tmux-ide 2.9.0-beta.21 → 2.9.0-beta.22

package/packages/daemon/dist/command-center/server.js

@@ -1,3 +1,4 @@
+import { mountTmuxServerRoutes } from "./tmux-servers.js";
 import { streamBoundedLogs } from "./log-stream.js";
 import { mountWorkspaceAdmissionRoute } from "./resources/workspace-admission-route.js";
 import { mountFleetPreviewRoute } from "./resources/fleet-preview-route.js";
@@ -317,6 +318,11 @@ export function createApp(options = {}) {
     const app = new Hono();
     // Allow cross-origin (Next.js dashboard, Tailscale, etc.)
     app.use("/*", cors());
+    if (options.tmuxServerOwners)
+        mountTmuxServerRoutes(app, {
+            ownerToken: options.remoteAccess?.ownerToken ?? null,
+            owners: options.tmuxServerOwners,
+        });
     // Owner-only reads use the same early routing boundary as issuance below:
     // remote/project credentials neither authorize nor block the owner bearer.
     mountDiagnosticsRoute(app, {
@@ -506,10 +512,24 @@ export function createApp(options = {}) {
     // Credential-free endpoint binding. A desktop host reads the nonce from the
     // owner-only canonical record, probes this endpoint, and compares before it
     // sends any remote-access or local-bypass credential.
-    app.get("/identity", (c) => {
+    // Coalesce concurrent probes, but never reuse a completed server proof.
+    let pendingTmuxProof = null;
+    app.get("/identity", async (c) => {
+        const wantsTmuxProof = c.req.query("tmuxServerProof") === "1";
+        let tmuxServerProof = null;
+        if (wantsTmuxProof && options.tmuxServerProof) {
+            pendingTmuxProof ??= Promise.resolve()
+                .then(options.tmuxServerProof)
+                .catch(() => null)
+                .finally(() => {
+                pendingTmuxProof = null;
+            });
+            tmuxServerProof = await pendingTmuxProof;
+        }
         return c.json({
             ok: true,
             pid: process.pid,
+            ...(wantsTmuxProof && options.tmuxServerProof ? { tmuxServerProof } : {}),
             protocolVersion: DAEMON_WIRE_PROTOCOL_VERSION,
             productVersion: daemonIdentity.productVersion,
             instanceId: daemonIdentity.instanceId,

package/packages/daemon/dist/command-center/tmux-server-native-backing.js

@@ -0,0 +1,37 @@
+import { Hono } from "hono";
+import { TmuxServerScopeSchemaZ } from "@tmux-ide/contracts";
+import { TmuxServerScopeError } from "../lib/tmux-server-owners.js";
+import { mountTerminalNativeBackingRoute } from "./resources/terminal-native-backing-route.js";
+/** Retain admission/coalescing limits for the lifetime of each independent owner. */
+export function mountTmuxServerNativeBackingRoute(app, options) {
+    const routers = new WeakMap();
+    app.get(`${options.scopedPath}/native-backing/:workspaceName/:pane`, async (c) => {
+        const scope = TmuxServerScopeSchemaZ.safeParse({
+            serverId: c.req.param("serverId"),
+            generation: c.req.param("generation"),
+        });
+        if (!scope.success)
+            return c.json({ status: "invalid" }, 400);
+        try {
+            return await options.owners.withOwner(scope.data, async (owner) => {
+                let router = routers.get(owner);
+                if (!router) {
+                    router = new Hono();
+                    mountTerminalNativeBackingRoute(router, {
+                        ownerToken: options.ownerToken,
+                        generation: owner.generation,
+                        resolveSession: (workspace) => owner.workspaceRegistry.get(workspace)?.sessionName ?? null,
+                        capture: (session, pane, expected) => owner.sessionRuntimeRegistry.captureNativeBacking(session, pane, expected),
+                    });
+                    routers.set(owner, router);
+                }
+                const url = new URL(c.req.url);
+                url.pathname = `/api/project/${encodeURIComponent(c.req.param("workspaceName"))}/terminal-native-backing/${encodeURIComponent(c.req.param("pane"))}`;
+                return await router.request(new Request(url, c.req.raw));
+            });
+        }
+        catch (error) {
+            return c.json({ status: error instanceof TmuxServerScopeError ? "retired" : "unavailable" }, error instanceof TmuxServerScopeError ? 409 : 503);
+        }
+    });
+}

package/packages/daemon/dist/command-center/tmux-servers.js

@@ -0,0 +1,345 @@
+import { mountTmuxServerNativeBackingRoute } from "./tmux-server-native-backing.js";
+import { Hono } from "hono";
+import { streamSSE } from "hono/streaming";
+import { projectApplicationShellResource } from "./resources/application-shell.js";
+import { fleetSessionIdForName } from "./resources/fleet-catalog.js";
+import { z } from "zod";
+import { TMUX_SERVERS_API_PATH, PANE_STREAM_ISSUE_PATH, TmuxServerIdSchemaZ, TmuxServerScopeSchemaZ, TmuxServersResourceSchemaZ, TmuxServerSessionsResourceSchemaZ, WorkspaceMultiplexerMutationRequestSchemaZ, WorkspacePaneCreateMutationRequestSchemaZ, WorkspaceSessionCreateArgumentsSchemaZ, } from "@tmux-ide/contracts";
+import { TmuxServerRegistrationSchemaZ, TmuxServerScopeError, } from "../lib/tmux-server-owners.js";
+import { WorkspaceMultiplexerError } from "../lib/workspace-multiplexer-verbs.js";
+import { ownerBearerMatches } from "./owner-authority.js";
+import { mountPaneStreamIssueRoute } from "./pane-stream-issue.js";
+import { projectTerminalRuntimeInventory } from "./resources/terminal-runtime-inventory.js";
+const registrationSchema = TmuxServerRegistrationSchemaZ.omit({ serverId: true }).strict();
+const workspaceSchema = z
+    .string()
+    .min(1)
+    .max(160)
+    .refine((value) => !/[\0\r\n]/u.test(value));
+async function boundedJson(request) {
+    if (!request.body)
+        throw new TypeError("Missing body");
+    const reader = request.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            size += next.value.byteLength;
+            if (size > 64 * 1024) {
+                void reader.cancel().catch(() => undefined);
+                throw new TypeError("Body too large");
+            }
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+}
+function failure(c, error) {
+    if (error instanceof TmuxServerScopeError)
+        return c.json({ error: { code: error.code } }, error.code === "not-found" ? 404 : error.code === "capacity" ? 429 : 409);
+    if (error instanceof WorkspaceMultiplexerError)
+        return c.json({ error: { code: error.code } }, 409);
+    if (error instanceof z.ZodError || error instanceof SyntaxError || error instanceof TypeError)
+        return c.json({ error: { code: "invalid-request" } }, 400);
+    return c.json({ error: { code: "server-unavailable" } }, 503);
+}
+/** Owner capability is mandatory even when the ordinary local HTTP surface is open. */
+export function mountTmuxServerRoutes(app, options) {
+    const base = TMUX_SERVERS_API_PATH;
+    const authorize = async (c, next) => {
+        c.header("Cache-Control", "no-store");
+        if (!ownerBearerMatches(c.req.header("Authorization"), options.ownerToken))
+            return c.json({ error: { code: "owner-required" } }, 401);
+        await next();
+    };
+    app.use(base, authorize);
+    app.use(`${base}/*`, authorize);
+    const route = (work) => async (c) => {
+        try {
+            return await work(c);
+        }
+        catch (error) {
+            return failure(c, error);
+        }
+    };
+    const scope = (c) => TmuxServerScopeSchemaZ.parse({
+        serverId: c.req.param("serverId"),
+        generation: c.req.param("generation"),
+    });
+    app.get(base, route(async (c) => c.json(TmuxServersResourceSchemaZ.parse({ version: 1, servers: await options.owners.refresh() }))));
+    app.post(base, route(async (c) => c.json(await options.owners.register(registrationSchema.parse(await boundedJson(c.req.raw))), 201)));
+    app.delete(`${base}/:serverId`, route(async (c) => {
+        await options.owners.remove(TmuxServerIdSchemaZ.parse(c.req.param("serverId")));
+        return c.json({ removed: true });
+    }));
+    const scoped = `${base}/:serverId/:generation`;
+    mountTmuxServerNativeBackingRoute(app, {
+        scopedPath: scoped,
+        ownerToken: options.ownerToken,
+        owners: options.owners,
+    });
+    app.post(`${scoped}/sessions/create`, route(async (c) => {
+        const server = scope(c);
+        const request = z
+            .object({
+            operationId: z.uuid(),
+            expectedDaemonInstanceId: z.uuid(),
+            intent: WorkspaceSessionCreateArgumentsSchemaZ,
+        })
+            .strict()
+            .parse(await boundedJson(c.req.raw));
+        if (request.expectedDaemonInstanceId !== server.generation ||
+            (request.intent.expectedDaemonInstanceId &&
+                request.intent.expectedDaemonInstanceId !== server.generation))
+            return c.json({ error: { code: "stale-generation" } }, 409);
+        return c.json(await options.owners.withOwner(server, (owner) => owner.createSession(request.operationId, {
+            ...request.intent,
+            expectedDaemonInstanceId: server.generation,
+        })));
+    }));
+    app.post(`${scoped}/sessions/:liveSessionId/open`, route(async (c) => {
+        const server = scope(c);
+        const result = await options.owners.withOwner(server, (owner) => owner.openSession(workspaceSchema.parse(c.req.param("liveSessionId"))));
+        return c.json({ version: 1, server, ...result });
+    }));
+    app.get(`${scoped}/sessions`, route(async (c) => {
+        const server = scope(c);
+        return c.json(TmuxServerSessionsResourceSchemaZ.parse({
+            version: 1,
+            server,
+            sessions: await options.owners.withOwner(server, async (owner) => {
+                const sessions = await owner.catalog();
+                const workspaces = owner.workspaceRegistry.list();
+                return sessions.map((session) => {
+                    const aliases = workspaces.filter((workspace) => workspace.sessionName === session.sessionName);
+                    return { ...session, workspaceName: aliases.length === 1 ? aliases[0].name : null };
+                });
+            }),
+        }));
+    }));
+    app.get(`${scoped}/inventory/:workspaceName`, route(async (c) => {
+        const server = scope(c);
+        const workspaceName = workspaceSchema.parse(c.req.param("workspaceName"));
+        const resource = await options.owners.withOwner(server, async (owner) => {
+            const sessions = await owner.catalog();
+            const workspace = owner.workspaceRegistry.get(workspaceName);
+            if (!workspace)
+                return null;
+            const expected = c.req.query("liveSessionId");
+            if (expected &&
+                !sessions.some((row) => row.sessionName === workspace.sessionName && row.liveSessionId === expected))
+                throw new TmuxServerScopeError("stale-generation");
+            const snapshot = await owner.terminalInventoryRuntime.discoverTerminalRuntimeSession(workspace.sessionName, c.req.raw.signal);
+            return snapshot ? projectTerminalRuntimeInventory(snapshot, 0) : null;
+        });
+        return resource
+            ? c.json({ version: 1, server, resource })
+            : c.json({ error: { code: "workspace-not-found" } }, 404);
+    }));
+    app.get(`${scoped}/catalog`, route(async (c) => {
+        const server = scope(c);
+        const resource = await options.owners.withOwner(server, async (owner) => {
+            const sessions = await owner.catalog();
+            return {
+                intents: owner.workspaceRegistry.list().map((entry) => ({
+                    workspaceName: entry.name,
+                    sessionName: entry.sessionName,
+                    source: "workspace",
+                    availability: sessions.some((row) => row.sessionName === entry.sessionName)
+                        ? "live"
+                        : "stopped",
+                })),
+                liveSessions: sessions.map((row) => ({
+                    sessionName: row.sessionName,
+                    fleetSessionId: fleetSessionIdForName(row.sessionName),
+                    paneCount: row.paneCount,
+                })),
+            };
+        });
+        return c.json({ version: 1, server, resource });
+    }));
+    app.get(`${scoped}/application-shell/:workspaceName`, route(async (c) => {
+        const server = scope(c);
+        const workspaceName = workspaceSchema.parse(c.req.param("workspaceName"));
+        const resource = await options.owners.withOwner(server, async (owner) => {
+            const sessions = await owner.catalog();
+            const workspace = owner.workspaceRegistry.get(workspaceName);
+            if (!workspace)
+                return null;
+            if (!sessions.some((row) => row.sessionName === workspace.sessionName &&
+                row.liveSessionId === c.req.query("liveSessionId")))
+                throw new TmuxServerScopeError("stale-generation");
+            const snapshot = await owner.terminalInventoryRuntime.discoverTerminalRuntimeSession(workspace.sessionName, c.req.raw.signal);
+            return snapshot ? projectApplicationShellResource(snapshot) : null;
+        });
+        return resource
+            ? c.json({ version: 1, server, resource })
+            : c.json({ error: { code: "workspace-not-found" } }, 404);
+    }));
+    // Subscribe before publishing ready: a topology change during the subsequent HTTP read
+    // invalidates that read. This shares the owner's retained mirror, never a new tmux client.
+    app.get(`${scoped}/session-events/:workspaceName`, route(async (c) => {
+        const server = scope(c);
+        const workspaceName = workspaceSchema.parse(c.req.param("workspaceName"));
+        const owner = await options.owners.withOwner(server, async (candidate) => {
+            const sessions = await candidate.catalog();
+            const workspace = candidate.workspaceRegistry.get(workspaceName);
+            if (!workspace ||
+                !sessions.some((row) => row.sessionName === workspace.sessionName &&
+                    row.liveSessionId === c.req.query("liveSessionId")))
+                throw new TmuxServerScopeError("stale-generation");
+            return candidate;
+        });
+        const workspace = owner.workspaceRegistry.get(workspaceName);
+        return streamSSE(c, async (stream) => {
+            let stopped = false;
+            let wake = null;
+            let revision = 0;
+            const dirty = () => {
+                revision++;
+                wake?.();
+            };
+            stream.onAbort(() => {
+                stopped = true;
+                wake?.();
+            });
+            const identity = await owner.sessionRuntimeRegistry.describeSessionAuthority(workspace.sessionName);
+            let topology = null;
+            let sessionReplaced = false;
+            const subscription = await owner.sessionRuntimeRegistry.subscribeLayout(workspace.sessionName, () => undefined, {
+                expectedRuntimeSessionId: identity.runtimeSessionId,
+                expectedSemanticPaneIds: identity.description.panes.map((pane) => pane.semanticPaneId),
+                onAuthority(snapshot) {
+                    if (snapshot.windowLinks.liveSessionId !== c.req.query("liveSessionId")) {
+                        sessionReplaced = true;
+                        dirty();
+                        return;
+                    }
+                    // Full replacement observes removed windows and retains no historical keys.
+                    // Geometry, focus and active-link changes stay entirely on the pane stream.
+                    const signature = JSON.stringify(snapshot.layouts
+                        .map((layout) => [
+                        layout.semanticWindowId,
+                        layout.windowName,
+                        layout.panes.map((pane) => pane.semanticPaneId).sort(),
+                    ])
+                        .sort((a, b) => String(a[0]).localeCompare(String(b[0]))));
+                    if (topology === signature)
+                        return;
+                    topology = signature;
+                    dirty();
+                },
+            });
+            try {
+                options.owners.current(server);
+                if (sessionReplaced)
+                    throw new TmuxServerScopeError("stale-generation");
+                await stream.writeSSE({
+                    data: JSON.stringify({ version: 1, server, type: "ready", revision }),
+                });
+                let sent = revision;
+                let nextIdentityCheck = Date.now() + 5000;
+                while (!stopped) {
+                    await new Promise((resolve) => {
+                        const timer = setTimeout(resolve, 1000);
+                        wake = () => {
+                            clearTimeout(timer);
+                            resolve();
+                        };
+                        if (stopped || revision !== sent)
+                            wake();
+                    });
+                    wake = null;
+                    if (stopped)
+                        break;
+                    if (sessionReplaced)
+                        throw new TmuxServerScopeError("stale-generation");
+                    options.owners.current(server);
+                    if (Date.now() >= nextIdentityCheck) {
+                        const sessions = await owner.catalog();
+                        options.owners.current(server);
+                        if (!sessions.some((row) => row.sessionName === workspace.sessionName &&
+                            row.liveSessionId === c.req.query("liveSessionId")))
+                            throw new TmuxServerScopeError("stale-generation");
+                        nextIdentityCheck = Date.now() + 5000;
+                    }
+                    if (revision !== sent) {
+                        sent = revision;
+                        await stream.writeSSE({
+                            data: JSON.stringify({ version: 1, server, type: "invalidate", revision }),
+                        });
+                    }
+                    else
+                        await stream.writeSSE({
+                            data: JSON.stringify({ version: 1, server, type: "heartbeat", revision }),
+                        });
+                }
+            }
+            catch {
+                if (!stopped)
+                    await stream
+                        .writeSSE({ data: JSON.stringify({ version: 1, server, type: "retired", revision }) })
+                        .catch(() => undefined);
+            }
+            finally {
+                await subscription.close();
+            }
+        });
+    }));
+    app.post(`${scoped}/panes/create`, route(async (c) => {
+        const server = scope(c);
+        const liveSessionId = workspaceSchema.parse(c.req.query("liveSessionId"));
+        const request = WorkspacePaneCreateMutationRequestSchemaZ.parse(await boundedJson(c.req.raw));
+        if (request.expectedDaemonInstanceId !== server.generation)
+            return c.json({ error: { code: "stale-generation" } }, 409);
+        return c.json(await options.owners.withOwner(server, (owner) => owner.createSessionPane(liveSessionId, request)));
+    }));
+    app.post(`${scoped}/mutations`, route(async (c) => {
+        const server = scope(c);
+        const request = WorkspaceMultiplexerMutationRequestSchemaZ.parse(await boundedJson(c.req.raw));
+        if (request.expectedDaemonInstanceId !== server.generation)
+            return c.json({ error: { code: "stale-generation" } }, 409);
+        const liveSessionId = c.req.query("liveSessionId");
+        const result = await options.owners.withOwner(server, (owner) => liveSessionId
+            ? owner.mutateSession(liveSessionId, request, c.req.header("X-Tmux-Ide-Host-Client-Id"))
+            : owner.multiplexerBackend.mutate(request, c.req.header("X-Tmux-Ide-Host-Client-Id"), undefined, true));
+        return c.json(result);
+    }));
+    app.post(`${scoped}/pane-streams/issue`, route(async (c) => {
+        const server = scope(c);
+        return options.owners.withOwner(server, async (owner) => {
+            const sessions = await owner.catalog();
+            const liveSessionId = c.req.query("liveSessionId");
+            if (liveSessionId) {
+                const body = (await boundedJson(c.req.raw.clone()));
+                const workspace = owner.workspaceRegistry.get(body.stream?.workspaceName ?? "");
+                if (!workspace ||
+                    !sessions.some((row) => row.sessionName === workspace.sessionName && row.liveSessionId === liveSessionId))
+                    throw new TmuxServerScopeError("stale-generation");
+            }
+            const issueApp = new Hono();
+            mountPaneStreamIssueRoute(issueApp, {
+                daemonInstanceId: server.generation,
+                ownerToken: options.ownerToken,
+                workspaceRegistry: owner.workspaceRegistry,
+                backend: owner.paneStreamRuntime.coordinator,
+            });
+            const url = new URL(c.req.url);
+            url.pathname = PANE_STREAM_ISSUE_PATH;
+            url.search = "";
+            return await issueApp.request(new Request(url, c.req.raw));
+        });
+    }));
+}

package/packages/daemon/dist/lib/canonical-daemon-bootstrap.js

@@ -1,4 +1,6 @@
-import { resolveRuntimeNamespace } from "./runtime-namespace.js";
+import { captureTmuxServerProof, captureUnboundTmuxSelectorProof, } from "./tmux-server-proof.js";
+import { createPinnedWorkspaceTmuxRunner, resolveWorkspacePaneTmuxAuthority, } from "./workspace-pane-creation.js";
+import { resolveRuntimeNamespace, resolveTmuxServerIntent } from "./runtime-namespace.js";
 import { compareProductVersions } from "./semver.js";
 import { spawn } from "node:child_process";
 import { resolve } from "node:path";
@@ -64,6 +66,16 @@ function sameCanonicalInstance(left, right) {
 const defaultDependencies = {
     // This adapter owns startup, so legacy permission preparation is explicit
     // here. Injected inspectors remain isolated from real filesystem mutation.
+    serverProof: (intent) => {
+        try {
+            const authority = { ...resolveWorkspacePaneTmuxAuthority(), socketSelector: intent.selector };
+            return (captureTmuxServerProof(createPinnedWorkspaceTmuxRunner(authority, { timeoutMs: 1000 })) ??
+                captureUnboundTmuxSelectorProof(authority));
+        }
+        catch {
+            return null;
+        }
+    },
     inspect: prepareCanonicalDaemonInfoForBootstrap,
     ownerProvenDead: isCanonicalDaemonRecordOwnerProvenDead,
     alive: isCanonicalDaemonAlive,
@@ -88,11 +100,14 @@ function needsReplacement(info, expected) {
     }
     return info.protocolVersion < DAEMON_WIRE_PROTOCOL_VERSION;
 }
-async function replaceOlderCanonicalDaemon(deps, info, timeoutMs, expectedProductVersion) {
+async function replaceOlderCanonicalDaemon(deps, info, timeoutMs, expectedProductVersion, intent = null) {
     if (!needsReplacement(info, expectedProductVersion)) {
         throw new DaemonBootstrapError("incompatible", `Canonical daemon protocol ${info.protocolVersion} cannot be replaced by older protocol ${DAEMON_WIRE_PROTOCOL_VERSION}.`, { reason: "protocol-mismatch" });
     }
-    const [identity, health] = await Promise.all([deps.identity(info), deps.health(info)]);
+    const [identity, health] = await Promise.all([
+        deps.identity(info, undefined, Boolean(intent)),
+        deps.health(info),
+    ]);
     if (!info.authToken ||
         !identity ||
         !health ||
@@ -105,6 +120,7 @@ async function replaceOlderCanonicalDaemon(deps, info, timeoutMs, expectedProduc
         health.productVersion !== info.productVersion) {
         throw new DaemonBootstrapError("incompatible", "The older canonical daemon changed identity before the version upgrade.", { reason: "identity-mismatch" });
     }
+    assertServerIntent(deps, info, identity, intent);
     const latest = deps.inspect();
     if (latest.status !== "valid" ||
         !sameCanonicalInstance(latest.info, info) ||
@@ -131,7 +147,17 @@ async function replaceOlderCanonicalDaemon(deps, info, timeoutMs, expectedProduc
     }
     throw new DaemonBootstrapError("control-timeout", "The older canonical daemon did not retire after accepting the version upgrade.", { reason: "protocol-mismatch" });
 }
-async function probeCanonical(deps, expectedProductVersion) {
+function assertServerIntent(deps, info, identity, intent) {
+    if (!intent)
+        return;
+    const proof = deps.serverProof(intent);
+    if (info.tmuxServerProofVersion !== 1 || !identity.tmuxServerProof || !proof)
+        throw new DaemonBootstrapError("incompatible", "Cannot prove the requested tmux server for this daemon. Its server identity is unavailable or unsupported; the existing daemon was left running.", { reason: "tmux-server-unproven" });
+    if (identity.tmuxServerProof.kind !== proof.kind ||
+        identity.tmuxServerProof.digest !== proof.digest)
+        throw new DaemonBootstrapError("incompatible", "The existing daemon manages a different tmux server. It was left running; select its server or use a separate daemon namespace.", { reason: "tmux-server-mismatch" });
+}
+async function probeCanonical(deps, expectedProductVersion, intent = null) {
     const state = deps.inspect();
     if (state.status === "missing")
         return { status: "absent-or-stale" };
@@ -149,7 +175,7 @@ async function probeCanonical(deps, expectedProductVersion) {
     if (!(await deps.alive(state.info)))
         return { status: state.info.supervisionId ? "owner-pending" : "absent-or-stale" };
     const [identity, health] = await Promise.all([
-        deps.identity(state.info),
+        deps.identity(state.info, undefined, Boolean(intent)),
         deps.health(state.info),
     ]);
     // A living elected generation may publish before its accept loop. Preserve
@@ -162,6 +188,7 @@ async function probeCanonical(deps, expectedProductVersion) {
         identity.startedAt !== state.info.startedAt) {
         return { status: "incompatible", reason: "identity-mismatch" };
     }
+    assertServerIntent(deps, state.info, identity, intent);
     if (state.info.protocolVersion !== DAEMON_WIRE_PROTOCOL_VERSION ||
         identity.protocolVersion !== state.info.protocolVersion ||
         health.protocolVersion !== state.info.protocolVersion) {
@@ -211,9 +238,15 @@ function supervisedAdmission(deps, declaredBinding) {
     };
 }
 export function createCanonicalDaemonBootstrapCoordinator(options, dependencies = {}) {
+    options = {
+        ...options,
+        tmuxServerIntent: options.tmuxServerIntent === undefined ? resolveTmuxServerIntent() : options.tmuxServerIntent,
+    };
     const deps = supervisedAdmission({ ...defaultDependencies, ...dependencies }, options.supervisionId);
     return new DaemonBootstrapCoordinator({
-        probe: () => probeCanonical(deps, options.expectedProductVersion),
+        probe: () => probeCanonical(deps, options.expectedProductVersion, options.tmuxServerIntent === undefined
+            ? resolveTmuxServerIntent()
+            : options.tmuxServerIntent),
         spawn: () => deps.spawnOwner(resolve(options.entryPath), resolve(options.cwd ?? process.cwd())),
         timeoutMs: options.timeoutMs,
         onPhaseChanged: options.onPhaseChanged,
@@ -222,6 +255,10 @@ export function createCanonicalDaemonBootstrapCoordinator(options, dependencies
     });
 }
 export function ensureCanonicalDaemon(options, dependencies = {}) {
+    options = {
+        ...options,
+        tmuxServerIntent: options.tmuxServerIntent === undefined ? resolveTmuxServerIntent() : options.tmuxServerIntent,
+    };
     const deps = supervisedAdmission({ ...defaultDependencies, ...dependencies }, options.supervisionId);
     const ensure = () => createCanonicalDaemonBootstrapCoordinator(options, deps).ensure();
     return ensure().catch(async (error) => {
@@ -246,7 +283,9 @@ export function ensureCanonicalDaemon(options, dependencies = {}) {
         }
         const replacing = state.info;
         try {
-            await replaceOlderCanonicalDaemon(deps, replacing, options.timeoutMs ?? 15_000, options.expectedProductVersion);
+            await replaceOlderCanonicalDaemon(deps, replacing, options.timeoutMs ?? 15_000, options.expectedProductVersion, options.tmuxServerIntent === undefined
+                ? resolveTmuxServerIntent()
+                : options.tmuxServerIntent);
         }
         catch (replacementError) {
             // A duplicate upgrader can retire the exact owner while this caller is
@@ -265,6 +304,10 @@ export function ensureCanonicalDaemon(options, dependencies = {}) {
 }
 /** Retire only a verified older owner; the foreground caller retains ownership of startup. */
 export async function retireOutdatedCanonicalDaemon(options, dependencies = {}) {
+    options = {
+        ...options,
+        tmuxServerIntent: options.tmuxServerIntent === undefined ? resolveTmuxServerIntent() : options.tmuxServerIntent,
+    };
     const deps = supervisedAdmission({ ...defaultDependencies, ...dependencies }, options.supervisionId);
     const state = deps.inspect();
     if (options.supervisionId &&
@@ -283,7 +326,7 @@ export async function retireOutdatedCanonicalDaemon(options, dependencies = {})
         return false;
     }
     try {
-        await replaceOlderCanonicalDaemon(deps, state.info, options.timeoutMs ?? 15_000, options.expectedProductVersion);
+        await replaceOlderCanonicalDaemon(deps, state.info, options.timeoutMs ?? 15_000, options.expectedProductVersion, options.tmuxServerIntent === undefined ? resolveTmuxServerIntent() : options.tmuxServerIntent);
         return true;
     }
     catch (error) {
@@ -294,3 +337,16 @@ export async function retireOutdatedCanonicalDaemon(options, dependencies = {})
         throw error;
     }
 }
+/** Admission for foreground election winners and explicit takeover paths. */
+export async function assertCanonicalDaemonServerIntent(info, intent = resolveTmuxServerIntent(), dependencies = {}) {
+    if (!intent)
+        return;
+    const deps = { ...defaultDependencies, ...dependencies };
+    const identity = await deps.identity(info, undefined, true);
+    if (!identity ||
+        identity.pid !== info.pid ||
+        identity.instanceId !== info.instanceId ||
+        identity.startedAt !== info.startedAt)
+        throw new DaemonBootstrapError("incompatible", "Canonical daemon identity could not be verified for the requested tmux server.", { reason: "identity-mismatch" });
+    assertServerIntent(deps, info, identity, intent);
+}

package/packages/daemon/dist/lib/canonical-daemon.js

@@ -432,6 +432,9 @@ export function writeCanonicalDaemonInfo(info, claim) {
         instanceId: info.instanceId,
         startedAt: info.startedAt,
         ...(info.environmentId !== undefined ? { environmentId: info.environmentId } : {}),
+        ...(info.tmuxServerProofVersion !== undefined
+            ? { tmuxServerProofVersion: info.tmuxServerProofVersion }
+            : {}),
         bindHostname: info.bindHostname,
         authToken: info.authToken,
         ...(info.provenance !== undefined ? { provenance: info.provenance } : {}),
@@ -795,11 +798,11 @@ export async function probeCanonicalDaemonHealth(info, parentSignal) {
     }
 }
 /** Credential-free endpoint binding probe; callers compare instanceId to daemon.json. */
-export async function probeCanonicalDaemonIdentity(info, parentSignal) {
+export async function probeCanonicalDaemonIdentity(info, parentSignal, includeTmuxServerProof = false) {
     if (!(await isCanonicalDaemonAlive(info)))
         return null;
     try {
-        const res = await fetch(canonicalDaemonUrl("http", info.bindHostname, info.port, "/identity"), {
+        const res = await fetch(canonicalDaemonUrl("http", info.bindHostname, info.port, includeTmuxServerProof ? "/identity?tmuxServerProof=1" : "/identity"), {
             signal: parentSignal ?? timeoutSignal(750),
         });
         if (!res.ok)