tmux-ide 2.9.0-beta.21 → 2.9.0-beta.26

package/packages/daemon/src/lib/workspace-multiplexer-verbs.ts

@@ -28,6 +28,8 @@ import {
   type WorkspaceMultiplexerWindowTarget,
   type SessionRuntimePaneReadIntent,
   type Workspace,
+  type WindowLinkTarget,
+  type WindowLinkTopology,
 } from "@tmux-ide/contracts";
 import { TmuxError } from "@tmux-ide/tmux-bridge";
 
@@ -46,6 +48,8 @@ import {
 } from "./tmux-interaction-options.ts";
 import { memorablePaneName } from "../terminal/protocol/pane-display-name.ts";
 
+import { WindowLinkResolutionError } from "../terminal/mirror/window-link-authority.ts";
+
 const CREATION_OPTION = "@tmux_ide_creation_id";
 const SEMANTIC_PANE_OPTION = "@tmux_ide_pane_id";
 const SEMANTIC_WINDOW_OPTION = "@tmux_ide_window_id";
@@ -68,6 +72,10 @@ export type WorkspaceMultiplexerErrorCode =
   | "pane_not_found"
   | "window_not_found"
   | "ambiguous_target"
+  | "window_link_stale"
+  | "window_link_ambiguous"
+  | "window_link_session_mismatch"
+  | "window_link_backing_mismatch"
   /** Refused: killing it would take the whole session with it. */
   | "last_window_refused"
   /** Refused: killing it would take the whole session with it. */
@@ -88,6 +96,10 @@ const ERROR_MESSAGES: Readonly<Record<WorkspaceMultiplexerErrorCode, string>> =
   workspace_unavailable: "The requested workspace is not available for multiplexer verbs.",
   pane_not_found: "No pane in this workspace carries the requested semantic identity.",
   window_not_found: "No window in this workspace carries the requested identity.",
+  window_link_stale: "The window link observation is no longer current.",
+  window_link_ambiguous: "Select an explicit window link for this pane.",
+  window_link_session_mismatch: "The window link belongs to another session generation.",
+  window_link_backing_mismatch: "The window link no longer names the expected window.",
   ambiguous_target: "The requested identity names more than one live tmux object.",
   last_window_refused:
     "This is the session's last window. Close the session instead if that is what you mean.",
@@ -201,7 +213,19 @@ export function parseMultiplexerPaneRows(output: string): readonly MultiplexerPa
       creationId: creationId === "" ? null : creationId,
     });
   }
-  return rows;
+  // list-panes -s repeats each backing for its session links. Identical native
+  // rows are one pane; conflicting observations fail closed.
+  const unique = new Map<string, MultiplexerPaneRow>();
+  for (const row of rows) {
+    const previous = unique.get(row.paneId);
+    if (previous && JSON.stringify(previous) !== JSON.stringify(row)) {
+      throw new WorkspaceMultiplexerError("workspace_unavailable", {
+        reason: "conflicting_linked_pane_observation",
+      });
+    }
+    unique.set(row.paneId, row);
+  }
+  return [...unique.values()];
 }
 
 /** Distinct windows in a pane listing, in first-seen order. */
@@ -288,6 +312,17 @@ const DEFAULT_IO: Omit<WorkspaceMultiplexerIo, "runTmux"> = {
 
 const MAX_CACHED_SESSIONS = 512;
 
+export interface AuthoritativeWindowLinkAction {
+  readonly action: "select" | "unlink";
+  readonly target?: WindowLinkTarget;
+  /** Semantic pane identity, resolved by the retained mirror authority. */
+  readonly paneId?: string;
+}
+export interface AuthoritativeWindowLinkActionResult {
+  readonly outcome: "applied" | "stale" | "native-refused" | "indeterminate";
+  readonly windowLinks: WindowLinkTopology | null;
+}
+
 export class WorkspaceMultiplexerAuthority {
   readonly #daemonInstanceId: string;
   readonly #registry: WorkspaceRegistry;
@@ -329,6 +364,82 @@ export class WorkspaceMultiplexerAuthority {
     return this.#mutate(raw, timing);
   }
 
+  /** Runs only inside the existing semantic mutation lane; never rediscovers a stale link. */
+  async mutateWindowLink(
+    raw: WorkspaceMultiplexerMutationRequest,
+    execute: (
+      session: string,
+      action: AuthoritativeWindowLinkAction,
+    ) => Promise<AuthoritativeWindowLinkActionResult>,
+  ): Promise<WorkspaceMultiplexerMutationResult> {
+    if (this.#disposed) throw new WorkspaceMultiplexerError("workspace_unavailable");
+    const request = WorkspaceMultiplexerMutationRequestSchemaZ.parse(raw);
+    if (request.expectedDaemonInstanceId !== this.#daemonInstanceId)
+      throw new WorkspaceMultiplexerError("daemon_instance_mismatch");
+    const intent = request.intent;
+    if (
+      intent.verb !== "workspace.window.link.select" &&
+      intent.verb !== "workspace.window.link.unlink" &&
+      intent.verb !== "workspace.pane.select"
+    )
+      throw new TypeError("Expected a window-link selection or unlink intent");
+    const workspace = this.#registry.get(intent.workspaceName);
+    if (!workspace) throw new WorkspaceMultiplexerError("workspace_not_found");
+    const envelope = {
+      operationId: request.operationId,
+      daemonInstanceId: this.#daemonInstanceId,
+      workspaceName: intent.workspaceName,
+    };
+    try {
+      const result = await execute(
+        workspace.sessionName,
+        intent.verb === "workspace.pane.select"
+          ? {
+              action: "select",
+              ...(intent.windowLink ? { target: intent.windowLink } : {}),
+              paneId: intent.semanticPaneId,
+            }
+          : {
+              action: intent.verb === "workspace.window.link.unlink" ? "unlink" : "select",
+              target: intent.target,
+            },
+      );
+      if (result.outcome !== "applied") {
+        throw new WorkspaceMultiplexerError(
+          result.outcome === "stale"
+            ? "window_link_stale"
+            : result.outcome === "native-refused"
+              ? "mutation_failed"
+              : "mutation_unverified",
+          { reason: result.outcome },
+        );
+      }
+      return WorkspaceMultiplexerMutationResultSchemaZ.parse(
+        intent.verb === "workspace.pane.select"
+          ? {
+              ...envelope,
+              verb: intent.verb,
+              outcome: "applied",
+              semanticPaneId: intent.semanticPaneId,
+            }
+          : { ...envelope, verb: intent.verb, outcome: "applied", target: intent.target },
+      );
+    } catch (error) {
+      if (error instanceof WorkspaceMultiplexerError) throw error;
+      if (error instanceof WindowLinkResolutionError)
+        throw new WorkspaceMultiplexerError(
+          error.reason,
+          { operationId: request.operationId },
+          error,
+        );
+      throw new WorkspaceMultiplexerError(
+        "mutation_unverified",
+        { operationId: request.operationId },
+        error,
+      );
+    }
+  }
+
   /**
    * Capture a semantically addressed pane for an authored read. The tmux
    * after-capture hook is the completion authority; this method only performs
@@ -608,6 +719,11 @@ export class WorkspaceMultiplexerAuthority {
     } as const;
 
     switch (intent.verb) {
+      case "workspace.window.link.select":
+      case "workspace.window.link.unlink":
+        throw new WorkspaceMultiplexerError("workspace_unavailable", {
+          reason: "window_link_authority_required",
+        });
       case "workspace.window.split":
         return this.#split(request, workspace, envelope);
       case "workspace.window.kill":
@@ -1039,6 +1155,10 @@ export class WorkspaceMultiplexerAuthority {
     envelope: { operationId: string; daemonInstanceId: string; workspaceName: string },
     timing?: WorkspaceMultiplexerOperationTiming,
   ): WorkspaceMultiplexerMutationResult {
+    if (intent.windowLink)
+      throw new WorkspaceMultiplexerError("workspace_unavailable", {
+        reason: "window_link_authority_required",
+      });
     const timed = <T>(operation: string, run: () => T): T => {
       if (!timing) return run();
       let startedAtMicros: number;

package/packages/daemon/src/lib/workspace-pane-creation.ts

@@ -1,6 +1,6 @@
 import { boundedTmuxRead } from "./bounded-tmux-read.ts";
 import { accessSync, constants, realpathSync, statSync } from "node:fs";
-import { delimiter, isAbsolute, join, relative, sep } from "node:path";
+import { isAbsolute, relative, sep } from "node:path";
 
 import {
   WorkspacePaneCreateMutationRequestSchemaZ,
@@ -13,7 +13,10 @@ import {
 } from "@tmux-ide/contracts";
 import { runTmuxBinary, TmuxError } from "@tmux-ide/tmux-bridge";
 import { createNamedSocketFence } from "./tmux-named-socket-fence.ts";
-import { resolveBundledTmux } from "./bundled-tmux.ts";
+import {
+  resolveTmuxExecutable as resolvePinnedTmuxExecutable,
+  tmuxClientEnvironment,
+} from "./tmux-client-execution.ts";
 
 import { probeProjectReadiness } from "./project-readiness-probe.ts";
 import { agentHintForCommand } from "./agent-kind.ts";
@@ -26,7 +29,7 @@ import { getDefaultWorkspaceRegistry, type WorkspaceRegistry } from "./workspace
 import { memorablePaneName } from "../terminal/protocol/pane-display-name.ts";
 import { shellEscape } from "./shell.ts";
 import { MissionRepository } from "./mission-repository.ts";
-import { resolveRuntimeNamespace } from "./runtime-namespace.ts";
+import { resolveRuntimeNamespace, resolveTmuxServerIntent } from "./runtime-namespace.ts";
 import { prepareTmuxTruecolorEnvironment } from "./tmux-terminal-color.ts";
 import {
   captureUnixSocketIdentity,
@@ -220,57 +223,15 @@ function assertEffectiveConfigProvenance(
 }
 
 function resolveTmuxExecutable(): string {
-  if (resolveRuntimeNamespace().development) return resolveBundledTmux()!;
-  const configured = process.env.TMUX_IDE_TMUX_BIN;
-  if (!configured) {
-    const bundled = resolveBundledTmux();
-    if (bundled) return bundled;
-  }
-  const candidates = configured
-    ? [configured]
-    : (process.env.PATH ?? "")
-        .split(delimiter)
-        // Empty and relative PATH entries mean the daemon/project cwd. They
-        // are never executable authority for a privileged tmux mutation.
-        .filter((entry) => entry.length > 0 && isAbsolute(entry))
-        .map((entry) => join(entry, "tmux"));
-  for (const candidate of candidates) {
-    try {
-      if (!isAbsolute(candidate)) continue;
-      accessSync(candidate, constants.X_OK);
-      const canonical = realpathSync(candidate);
-      if (statSync(canonical).isFile()) return canonical;
-    } catch {
-      // Continue to the next daemon-start candidate.
-    }
-  }
-  throw new WorkspacePaneCreationError("workspace_unavailable", {
-    reason: "tmux_executable_unavailable",
-  });
-}
-
-const SAFE_TERMINAL_VALUE = /^(?:xterm|screen|tmux|rxvt|vt100|ansi)[A-Za-z0-9+._-]{0,58}$/u;
-const SAFE_LOCALE_VALUE = /^[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}$/u;
-
-/**
- * The pinned tmux client receives only presentation metadata. Everything else
- * is denied by omission: PATH/HOME/SHELL, TMUX/TMUX_PANE/TMUX_TMPDIR, shell
- * startup hooks, dynamic-loader variables, Node options, and project secrets
- * cannot redirect authority or inject code into this daemon-owned execution.
- */
-function tmuxClientEnvironment(source: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-  const environment: NodeJS.ProcessEnv = {
-    TERM: SAFE_TERMINAL_VALUE.test(source.TERM ?? "") ? source.TERM : "xterm-256color",
-    // A pinned runner may be the first tmux client and therefore create the
-    // server. Never let a headless parent (`TERM=dumb`, `NO_COLOR=1`) become
-    // the global environment inherited by every later interactive child.
-    COLORTERM: "truecolor",
-  };
-  for (const name of ["LANG", "LC_ALL", "LC_CTYPE"] as const) {
-    const value = source[name];
-    if (value && SAFE_LOCALE_VALUE.test(value)) environment[name] = value;
+  // Preserve development artifact qualification errors instead of masking them.
+  if (resolveRuntimeNamespace().development) return resolvePinnedTmuxExecutable();
+  try {
+    return resolvePinnedTmuxExecutable();
+  } catch {
+    throw new WorkspacePaneCreationError("workspace_unavailable", {
+      reason: "tmux_executable_unavailable",
+    });
   }
-  return environment;
 }
 
 function tmuxSocketFromEnvironment(): string | null {
@@ -281,7 +242,7 @@ function tmuxSocketFromEnvironment(): string | null {
 export function resolveWorkspacePaneTmuxAuthority(): WorkspacePaneTmuxAuthority {
   const namespace = resolveRuntimeNamespace();
   const executablePath = resolveTmuxExecutable();
-  if (namespace.development)
+  if (resolveTmuxServerIntent()?.source === "explicit")
     return Object.freeze({ executablePath, socketSelector: namespace.tmuxSocket });
   const environmentSocket = tmuxSocketFromEnvironment();
   if (environmentSocket) {
@@ -305,7 +266,7 @@ export function resolveWorkspacePaneTmuxAuthority(): WorkspacePaneTmuxAuthority
   // A sessionless daemon may start before the default tmux server exists. Pin
   // the daemon's default socket *name* and captured environment rather than
   // consulting a later request's TMUX/PATH.
-  return Object.freeze({ executablePath, socketSelector: resolveRuntimeNamespace().tmuxSocket });
+  return Object.freeze({ executablePath, socketSelector: namespace.tmuxSocket });
 }
 
 /** Execute mutations only through the daemon-generation-pinned tmux authority. */

package/packages/daemon/src/lib/workspace-promotion.ts

@@ -122,6 +122,7 @@ const PANE_VERIFY_FORMAT = [
   "#{pane_id}",
   `#{${SEMANTIC_PANE_OPTION}}`,
   `#{${SEMANTIC_WINDOW_OPTION}}`,
+  "#{window_index}",
   SENTINEL,
 ].join(FIELD);
 
@@ -209,6 +210,7 @@ interface ScanPane {
 }
 
 interface VerifyPane {
+  readonly windowIndex: number;
   readonly sessionId: string;
   readonly windowId: string;
   readonly windowName: string;
@@ -384,8 +386,10 @@ function parseVerifyPanes(output: string): VerifyPane[] {
     const windowPaneCount = positiveInteger(fields[3] ?? "");
     const sessionWindowCount = positiveInteger(fields[4] ?? "");
     if (
-      fields.length !== 9 ||
-      fields[8] !== SENTINEL ||
+      fields.length !== 10 ||
+      fields[9] !== SENTINEL ||
+      !/^(0|[1-9][0-9]*)$/u.test(fields[8]!) ||
+      !Number.isSafeInteger(Number(fields[8])) ||
       !/^\$[0-9]+$/u.test(fields[0]!) ||
       !/^@[0-9]+$/u.test(fields[1]!) ||
       !/^%[0-9]+$/u.test(fields[5]!) ||
@@ -405,6 +409,7 @@ function parseVerifyPanes(output: string): VerifyPane[] {
       paneId: fields[5]!,
       semanticPaneId: fields[6]!,
       semanticWindowId: fields[7]!,
+      windowIndex: Number(fields[8]),
     });
   }
   return panes;
@@ -565,9 +570,7 @@ export class WorkspacePromotionAuthority {
       // promotion is the app's only repair verb — so reconcile the stamps here
       // before resolving to a `replayed` outcome. Stamping is additive and never
       // overwrites a valid stamp, so a healthy session is untouched.
-      const alreadyRegistered = this.#registry
-        .list()
-        .find((workspace) => workspace.sessionName === session.sessionName);
+      const alreadyRegistered = this.#registeredSession(session.sessionName);
       if (alreadyRegistered) {
         const registeredIdentity: PromotionIdentity = {
           workspaceName: alreadyRegistered.name,
@@ -590,6 +593,42 @@ export class WorkspacePromotionAuthority {
       await this.#verifyPromotedInventory(session.sessionId, identity);
       await this.#publishFleetEnrollment(request, session, identity);
 
+      // Catalog discovery can admit this session while the native stamping
+      // and verification awaits run. Reuse that exact registry identity instead
+      // of publishing a second name for the same session at the commit point.
+      const discovered = this.#registeredSession(session.sessionName);
+      if (discovered) {
+        if (discovered.name !== identity.workspaceName) {
+          try {
+            await this.#io.runTmux([
+              "set-option",
+              "-t",
+              session.sessionId,
+              SESSION_WORKSPACE_OPTION,
+              discovered.name,
+            ]);
+          } catch (error) {
+            throw new WorkspacePromotionError(
+              "stamp_failed",
+              {
+                operationId: request.operationId,
+                workspaceName: discovered.name,
+              },
+              error,
+            );
+          }
+        }
+        this.#assertActive(request.operationId);
+        if (this.#registeredSession(session.sessionName)?.name !== discovered.name) {
+          throw new WorkspacePromotionError("workspace_conflict", {
+            operationId: request.operationId,
+            workspaceName: discovered.name,
+          });
+        }
+        return this.#succeed(request, fingerprint, discovered.name, session.sessionName, {
+          replayed: true,
+        });
+      }
       let registered: Workspace;
       try {
         registered = this.#registry.add({
@@ -651,6 +690,16 @@ export class WorkspacePromotionAuthority {
     }
   }
 
+  #registeredSession(sessionName: string): Workspace | undefined {
+    const candidates = this.#registry
+      .list()
+      .filter((workspace) => workspace.sessionName === sessionName);
+    if (candidates.length > 1) {
+      throw new WorkspacePromotionError("workspace_conflict", { sessionName });
+    }
+    return candidates[0];
+  }
+
   #assertConflictFreeIdentity(identity: PromotionIdentity): void {
     for (const workspace of this.#registry.list()) {
       if (
@@ -757,6 +806,19 @@ export class WorkspacePromotionAuthority {
       });
     }
 
+    // list-panes -s repeats each backing pane once per window link. Stamp the
+    // backing only once, and reject contradictory observations before writes.
+    const uniqueScan = new Map<string, ScanPane>();
+    for (const pane of scanned) {
+      const previous = uniqueScan.get(pane.paneId);
+      if (previous && JSON.stringify(previous) !== JSON.stringify(pane)) {
+        throw new WorkspacePromotionError("promotion_verification_failed", {
+          reason: "inconsistent_tmux_topology",
+        });
+      }
+      uniqueScan.set(pane.paneId, pane);
+    }
+    scanned = [...uniqueScan.values()];
     const nowSec = Math.floor(this.#io.now() / 1000);
     const reconciledWindows = new Set<string>();
     try {
@@ -928,8 +990,32 @@ export class WorkspacePromotionAuthority {
       });
     }
 
+    // Validate links independently from their shared backing. Repeated native
+    // panes are legal only across distinct links with identical backing facts.
+    const links = new Map<number, VerifyPane[]>();
+    const backingPanes = new Map<string, Omit<VerifyPane, "windowIndex">>();
+    const semanticWindows = new Map<string, string>();
+    for (const pane of panes) {
+      const { windowIndex, ...backing } = pane;
+      const previous = backingPanes.get(pane.paneId);
+      const semanticOwner = semanticWindows.get(pane.semanticWindowId);
+      const rows = links.get(windowIndex) ?? [];
+      if (
+        (previous && JSON.stringify(previous) !== JSON.stringify(backing)) ||
+        (semanticOwner && semanticOwner !== pane.windowId) ||
+        rows.some((row) => row.paneId === pane.paneId || row.windowId !== pane.windowId)
+      ) {
+        throw new WorkspacePromotionError("promotion_verification_failed", {
+          reason: "inconsistent_tmux_topology",
+        });
+      }
+      backingPanes.set(pane.paneId, backing);
+      semanticWindows.set(pane.semanticWindowId, pane.windowId);
+      rows.push(pane);
+      links.set(windowIndex, rows);
+    }
     const catalog = analyzeTrustedSemanticPaneCatalog(
-      panes.map((pane) => ({
+      [...backingPanes.values()].map((pane) => ({
         workspaceName: identity.workspaceName,
         semanticPaneId: pane.semanticPaneId === "" ? null : pane.semanticPaneId,
         sessionId: pane.sessionId,
@@ -950,17 +1036,17 @@ export class WorkspacePromotionAuthority {
       });
     }
 
-    const windows = new Map<string, VerifyPane[]>();
-    for (const pane of panes) {
-      const rows = windows.get(pane.windowId) ?? [];
+    const backings = new Map<string, Omit<VerifyPane, "windowIndex">[]>();
+    for (const pane of backingPanes.values()) {
+      const rows = backings.get(pane.windowId) ?? [];
       rows.push(pane);
-      windows.set(pane.windowId, rows);
+      backings.set(pane.windowId, rows);
     }
     const sessionWindowCount = panes[0]!.sessionWindowCount;
     if (
-      windows.size !== sessionWindowCount ||
+      links.size !== sessionWindowCount ||
       panes.some((pane) => pane.sessionWindowCount !== sessionWindowCount) ||
-      [...windows.values()].some(
+      [...links.values(), ...backings.values()].some(
         (rows) =>
           rows.length !== rows[0]!.windowPaneCount ||
           rows.some(

package/packages/daemon/src/lib/workspace-registry.ts

@@ -173,6 +173,11 @@ export class WorkspaceRegistry {
     return this.workspaces.some((w) => w.name === name);
   }
 
+  /** Whether this entry is discovered live state, never durable user intent. */
+  isVolatile(name: string): boolean {
+    return this.volatileNames.has(name);
+  }
+
   add(input: AddWorkspaceInput): Workspace {
     if (this.has(input.name)) {
       throw new WorkspaceAlreadyExistsError(input.name);

package/packages/daemon/src/server/pane-stream-upgrade.ts

@@ -33,9 +33,11 @@ function rejectUpgrade(socket: Socket, status: number): void {
       ? "Forbidden"
       : status === 404
         ? "Not Found"
-        : status === 426
-          ? "Upgrade Required"
-          : "Service Unavailable";
+        : status === 410
+          ? "Gone"
+          : status === 426
+            ? "Upgrade Required"
+            : "Service Unavailable";
   try {
     socket.end(`HTTP/1.1 ${status} ${phrase}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
   } catch {
@@ -56,6 +58,8 @@ export interface PaneStreamWebSocketBoundary {
 export function attachPaneStreamWebSocket(
   server: Server,
   coordinator: PaneStreamAdmissionCoordinator,
+  redemptionPath: string = PANE_STREAM_REDEEM_PATH,
+  isCurrent: () => boolean = () => true,
 ): PaneStreamWebSocketBoundary {
   const wss = new WebSocketServer({
     noServer: true,
@@ -77,8 +81,20 @@ export function attachPaneStreamWebSocket(
   ): void => {
     const rawPath = request.url ?? "";
     const pathname = rawPath.split("?", 1)[0] ?? "";
-    if (!pathname.startsWith("/v1/terminal/pane-streams/")) return;
-    if (pathname !== PANE_STREAM_REDEEM_PATH) {
+    if (
+      redemptionPath === PANE_STREAM_REDEEM_PATH &&
+      pathname.startsWith("/v1/terminal/pane-streams/")
+    ) {
+      rejectUpgrade(socket, 426);
+      return;
+    }
+    if (redemptionPath !== PANE_STREAM_REDEEM_PATH && pathname !== redemptionPath) return;
+    if (
+      redemptionPath === PANE_STREAM_REDEEM_PATH &&
+      !pathname.startsWith("/v2/terminal/pane-streams/")
+    )
+      return;
+    if (pathname !== redemptionPath) {
       rejectUpgrade(socket, 404);
       return;
     }
@@ -102,6 +118,10 @@ export function attachPaneStreamWebSocket(
       rejectUpgrade(socket, 403);
       return;
     }
+    if (!isCurrent()) {
+      rejectUpgrade(socket, 410);
+      return;
+    }
     const decision = coordinator.reserveUpgrade({
       path: rawPath,
       protocols: protocols(protocolHeaders[0]),