tmux-ide 2.9.0-beta.21 → 2.9.0-beta.26

package/packages/daemon/src/terminal/attachments/native-runtime.ts

@@ -1,3 +1,7 @@
+import {
+  fenceNativeTmuxCommand,
+  type NativeTmuxServerIdentity,
+} from "../../lib/tmux-server-generation-runner.ts";
 import { accessSync, constants, realpathSync, statSync } from "node:fs";
 import { execFile } from "node:child_process";
 import type { createNamedSocketFence } from "../../lib/tmux-named-socket-fence.ts";
@@ -119,6 +123,7 @@ export function getNativeTerminalAttachmentRuntimeConstructionCount(): number {
 }
 
 export interface NativeTerminalAttachmentTmuxAuthority {
+  readonly nativeServerIdentity?: NativeTmuxServerIdentity;
   /** Shared with the canonical daemon's named command runners. */
   readonly namedSocketFence?: ReturnType<typeof createNamedSocketFence>;
   readonly executablePath: string;
@@ -163,6 +168,7 @@ export interface NativeTerminalInventoryReadRunner {
 }
 
 interface CanonicalTmuxAuthority {
+  readonly nativeServerIdentity?: NativeTmuxServerIdentity;
   readonly namedSocketFence: ReturnType<typeof createNamedSocketFence> | null;
   readonly executablePath: string;
   readonly socketSelector: DaemonTmuxSocketSelector;
@@ -208,6 +214,7 @@ function canonicalAuthority(input: NativeTerminalAttachmentTmuxAuthority): Canon
       socketArgv = ["-L", input.socketSelector.name];
     }
     return Object.freeze({
+      nativeServerIdentity: input.nativeServerIdentity,
       namedSocketFence: socketSelector.kind === "name" ? (input.namedSocketFence ?? null) : null,
       executablePath,
       socketSelector: Object.freeze(socketSelector),
@@ -288,9 +295,12 @@ function pinnedRunner(
     run(command: TmuxArgvPlan): TmuxAttachmentCommandResult {
       if (command.executable !== "tmux") return { status: "failed" };
       try {
+        const guarded = authority.nativeServerIdentity
+          ? fenceNativeTmuxCommand(command.argv, authority.nativeServerIdentity)
+          : null;
         const stdout = execute(
           authority.executablePath,
-          [...currentSocketArgv(authority), ...command.argv],
+          [...currentSocketArgv(authority), ...(guarded?.argv ?? command.argv)],
           {
             cwd: authority.trustedCwd,
             env: authority.environment,
@@ -298,7 +308,7 @@ function pinnedRunner(
             timeoutMs: TERMINAL_ATTACHMENT_TMUX_COMMAND_TIMEOUT_MS,
           },
         );
-        const value = String(stdout);
+        const value = guarded ? guarded.verify(String(stdout)) : String(stdout);
         if (authority.namedSocketFence && !authority.namedSocketFence.isPinned())
           authority.namedSocketFence.resolve();
         if (value.includes("\0") || Buffer.byteLength(value, "utf8") > MAX_TMUX_OUTPUT_BYTES) {
@@ -368,13 +378,16 @@ function pinnedReadRunner(
     async run(command: TmuxArgvPlan, signal?: AbortSignal): Promise<TmuxAttachmentCommandResult> {
       if (command.executable !== "tmux" || signal?.aborted) return { status: "failed" };
       try {
+        const guarded = authority.nativeServerIdentity
+          ? fenceNativeTmuxCommand(command.argv, authority.nativeServerIdentity)
+          : null;
         const stdout = await execute(
           authority.executablePath,
           [
             ...(authority.namedSocketFence
               ? await authority.namedSocketFence.resolveAsync(signal)
               : currentSocketArgv(authority)),
-            ...command.argv,
+            ...(guarded?.argv ?? command.argv),
           ],
           {
             cwd: authority.trustedCwd,
@@ -384,7 +397,7 @@ function pinnedReadRunner(
             ...(signal ? { signal } : {}),
           },
         );
-        const value = String(stdout);
+        const value = guarded ? guarded.verify(String(stdout)) : String(stdout);
         if (authority.namedSocketFence && !authority.namedSocketFence.isPinned())
           await authority.namedSocketFence.resolveAsync(signal);
         if (value.includes("\0") || Buffer.byteLength(value, "utf8") > MAX_TMUX_OUTPUT_BYTES)
@@ -690,6 +703,7 @@ const PANE_FORMAT = [
   // window reports the same value; the catalog requires it before a multi-pane
   // window is attachable.
   "#{@tmux_ide_window_id}",
+  "#{window_index}",
   PANE_WIRE_SENTINEL,
 ].join(WIRE_SEPARATOR);
 
@@ -742,12 +756,13 @@ type LivePaneFacts = Omit<NativeTerminalInventoryPaneSnapshot, "workspaceName">;
 function parsePaneSnapshot(
   stdout: string,
   expected: LiveSessionIdentity,
-): readonly LivePaneFacts[] {
+): { panes: readonly LivePaneFacts[]; linksProof: string } {
   const panes: LivePaneFacts[] = [];
-  const runtimeIds = new Set<string>();
+  const runtimeIds = new Map<string, { facts: LivePaneFacts; proof: string }>();
+  const links = new Map<number, { windowId: string; active: boolean; panes: Set<string> }>();
   for (const line of strictLines(stdout, MAX_DISCOVERED_PANES)) {
     const fields = line.split(WIRE_SEPARATOR);
-    if (fields.length !== 19 || fields[18] !== PANE_WIRE_SENTINEL) {
+    if (fields.length !== 20 || fields[19] !== PANE_WIRE_SENTINEL) {
       throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
     }
     const [
@@ -769,6 +784,7 @@ function parsePaneSnapshot(
       missionStamp,
       dir,
       windowStampValue,
+      windowIndexValue,
     ] = fields as [
       string,
       string,
@@ -789,22 +805,21 @@ function parsePaneSnapshot(
       string,
       string,
       string,
+      string,
     ];
     if (
       sessionName !== expected.name ||
       sessionId !== expected.id ||
       !RUNTIME_WINDOW_ID.test(windowId) ||
       !RUNTIME_PANE_ID.test(runtimePaneId) ||
-      runtimeIds.has(runtimePaneId) ||
       !["0", "1"].includes(windowActive) ||
       !["0", "1"].includes(paneActive)
     ) {
       throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
     }
-    runtimeIds.add(runtimePaneId);
     const nullable = (value: string): string | null =>
       boundedWireValue(value, 256).length === 0 ? null : value;
-    panes.push({
+    const facts: LivePaneFacts = {
       sessionName,
       sessionId,
       windowId,
@@ -826,22 +841,58 @@ function parsePaneSnapshot(
       // registered workspace remains the trusted application-shell root, so
       // keep discovery available and carry the empty presentation value.
       dir: boundedWireValue(dir, 4_096),
-    });
+    };
+    const windowIndex = nonnegativeInteger(windowIndexValue);
+    const link = links.get(windowIndex) ?? {
+      windowId,
+      active: windowActive === "1",
+      panes: new Set<string>(),
+    };
+    if (
+      link.windowId !== windowId ||
+      link.active !== (windowActive === "1") ||
+      link.panes.has(runtimePaneId)
+    ) {
+      throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
+    }
+    link.panes.add(runtimePaneId);
+    links.set(windowIndex, link);
+    // Only link index and current-link state may differ for a shared backing.
+    const proof = JSON.stringify(fields.filter((_value, index) => index !== 10 && index !== 18));
+    const previous = runtimeIds.get(runtimePaneId);
+    if (previous) {
+      if (previous.proof !== proof)
+        throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
+      if (facts.active && !previous.facts.active) {
+        const merged = { ...previous.facts, active: true };
+        panes[panes.indexOf(previous.facts)] = merged;
+        previous.facts = merged;
+      }
+    } else {
+      runtimeIds.set(runtimePaneId, { facts, proof });
+      panes.push(facts);
+    }
   }
   const counts = new Map<string, number>();
   for (const pane of panes) counts.set(pane.windowId, (counts.get(pane.windowId) ?? 0) + 1);
-  const windows = new Set(panes.map((pane) => pane.windowId));
   if (
     panes.some(
       (pane) =>
         counts.get(pane.windowId) !== pane.windowPaneCount ||
-        windows.size !== pane.sessionWindowCount,
+        links.size !== pane.sessionWindowCount,
     ) ||
+    [...links.values()].some((link) => link.panes.size !== counts.get(link.windowId)) ||
+    [...links.values()].filter((link) => link.active).length > 1 ||
     panes.filter((pane) => pane.active).length > 1
   ) {
     throw new NativeTerminalAttachmentRuntimeError("invalid-tmux-output");
   }
-  return panes;
+  return {
+    panes,
+    linksProof: JSON.stringify(
+      [...links].map(([index, link]) => [index, link.windowId, [...link.panes]]),
+    ),
+  };
 }
 
 /**
@@ -872,10 +923,12 @@ export async function discoverWorkspaceRegistryTerminalInventory(
     const argv = ["list-panes", "-s", "-t", identity.id, "-F", PANE_FORMAT] as const;
     const before = await requiredTmuxResult(runner, argv, signal);
     if (before === null) continue;
-    const panes = parsePaneSnapshot(before, identity);
+    const first = parsePaneSnapshot(before, identity);
+    const panes = first.panes;
     const after = await requiredTmuxResult(runner, argv, signal);
     if (after === null) throw new NativeTerminalAttachmentRuntimeError("discovery-failed");
-    const latest = parsePaneSnapshot(after, identity);
+    const second = parsePaneSnapshot(after, identity);
+    const latest = second.panes;
     // Foreground commands, titles, focus and paths can change while the same
     // pane remains valid. Fence binding/topology only, then publish one complete
     // latest snapshot rather than mixing presentation values across reads.
@@ -891,6 +944,7 @@ export async function discoverWorkspaceRegistryTerminalInventory(
       "index",
     ] as const;
     if (
+      first.linksProof !== second.linksProof ||
       panes.length !== latest.length ||
       panes.some((pane, index) => proofKeys.some((key) => pane[key] !== latest[index]![key]))
     ) {

package/packages/daemon/src/terminal/mirror/control-channel.ts

@@ -20,6 +20,8 @@
  * chance to detach us — killing the reader first can wedge the server.
  */
 import { spawn, type ChildProcess } from "node:child_process";
+import { shellEscape } from "../../lib/shell.ts";
+import type { NativeTmuxServerIdentity } from "../../lib/tmux-server-generation-runner.ts";
 import { parseControlLine } from "../protocol/control.ts";
 
 export interface ControlReply {
@@ -752,6 +754,7 @@ export class ControlChannelCore {
 export interface MirrorControlChannelOptions {
   /** Resolve through the owning daemon's generation fence before each spawn. */
   resolveSocketPath?: () => string;
+  nativeServerIdentity?: NativeTmuxServerIdentity;
   session: string;
   handlers: MirrorChannelHandlers;
   /** `tmux -L <name>` — isolated servers in tests; omit for the default. */
@@ -772,10 +775,23 @@ export interface MirrorControlChannelOptions {
 export function mirrorControlAttachArgs(
   options: Pick<
     MirrorControlChannelOptions,
-    "session" | "socketName" | "socketPath" | "configFile"
+    "session" | "socketName" | "socketPath" | "configFile" | "nativeServerIdentity"
   >,
   pauseAfterSeconds = DEFAULT_PAUSE_AFTER_SECONDS,
 ): string[] {
+  const attach = [
+    "attach",
+    "-t",
+    options.session,
+    "-f",
+    `ignore-size,pause-after=${pauseAfterSeconds},active-pane`,
+  ];
+  const expected = options.nativeServerIdentity;
+  if (
+    expected &&
+    (!/^[1-9][0-9]*$/u.test(expected.pid) || !/^[1-9][0-9]*$/u.test(expected.startTime))
+  )
+    throw new Error("Invalid expected native server identity");
   return [
     ...(options.socketPath
       ? ["-S", options.socketPath]
@@ -784,11 +800,15 @@ export function mirrorControlAttachArgs(
         : []),
     ...(options.configFile ? ["-f", options.configFile] : []),
     "-C",
-    "attach",
-    "-t",
-    options.session,
-    "-f",
-    `ignore-size,pause-after=${pauseAfterSeconds},active-pane`,
+    ...(expected
+      ? [
+          "if-shell",
+          "-F",
+          `#{&&:#{==:#{pid},${expected.pid}},#{==:#{start_time},${expected.startTime}}}`,
+          attach.map(shellEscape).join(" "),
+          "display-message -p 'tmux-server-generation-refused'",
+        ]
+      : attach),
   ];
 }
 
@@ -801,6 +821,8 @@ export class MirrorControlChannel implements MirrorChannelIo {
   private readonly core: ControlChannelCore;
   private readonly opts: MirrorControlChannelOptions;
   private exited = false;
+  private verifiedAttach = false;
+  private guardedStart: { resolve: () => void; reject: (error: Error) => void } | null = null;
   private atomicCollectorTimer: ReturnType<typeof setTimeout> | null = null;
 
   constructor(opts: MirrorControlChannelOptions) {
@@ -808,6 +830,16 @@ export class MirrorControlChannel implements MirrorChannelIo {
     this.core = new ControlChannelCore(
       {
         ...opts.handlers,
+        onOutput: (...args) => {
+          if (!opts.nativeServerIdentity || this.verifiedAttach) opts.handlers.onOutput(...args);
+        },
+        onNotify: (name, rest) => {
+          if (opts.nativeServerIdentity && name === "session-changed") {
+            this.verifiedAttach = true;
+            this.guardedStart?.resolve();
+          }
+          if (!opts.nativeServerIdentity || this.verifiedAttach) opts.handlers.onNotify(name, rest);
+        },
         onExit: (reason) => this.noteExit(reason),
       },
       opts.nowMicros,
@@ -851,7 +883,31 @@ export class MirrorControlChannel implements MirrorChannelIo {
     // tmux opens with an unsolicited %begin/%end greeting block; a queued
     // resolver makes start() settle when the protocol is actually live.
     return new Promise((resolve, reject) => {
-      this.core.push({ kind: "promise", resolve: () => resolve(), reject, lines: [] });
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const settle = (error?: Error) => {
+        if (timer) clearTimeout(timer);
+        this.guardedStart = null;
+        if (error) reject(error);
+        else resolve();
+      };
+      if (this.opts.nativeServerIdentity) {
+        this.guardedStart = { resolve: () => settle(), reject: (error) => settle(error) };
+        timer = setTimeout(() => {
+          settle(new Error("Tmux generation-guarded attach timed out"));
+          void this.dispose();
+        }, 5_000);
+        timer.unref?.();
+      }
+      // The outer if-shell greeting precedes its attach branch. Only native
+      // session-changed proves that the guarded attach actually succeeded.
+      this.core.push({
+        kind: "promise",
+        resolve: () => {
+          if (!this.opts.nativeServerIdentity) settle();
+        },
+        reject: (error) => settle(error),
+        lines: [],
+      });
       proc.on("error", (err) => {
         this.core.fail(String(err));
         reject(err);
@@ -1010,6 +1066,7 @@ export class MirrorControlChannel implements MirrorChannelIo {
   private noteExit(reason: string | null): void {
     if (this.exited) return;
     this.exited = true;
+    this.guardedStart?.reject(new Error(reason ?? "Control channel exited before guarded attach"));
     this.opts.handlers.onExit(reason);
   }
 }

package/packages/daemon/src/terminal/mirror/events.ts

@@ -1,3 +1,4 @@
+import type { WindowLinkTopology } from "@tmux-ide/contracts";
 import type { NativeGridCapture } from "./native-grid-capture.ts";
 /**
  * Public event contract of the daemon MirrorService (m43 card 1).
@@ -131,6 +132,7 @@ export interface MirrorLayoutAuthoritySnapshot {
   readonly session: string;
   readonly runtimeSessionId: string;
   readonly topologyEpoch: number;
+  readonly windowLinks: WindowLinkTopology;
   readonly layouts: readonly MirrorLayoutEvent[];
 }
 

package/packages/daemon/src/terminal/mirror/mirror-service.ts

@@ -1,3 +1,12 @@
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { resolveTmuxExecutable, tmuxClientEnvironment } from "../../lib/tmux-client-execution.ts";
+import {
+  captureUnixSocketIdentity,
+  revalidateUnixSocketIdentity,
+} from "../../lib/unix-socket-authority.ts";
+import { execFile } from "node:child_process";
+import type { WindowLinkTarget } from "@tmux-ide/contracts";
 /**
  * MirrorService — the daemon-side shared mirror layer (m43 card 1).
  *
@@ -37,6 +46,7 @@ import {
 } from "./control-mode-ownership.ts";
 
 export interface MirrorServiceOptions {
+  nativeServerIdentity?: import("../../lib/tmux-server-generation-runner.ts").NativeTmuxServerIdentity;
   resolveSocketPath?: () => string;
   /** `tmux -L <name>` for every channel — isolated servers in tests. */
   socketName?: string;
@@ -284,6 +294,15 @@ export class MirrorService {
     };
   }
 
+  async executeWindowLinkAction(
+    session: string,
+    request: { action: "select" | "unlink"; target?: WindowLinkTarget; paneId?: string },
+  ) {
+    const entry = this.channels.get(session);
+    if (!entry || entry.retired) throw new Error(`Mirror session ${session} is unavailable`);
+    return entry.channel.executeWindowLinkAction(request);
+  }
+
   /** Synchronous hot input on an already-retained SessionRuntime channel. */
   sendText(
     session: string,
@@ -413,6 +432,21 @@ export class MirrorService {
       );
       let channel: SessionChannel;
       try {
+        const initialSocket = this.opts.resolveSocketPath
+          ? this.opts.resolveSocketPath()
+          : this.opts.socketPath;
+        const mutationSocketIdentity = initialSocket
+          ? captureUnixSocketIdentity(initialSocket)
+          : null;
+        const executable = mutationSocketIdentity
+          ? realpathSync(this.opts.executable ?? resolveTmuxExecutable())
+          : null;
+        if (executable) {
+          accessSync(executable, constants.X_OK);
+          if (!isAbsolute(executable) || !statSync(executable).isFile())
+            throw new Error("Invalid pinned tmux executable");
+        }
+        const environment = Object.freeze(tmuxClientEnvironment(process.env));
         const channelOptions: SessionChannelOptions = {
           session,
           createIo: (handlers) =>
@@ -424,10 +458,32 @@ export class MirrorService {
               socketPath: this.opts.socketPath,
               resolveSocketPath: this.opts.resolveSocketPath,
               executable: this.opts.executable,
+              nativeServerIdentity: this.opts.nativeServerIdentity,
               configFile: this.opts.configFile,
               pauseAfterSeconds: this.opts.pauseAfterSeconds,
               nowMicros: this.opts.nowMicros,
             }),
+          executeWindowLinkGuard: (args) => {
+            if (!mutationSocketIdentity || !executable)
+              throw new Error("Window link mutation requires a pinned socket authority");
+            if (this.opts.resolveSocketPath) this.opts.resolveSocketPath();
+            const socket = revalidateUnixSocketIdentity(mutationSocketIdentity);
+            return new Promise((resolve) => {
+              execFile(
+                executable,
+                ["-N", "-u", "-S", socket, ...args],
+                { timeout: 5000, maxBuffer: 65536, encoding: "utf8", env: environment },
+                (error, stdout) => {
+                  const status = !error
+                    ? 0
+                    : typeof error.code === "number" && !error.killed
+                      ? error.code
+                      : null;
+                  resolve({ status, stdout });
+                },
+              );
+            });
+          },
           historyLines: this.opts.historyLines,
           internalReadHookEmission: this.opts.internalReadHookEmission,
           generatePaneId: this.opts.generatePaneId,