tmux-ide 2.9.0-beta.21 → 2.9.0-beta.26

package/packages/daemon/src/lib/embedded-tmux-server-owners.ts

@@ -0,0 +1,190 @@
+import type { Server, IncomingMessage } from "node:http";
+import type { Socket } from "node:net";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { tmuxServerPaneStreamPath } from "@tmux-ide/contracts";
+import {
+  TmuxServerOwners,
+  MAX_TMUX_SERVER_OWNERS,
+  type TmuxServerRegistration,
+} from "./tmux-server-owners.ts";
+import {
+  createTmuxServerProbe,
+  readTmuxServerRegistrations,
+  writeTmuxServerRegistrations,
+} from "./tmux-server-registration.ts";
+import { createNativeTmuxServerOwner, type NativeTmuxServerOwner } from "./tmux-server-owner.ts";
+import type { WorkspacePaneTmuxAuthority } from "./workspace-pane-creation.ts";
+import {
+  attachPaneStreamWebSocket,
+  type PaneStreamWebSocketBoundary,
+} from "../server/pane-stream-upgrade.ts";
+
+/** Adapts the established default owner without duplicating its control clients. */
+export async function createEmbeddedTmuxServerOwners(options: {
+  readonly defaultAuthority: WorkspacePaneTmuxAuthority;
+  readonly defaultGeneration: string;
+  readonly expectedDefaultProofDigest: string | null;
+  readonly defaultOwner: Omit<NativeTmuxServerOwner, "serverId" | "generation">;
+  readonly stateDirectory: string;
+  readonly webSocketBaseUrl: string;
+}) {
+  const path = join(options.stateDirectory, "tmux-servers.json");
+  const persisted = readTmuxServerRegistrations(path);
+  const probe = createTmuxServerProbe(options.defaultAuthority.executablePath);
+  const defaultObservation = await probe(options.defaultAuthority.socketSelector);
+  let established = persisted.find(
+    (entry) =>
+      JSON.stringify(entry.selector) === JSON.stringify(options.defaultAuthority.socketSelector),
+  );
+  if (!established && defaultObservation) {
+    for (const entry of persisted) {
+      const observation = await probe(entry.selector);
+      if (observation?.fingerprint === defaultObservation.fingerprint) {
+        established = entry;
+        break;
+      }
+    }
+  }
+  const defaultRegistration: TmuxServerRegistration = established ?? {
+    serverId: `tmux-server.${randomUUID().replaceAll("-", "")}`,
+    label: "Default",
+    selector: options.defaultAuthority.socketSelector,
+  };
+  let httpServer: Server | null = null;
+  const boundaries = new Map<string, PaneStreamWebSocketBoundary>();
+  const pending = new Map<string, NativeTmuxServerOwner>();
+  const isCurrent = (owner: NativeTmuxServerOwner): boolean => {
+    try {
+      return (
+        owners.current({ serverId: owner.serverId, generation: owner.generation })
+          .paneStreamRuntime === owner.paneStreamRuntime
+      );
+    } catch {
+      return false;
+    }
+  };
+  const attachOwner = (route: string, owner: NativeTmuxServerOwner) => {
+    pending.set(route, owner);
+    if (httpServer)
+      boundaries.set(
+        route,
+        attachPaneStreamWebSocket(httpServer, owner.paneStreamRuntime.coordinator, route, () =>
+          isCurrent(owner),
+        ),
+      );
+  };
+  let defaultRetired = false;
+  const retireDefault = async () => {
+    if (defaultRetired) return;
+    defaultRetired = true;
+    await options.defaultOwner.dispose();
+  };
+  const owners = new TmuxServerOwners<NativeTmuxServerOwner>({
+    probe,
+    persist: (registrations) => writeTmuxServerRegistrations(path, registrations),
+    create: async (registration, scope, observation) => {
+      if (registration.serverId === defaultRegistration.serverId) await retireDefault();
+      const route = tmuxServerPaneStreamPath(scope);
+      const owner = await createNativeTmuxServerOwner({
+        ...scope,
+        tmuxAuthority: observation.authority,
+        nativeServerIdentity: observation.nativeServerIdentity,
+        stateDirectory: join(options.stateDirectory, "server-owners", registration.serverId),
+        webSocketUrl: new URL(route, options.webSocketBaseUrl).href,
+      });
+      attachOwner(route, owner);
+      return {
+        ...owner,
+        dispose: async () => {
+          const boundary = boundaries.get(route);
+          boundaries.delete(route);
+          pending.delete(route);
+          try {
+            await boundary?.close();
+          } finally {
+            await owner.dispose();
+          }
+        },
+      };
+    },
+  });
+  if (defaultObservation && defaultObservation.fingerprint === options.expectedDefaultProofDigest)
+    owners.adopt(
+      defaultRegistration,
+      { serverId: defaultRegistration.serverId, generation: options.defaultGeneration },
+      defaultObservation,
+      {
+        ...options.defaultOwner,
+        serverId: defaultRegistration.serverId,
+        generation: options.defaultGeneration,
+        dispose: retireDefault,
+      },
+    );
+  try {
+    if (
+      !defaultObservation ||
+      defaultObservation.fingerprint !== options.expectedDefaultProofDigest
+    )
+      await owners.register(defaultRegistration);
+    for (const registration of persisted) {
+      if (registration.serverId !== defaultRegistration.serverId)
+        await owners.register(registration);
+    }
+    writeTmuxServerRegistrations(path, owners.registrations());
+  } catch (error) {
+    await owners.dispose();
+    throw error;
+  }
+  const refuseUnknownScope = (request: IncomingMessage, socket: Socket) => {
+    const route = (request.url ?? "").split("?", 1)[0]!;
+    if (route.startsWith("/v2/tmux-servers/") && !pending.has(route))
+      socket.end("HTTP/1.1 410 Gone\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+  };
+  return {
+    owners,
+    isDefaultCurrent() {
+      if (defaultRetired) return false;
+      if (
+        !defaultObservation ||
+        defaultObservation.fingerprint !== options.expectedDefaultProofDigest
+      )
+        return true;
+      try {
+        owners.current({
+          serverId: defaultRegistration.serverId,
+          generation: options.defaultGeneration,
+        });
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    attach(server: Server) {
+      if (httpServer) throw new Error("Server owner transport already attached");
+      httpServer = server;
+      server.on("upgrade", refuseUnknownScope);
+      server.setMaxListeners(
+        Math.max(
+          server.getMaxListeners(),
+          MAX_TMUX_SERVER_OWNERS + server.listenerCount("upgrade") + 4,
+        ),
+      );
+      for (const [route, owner] of pending)
+        boundaries.set(
+          route,
+          attachPaneStreamWebSocket(server, owner.paneStreamRuntime.coordinator, route, () =>
+            isCurrent(owner),
+          ),
+        );
+    },
+    async dispose() {
+      httpServer?.off("upgrade", refuseUnknownScope);
+      await owners.dispose();
+    },
+    /** Legacy default routes remain bound to their original authority; never retarget. */
+    get defaultRetired() {
+      return defaultRetired;
+    },
+  };
+}

package/packages/daemon/src/lib/fleet-lifecycle-authority.ts

@@ -1,3 +1,4 @@
+import { liveSessionIdForNativeIdentity } from "../terminal/protocol/live-session-identity.ts";
 import { createHash, randomUUID } from "node:crypto";
 import { isAbsolute, resolve } from "node:path";
 import { realpath, stat } from "node:fs/promises";
@@ -56,6 +57,7 @@ export class FleetLifecycleAuthority {
   readonly #startedAt: string;
   readonly #registry: Pick<WorkspaceRegistry, "list" | "add">;
   readonly #runTmux: (args: readonly string[]) => string;
+  readonly #ensureChromeUpdater: boolean;
   readonly #readFleet: () => FleetSessionFacts[] | null;
   readonly #operations = new Map<string, { fingerprint: string; result: unknown }>();
   #tail: Promise<void> = Promise.resolve();
@@ -67,11 +69,14 @@ export class FleetLifecycleAuthority {
     registry: Pick<WorkspaceRegistry, "list" | "add">;
     runTmux: (args: readonly string[]) => string;
     readFleet?: () => FleetSessionFacts[] | null;
+    /** Independent visual owners do not need an additional chrome updater process. */
+    ensureChromeUpdater?: boolean;
   }) {
     this.#daemonInstanceId = options.daemonInstanceId;
     this.#productVersion = options.productVersion;
     this.#startedAt = options.startedAt;
     this.#registry = options.registry;
+    this.#ensureChromeUpdater = options.ensureChromeUpdater ?? true;
     this.#runTmux = options.runTmux;
     this.#readFleet = options.readFleet ?? (() => readAdoptedFleet(this.#registry));
   }
@@ -135,10 +140,14 @@ export class FleetLifecycleAuthority {
       }
     }
     let created = false;
+    let liveSessionId: string | undefined;
     try {
-      this.#runTmux([
+      const createdId = this.#runTmux([
         "new-session",
         "-d",
+        "-P",
+        "-F",
+        "#{pid}\t#{session_id}\t#{session_created}",
         ...TMUX_TRUECOLOR_ENVIRONMENT_ARGS,
         "-s",
         identity.sessionName,
@@ -148,14 +157,26 @@ export class FleetLifecycleAuthority {
         cwd,
         TMUX_TRUECOLOR_INTERACTIVE_SHELL_COMMAND,
       ]);
+      const [serverPid, sessionId, sessionCreated] = createdId.trim().split("\t");
+      if (
+        serverPid &&
+        /^\d+$/u.test(serverPid) &&
+        sessionId &&
+        /^\$\d+$/u.test(sessionId) &&
+        sessionCreated &&
+        /^\d+$/u.test(sessionCreated)
+      )
+        liveSessionId = liveSessionIdForNativeIdentity(serverPid, sessionId, sessionCreated);
       created = true;
       prepareTmuxTruecolorEnvironment(this.#runTmux, identity.sessionName);
       this.#runTmux(["set-environment", "-t", identity.sessionName, "TMUX_IDE", "1"]);
       this.#runTmux(adoptMarkArgv(identity.sessionName));
-      try {
-        this.#runTmux(updaterProbeArgv());
-      } catch {
-        this.#runTmux(updaterSpawnArgv());
+      if (this.#ensureChromeUpdater) {
+        try {
+          this.#runTmux(updaterProbeArgv());
+        } catch {
+          this.#runTmux(updaterSpawnArgv());
+        }
       }
       if (!existing)
         this.#registry.add({
@@ -180,6 +201,7 @@ export class FleetLifecycleAuthority {
       operationId,
       daemonInstanceId: this.#daemonInstanceId,
       outcome: "created",
+      ...(input.includeLiveSessionId && liveSessionId ? { liveSessionId } : {}),
       fleetSessionId: fleetSessionIdForName(identity.sessionName),
       workspaceName: identity.workspaceName,
       displayName: input.displayName,
@@ -368,10 +390,12 @@ export class FleetLifecycleAuthority {
       this.#runTmux(["set-option", "-p", "-t", paneId, "@agent_launch", input.command]);
       this.#runTmux(["set-option", "-p", "-t", paneId, "@agent_hint", input.harness]);
       this.#runTmux(["select-pane", "-t", paneId, "-T", input.displayTitle]);
-      try {
-        this.#runTmux(updaterProbeArgv());
-      } catch {
-        this.#runTmux(updaterSpawnArgv());
+      if (this.#ensureChromeUpdater) {
+        try {
+          this.#runTmux(updaterProbeArgv());
+        } catch {
+          this.#runTmux(updaterSpawnArgv());
+        }
       }
     } catch (error) {
       if (createdSession) this.#tryTmux(["kill-session", "-t", sessionName]);

package/packages/daemon/src/lib/headless-daemon.ts

@@ -1,3 +1,5 @@
+import { assertCanonicalDaemonServerIntent } from "./canonical-daemon-bootstrap.ts";
+import { resolveTmuxServerIntent } from "./runtime-namespace.ts";
 import {
   canonicalDaemonUrl,
   matchesCanonicalDaemonPredecessor,
@@ -28,6 +30,7 @@ import { generateAuthToken } from "./auth-token.ts";
 import type { DaemonRestartRequest } from "./daemon-restart-request.ts";
 
 export interface HeadlessDaemonOptions {
+  readonly tmuxServerIntent?: ReturnType<typeof resolveTmuxServerIntent>;
   readonly supervisionId?: string;
   /** Managed launch receipt, only after this process wins election and is attachable. */
   readonly onOwnedReady?: (info: CanonicalDaemonInfo) => void;
@@ -48,6 +51,8 @@ export interface HeadlessDaemonDependencies {
   readonly probeCanonicalDaemonHealth: (info: CanonicalDaemonInfo) => Promise<DaemonHealth | null>;
   readonly probeCanonicalDaemonIdentity: (
     info: CanonicalDaemonInfo,
+    signal?: AbortSignal,
+    includeTmuxServerProof?: boolean,
   ) => Promise<DaemonIdentity | null>;
   readonly startEmbeddedDaemon: (opts: EmbeddedDaemonOptions) => Promise<EmbeddedDaemonHandle>;
   readonly writeStdout: (line: string) => void;
@@ -140,7 +145,11 @@ async function assertAttachableDaemon(
   info: CanonicalDaemonInfo,
   options: HeadlessDaemonOptions,
 ): Promise<void> {
-  const identity = await deps.probeCanonicalDaemonIdentity(info);
+  const identity = await deps.probeCanonicalDaemonIdentity(
+    info,
+    undefined,
+    Boolean(options.tmuxServerIntent),
+  );
   if (!identity) {
     throw new IdeError(
       `Canonical daemon PID ${info.pid} is alive but its identity endpoint is unavailable. ` +
@@ -149,6 +158,9 @@ async function assertAttachableDaemon(
     );
   }
   assertIdentityMatches(info, identity);
+  await assertCanonicalDaemonServerIntent(info, options.tmuxServerIntent ?? null, {
+    identity: async () => identity,
+  });
   const health = await deps.probeCanonicalDaemonHealth(info);
   if (!health) {
     throw new IdeError(
@@ -288,6 +300,11 @@ export async function runHeadlessDaemon(
   options: HeadlessDaemonOptions = {},
   deps: HeadlessDaemonDependencies = defaultDependencies,
 ): Promise<"stopped" | "already-running"> {
+  options = {
+    ...options,
+    tmuxServerIntent:
+      options.tmuxServerIntent === undefined ? resolveTmuxServerIntent() : options.tmuxServerIntent,
+  };
   let restoreTmuxWorkspaces = false;
   const lifecycle: { restart?: DaemonRestartRequest; predecessor?: CanonicalDaemonPredecessor } =
     {};

package/packages/daemon/src/lib/runtime-namespace.ts

@@ -44,6 +44,7 @@ export interface RuntimeNamespace {
   readonly daemonInfoDir: string;
   readonly controlSocketPath: string;
   readonly eventLogPath: string;
+  readonly tmuxSocketExplicit?: boolean;
   readonly tmuxSocket:
     | { readonly kind: "name"; readonly name: string }
     | { readonly kind: "path"; readonly path: string };
@@ -287,6 +288,7 @@ export function resolveRuntimeNamespace(
     controlSocketPath: join(runtimeDir, "control.sock"),
     eventLogPath: join(stateHome, "events.jsonl"),
     tmuxSocket,
+    tmuxSocketExplicit: Boolean(tmuxSocketName || tmuxSocketPath),
     cleanupToken,
     namespaceId: development?.id ?? (isolated ? cleanupToken! : "canonical"),
     persistence: isolated && !development ? "ephemeral" : "durable",
@@ -316,9 +318,11 @@ export function runtimeNamespaceEnvironment(
     [STATE_HOME_ENV]: namespace.stateHome,
     [REGISTRY_DIR_ENV]: namespace.registryDir,
     [DAEMON_INFO_DIR_ENV]: namespace.daemonInfoDir,
-    ...(namespace.tmuxSocket.kind === "name"
-      ? { [TMUX_SOCKET_NAME_ENV]: namespace.tmuxSocket.name }
-      : { [TMUX_SOCKET_PATH_ENV]: namespace.tmuxSocket.path }),
+    ...(namespace.tmuxSocketExplicit === false
+      ? {}
+      : namespace.tmuxSocket.kind === "name"
+        ? { [TMUX_SOCKET_NAME_ENV]: namespace.tmuxSocket.name }
+        : { [TMUX_SOCKET_PATH_ENV]: namespace.tmuxSocket.path }),
     ...(namespace.cleanupToken ? { [CLEANUP_TOKEN_ENV]: namespace.cleanupToken } : {}),
   });
 }
@@ -388,3 +392,20 @@ export function assertQualifiedDevelopmentLaunch(): void {
       "Development launch requires exact build artifacts (D03); installed CLI fallback is disabled",
     );
 }
+
+/** Caller intent differs from the default used when starting a new owner. */
+export function resolveTmuxServerIntent(options: RuntimeNamespaceResolutionOptions = {}): {
+  readonly source: "explicit" | "current";
+  readonly selector: RuntimeNamespace["tmuxSocket"];
+} | null {
+  const env = options.env ?? process.env;
+  const namespace = resolveRuntimeNamespace(options);
+  if (
+    namespace.isolated ||
+    nonEmpty(env, TMUX_SOCKET_NAME_ENV) ||
+    nonEmpty(env, TMUX_SOCKET_PATH_ENV)
+  )
+    return { source: "explicit", selector: namespace.tmuxSocket };
+  const current = /^(.*),[0-9]+,[0-9]+$/u.exec(env.TMUX ?? "")?.[1];
+  return current ? { source: "current", selector: { kind: "path", path: current } } : null;
+}

package/packages/daemon/src/lib/tmux-client-execution.ts

@@ -0,0 +1,56 @@
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { delimiter, isAbsolute, join } from "node:path";
+import { resolveRuntimeNamespace } from "./runtime-namespace.ts";
+import { resolveBundledTmux } from "./bundled-tmux.ts";
+
+export function resolveTmuxExecutable(): string {
+  if (resolveRuntimeNamespace().development) return resolveBundledTmux()!;
+  const configured = process.env.TMUX_IDE_TMUX_BIN;
+  if (!configured) {
+    const bundled = resolveBundledTmux();
+    if (bundled) return bundled;
+  }
+  const candidates = configured
+    ? [configured]
+    : (process.env.PATH ?? "")
+        .split(delimiter)
+        // Empty and relative PATH entries mean the daemon/project cwd. They
+        // are never executable authority for a privileged tmux mutation.
+        .filter((entry) => entry.length > 0 && isAbsolute(entry))
+        .map((entry) => join(entry, "tmux"));
+  for (const candidate of candidates) {
+    try {
+      if (!isAbsolute(candidate)) continue;
+      accessSync(candidate, constants.X_OK);
+      const canonical = realpathSync(candidate);
+      if (statSync(canonical).isFile()) return canonical;
+    } catch {
+      // Continue to the next daemon-start candidate.
+    }
+  }
+  throw new Error("tmux_executable_unavailable");
+}
+
+const SAFE_TERMINAL_VALUE = /^(?:xterm|screen|tmux|rxvt|vt100|ansi)[A-Za-z0-9+._-]{0,58}$/u;
+const SAFE_LOCALE_VALUE = /^[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}$/u;
+
+/**
+ * The pinned tmux client receives only presentation metadata. Everything else
+ * is denied by omission: PATH/HOME/SHELL, TMUX/TMUX_PANE/TMUX_TMPDIR, shell
+ * startup hooks, dynamic-loader variables, Node options, and project secrets
+ * cannot redirect authority or inject code into this daemon-owned execution.
+ */
+export function tmuxClientEnvironment(source: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = {
+    TERM: SAFE_TERMINAL_VALUE.test(source.TERM ?? "") ? source.TERM : "xterm-256color",
+    // A pinned runner may be the first tmux client and therefore create the
+    // server. Never let a headless parent (`TERM=dumb`, `NO_COLOR=1`) become
+    // the global environment inherited by every later interactive child.
+    COLORTERM: "truecolor",
+  };
+  for (const name of ["LANG", "LC_ALL", "LC_CTYPE"] as const) {
+    const value = source[name];
+    if (value && SAFE_LOCALE_VALUE.test(value)) environment[name] = value;
+  }
+  return environment;
+}

package/packages/daemon/src/lib/tmux-named-socket-fence.ts

@@ -68,3 +68,8 @@ export function createNamedSocketFence(
     isPinned: () => shared.identity !== null,
   };
 }
+
+/** True only before this exact authority has observed any live socket. */
+export function isNamedSocketAuthorityUnbound(authority: WorkspacePaneTmuxAuthority): boolean {
+  return authority.socketSelector.kind === "name" && !states.get(authority)?.identity;
+}

package/packages/daemon/src/lib/tmux-server-generation-runner.ts

@@ -0,0 +1,81 @@
+import { randomUUID } from "node:crypto";
+import {
+  createPinnedWorkspaceTmuxRunner,
+  createPinnedWorkspaceTmuxAsyncRunner,
+  type WorkspacePaneTmuxAuthority,
+} from "./workspace-pane-creation.ts";
+import { shellEscape } from "./shell.ts";
+
+export interface NativeTmuxServerIdentity {
+  readonly pid: string;
+  readonly startTime: string;
+}
+
+/** Guard each command on the server which actually accepted this connection. */
+export function fenceNativeTmuxCommand(
+  args: readonly string[],
+  expected: NativeTmuxServerIdentity,
+) {
+  const { pid, startTime } = expected;
+  if (!/^[1-9][0-9]*$/u.test(pid) || !/^[1-9][0-9]*$/u.test(startTime))
+    throw new Error("Invalid native tmux server identity");
+  if (args.length === 0 || args.some((arg) => arg.includes("\0")))
+    throw new Error("Invalid tmux command");
+  const globalFlags: string[] = [];
+  let firstCommand = 0;
+  while (args[firstCommand]?.startsWith("-")) {
+    const flag = args[firstCommand]!;
+    if (flag !== "-N" && flag !== "-u")
+      throw new Error("Unsupported tmux global option in generation-fenced command");
+    globalFlags.push(flag);
+    firstCommand += 1;
+  }
+  if (firstCommand === args.length) throw new Error("Missing tmux command");
+  const condition = `#{&&:#{==:#{pid},${pid}},#{==:#{start_time},${startTime}}}`;
+  // Preserve arbitrary literal payloads; a standalone ; is the native argv
+  // command separator already used by the existing runners.
+  const command = args
+    .slice(firstCommand)
+    .map((arg) => (arg === ";" ? ";" : shellEscape(arg)))
+    .join(" ");
+  const refusal = `tmux-server-stale.${randomUUID()}`;
+  return {
+    argv: [...globalFlags, "if-shell", "-F", condition, command, `display-message -p '${refusal}'`],
+    verify(output: string): string {
+      if (output.trimEnd() === refusal)
+        throw new Error("Tmux server generation changed before command execution");
+      return output;
+    },
+  };
+}
+
+/** Socket validation alone leaves a validation-to-connect replacement race. */
+export function createServerGenerationFencedTmuxRunner(
+  authority: WorkspacePaneTmuxAuthority,
+  expected?: NativeTmuxServerIdentity,
+): (args: readonly string[]) => string {
+  const run = createPinnedWorkspaceTmuxRunner(authority, { timeoutMs: 5_000 });
+  const [pid, startTime] = expected
+    ? [expected.pid, expected.startTime]
+    : run(["display-message", "-p", "#{pid}\t#{start_time}"]).split("\t");
+  if (!pid || !startTime) throw new Error("Invalid native tmux server identity");
+  const identity = { pid, startTime };
+  // Validate once before publishing an owner; each command rechecks natively.
+  fenceNativeTmuxCommand(["display-message", "-p", ""], identity);
+  return (args) => {
+    const command = fenceNativeTmuxCommand(args, identity);
+    return command.verify(run(command.argv));
+  };
+}
+
+export function createServerGenerationFencedTmuxAsyncRunner(
+  authority: WorkspacePaneTmuxAuthority,
+  expected: NativeTmuxServerIdentity,
+): (args: readonly string[], signal?: AbortSignal) => Promise<string> {
+  const run = createPinnedWorkspaceTmuxAsyncRunner(authority);
+  fenceNativeTmuxCommand(["display-message", "-p", ""], expected);
+  return async (args, signal) => {
+    const command = fenceNativeTmuxCommand(args, expected);
+    return command.verify(await run(command.argv, signal));
+  };
+}