tmux-ide 2.9.0-beta.21 → 2.9.0-beta.22

package/packages/daemon/src/terminal/mirror/window-link-authority.ts

@@ -0,0 +1,203 @@
+import { randomUUID } from "node:crypto";
+import {
+  WINDOW_LINK_MAX_LINKS,
+  WindowLinkTargetSchemaZ,
+  WindowLinkTopologySchemaZ,
+  WorkspaceCatalogLiveSessionIdSchemaZ,
+  TerminalAttachmentSemanticWindowIdSchemaZ,
+  type WindowLinkTarget,
+  type WindowLinkTopology,
+} from "@tmux-ide/contracts";
+
+/** Trusted native observation. Native addresses never become public link handles. */
+export interface NativeWindowLinkObservation {
+  readonly index: number;
+  readonly runtimeWindowId: string;
+  readonly semanticWindowId: string;
+  readonly active: boolean;
+}
+
+export interface ResolvedWindowLink {
+  readonly runtimeSessionId: string;
+  readonly runtimeWindowId: string;
+  readonly index: number;
+}
+
+export type WindowLinkRefusal =
+  | "window_link_stale"
+  | "window_link_session_mismatch"
+  | "window_link_backing_mismatch"
+  | "window_link_ambiguous";
+
+export class WindowLinkResolutionError extends Error {
+  constructor(readonly reason: WindowLinkRefusal) {
+    super(reason);
+    this.name = "WindowLinkResolutionError";
+  }
+}
+
+interface LinkRecord extends NativeWindowLinkObservation {
+  readonly linkId: string;
+}
+
+/**
+ * One authority per daemon/server/session incarnation. This is an observation
+ * model, not an immutable native winlink identity: unobserved unlink/relink ABA
+ * is unknowable. Resolved targets still require an execution-time native guard.
+ * Not installed into the v1 stream; C2 activates it with the complete link-aware
+ * producer/consumer boundary.
+ */
+export class WindowLinkAuthority {
+  private records = new Map<number, LinkRecord>();
+  private revision = 0;
+  private topology: WindowLinkTopology | null = null;
+  private disposed = false;
+
+  constructor(
+    readonly liveSessionId: string,
+    private readonly runtimeSessionId: string,
+  ) {
+    WorkspaceCatalogLiveSessionIdSchemaZ.parse(liveSessionId);
+    if (
+      !/^\$(?:0|[1-9]\d{0,15})$/u.test(runtimeSessionId) ||
+      !Number.isSafeInteger(Number(runtimeSessionId.slice(1)))
+    )
+      throw new TypeError("Invalid native session id");
+  }
+
+  /** A malformed fresh observation revokes old actions; no partial topology is published. */
+  reconcile(observations: readonly NativeWindowLinkObservation[]): WindowLinkTopology {
+    try {
+      return this.stageAndPublish(observations);
+    } catch (error) {
+      this.invalidate();
+      throw error;
+    }
+  }
+
+  private stageAndPublish(
+    observations: readonly NativeWindowLinkObservation[],
+  ): WindowLinkTopology {
+    if (this.disposed) throw new WindowLinkResolutionError("window_link_stale");
+    if (observations.length === 0 || observations.length > WINDOW_LINK_MAX_LINKS)
+      throw new TypeError("Invalid window link count");
+    const indexes = new Set<number>();
+    const semanticByRuntime = new Map<string, string>();
+    const runtimeBySemantic = new Map<string, string>();
+    let activeCount = 0;
+    for (const row of observations) {
+      if (
+        !Number.isSafeInteger(row.index) ||
+        row.index < 0 ||
+        indexes.has(row.index) ||
+        !/^@(?:0|[1-9]\d{0,15})$/u.test(row.runtimeWindowId) ||
+        !Number.isSafeInteger(Number(row.runtimeWindowId.slice(1))) ||
+        typeof row.active !== "boolean"
+      )
+        throw new TypeError("Malformed native window link observation");
+      TerminalAttachmentSemanticWindowIdSchemaZ.parse(row.semanticWindowId);
+      indexes.add(row.index);
+      if (row.active) activeCount++;
+      const semantic = semanticByRuntime.get(row.runtimeWindowId);
+      const runtime = runtimeBySemantic.get(row.semanticWindowId);
+      if (
+        (semantic !== undefined && semantic !== row.semanticWindowId) ||
+        (runtime !== undefined && runtime !== row.runtimeWindowId)
+      )
+        throw new TypeError("Window backing identity is inconsistent");
+      semanticByRuntime.set(row.runtimeWindowId, row.semanticWindowId);
+      runtimeBySemantic.set(row.semanticWindowId, row.runtimeWindowId);
+    }
+    if (activeCount !== 1) throw new TypeError("Expected one active window link");
+    const rows = [...observations].sort((left, right) => left.index - right.index);
+    const changed =
+      rows.length !== this.records.size ||
+      rows.some((row) => {
+        const prior = this.records.get(row.index);
+        return (
+          prior?.runtimeWindowId !== row.runtimeWindowId ||
+          prior?.semanticWindowId !== row.semanticWindowId
+        );
+      });
+    const revision = this.revision + (changed ? 1 : 0);
+    if (!Number.isSafeInteger(revision)) throw new RangeError("Window link revision exhausted");
+    const next = new Map<number, LinkRecord>();
+    for (const row of rows) {
+      const prior = this.records.get(row.index);
+      const retained =
+        prior?.runtimeWindowId === row.runtimeWindowId &&
+        prior.semanticWindowId === row.semanticWindowId;
+      next.set(row.index, {
+        ...row,
+        linkId: retained ? prior.linkId : `window-link.${randomUUID().replaceAll("-", "")}`,
+      });
+    }
+    const records = [...next.values()];
+    const topology = WindowLinkTopologySchemaZ.parse({
+      liveSessionId: this.liveSessionId,
+      linkRevision: revision,
+      activeLinkId: records.find((row) => row.active)!.linkId,
+      links: records.map((row) => ({
+        linkId: row.linkId,
+        semanticWindowId: row.semanticWindowId,
+        displayIndex: row.index,
+      })),
+    });
+    this.records = next;
+    this.revision = revision;
+    this.topology = topology;
+    return this.snapshot()!;
+  }
+
+  snapshot(): WindowLinkTopology | null {
+    return this.topology
+      ? { ...this.topology, links: this.topology.links.map((link) => ({ ...link })) }
+      : null;
+  }
+
+  /** Reconnect/gap/discontinuous observation must retire all previously issued handles. */
+  invalidate(): void {
+    this.records.clear();
+    this.topology = null;
+    this.revision++;
+    if (!Number.isSafeInteger(this.revision)) this.disposed = true;
+  }
+
+  dispose(): void {
+    this.invalidate();
+    this.disposed = true;
+  }
+
+  resolve(target: WindowLinkTarget): ResolvedWindowLink {
+    WindowLinkTargetSchemaZ.parse(target);
+    if (target.liveSessionId !== this.liveSessionId)
+      throw new WindowLinkResolutionError("window_link_session_mismatch");
+    if (!this.topology || this.disposed || target.linkRevision !== this.revision)
+      throw new WindowLinkResolutionError("window_link_stale");
+    const record = [...this.records.values()].find((row) => row.linkId === target.linkId);
+    if (!record) throw new WindowLinkResolutionError("window_link_stale");
+    if (record.semanticWindowId !== target.expectedSemanticWindowId)
+      throw new WindowLinkResolutionError("window_link_backing_mismatch");
+    return {
+      runtimeSessionId: this.runtimeSessionId,
+      runtimeWindowId: record.runtimeWindowId,
+      index: record.index,
+    };
+  }
+
+  /** Legacy backing-only selection is safe only when exactly one link applies. */
+  uniqueTargetForBacking(semanticWindowId: string): WindowLinkTarget {
+    if (!this.topology || this.disposed) throw new WindowLinkResolutionError("window_link_stale");
+    const links = [...this.records.values()].filter(
+      (row) => row.semanticWindowId === semanticWindowId,
+    );
+    if (links.length === 0) throw new WindowLinkResolutionError("window_link_stale");
+    if (links.length !== 1) throw new WindowLinkResolutionError("window_link_ambiguous");
+    return {
+      liveSessionId: this.liveSessionId,
+      linkId: links[0]!.linkId,
+      expectedSemanticWindowId: semanticWindowId,
+      linkRevision: this.revision,
+    };
+  }
+}

package/packages/daemon/src/terminal/pane-stream/lease-manager.ts

@@ -11,7 +11,7 @@ import {
  * PaneStreamLeaseManager — in-memory authority for pane-stream leases (m43
  * card 2), following the terminal-attachment lease discipline:
  *
- *  - a one-time `ps1_` bearer ticket whose SHA-256 digest is all the manager
+ *  - a one-time `ps2_` bearer ticket whose SHA-256 digest is all the manager
  *    retains, burned before activation so no concurrent caller can replay it;
  *  - the ticket TTL bounds credential DELIVERY (the authenticated redemption
  *    frame must arrive in time); execution after delivery gets its own bounded
@@ -36,7 +36,7 @@ const SessionNameSchemaZ = z
   .min(1)
   .max(256)
   .refine((value) => !/[\0\r\n]/u.test(value));
-const TicketPattern = /^ps1_[A-Za-z0-9_-]{43}$/u;
+const TicketPattern = /^ps2_[A-Za-z0-9_-]{43}$/u;
 
 export interface PaneStreamLeaseBinding {
   readonly daemonInstanceId: string;
@@ -197,7 +197,7 @@ export class PaneStreamLeaseManager {
           "The secure random source returned an invalid ticket.",
         );
       }
-      const redemptionTicket = `ps1_${Buffer.from(ticketBytes).toString("base64url")}`;
+      const redemptionTicket = `ps2_${Buffer.from(ticketBytes).toString("base64url")}`;
       const state: LeaseState = {
         leaseId,
         requestId,

package/packages/daemon/src/terminal/pane-stream/pane-stream-websocket.ts

@@ -1,3 +1,4 @@
+import { PaneStreamLayoutSnapshotFrameSchemaZ, type WindowLinkTopology } from "@tmux-ide/contracts";
 import { z } from "zod";
 import {
   PANE_STREAM_MAX_HELD_DELTAS,
@@ -72,7 +73,7 @@ import {
 } from "./wire-ledger.ts";
 
 /**
- * The pane-stream WebSocket endpoint (m43 card 2): redeems a one-time `ps1_`
+ * The pane-stream WebSocket endpoint (m43 card 2): redeems a one-time `ps2_`
  * ticket and bridges MirrorService subscriptions to wire frames. Admission is
  * the direct-websocket discipline verbatim — Origin-gated upgrade reservation,
  * digest-only pending tickets, one text redemption frame, delivery-bound TTL —
@@ -126,7 +127,7 @@ function hasCanonicalInputFramePrefix(raw: Buffer): boolean {
     startsWithBuffer(raw, TYPE_FIRST_INPUT_FRAME_PREFIX)
   );
 }
-const TicketPattern = /^ps1_[A-Za-z0-9_-]{43}$/u;
+const TicketPattern = /^ps2_[A-Za-z0-9_-]{43}$/u;
 const BindingIdSchemaZ = z
   .string()
   .min(1)
@@ -593,7 +594,7 @@ export class PaneStreamAdmissionCoordinator {
     if (this.#shuttingDown) {
       return { accepted: false, code: "daemon-shutting-down", httpStatus: 503 };
     }
-    if (input.path !== PANE_STREAM_REDEEM_PATH) {
+    if (input.path !== new URL(this.#webSocketUrl).pathname) {
       return { accepted: false, code: "invalid-path", httpStatus: 404 };
     }
     if (input.protocols.length !== 1 || input.protocols[0] !== PANE_STREAM_WEBSOCKET_SUBPROTOCOL) {
@@ -1069,6 +1070,7 @@ export class PaneStreamLiveConnection {
   readonly #semanticLayouts = new Map<string, MirrorLayoutEvent>();
   #semanticExpectedPaneIds: readonly string[] | null = null;
   #semanticRuntimeSessionId: string | null = null;
+  #semanticWindowLinks: WindowLinkTopology | null = null;
   #semanticTopologyEpoch = -1;
   readonly #sendQueue: QueuedSend[] = [];
   readonly #semanticDrainWaiters = new Map<string, Array<() => void>>();
@@ -1411,7 +1413,15 @@ export class PaneStreamLiveConnection {
         authority.topologyEpoch < 0
           ? null
           : this.#validateInitialLayout(authority.layouts, expectedPaneIds);
-      if (!stagedInitialFrames) {
+      if (
+        !stagedInitialFrames ||
+        !PaneStreamLayoutSnapshotFrameSchemaZ.safeParse({
+          type: "layout-snapshot",
+          topologyEpoch: authority?.topologyEpoch,
+          layouts: stagedInitialFrames,
+          windowLinks: authority?.windowLinks,
+        }).success
+      ) {
         await subscription.close().catch(() => undefined);
         this.#failTopologyChanged();
         return;
@@ -1513,7 +1523,15 @@ export class PaneStreamLiveConnection {
       authority.topologyEpoch < 0
         ? null
         : this.#validateInitialLayout(authority.layouts, expectedPaneIds);
-    if (!initialFrames) {
+    if (
+      !initialFrames ||
+      !PaneStreamLayoutSnapshotFrameSchemaZ.safeParse({
+        type: "layout-snapshot",
+        topologyEpoch: authority?.topologyEpoch,
+        layouts: initialFrames,
+        windowLinks: authority?.windowLinks,
+      }).success
+    ) {
       await Promise.all(opened.map(({ delivery }) => delivery.close().catch(() => undefined)));
       this.#failTopologyChanged();
       return;
@@ -1521,6 +1539,7 @@ export class PaneStreamLiveConnection {
     this.#recordDiagnosticLifecycle("pane-stream-layout-validated");
     this.#semanticExpectedPaneIds = expectedPaneIds;
     this.#semanticRuntimeSessionId = authority!.runtimeSessionId;
+    this.#semanticWindowLinks = authority!.windowLinks;
     this.#semanticTopologyEpoch = authority!.topologyEpoch;
     this.#semanticLayouts.clear();
     for (const event of authority!.layouts)
@@ -1529,6 +1548,7 @@ export class PaneStreamLiveConnection {
       type: "layout-snapshot",
       topologyEpoch: authority!.topologyEpoch,
       layouts: initialFrames,
+      windowLinks: authority!.windowLinks,
     });
     layoutActivated = true;
     this.#recordDiagnosticLifecycle("pane-stream-delivery-open");
@@ -1854,10 +1874,33 @@ export class PaneStreamLiveConnection {
       return;
     }
     const frames = this.#validateInitialLayout(snapshot.layouts, this.#semanticExpectedPaneIds);
-    if (!frames) {
+    if (
+      !frames ||
+      !PaneStreamLayoutSnapshotFrameSchemaZ.safeParse({
+        type: "layout-snapshot",
+        topologyEpoch: snapshot.topologyEpoch,
+        layouts: frames,
+        windowLinks: snapshot.windowLinks,
+      }).success
+    ) {
+      this.#failTopologyChanged();
+      return;
+    }
+    const previousLinks = this.#semanticWindowLinks;
+    if (
+      !previousLinks ||
+      snapshot.windowLinks.liveSessionId !== previousLinks.liveSessionId ||
+      snapshot.windowLinks.linkRevision < previousLinks.linkRevision ||
+      (snapshot.windowLinks.linkRevision === previousLinks.linkRevision &&
+        JSON.stringify(
+          [...snapshot.windowLinks.links].sort((a, b) => a.linkId.localeCompare(b.linkId)),
+        ) !==
+          JSON.stringify([...previousLinks.links].sort((a, b) => a.linkId.localeCompare(b.linkId))))
+    ) {
       this.#failTopologyChanged();
       return;
     }
+    this.#semanticWindowLinks = snapshot.windowLinks;
     this.#semanticTopologyEpoch = snapshot.topologyEpoch;
     this.#semanticLayouts.clear();
     for (const event of snapshot.layouts)
@@ -1866,6 +1909,7 @@ export class PaneStreamLiveConnection {
       type: "layout-snapshot",
       topologyEpoch: snapshot.topologyEpoch,
       layouts: frames,
+      windowLinks: snapshot.windowLinks,
     });
   }
 

package/packages/daemon/src/terminal/protocol/live-session-identity.ts

@@ -0,0 +1,14 @@
+import { createHash } from "node:crypto";
+
+/** Shared opaque incarnation identity for catalog and terminal authority. */
+export function liveSessionIdForNativeIdentity(
+  serverPid: string,
+  sessionId: string,
+  sessionCreated: string,
+) {
+  const digest = createHash("sha256")
+    .update(`${serverPid}\0${sessionId}\0${sessionCreated}`)
+    .digest("hex")
+    .slice(0, 20);
+  return `live-session.${digest}` as const;
+}

package/packages/daemon/src/terminal/protocol/native-backing-client.ts

@@ -15,6 +15,8 @@ export type ReadNativeBacking = (
 /** One bounded read on entering scrollback. No captures are issued by wheel movement. */
 export async function readNativeBacking(options: {
   baseUrl: string;
+  /** Trusted host-selected owner route; credentials and proof remain unchanged. */
+  resourcePath?: string;
   ownerToken: string;
   workspaceName: string;
   paneId: string;
@@ -22,7 +24,8 @@ export async function readNativeBacking(options: {
   signal: AbortSignal;
 }): Promise<NativeGridCapture | null> {
   const url = new URL(
-    `/api/project/${encodeURIComponent(options.workspaceName)}/terminal-native-backing/${encodeURIComponent(options.paneId)}`,
+    options.resourcePath ??
+      `/api/project/${encodeURIComponent(options.workspaceName)}/terminal-native-backing/${encodeURIComponent(options.paneId)}`,
     options.baseUrl,
   );
   for (const [key, value] of Object.entries(options.expected))

package/packages/daemon/src/terminal/session-runtime/interaction-receipt-facts.ts

@@ -22,6 +22,12 @@ export function sessionRuntimeInteractionFacts(
         target: { kind: "pane", semanticPaneId: intent.semanticPaneId },
         summary: { operationKind: intent.verb, direction: intent.direction },
       };
+    case "workspace.window.link.select":
+    case "workspace.window.link.unlink":
+      return {
+        target: { kind: "window-link", target: intent.target },
+        summary: { operationKind: intent.verb },
+      };
     case "workspace.window.kill":
       return {
         target: { kind: "window", target: intent.target },
@@ -103,6 +109,9 @@ export function sessionRuntimeObservedProof(
   if (result.verb !== intent.verb)
     throw new TypeError("Mutation result verb does not match intent");
   switch (result.verb) {
+    case "workspace.window.link.select":
+    case "workspace.window.link.unlink":
+      return { operationKind: result.verb, outcome: result.outcome, target: result.target };
     case "workspace.window.split":
       return {
         operationKind: result.verb,

package/packages/daemon/src/terminal/session-runtime/registry.ts

@@ -550,6 +550,15 @@ export class SessionRuntimeRegistry implements PaneStreamMirror {
     );
   }
 
+  /** Called by the serialized semantic mutation executor, never by a transport directly. */
+  executeWindowLinkAction(
+    session: string,
+    request: Parameters<MirrorService["executeWindowLinkAction"]>[1],
+  ): ReturnType<MirrorService["executeWindowLinkAction"]> {
+    if (this.#disposed) return Promise.reject(new Error("Session runtime disposed"));
+    return this.#mirror.executeWindowLinkAction(session, request);
+  }
+
   /** Retire one no-longer-registered session without disturbing siblings. */
   async retireSession(session: string): Promise<void> {
     const runtime = this.#sessions.get(session);

package/packages/daemon/src/terminal/session-runtime/semantic-mutation-executor.ts

@@ -56,7 +56,7 @@ export interface SessionSemanticMutationExecutorOptions {
       nowMicros(): number;
       record(operation: string, startedAtMicros: number, endedAtMicros: number): void;
     }>,
-  ) => SessionRuntimeIntentResult;
+  ) => SessionRuntimeIntentResult | Promise<SessionRuntimeIntentResult>;
   /** Publishes through the daemon's existing replayable interaction journal. */
   readonly publishReceipt: (receipt: SessionRuntimeReceiptInput) => InteractionReceipt;
   /** Publishes the same replayable invalidation contract as HTTP semantic actions. */
@@ -416,7 +416,7 @@ export class SessionSemanticMutationExecutor {
       // Admission can wait behind prior work. Revalidate the opaque principal
       // at the last synchronous boundary before tmux receives any effect.
       authorizeBeforeEffect?.();
-      result = this.#options.execute(operationId, intent, timing);
+      result = await this.#options.execute(operationId, intent, timing);
     } catch (cause) {
       if (needsTmuxObservation) this.#deletePending(session, operationId);
       const error = new SessionRuntimeIntentError(

package/packages/daemon/src/terminal/session-runtime/semantic-mutation-resource-changes.ts

@@ -32,6 +32,7 @@ export function semanticMutationResourceChanges(
   if (
     result.verb === "workspace.window.split" ||
     result.verb === "workspace.window.kill" ||
+    result.verb === "workspace.window.link.unlink" ||
     result.verb === "workspace.pane.kill" ||
     result.verb === "workspace.session.kill"
   ) {

package/packages/daemon/src/tui/mirror/application-shell-daemon-connection.ts

@@ -1,12 +1,16 @@
+import { prepareScopedOpenTuiConnection } from "./application-shell-server-connection.ts";
 import { OpenTuiStartupError, startupFailureFromError } from "./startup-failure.ts";
 import type { OpenTuiSessionWorkspaceEnsureResult } from "./configless-session-bootstrap.ts";
 import {
+  applicationDaemonEndpoint,
+  type ApplicationDaemonEndpoint,
   readApplicationDaemonInfo as readCanonicalDaemonInfo,
   isApplicationDaemonAlive as isCanonicalDaemonAlive,
 } from "./runtime/application-daemon-authority.ts";
 import {
   APPLICATION_SHELL_RESOURCE_V2_VERSION,
   type CanonicalDaemonInfo,
+  type TmuxServerScope,
   type DesktopApplicationShellTarget,
   type DesktopDaemonHostDescriptor,
   type WorkspaceCatalogResourceV2,
@@ -18,7 +22,10 @@ import {
   type TerminalFirstDaemonTransport,
 } from "@tmux-ide/daemon-client/direct-application-shell-transport";
 import type { PreparedTerminalRuntimeInventory } from "@tmux-ide/daemon-client/workspace-event-supervisor";
-import type { WorkspaceClientCatalogPort } from "@tmux-ide/daemon-client/workspace-client-types";
+import type {
+  WorkspaceClientCatalogPort,
+  WorkspaceClientOwnerActionPort,
+} from "@tmux-ide/daemon-client/workspace-client-types";
 import { WebSocket } from "ws";
 
 import { canonicalDaemonUrl } from "../../lib/canonical-daemon.ts";
@@ -41,6 +48,8 @@ import {
  */
 export interface OpenTuiApplicationShellConnection {
   readonly workspaceName: string;
+  readonly server?: TmuxServerScope;
+  readonly ownerActions?: WorkspaceClientOwnerActionPort;
   /** Incarnation captured by the connection's routing read, never copied from a later catalog. */
   readonly liveSessionId?: string | null;
   readonly target: DesktopApplicationShellTarget;
@@ -53,6 +62,9 @@ export interface OpenTuiApplicationShellConnection {
 }
 
 export interface OpenTuiApplicationShellConnectionDependencies {
+  readonly server?: TmuxServerScope;
+  readonly readDaemonEndpoint?: () => ApplicationDaemonEndpoint;
+  readonly expectedLiveSessionId?: string;
   readonly readCanonicalDaemonInfo: () => CanonicalDaemonInfo | null;
   readonly isCanonicalDaemonAlive: (daemon: CanonicalDaemonInfo) => Promise<boolean>;
   readonly fetchCanonicalWorkspaceRouting: (
@@ -171,7 +183,15 @@ export async function resolveOpenTuiApplicationShellConnection(
     applicationShellResourceVersion: APPLICATION_SHELL_RESOURCE_V2_VERSION,
     ...(diagnose ? { terminalRuntimeDiagnostic: diagnose } : {}),
   });
-  const routing = createOpenTuiVerifiedRoutingContext(daemon, workspaceName, sessionName);
+  const routing = createOpenTuiVerifiedRoutingContext(
+    daemon,
+    workspaceName,
+    sessionName,
+    undefined,
+    dependencies.readDaemonEndpoint ?? applicationDaemonEndpoint,
+    undefined,
+    liveSessionId ?? undefined,
+  );
   let disposed = false;
   let diagnosticClientFetchOrdinal = 0;
   let diagnosticPrewarmOrdinal = 0;
@@ -368,6 +388,12 @@ export async function prepareOpenTuiApplicationShellConnection(
 ): Promise<OpenTuiApplicationShellConnection | null> {
   const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
   try {
+    if (dependencies.server) {
+      const unscoped = { ...dependencies, server: undefined };
+      return await prepareScopedOpenTuiConnection(sessionName, dependencies, () =>
+        prepareOpenTuiApplicationShellConnection(sessionName, unscoped),
+      );
+    }
     const result = await dependencies.ensureSessionWorkspace(sessionName);
     if (result === false) return null;
     if (typeof result !== "boolean" && result.status === "unavailable") {