX_INTERACTION_GAP_RECORD.length + 1_024;
+export function tmuxInteractionOption(bufferName) {
+    if (!/^[A-Za-z0-9._-]{1,256}$/u.test(bufferName))
+        throw new TypeError("Invalid observer name");
+    return `@${bufferName}`;
+}
+/** One native command, also used by atomic NOHOOKS recovery (fixed ordinals). */
+export function boundedTmuxInteractionAppendCommand(bufferName, record) {
+    const option = tmuxInteractionOption(bufferName);
+    if (!/^[A-Za-z0-9%:._|-]{1,1024}$/u.test(record)) {
+        throw new TypeError("Invalid observer metadata");
+    }
+    return `set-option -gF '${option}' '#{=/${TMUX_INTERACTION_RETAINED_CHARS}/${TMUX_INTERACTION_GAP_RECORD}:${option}}${record}'`;
+}

package/packages/daemon/dist/lib/workspace-promotion.js

@@ -1,8 +1,8 @@
 import { createHash } from "node:crypto";
-import { realpathSync, statSync } from "node:fs";
+import { realpath, stat } from "node:fs/promises";
 import { WorkspacePromoteMutationRequestSchemaZ, WorkspacePromoteMutationResultSchemaZ, } from "@tmux-ide/contracts";
-import { TmuxError } from "@tmux-ide/tmux-bridge";
-import { createPinnedWorkspaceTmuxRunner, resolveWorkspacePaneTmuxAuthority, } from "./workspace-pane-creation.js";
+import { classifyTmuxError, TmuxError } from "@tmux-ide/tmux-bridge";
+import { createPinnedWorkspaceTmuxAsyncRunner, resolveWorkspacePaneTmuxAuthority, } from "./workspace-pane-creation.js";
 import { getDefaultWorkspaceRegistry, WorkspaceAlreadyExistsError, } from "./workspace-registry.js";
 import { analyzeTrustedSemanticPaneCatalog } from "../terminal/attachments/semantic-pane-catalog.js";
 import { fleetSessionIdForName } from "../command-center/resources/fleet-catalog.js";
@@ -253,11 +253,23 @@ function resource(workspaceName) {
 function requestFingerprint(request) {
     return JSON.stringify(request);
 }
+/**
+ * The daemon's pinned async runner keeps every promotion round-trip off the
+ * event loop; it surfaces raw child-process failures, so classify them here
+ * into the shared `TmuxError` codes the io predicates below inspect.
+ */
+function classifiedAsyncRunner(tmuxAuthority) {
+    const run = createPinnedWorkspaceTmuxAsyncRunner(tmuxAuthority ?? resolveWorkspacePaneTmuxAuthority());
+    return (args) => run(args).catch((error) => {
+        throw error instanceof TmuxError ? error : classifyTmuxError(error);
+    });
+}
 const DEFAULT_IO = {
-    canonicalProjectDir: (path) => {
-        const canonical = realpathSync(path);
-        if (!statSync(canonical).isDirectory())
+    canonicalProjectDir: async (path) => {
+        const canonical = await realpath(path);
+        if (!(await stat(canonical)).isDirectory()) {
             throw new Error("project root is not a directory");
+        }
         return canonical;
     },
     isMissingTmuxTarget: (error) => error instanceof TmuxError && error.code === "SESSION_NOT_FOUND",
@@ -295,8 +307,7 @@ export class WorkspacePromotionAuthority {
         this.#io = {
             ...DEFAULT_IO,
             ...options.io,
-            runTmux: options.io?.runTmux ??
-                createPinnedWorkspaceTmuxRunner(options.tmuxAuthority ?? resolveWorkspacePaneTmuxAuthority()),
+            runTmux: options.io?.runTmux ?? classifiedAsyncRunner(options.tmuxAuthority),
         };
         this.#maxReplayOperations = boundedAuthorityLimit(options.maxOperations, MAX_OPERATIONS);
         this.#maxPendingOperations = boundedAuthorityLimit(options.maxPendingOperations, MAX_OPERATIONS);
@@ -347,7 +358,7 @@ export class WorkspacePromotionAuthority {
         if (existing)
             return this.#replay(existing, request, fingerprint);
         try {
-            const session = this.#resolveSession(request.intent.sessionId);
+            const session = await this.#resolveSession(request.intent.sessionId);
             // Already a registry workspace — including an app-created (m32) session —
             // is idempotent, not an error. It is NOT automatically attachable though:
             // the registry entry is keyed by session NAME and outlives the tmux
@@ -365,20 +376,20 @@ export class WorkspacePromotionAuthority {
                     workspaceName: alreadyRegistered.name,
                     sessionName: session.sessionName,
                 };
-                this.#stampPaneInventory(request, session, registeredIdentity);
+                await this.#stampPaneInventory(request, session, registeredIdentity);
                 this.#assertActive(request.operationId);
-                this.#verifyPromotedInventory(session.sessionId, registeredIdentity);
-                this.#publishFleetEnrollment(request, session, registeredIdentity);
+                await this.#verifyPromotedInventory(session.sessionId, registeredIdentity);
+                await this.#publishFleetEnrollment(request, session, registeredIdentity);
                 return this.#succeed(request, fingerprint, alreadyRegistered.name, session.sessionName, {
                     replayed: true,
                 });
             }
             const identity = derivePromotionIdentity(session.sessionName);
             this.#assertConflictFreeIdentity(identity);
-            const canonicalRoot = this.#stampSession(request, session, identity);
+            const canonicalRoot = await this.#stampSession(request, session, identity);
             this.#assertActive(request.operationId);
-            this.#verifyPromotedInventory(session.sessionId, identity);
-            this.#publishFleetEnrollment(request, session, identity);
+            await this.#verifyPromotedInventory(session.sessionId, identity);
+            await this.#publishFleetEnrollment(request, session, identity);
             let registered;
             try {
                 registered = this.#registry.add({
@@ -416,8 +427,8 @@ export class WorkspacePromotionAuthority {
             return this.#rememberFailure(request, fingerprint, this.#mapFailure(error, request));
         }
     }
-    #resolveSession(sessionId) {
-        const records = this.#listSessions();
+    async #resolveSession(sessionId) {
+        const records = await this.#listSessions();
         const matches = records.filter((record) => fleetSessionIdForName(record.sessionName) === sessionId);
         if (matches.length !== 1) {
             throw new WorkspacePromotionError("session_not_found", { sessionId });
@@ -428,9 +439,9 @@ export class WorkspacePromotionAuthority {
         }
         return match;
     }
-    #listSessions() {
+    async #listSessions() {
         try {
-            return parseSessionRecords(this.#io.runTmux(["list-sessions", "-F", SESSION_FORMAT]));
+            return parseSessionRecords(await this.#io.runTmux(["list-sessions", "-F", SESSION_FORMAT]));
         }
         catch (error) {
             if (this.#io.isTmuxUnavailable(error))
@@ -454,11 +465,11 @@ export class WorkspacePromotionAuthority {
      * a newly published marker makes the soon-to-be registered workspace visible
      * to the shared FleetCatalog in the same mutation transaction.
      */
-    #publishFleetEnrollment(request, session, identity) {
+    async #publishFleetEnrollment(request, session, identity) {
         if (session.adopted)
             return;
         try {
-            this.#io.runTmux(["set-option", "-t", session.sessionId, ADOPTED_OPTION, "1"]);
+            await this.#io.runTmux(["set-option", "-t", session.sessionId, ADOPTED_OPTION, "1"]);
         }
         catch (error) {
             throw new WorkspacePromotionError("stamp_failed", { operationId: request.operationId, workspaceName: identity.workspaceName }, error);
@@ -470,21 +481,21 @@ export class WorkspacePromotionAuthority {
      * `set-option` failure maps to `stamp_failed`; the caller has not yet touched
      * the registry, so a failure here leaves the session harmless.
      */
-    #stampSession(request, session, identity) {
-        const scanned = this.#stampPaneInventory(request, session, identity);
+    async #stampSession(request, session, identity) {
+        const scanned = await this.#stampPaneInventory(request, session, identity);
         try {
             for (const [option, value] of [
                 [SESSION_OPERATION_OPTION, request.operationId],
                 [SESSION_WORKSPACE_OPTION, identity.workspaceName],
                 [SESSION_PROMOTED_MARKER_OPTION, "1"],
             ]) {
-                this.#io.runTmux(["set-option", "-t", session.sessionId, option, value]);
+                await this.#io.runTmux(["set-option", "-t", session.sessionId, option, value]);
             }
         }
         catch (error) {
             throw new WorkspacePromotionError("stamp_failed", { operationId: request.operationId, workspaceName: identity.workspaceName }, error);
         }
-        return this.#resolveProjectDir(session, scanned);
+        return await this.#resolveProjectDir(session, scanned);
     }
     /**
      * Stamp every pane and window of the session — additive, never overwriting a
@@ -493,10 +504,17 @@ export class WorkspacePromotionAuthority {
      * session, which may be an m32-open workspace whose provenance must never
      * acquire the promotion marker.
      */
-    #stampPaneInventory(request, session, identity) {
+    async #stampPaneInventory(request, session, identity) {
         let scanned;
         try {
-            scanned = parseScanPanes(this.#io.runTmux(["list-panes", "-s", "-t", session.sessionId, "-F", PANE_SCAN_FORMAT]));
+            scanned = parseScanPanes(await this.#io.runTmux([
+                "list-panes",
+                "-s",
+                "-t",
+                session.sessionId,
+                "-F",
+                PANE_SCAN_FORMAT,
+            ]));
         }
         catch (error) {
             if (error instanceof WorkspacePromotionError)
@@ -519,7 +537,7 @@ export class WorkspacePromotionAuthority {
             for (const pane of scanned) {
                 if (!hasValidPaneStamp(pane.semanticPaneId)) {
                     const paneStamp = `pane.promoted.${digest(`${session.sessionName}\0${pane.paneId}`)}`;
-                    this.#io.runTmux([
+                    await this.#io.runTmux([
                         "set-option",
                         "-p",
                         "-t",
@@ -531,14 +549,14 @@ export class WorkspacePromotionAuthority {
                         // Additive: only fill an empty `@ide_*`, never clobber existing intent.
                         if (value === null)
                             continue;
-                        this.#io.runTmux(["set-option", "-p", "-t", pane.paneId, option, value]);
+                        await this.#io.runTmux(["set-option", "-p", "-t", pane.paneId, option, value]);
                     }
                 }
                 if (!reconciledWindows.has(pane.windowId)) {
                     reconciledWindows.add(pane.windowId);
                     if (pane.semanticWindowId.length === 0) {
                         const windowStamp = `window.promoted.${digest(`${session.sessionName}\0${pane.windowId}`)}`;
-                        this.#io.runTmux([
+                        await this.#io.runTmux([
                             "set-option",
                             "-w",
                             "-t",
@@ -549,7 +567,7 @@ export class WorkspacePromotionAuthority {
                         // Initialize chrome only when adopting a previously unstamped
                         // window. Reopening an existing workspace must preserve native
                         // border choices and PTY dimensions, even while stamping new panes.
-                        this.#io.runTmux([
+                        await this.#io.runTmux([
                             "set-option",
                             "-w",
                             "-t",
@@ -557,7 +575,7 @@ export class WorkspacePromotionAuthority {
                             "pane-border-status",
                             "top",
                         ]);
-                        this.#io.runTmux([
+                        await this.#io.runTmux([
                             "set-option",
                             "-w",
                             "-t",
@@ -584,7 +602,7 @@ export class WorkspacePromotionAuthority {
      *   (b) then the active pane's cwd, then the remaining panes in scan order;
      *   (c) only when NOTHING resolves does promotion fail.
      */
-    #resolveProjectDir(session, scanned) {
+    async #resolveProjectDir(session, scanned) {
         const active = scanned.find((pane) => pane.active);
         const candidates = [
             session.sessionPath,
@@ -595,7 +613,7 @@ export class WorkspacePromotionAuthority {
             if (candidate.length === 0)
                 continue;
             try {
-                return this.#io.canonicalProjectDir(candidate);
+                return await this.#io.canonicalProjectDir(candidate);
             }
             catch {
                 // A dead or non-directory cwd (a pruned worktree) is expected; try the
@@ -648,12 +666,12 @@ export class WorkspacePromotionAuthority {
      * initial-Terminal-window assertion — a promoted session may have any number
      * of windows and multi-pane windows.
      */
-    #verifyPromotedInventory(sessionId, identity) {
+    async #verifyPromotedInventory(sessionId, identity) {
         let panes;
         try {
             const args = ["list-panes", "-s", "-t", sessionId, "-F", PANE_VERIFY_FORMAT];
-            const before = boundedTmuxOutput(this.#io.runTmux(args));
-            const after = boundedTmuxOutput(this.#io.runTmux(args));
+            const before = boundedTmuxOutput(await this.#io.runTmux(args));
+            const after = boundedTmuxOutput(await this.#io.runTmux(args));
             if (before !== after) {
                 throw new WorkspacePromotionError("promotion_verification_failed", {
                     reason: "inventory_changed_during_proof",

package/packages/daemon/dist/terminal/mirror/session-channel.js

@@ -1,3 +1,4 @@
+import { boundedTmuxInteractionAppendCommand } from "../../lib/tmux-interaction-retention.js";
 import { decodeNativeGridCapture, isNativeBootstrapCapture, } from "./native-grid-capture.js";
 /**
  * SessionChannel — one control-mode channel serving every pane subscription
@@ -1422,7 +1423,7 @@ export class SessionChannel {
             return;
         }
         const sentinel = (kind) => `display-message -p -l -t ${pane.runtimeId} ` + `"%tmux-ide-atomic-v1 ${nonce} ${kind}"`;
-        const observerCommands = ` ; set-buffer -a -b ${observer.bufferName} ${tmuxSingleQuote(observer.record)}` +
+        const observerCommands = ` ; ${boundedTmuxInteractionAppendCommand(observer.bufferName, observer.record)}` +
             ` ; wait-for -S ${observer.signalChannel}`;
         const body = `set-option -po -t ${pane.runtimeId} ${INTERNAL_READ_OPERATION_OPTION} ${internalReadMarker}` +
             ` ; ${sentinel("start")}` +