tmux-ide 2.9.0-beta.21 → 2.9.0-beta.22

package/packages/daemon/dist/terminal/attachments/native-runtime.js

@@ -1,3 +1,4 @@
+import { fenceNativeTmuxCommand, } from "../../lib/tmux-server-generation-runner.js";
 import { accessSync, constants, realpathSync, statSync } from "node:fs";
 import { execFile } from "node:child_process";
 import { isAbsolute } from "node:path";
@@ -91,6 +92,7 @@ function canonicalAuthority(input) {
             socketArgv = ["-L", input.socketSelector.name];
         }
         return Object.freeze({
+            nativeServerIdentity: input.nativeServerIdentity,
             namedSocketFence: socketSelector.kind === "name" ? (input.namedSocketFence ?? null) : null,
             executablePath,
             socketSelector: Object.freeze(socketSelector),
@@ -144,13 +146,16 @@ function pinnedRunner(authority, execute, startupPolicy) {
             if (command.executable !== "tmux")
                 return { status: "failed" };
             try {
-                const stdout = execute(authority.executablePath, [...currentSocketArgv(authority), ...command.argv], {
+                const guarded = authority.nativeServerIdentity
+                    ? fenceNativeTmuxCommand(command.argv, authority.nativeServerIdentity)
+                    : null;
+                const stdout = execute(authority.executablePath, [...currentSocketArgv(authority), ...(guarded?.argv ?? command.argv)], {
                     cwd: authority.trustedCwd,
                     env: authority.environment,
                     maxBuffer: MAX_TMUX_OUTPUT_BYTES,
                     timeoutMs: TERMINAL_ATTACHMENT_TMUX_COMMAND_TIMEOUT_MS,
                 });
-                const value = String(stdout);
+                const value = guarded ? guarded.verify(String(stdout)) : String(stdout);
                 if (authority.namedSocketFence && !authority.namedSocketFence.isPinned())
                     authority.namedSocketFence.resolve();
                 if (value.includes("\0") || Buffer.byteLength(value, "utf8") > MAX_TMUX_OUTPUT_BYTES) {
@@ -209,11 +214,14 @@ function pinnedReadRunner(authority, execute) {
             if (command.executable !== "tmux" || signal?.aborted)
                 return { status: "failed" };
             try {
+                const guarded = authority.nativeServerIdentity
+                    ? fenceNativeTmuxCommand(command.argv, authority.nativeServerIdentity)
+                    : null;
                 const stdout = await execute(authority.executablePath, [
                     ...(authority.namedSocketFence
                         ? await authority.namedSocketFence.resolveAsync(signal)
                         : currentSocketArgv(authority)),
-                    ...command.argv,
+                    ...(guarded?.argv ?? command.argv),
                 ], {
                     cwd: authority.trustedCwd,
                     env: authority.environment,
@@ -221,7 +229,7 @@ function pinnedReadRunner(authority, execute) {
                     timeoutMs: TERMINAL_ATTACHMENT_TMUX_COMMAND_TIMEOUT_MS,
                     ...(signal ? { signal } : {}),
                 });
-                const value = String(stdout);
+                const value = guarded ? guarded.verify(String(stdout)) : String(stdout);
                 if (authority.namedSocketFence && !authority.namedSocketFence.isPinned())
                     await authority.namedSocketFence.resolveAsync(signal);
                 if (value.includes("\0") || Buffer.byteLength(value, "utf8") > MAX_TMUX_OUTPUT_BYTES)
@@ -443,6 +451,7 @@ const PANE_FORMAT = [
     // window reports the same value; the catalog requires it before a multi-pane
     // window is attachable.
     "#{@tmux_ide_window_id}",
+    "#{window_index}",
     PANE_WIRE_SENTINEL,
 ].join(WIRE_SEPARATOR);
 async function requiredTmuxResult(runner, argv, signal) {
@@ -479,25 +488,24 @@ async function liveSessionIdentities(runner, signal) {
 }
 function parsePaneSnapshot(stdout, expected) {
     const panes = [];
-    const runtimeIds = new Set();
+    const runtimeIds = new Map();
+    const links = new Map();
     for (const line of strictLines(stdout, MAX_DISCOVERED_PANES)) {
         const fields = line.split(WIRE_SEPARATOR);
-        if (fields.length !== 19 || fields[18] !== PANE_WIRE_SENTINEL) {
+        if (fields.length !== 20 || fields[19] !== PANE_WIRE_SENTINEL) {
             throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
         }
-        const [sessionName, sessionId, windowId, runtimePaneId, paneCountValue, windowCountValue, stamp, indexValue, title, currentCommand, windowActive, paneActive, role, name, type, missionStamp, dir, windowStampValue,] = fields;
+        const [sessionName, sessionId, windowId, runtimePaneId, paneCountValue, windowCountValue, stamp, indexValue, title, currentCommand, windowActive, paneActive, role, name, type, missionStamp, dir, windowStampValue, windowIndexValue,] = fields;
         if (sessionName !== expected.name ||
             sessionId !== expected.id ||
             !RUNTIME_WINDOW_ID.test(windowId) ||
             !RUNTIME_PANE_ID.test(runtimePaneId) ||
-            runtimeIds.has(runtimePaneId) ||
             !["0", "1"].includes(windowActive) ||
             !["0", "1"].includes(paneActive)) {
             throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
         }
-        runtimeIds.add(runtimePaneId);
         const nullable = (value) => boundedWireValue(value, 256).length === 0 ? null : value;
-        panes.push({
+        const facts = {
             sessionName,
             sessionId,
             windowId,
@@ -519,18 +527,51 @@ function parsePaneSnapshot(stdout, expected) {
             // registered workspace remains the trusted application-shell root, so
             // keep discovery available and carry the empty presentation value.
             dir: boundedWireValue(dir, 4_096),
-        });
+        };
+        const windowIndex = nonnegativeInteger(windowIndexValue);
+        const link = links.get(windowIndex) ?? {
+            windowId,
+            active: windowActive === "1",
+            panes: new Set(),
+        };
+        if (link.windowId !== windowId ||
+            link.active !== (windowActive === "1") ||
+            link.panes.has(runtimePaneId)) {
+            throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
+        }
+        link.panes.add(runtimePaneId);
+        links.set(windowIndex, link);
+        // Only link index and current-link state may differ for a shared backing.
+        const proof = JSON.stringify(fields.filter((_value, index) => index !== 10 && index !== 18));
+        const previous = runtimeIds.get(runtimePaneId);
+        if (previous) {
+            if (previous.proof !== proof)
+                throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
+            if (facts.active && !previous.facts.active) {
+                const merged = { ...previous.facts, active: true };
+                panes[panes.indexOf(previous.facts)] = merged;
+                previous.facts = merged;
+            }
+        }
+        else {
+            runtimeIds.set(runtimePaneId, { facts, proof });
+            panes.push(facts);
+        }
     }
     const counts = new Map();
     for (const pane of panes)
         counts.set(pane.windowId, (counts.get(pane.windowId) ?? 0) + 1);
-    const windows = new Set(panes.map((pane) => pane.windowId));
     if (panes.some((pane) => counts.get(pane.windowId) !== pane.windowPaneCount ||
-        windows.size !== pane.sessionWindowCount) ||
+        links.size !== pane.sessionWindowCount) ||
+        [...links.values()].some((link) => link.panes.size !== counts.get(link.windowId)) ||
+        [...links.values()].filter((link) => link.active).length > 1 ||
         panes.filter((pane) => pane.active).length > 1) {
         throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
     }
-    return panes;
+    return {
+        panes,
+        linksProof: JSON.stringify([...links].map(([index, link]) => [index, link.windowId, [...link.panes]])),
+    };
 }
 /**
  * One bounded, old-tmux-safe discovery path for both live attachment and the
@@ -558,11 +599,13 @@ export async function discoverWorkspaceRegistryTerminalInventory(registry, runne
         const before = await requiredTmuxResult(runner, argv, signal);
         if (before === null)
             continue;
-        const panes = parsePaneSnapshot(before, identity);
+        const first = parsePaneSnapshot(before, identity);
+        const panes = first.panes;
         const after = await requiredTmuxResult(runner, argv, signal);
         if (after === null)
             throw new NativeTerminalAttachmentRuntimeError("discovery-failed");
-        const latest = parsePaneSnapshot(after, identity);
+        const second = parsePaneSnapshot(after, identity);
+        const latest = second.panes;
         // Foreground commands, titles, focus and paths can change while the same
         // pane remains valid. Fence binding/topology only, then publish one complete
         // latest snapshot rather than mixing presentation values across reads.
@@ -577,7 +620,8 @@ export async function discoverWorkspaceRegistryTerminalInventory(registry, runne
             "windowStamp",
             "index",
         ];
-        if (panes.length !== latest.length ||
+        if (first.linksProof !== second.linksProof ||
+            panes.length !== latest.length ||
             panes.some((pane, index) => proofKeys.some((key) => pane[key] !== latest[index][key]))) {
             throw new NativeTerminalAttachmentRuntimeError("discovery-failed");
         }

package/packages/daemon/dist/terminal/mirror/__tests__/scripted-channel.js

@@ -23,6 +23,10 @@ export class ScriptedChannelDriver {
             if (command.startsWith('display-message -p "#{qa:session_name}')) {
                 return basic(command) ?? [];
             }
+            // This scalar observation is not a deferred cursor probe. Answer it
+            // before an automatic inventory reply can consume its pending FIFO slot.
+            if (isHistorySizeProbe(command))
+                return ["0"];
             if (command.includes("capture-pane") || command.startsWith("display-message"))
                 return null;
             return basic(command) ?? [];
@@ -32,7 +36,8 @@ export class ScriptedChannelDriver {
     pump() {
         for (let index = this.#handledWrites; index < this.channel.written.length; index += 1) {
             const command = this.channel.written[index];
-            if (command.startsWith('display-message -p "#{qa:session_name}'))
+            if (command.startsWith('display-message -p "#{qa:session_name}') ||
+                isHistorySizeProbe(command))
                 continue;
             if (command.includes("capture-pane") || command.startsWith("display-message")) {
                 this.deferredCommands.push(command);
@@ -88,3 +93,6 @@ export function standardScriptedChannel(handlers, options) {
         ...options,
     });
 }
+function isHistorySizeProbe(command) {
+    return /^display-message -p -t %\d+ "#\{history_size\}"$/u.test(command);
+}

package/packages/daemon/dist/terminal/mirror/__tests__/simulated-channel.js

@@ -116,13 +116,22 @@ export const FIXTURE = {
 export function fixtureAutoReply(state) {
     return (cmd) => {
         if (cmd.startsWith('display-message -p "#{qa:session_name}'))
-            return ["zz-sim\t$1"];
+            return ["zz-sim\t$1\t1234\t1700000000"];
         if (cmd.includes("qa:@tmux_ide_pane_id"))
             return state.descriptorRows;
         if (cmd.startsWith("list-panes -s"))
             return state.truthRows;
         if (cmd.startsWith("list-windows"))
-            return state.windowRows;
+            return state.windowRows.map((row, index) => {
+                const parts = row.split("\t");
+                if (parts.length === 7)
+                    parts.push(parts[4]);
+                if (parts.length === 8)
+                    parts.push("emacs");
+                if (parts.length === 9)
+                    parts.push(String(index));
+                return parts.join("\t");
+            });
         // Product-owned seeds are one atomic `set-option ; capture-pane` command
         // list. The capture reply remains manual just like a bare capture probe.
         if (cmd.includes("capture-pane"))

package/packages/daemon/dist/terminal/mirror/control-channel.js

@@ -20,6 +20,7 @@
  * chance to detach us — killing the reader first can wedge the server.
  */
 import { spawn } from "node:child_process";
+import { shellEscape } from "../../lib/shell.js";
 import { parseControlLine } from "../protocol/control.js";
 const ATOMIC_CAPTURE_BYTE_HARD_CAP = 16 * 1024 * 1024;
 // Budget row bookkeeping separately from wire bytes (64 bytes per retained
@@ -538,6 +539,17 @@ export class ControlChannelCore {
     }
 }
 export function mirrorControlAttachArgs(options, pauseAfterSeconds = DEFAULT_PAUSE_AFTER_SECONDS) {
+    const attach = [
+        "attach",
+        "-t",
+        options.session,
+        "-f",
+        `ignore-size,pause-after=${pauseAfterSeconds},active-pane`,
+    ];
+    const expected = options.nativeServerIdentity;
+    if (expected &&
+        (!/^[1-9][0-9]*$/u.test(expected.pid) || !/^[1-9][0-9]*$/u.test(expected.startTime)))
+        throw new Error("Invalid expected native server identity");
     return [
         ...(options.socketPath
             ? ["-S", options.socketPath]
@@ -546,11 +558,15 @@ export function mirrorControlAttachArgs(options, pauseAfterSeconds = DEFAULT_PAU
                 : []),
         ...(options.configFile ? ["-f", options.configFile] : []),
         "-C",
-        "attach",
-        "-t",
-        options.session,
-        "-f",
-        `ignore-size,pause-after=${pauseAfterSeconds},active-pane`,
+        ...(expected
+            ? [
+                "if-shell",
+                "-F",
+                `#{&&:#{==:#{pid},${expected.pid}},#{==:#{start_time},${expected.startTime}}}`,
+                attach.map(shellEscape).join(" "),
+                "display-message -p 'tmux-server-generation-refused'",
+            ]
+            : attach),
     ];
 }
 /** Spike-verified default: bounds a stalled reader's server-side buffering
@@ -561,11 +577,25 @@ export class MirrorControlChannel {
     core;
     opts;
     exited = false;
+    verifiedAttach = false;
+    guardedStart = null;
     atomicCollectorTimer = null;
     constructor(opts) {
         this.opts = opts;
         this.core = new ControlChannelCore({
             ...opts.handlers,
+            onOutput: (...args) => {
+                if (!opts.nativeServerIdentity || this.verifiedAttach)
+                    opts.handlers.onOutput(...args);
+            },
+            onNotify: (name, rest) => {
+                if (opts.nativeServerIdentity && name === "session-changed") {
+                    this.verifiedAttach = true;
+                    this.guardedStart?.resolve();
+                }
+                if (!opts.nativeServerIdentity || this.verifiedAttach)
+                    opts.handlers.onNotify(name, rest);
+            },
             onExit: (reason) => this.noteExit(reason),
         }, opts.nowMicros);
     }
@@ -604,7 +634,35 @@ export class MirrorControlChannel {
         // tmux opens with an unsolicited %begin/%end greeting block; a queued
         // resolver makes start() settle when the protocol is actually live.
         return new Promise((resolve, reject) => {
-            this.core.push({ kind: "promise", resolve: () => resolve(), reject, lines: [] });
+            let timer;
+            const settle = (error) => {
+                if (timer)
+                    clearTimeout(timer);
+                this.guardedStart = null;
+                if (error)
+                    reject(error);
+                else
+                    resolve();
+            };
+            if (this.opts.nativeServerIdentity) {
+                this.guardedStart = { resolve: () => settle(), reject: (error) => settle(error) };
+                timer = setTimeout(() => {
+                    settle(new Error("Tmux generation-guarded attach timed out"));
+                    void this.dispose();
+                }, 5_000);
+                timer.unref?.();
+            }
+            // The outer if-shell greeting precedes its attach branch. Only native
+            // session-changed proves that the guarded attach actually succeeded.
+            this.core.push({
+                kind: "promise",
+                resolve: () => {
+                    if (!this.opts.nativeServerIdentity)
+                        settle();
+                },
+                reject: (error) => settle(error),
+                lines: [],
+            });
             proc.on("error", (err) => {
                 this.core.fail(String(err));
                 reject(err);
@@ -747,6 +805,7 @@ export class MirrorControlChannel {
         if (this.exited)
             return;
         this.exited = true;
+        this.guardedStart?.reject(new Error(reason ?? "Control channel exited before guarded attach"));
         this.opts.handlers.onExit(reason);
     }
 }

package/packages/daemon/dist/terminal/mirror/mirror-service.js

@@ -1,3 +1,8 @@
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { resolveTmuxExecutable, tmuxClientEnvironment } from "../../lib/tmux-client-execution.js";
+import { captureUnixSocketIdentity, revalidateUnixSocketIdentity, } from "../../lib/unix-socket-authority.js";
+import { execFile } from "node:child_process";
 /**
  * MirrorService — the daemon-side shared mirror layer (m43 card 1).
  *
@@ -144,6 +149,12 @@ export class MirrorService {
             },
         };
     }
+    async executeWindowLinkAction(session, request) {
+        const entry = this.channels.get(session);
+        if (!entry || entry.retired)
+            throw new Error(`Mirror session ${session} is unavailable`);
+        return entry.channel.executeWindowLinkAction(request);
+    }
     /** Synchronous hot input on an already-retained SessionRuntime channel. */
     sendText(session, semanticPaneId, text, performanceTraceId, isolated = false) {
         const entry = this.channels.get(session);
@@ -254,6 +265,21 @@ export class MirrorService {
             }), this.owner);
             let channel;
             try {
+                const initialSocket = this.opts.resolveSocketPath
+                    ? this.opts.resolveSocketPath()
+                    : this.opts.socketPath;
+                const mutationSocketIdentity = initialSocket
+                    ? captureUnixSocketIdentity(initialSocket)
+                    : null;
+                const executable = mutationSocketIdentity
+                    ? realpathSync(this.opts.executable ?? resolveTmuxExecutable())
+                    : null;
+                if (executable) {
+                    accessSync(executable, constants.X_OK);
+                    if (!isAbsolute(executable) || !statSync(executable).isFile())
+                        throw new Error("Invalid pinned tmux executable");
+                }
+                const environment = Object.freeze(tmuxClientEnvironment(process.env));
                 const channelOptions = {
                     session,
                     createIo: (handlers) => this.opts.createIo?.(session, handlers) ??
@@ -264,10 +290,28 @@ export class MirrorService {
                             socketPath: this.opts.socketPath,
                             resolveSocketPath: this.opts.resolveSocketPath,
                             executable: this.opts.executable,
+                            nativeServerIdentity: this.opts.nativeServerIdentity,
                             configFile: this.opts.configFile,
                             pauseAfterSeconds: this.opts.pauseAfterSeconds,
                             nowMicros: this.opts.nowMicros,
                         }),
+                    executeWindowLinkGuard: (args) => {
+                        if (!mutationSocketIdentity || !executable)
+                            throw new Error("Window link mutation requires a pinned socket authority");
+                        if (this.opts.resolveSocketPath)
+                            this.opts.resolveSocketPath();
+                        const socket = revalidateUnixSocketIdentity(mutationSocketIdentity);
+                        return new Promise((resolve) => {
+                            execFile(executable, ["-N", "-u", "-S", socket, ...args], { timeout: 5000, maxBuffer: 65536, encoding: "utf8", env: environment }, (error, stdout) => {
+                                const status = !error
+                                    ? 0
+                                    : typeof error.code === "number" && !error.killed
+                                        ? error.code
+                                        : null;
+                                resolve({ status, stdout });
+                            });
+                        });
+                    },
                     historyLines: this.opts.historyLines,
                     internalReadHookEmission: this.opts.internalReadHookEmission,
                     generatePaneId: this.opts.generatePaneId,