tmux-ide 2.9.0-beta.21 → 2.9.0-beta.26

package/packages/daemon/dist/terminal/mirror/window-link-authority.js

@@ -0,0 +1,160 @@
+import { randomUUID } from "node:crypto";
+import { WINDOW_LINK_MAX_LINKS, WindowLinkTargetSchemaZ, WindowLinkTopologySchemaZ, WorkspaceCatalogLiveSessionIdSchemaZ, TerminalAttachmentSemanticWindowIdSchemaZ, } from "@tmux-ide/contracts";
+export class WindowLinkResolutionError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+        this.name = "WindowLinkResolutionError";
+    }
+}
+/**
+ * One authority per daemon/server/session incarnation. This is an observation
+ * model, not an immutable native winlink identity: unobserved unlink/relink ABA
+ * is unknowable. Resolved targets still require an execution-time native guard.
+ * Not installed into the v1 stream; C2 activates it with the complete link-aware
+ * producer/consumer boundary.
+ */
+export class WindowLinkAuthority {
+    liveSessionId;
+    runtimeSessionId;
+    records = new Map();
+    revision = 0;
+    topology = null;
+    disposed = false;
+    constructor(liveSessionId, runtimeSessionId) {
+        this.liveSessionId = liveSessionId;
+        this.runtimeSessionId = runtimeSessionId;
+        WorkspaceCatalogLiveSessionIdSchemaZ.parse(liveSessionId);
+        if (!/^\$(?:0|[1-9]\d{0,15})$/u.test(runtimeSessionId) ||
+            !Number.isSafeInteger(Number(runtimeSessionId.slice(1))))
+            throw new TypeError("Invalid native session id");
+    }
+    /** A malformed fresh observation revokes old actions; no partial topology is published. */
+    reconcile(observations) {
+        try {
+            return this.stageAndPublish(observations);
+        }
+        catch (error) {
+            this.invalidate();
+            throw error;
+        }
+    }
+    stageAndPublish(observations) {
+        if (this.disposed)
+            throw new WindowLinkResolutionError("window_link_stale");
+        if (observations.length === 0 || observations.length > WINDOW_LINK_MAX_LINKS)
+            throw new TypeError("Invalid window link count");
+        const indexes = new Set();
+        const semanticByRuntime = new Map();
+        const runtimeBySemantic = new Map();
+        let activeCount = 0;
+        for (const row of observations) {
+            if (!Number.isSafeInteger(row.index) ||
+                row.index < 0 ||
+                indexes.has(row.index) ||
+                !/^@(?:0|[1-9]\d{0,15})$/u.test(row.runtimeWindowId) ||
+                !Number.isSafeInteger(Number(row.runtimeWindowId.slice(1))) ||
+                typeof row.active !== "boolean")
+                throw new TypeError("Malformed native window link observation");
+            TerminalAttachmentSemanticWindowIdSchemaZ.parse(row.semanticWindowId);
+            indexes.add(row.index);
+            if (row.active)
+                activeCount++;
+            const semantic = semanticByRuntime.get(row.runtimeWindowId);
+            const runtime = runtimeBySemantic.get(row.semanticWindowId);
+            if ((semantic !== undefined && semantic !== row.semanticWindowId) ||
+                (runtime !== undefined && runtime !== row.runtimeWindowId))
+                throw new TypeError("Window backing identity is inconsistent");
+            semanticByRuntime.set(row.runtimeWindowId, row.semanticWindowId);
+            runtimeBySemantic.set(row.semanticWindowId, row.runtimeWindowId);
+        }
+        if (activeCount !== 1)
+            throw new TypeError("Expected one active window link");
+        const rows = [...observations].sort((left, right) => left.index - right.index);
+        const changed = rows.length !== this.records.size ||
+            rows.some((row) => {
+                const prior = this.records.get(row.index);
+                return (prior?.runtimeWindowId !== row.runtimeWindowId ||
+                    prior?.semanticWindowId !== row.semanticWindowId);
+            });
+        const revision = this.revision + (changed ? 1 : 0);
+        if (!Number.isSafeInteger(revision))
+            throw new RangeError("Window link revision exhausted");
+        const next = new Map();
+        for (const row of rows) {
+            const prior = this.records.get(row.index);
+            const retained = prior?.runtimeWindowId === row.runtimeWindowId &&
+                prior.semanticWindowId === row.semanticWindowId;
+            next.set(row.index, {
+                ...row,
+                linkId: retained ? prior.linkId : `window-link.${randomUUID().replaceAll("-", "")}`,
+            });
+        }
+        const records = [...next.values()];
+        const topology = WindowLinkTopologySchemaZ.parse({
+            liveSessionId: this.liveSessionId,
+            linkRevision: revision,
+            activeLinkId: records.find((row) => row.active).linkId,
+            links: records.map((row) => ({
+                linkId: row.linkId,
+                semanticWindowId: row.semanticWindowId,
+                displayIndex: row.index,
+            })),
+        });
+        this.records = next;
+        this.revision = revision;
+        this.topology = topology;
+        return this.snapshot();
+    }
+    snapshot() {
+        return this.topology
+            ? { ...this.topology, links: this.topology.links.map((link) => ({ ...link })) }
+            : null;
+    }
+    /** Reconnect/gap/discontinuous observation must retire all previously issued handles. */
+    invalidate() {
+        this.records.clear();
+        this.topology = null;
+        this.revision++;
+        if (!Number.isSafeInteger(this.revision))
+            this.disposed = true;
+    }
+    dispose() {
+        this.invalidate();
+        this.disposed = true;
+    }
+    resolve(target) {
+        WindowLinkTargetSchemaZ.parse(target);
+        if (target.liveSessionId !== this.liveSessionId)
+            throw new WindowLinkResolutionError("window_link_session_mismatch");
+        if (!this.topology || this.disposed || target.linkRevision !== this.revision)
+            throw new WindowLinkResolutionError("window_link_stale");
+        const record = [...this.records.values()].find((row) => row.linkId === target.linkId);
+        if (!record)
+            throw new WindowLinkResolutionError("window_link_stale");
+        if (record.semanticWindowId !== target.expectedSemanticWindowId)
+            throw new WindowLinkResolutionError("window_link_backing_mismatch");
+        return {
+            runtimeSessionId: this.runtimeSessionId,
+            runtimeWindowId: record.runtimeWindowId,
+            index: record.index,
+        };
+    }
+    /** Legacy backing-only selection is safe only when exactly one link applies. */
+    uniqueTargetForBacking(semanticWindowId) {
+        if (!this.topology || this.disposed)
+            throw new WindowLinkResolutionError("window_link_stale");
+        const links = [...this.records.values()].filter((row) => row.semanticWindowId === semanticWindowId);
+        if (links.length === 0)
+            throw new WindowLinkResolutionError("window_link_stale");
+        if (links.length !== 1)
+            throw new WindowLinkResolutionError("window_link_ambiguous");
+        return {
+            liveSessionId: this.liveSessionId,
+            linkId: links[0].linkId,
+            expectedSemanticWindowId: semanticWindowId,
+            linkRevision: this.revision,
+        };
+    }
+}

package/packages/daemon/dist/terminal/pane-stream/lease-manager.js

@@ -5,7 +5,7 @@ import { PaneStreamLeaseRequestSchemaZ, } from "@tmux-ide/contracts";
  * PaneStreamLeaseManager — in-memory authority for pane-stream leases (m43
  * card 2), following the terminal-attachment lease discipline:
  *
- *  - a one-time `ps1_` bearer ticket whose SHA-256 digest is all the manager
+ *  - a one-time `ps2_` bearer ticket whose SHA-256 digest is all the manager
  *    retains, burned before activation so no concurrent caller can replay it;
  *  - the ticket TTL bounds credential DELIVERY (the authenticated redemption
  *    frame must arrive in time); execution after delivery gets its own bounded
@@ -30,7 +30,7 @@ const SessionNameSchemaZ = z
     .min(1)
     .max(256)
     .refine((value) => !/[\0\r\n]/u.test(value));
-const TicketPattern = /^ps1_[A-Za-z0-9_-]{43}$/u;
+const TicketPattern = /^ps2_[A-Za-z0-9_-]{43}$/u;
 export class PaneStreamLeaseError extends Error {
     code;
     constructor(code, message) {
@@ -95,7 +95,7 @@ export class PaneStreamLeaseManager {
             if (ticketBytes.byteLength !== 32) {
                 throw new PaneStreamLeaseError("identity-generation-failed", "The secure random source returned an invalid ticket.");
             }
-            const redemptionTicket = `ps1_${Buffer.from(ticketBytes).toString("base64url")}`;
+            const redemptionTicket = `ps2_${Buffer.from(ticketBytes).toString("base64url")}`;
             const state = {
                 leaseId,
                 requestId,

package/packages/daemon/dist/terminal/pane-stream/pane-stream-websocket.js

@@ -1,3 +1,4 @@
+import { PaneStreamLayoutSnapshotFrameSchemaZ } from "@tmux-ide/contracts";
 import { z } from "zod";
 import { PANE_STREAM_MAX_HELD_DELTAS, PANE_STREAM_MAX_OUTPUT_BYTES, PANE_STREAM_MAX_PANES, PANE_STREAM_MAX_SEED_BYTES, PANE_STREAM_PROTOCOL_VERSION, PANE_STREAM_REDEEM_PATH, PANE_STREAM_WEBSOCKET_SUBPROTOCOL, PaneStreamClientFrameSchemaZ, PaneStreamLoopbackWebSocketUrlSchemaZ, PaneStreamRedeemFrameSchemaZ, PaneStreamServerFrameSchemaZ, sharedMonotonicMicros, } from "@tmux-ide/contracts";
 import { canonicalOriginOrNull, digestSecret, digestsEqual, rawDataByteLength, rawDataToBuffer, safeCloseSocket, strictJsonParse, } from "../attachments/admission-util.js";
@@ -6,7 +7,7 @@ import { terminalDeliveryObservationOrdinal } from "../session-runtime/terminal-
 import { PaneStreamLeaseError, } from "./lease-manager.js";
 import { DEFAULT_PANE_STREAM_FLOW_BUDGETS, PaneStreamWireLedger, } from "./wire-ledger.js";
 /**
- * The pane-stream WebSocket endpoint (m43 card 2): redeems a one-time `ps1_`
+ * The pane-stream WebSocket endpoint (m43 card 2): redeems a one-time `ps2_`
  * ticket and bridges MirrorService subscriptions to wire frames. Admission is
  * the direct-websocket discipline verbatim — Origin-gated upgrade reservation,
  * digest-only pending tickets, one text redemption frame, delivery-bound TTL —
@@ -53,7 +54,7 @@ function hasCanonicalInputFramePrefix(raw) {
         startsWithBuffer(raw, CANONICAL_TEXT_INPUT_FRAME_PREFIX) ||
         startsWithBuffer(raw, TYPE_FIRST_INPUT_FRAME_PREFIX));
 }
-const TicketPattern = /^ps1_[A-Za-z0-9_-]{43}$/u;
+const TicketPattern = /^ps2_[A-Za-z0-9_-]{43}$/u;
 const BindingIdSchemaZ = z
     .string()
     .min(1)
@@ -270,7 +271,7 @@ export class PaneStreamAdmissionCoordinator {
         if (this.#shuttingDown) {
             return { accepted: false, code: "daemon-shutting-down", httpStatus: 503 };
         }
-        if (input.path !== PANE_STREAM_REDEEM_PATH) {
+        if (input.path !== new URL(this.#webSocketUrl).pathname) {
             return { accepted: false, code: "invalid-path", httpStatus: 404 };
         }
         if (input.protocols.length !== 1 || input.protocols[0] !== PANE_STREAM_WEBSOCKET_SUBPROTOCOL) {
@@ -616,6 +617,7 @@ export class PaneStreamLiveConnection {
     #semanticLayouts = new Map();
     #semanticExpectedPaneIds = null;
     #semanticRuntimeSessionId = null;
+    #semanticWindowLinks = null;
     #semanticTopologyEpoch = -1;
     #sendQueue = [];
     #semanticDrainWaiters = new Map();
@@ -920,7 +922,13 @@ export class PaneStreamLiveConnection {
                 authority.topologyEpoch < 0
                 ? null
                 : this.#validateInitialLayout(authority.layouts, expectedPaneIds);
-            if (!stagedInitialFrames) {
+            if (!stagedInitialFrames ||
+                !PaneStreamLayoutSnapshotFrameSchemaZ.safeParse({
+                    type: "layout-snapshot",
+                    topologyEpoch: authority?.topologyEpoch,
+                    layouts: stagedInitialFrames,
+                    windowLinks: authority?.windowLinks,
+                }).success) {
                 await subscription.close().catch(() => undefined);
                 this.#failTopologyChanged();
                 return;
@@ -1006,7 +1014,13 @@ export class PaneStreamLiveConnection {
             authority.topologyEpoch < 0
             ? null
             : this.#validateInitialLayout(authority.layouts, expectedPaneIds);
-        if (!initialFrames) {
+        if (!initialFrames ||
+            !PaneStreamLayoutSnapshotFrameSchemaZ.safeParse({
+                type: "layout-snapshot",
+                topologyEpoch: authority?.topologyEpoch,
+                layouts: initialFrames,
+                windowLinks: authority?.windowLinks,
+            }).success) {
             await Promise.all(opened.map(({ delivery }) => delivery.close().catch(() => undefined)));
             this.#failTopologyChanged();
             return;
@@ -1014,6 +1028,7 @@ export class PaneStreamLiveConnection {
         this.#recordDiagnosticLifecycle("pane-stream-layout-validated");
         this.#semanticExpectedPaneIds = expectedPaneIds;
         this.#semanticRuntimeSessionId = authority.runtimeSessionId;
+        this.#semanticWindowLinks = authority.windowLinks;
         this.#semanticTopologyEpoch = authority.topologyEpoch;
         this.#semanticLayouts.clear();
         for (const event of authority.layouts)
@@ -1022,6 +1037,7 @@ export class PaneStreamLiveConnection {
             type: "layout-snapshot",
             topologyEpoch: authority.topologyEpoch,
             layouts: initialFrames,
+            windowLinks: authority.windowLinks,
         });
         layoutActivated = true;
         this.#recordDiagnosticLifecycle("pane-stream-delivery-open");
@@ -1332,10 +1348,27 @@ export class PaneStreamLiveConnection {
             return;
         }
         const frames = this.#validateInitialLayout(snapshot.layouts, this.#semanticExpectedPaneIds);
-        if (!frames) {
+        if (!frames ||
+            !PaneStreamLayoutSnapshotFrameSchemaZ.safeParse({
+                type: "layout-snapshot",
+                topologyEpoch: snapshot.topologyEpoch,
+                layouts: frames,
+                windowLinks: snapshot.windowLinks,
+            }).success) {
             this.#failTopologyChanged();
             return;
         }
+        const previousLinks = this.#semanticWindowLinks;
+        if (!previousLinks ||
+            snapshot.windowLinks.liveSessionId !== previousLinks.liveSessionId ||
+            snapshot.windowLinks.linkRevision < previousLinks.linkRevision ||
+            (snapshot.windowLinks.linkRevision === previousLinks.linkRevision &&
+                JSON.stringify([...snapshot.windowLinks.links].sort((a, b) => a.linkId.localeCompare(b.linkId))) !==
+                    JSON.stringify([...previousLinks.links].sort((a, b) => a.linkId.localeCompare(b.linkId))))) {
+            this.#failTopologyChanged();
+            return;
+        }
+        this.#semanticWindowLinks = snapshot.windowLinks;
         this.#semanticTopologyEpoch = snapshot.topologyEpoch;
         this.#semanticLayouts.clear();
         for (const event of snapshot.layouts)
@@ -1344,6 +1377,7 @@ export class PaneStreamLiveConnection {
             type: "layout-snapshot",
             topologyEpoch: snapshot.topologyEpoch,
             layouts: frames,
+            windowLinks: snapshot.windowLinks,
         });
     }
     #onLayout(event) {

package/packages/daemon/dist/terminal/protocol/live-session-identity.js

@@ -0,0 +1,9 @@
+import { createHash } from "node:crypto";
+/** Shared opaque incarnation identity for catalog and terminal authority. */
+export function liveSessionIdForNativeIdentity(serverPid, sessionId, sessionCreated) {
+    const digest = createHash("sha256")
+        .update(`${serverPid}\0${sessionId}\0${sessionCreated}`)
+        .digest("hex")
+        .slice(0, 20);
+    return `live-session.${digest}`;
+}

package/packages/daemon/dist/terminal/protocol/native-backing-client.js

@@ -1,7 +1,8 @@
 import { decodeNativeGridCapture } from "../mirror/native-grid-capture.js";
 /** One bounded read on entering scrollback. No captures are issued by wheel movement. */
 export async function readNativeBacking(options) {
-    const url = new URL(`/api/project/${encodeURIComponent(options.workspaceName)}/terminal-native-backing/${encodeURIComponent(options.paneId)}`, options.baseUrl);
+    const url = new URL(options.resourcePath ??
+        `/api/project/${encodeURIComponent(options.workspaceName)}/terminal-native-backing/${encodeURIComponent(options.paneId)}`, options.baseUrl);
     for (const [key, value] of Object.entries(options.expected))
         url.searchParams.set(key, String(value));
     const response = await fetch(url, {

package/packages/daemon/dist/terminal/session-runtime/interaction-receipt-facts.js

@@ -7,6 +7,12 @@ export function sessionRuntimeInteractionFacts(intent) {
                 target: { kind: "pane", semanticPaneId: intent.semanticPaneId },
                 summary: { operationKind: intent.verb, direction: intent.direction },
             };
+        case "workspace.window.link.select":
+        case "workspace.window.link.unlink":
+            return {
+                target: { kind: "window-link", target: intent.target },
+                summary: { operationKind: intent.verb },
+            };
         case "workspace.window.kill":
             return {
                 target: { kind: "window", target: intent.target },
@@ -85,6 +91,9 @@ export function sessionRuntimeObservedProof(intent, rawResult) {
     if (result.verb !== intent.verb)
         throw new TypeError("Mutation result verb does not match intent");
     switch (result.verb) {
+        case "workspace.window.link.select":
+        case "workspace.window.link.unlink":
+            return { operationKind: result.verb, outcome: result.outcome, target: result.target };
         case "workspace.window.split":
             return {
                 operationKind: result.verb,

package/packages/daemon/dist/terminal/session-runtime/registry.js

@@ -258,6 +258,12 @@ export class SessionRuntimeRegistry {
         return ((this.#sessions.get(session)?.trustedInventoryQualified() ?? false) &&
             this.#mirror.hasRetainedSession(session));
     }
+    /** Called by the serialized semantic mutation executor, never by a transport directly. */
+    executeWindowLinkAction(session, request) {
+        if (this.#disposed)
+            return Promise.reject(new Error("Session runtime disposed"));
+        return this.#mirror.executeWindowLinkAction(session, request);
+    }
     /** Retire one no-longer-registered session without disturbing siblings. */
     async retireSession(session) {
         const runtime = this.#sessions.get(session);

package/packages/daemon/dist/terminal/session-runtime/semantic-mutation-executor.js

@@ -244,7 +244,7 @@ export class SessionSemanticMutationExecutor {
             // Admission can wait behind prior work. Revalidate the opaque principal
             // at the last synchronous boundary before tmux receives any effect.
             authorizeBeforeEffect?.();
-            result = this.#options.execute(operationId, intent, timing);
+            result = await this.#options.execute(operationId, intent, timing);
         }
         catch (cause) {
             if (needsTmuxObservation)

package/packages/daemon/dist/terminal/session-runtime/semantic-mutation-resource-changes.js

@@ -17,6 +17,7 @@ export function semanticMutationResourceChanges(raw) {
     ];
     if (result.verb === "workspace.window.split" ||
         result.verb === "workspace.window.kill" ||
+        result.verb === "workspace.window.link.unlink" ||
         result.verb === "workspace.pane.kill" ||
         result.verb === "workspace.session.kill") {
         changes.push({ ...base, workspaceName: null, resource: "fleet-catalog" });

package/packages/daemon/dist/tui/mirror/application-shell-daemon-connection.js

@@ -1,5 +1,6 @@
+import { prepareScopedOpenTuiConnection } from "./application-shell-server-connection.js";
 import { OpenTuiStartupError, startupFailureFromError } from "./startup-failure.js";
-import { readApplicationDaemonInfo as readCanonicalDaemonInfo, isApplicationDaemonAlive as isCanonicalDaemonAlive, } from "./runtime/application-daemon-authority.js";
+import { applicationDaemonEndpoint, readApplicationDaemonInfo as readCanonicalDaemonInfo, isApplicationDaemonAlive as isCanonicalDaemonAlive, } from "./runtime/application-daemon-authority.js";
 import { APPLICATION_SHELL_RESOURCE_V2_VERSION, } from "@tmux-ide/contracts";
 import { createDirectLoopbackDaemonTransport, } from "@tmux-ide/daemon-client/direct-application-shell-transport";
 import { WebSocket } from "ws";
@@ -88,7 +89,7 @@ export async function resolveOpenTuiApplicationShellConnection(sessionName, over
         applicationShellResourceVersion: APPLICATION_SHELL_RESOURCE_V2_VERSION,
         ...(diagnose ? { terminalRuntimeDiagnostic: diagnose } : {}),
     });
-    const routing = createOpenTuiVerifiedRoutingContext(daemon, workspaceName, sessionName);
+    const routing = createOpenTuiVerifiedRoutingContext(daemon, workspaceName, sessionName, undefined, dependencies.readDaemonEndpoint ?? applicationDaemonEndpoint, undefined, liveSessionId ?? undefined);
     let disposed = false;
     let diagnosticClientFetchOrdinal = 0;
     let diagnosticPrewarmOrdinal = 0;
@@ -263,6 +264,10 @@ export async function resolveOpenTuiApplicationShellConnection(sessionName, over
 export async function prepareOpenTuiApplicationShellConnection(sessionName, overrides = {}) {
     const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
     try {
+        if (dependencies.server) {
+            const unscoped = { ...dependencies, server: undefined };
+            return await prepareScopedOpenTuiConnection(sessionName, dependencies, () => prepareOpenTuiApplicationShellConnection(sessionName, unscoped));
+        }
         const result = await dependencies.ensureSessionWorkspace(sessionName);
         if (result === false)
             return null;

package/packages/daemon/dist/tui/mirror/application-shell-server-connection.js

@@ -0,0 +1,114 @@
+import { createTmuxServerClient } from "@tmux-ide/daemon-client/tmux-server-client";
+import { createScopedTmuxServerTransport, createScopedTmuxServerCatalogPort, createScopedTmuxServerOwnerActions, } from "@tmux-ide/daemon-client/scoped-tmux-server-transport";
+import { canonicalDaemonUrl } from "../../lib/canonical-daemon.js";
+import { createOpenTuiVerifiedRoutingContext } from "./open-tui-verified-routing.js";
+import { OPEN_TUI_HOST_CLIENT_ID } from "./open-tui-workspace-runtime-port.js";
+import { OpenTuiStartupError } from "./startup-failure.js";
+/** A selected registration never falls through to a name-only/default-server route. */
+export async function prepareScopedOpenTuiConnection(sessionName, dependencies, prepareDefault) {
+    const scope = dependencies.server;
+    const daemon = dependencies.readCanonicalDaemonInfo();
+    if (!daemon || !daemon.authToken || !(await dependencies.isCanonicalDaemonAlive(daemon)))
+        throw new OpenTuiStartupError({ reason: "daemon-unavailable" });
+    const clientOptions = {
+        baseUrl: canonicalDaemonUrl("http", daemon.bindHostname, daemon.port),
+        ownerToken: daemon.authToken,
+        hostClientId: OPEN_TUI_HOST_CLIENT_ID,
+        origin: "tmux-ide://opentui",
+    };
+    const client = createTmuxServerClient(clientOptions, scope);
+    try {
+        const catalog = await client.sessions();
+        const candidates = catalog.sessions.filter((session) => session.sessionName === sessionName &&
+            (!dependencies.expectedLiveSessionId ||
+                session.liveSessionId === dependencies.expectedLiveSessionId));
+        if (candidates.length !== 1)
+            throw new OpenTuiStartupError({ reason: "session-unavailable" });
+        const liveSessionId = candidates[0].liveSessionId;
+        // The borrowed default owner has the daemon's original generation. Its existing
+        // transport preserves the full app surface while the scoped read proves routing.
+        if (scope.generation === daemon.instanceId) {
+            const connection = await prepareDefault();
+            if (!connection || connection.liveSessionId !== liveSessionId) {
+                connection?.dispose();
+                throw new OpenTuiStartupError({ reason: "session-unavailable" });
+            }
+            try {
+                const current = await client.sessions();
+                if (!current.sessions.some((session) => session.liveSessionId === liveSessionId && session.sessionName === sessionName))
+                    throw new OpenTuiStartupError({ reason: "session-unavailable" });
+                const options = {
+                    clientOptions,
+                    scope,
+                    target: connection.target,
+                    sessionName,
+                    liveSessionId,
+                };
+                const routing = createOpenTuiVerifiedRoutingContext(daemon, connection.workspaceName, sessionName, undefined, dependencies.readDaemonEndpoint, scope, liveSessionId);
+                connection.routing?.retire();
+                return {
+                    ...connection,
+                    server: scope,
+                    routing,
+                    ownerActions: createScopedTmuxServerOwnerActions(options, connection.transport),
+                    dispose() {
+                        routing?.retire();
+                        connection.dispose();
+                    },
+                };
+            }
+            catch (error) {
+                connection.dispose();
+                throw error;
+            }
+        }
+        const opened = await client.openSession(liveSessionId);
+        if (opened.liveSessionId !== liveSessionId)
+            throw new OpenTuiStartupError({ reason: "session-unavailable" });
+        const workspaceName = opened.workspaceName;
+        const target = {
+            daemon: {
+                protocolVersion: daemon.protocolVersion,
+                productVersion: daemon.productVersion,
+                instanceId: scope.generation,
+                startedAt: daemon.startedAt,
+                ...(daemon.environmentId ? { environmentId: daemon.environmentId } : {}),
+            },
+            workspaceName,
+        };
+        const options = { clientOptions, scope, target, sessionName, liveSessionId };
+        const transport = createScopedTmuxServerTransport(options);
+        const routing = createOpenTuiVerifiedRoutingContext(daemon, workspaceName, sessionName, undefined, dependencies.readDaemonEndpoint, scope, liveSessionId);
+        const controller = new AbortController();
+        let preparation = null;
+        return {
+            workspaceName,
+            liveSessionId,
+            target,
+            server: scope,
+            transport,
+            routing,
+            catalog: createScopedTmuxServerCatalogPort(options, transport),
+            ownerActions: createScopedTmuxServerOwnerActions(options, transport),
+            prepareTerminalRuntimeInventory() {
+                preparation ??= transport
+                    .prepareTerminalRuntimeInventory(target, AbortSignal.any([controller.signal, AbortSignal.timeout(5_000)]))
+                    .catch(() => {
+                    // Fallback remains inside this owner; never use the legacy default resource.
+                    transport.selectApplicationShellFallback("preparation-rejected");
+                    return null;
+                });
+                return preparation;
+            },
+            dispose() {
+                controller.abort(new DOMException("Selected server connection retired", "AbortError"));
+                void preparation?.then((prepared) => prepared?.dispose()).catch(() => undefined);
+                transport.disposeEventSupervisor();
+                routing?.retire();
+            },
+        };
+    }
+    finally {
+        client.dispose();
+    }
+}

package/packages/daemon/dist/tui/mirror/menu-model.js

@@ -52,7 +52,7 @@ export const MENU_ITEMS = {
     window: [
         { id: "new", label: "New window" },
         { id: "rename", label: "Rename window", input: "rename to" },
-        { id: "kill", label: "Kill window", danger: true },
+        { id: "kill", label: "Kill window and panes in all links", danger: true },
     ],
 };
 /** PURE — the pane menu's item list for a concrete pane (M22.9). App-mouse

package/packages/daemon/dist/tui/mirror/open-tui-verified-routing.js

@@ -1,8 +1,9 @@
-import { openPaneStreamRuntimeClient, } from "@tmux-ide/daemon-client/pane-stream-client";
+import { openPaneStreamRuntimeClient, connectIssuedPaneStreamRuntimeClient, } from "@tmux-ide/daemon-client/pane-stream-client";
+import { createTmuxServerClient } from "@tmux-ide/daemon-client/tmux-server-client";
 import { canonicalDaemonUrl } from "../../lib/canonical-daemon.js";
 import { readNativeBacking, } from "../../terminal/protocol/native-backing-client.js";
 import { applicationDaemonEndpoint, } from "./runtime/application-daemon-authority.js";
-export function createOpenTuiVerifiedRoutingContext(daemon, workspaceName, sessionName, openClient = openPaneStreamRuntimeClient, readEndpoint = applicationDaemonEndpoint) {
+export function createOpenTuiVerifiedRoutingContext(daemon, workspaceName, sessionName, openClient = openPaneStreamRuntimeClient, readEndpoint = applicationDaemonEndpoint, server, liveSessionId) {
     if (!daemon.authToken)
         return null;
     const ownerToken = daemon.authToken;
@@ -21,7 +22,7 @@ export function createOpenTuiVerifiedRoutingContext(daemon, workspaceName, sessi
     const localSocketOrigin = new URL(baseUrl);
     localSocketOrigin.protocol = "ws:";
     const identity = Object.freeze({
-        daemonInstanceId: daemon.instanceId,
+        daemonInstanceId: server?.generation ?? daemon.instanceId,
         workspaceName,
         sessionName,
     });
@@ -47,11 +48,17 @@ export function createOpenTuiVerifiedRoutingContext(daemon, workspaceName, sessi
     };
     return Object.freeze({
         ...identity,
+        ...(liveSessionId ? { liveSessionId } : {}),
         assertCurrent,
         readNativeBacking: async (paneId, expected, signal) => {
             assertCurrent({ ...identity, daemonInstanceId: expected.generation });
             const result = await readNativeBacking({
                 baseUrl,
+                ...(server
+                    ? {
+                        resourcePath: `/api/v1/tmux-servers/${server.serverId}/${server.generation}/native-backing/${encodeURIComponent(workspaceName)}/${encodeURIComponent(paneId)}`,
+                    }
+                    : {}),
                 ownerToken,
                 workspaceName,
                 paneId,
@@ -66,7 +73,30 @@ export function createOpenTuiVerifiedRoutingContext(daemon, workspaceName, sessi
             if (options.stream.workspaceName !== identity.workspaceName) {
                 throw new Error("Pane-stream request escaped its verified workspace route");
             }
-            return await openClient({
+            const openScoped = async (scopedOptions) => {
+                const client = createTmuxServerClient({
+                    baseUrl,
+                    ownerToken,
+                    hostClientId: scopedOptions.hostClientId,
+                    origin: scopedOptions.origin,
+                    fetch: scopedOptions.fetch,
+                }, server);
+                try {
+                    if (scopedOptions.signal?.aborted)
+                        throw scopedOptions.signal.reason;
+                    const issued = await client.issuePaneStream(scopedOptions.requestId, scopedOptions.stream, liveSessionId);
+                    assertCurrent(expected);
+                    if (scopedOptions.signal?.aborted)
+                        throw scopedOptions.signal.reason;
+                    if (issued.status === "error")
+                        throw new Error(issued.error.reason);
+                    return await connectIssuedPaneStreamRuntimeClient(scopedOptions, issued.descriptor);
+                }
+                finally {
+                    client.dispose();
+                }
+            };
+            return await (server ? openScoped : openClient)({
                 ...options,
                 baseUrl,
                 ownerToken,