tmux-ide 2.9.0-beta.21 → 2.9.0-beta.26

package/packages/daemon/dist/lib/canonical-daemon.js

@@ -432,6 +432,9 @@ export function writeCanonicalDaemonInfo(info, claim) {
         instanceId: info.instanceId,
         startedAt: info.startedAt,
         ...(info.environmentId !== undefined ? { environmentId: info.environmentId } : {}),
+        ...(info.tmuxServerProofVersion !== undefined
+            ? { tmuxServerProofVersion: info.tmuxServerProofVersion }
+            : {}),
         bindHostname: info.bindHostname,
         authToken: info.authToken,
         ...(info.provenance !== undefined ? { provenance: info.provenance } : {}),
@@ -795,11 +798,11 @@ export async function probeCanonicalDaemonHealth(info, parentSignal) {
     }
 }
 /** Credential-free endpoint binding probe; callers compare instanceId to daemon.json. */
-export async function probeCanonicalDaemonIdentity(info, parentSignal) {
+export async function probeCanonicalDaemonIdentity(info, parentSignal, includeTmuxServerProof = false) {
     if (!(await isCanonicalDaemonAlive(info)))
         return null;
     try {
-        const res = await fetch(canonicalDaemonUrl("http", info.bindHostname, info.port, "/identity"), {
+        const res = await fetch(canonicalDaemonUrl("http", info.bindHostname, info.port, includeTmuxServerProof ? "/identity?tmuxServerProof=1" : "/identity"), {
             signal: parentSignal ?? timeoutSignal(750),
         });
         if (!res.ok)

package/packages/daemon/dist/lib/daemon-embed.js

@@ -6,7 +6,15 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { runtimeTmuxArgs } from "./runtime-namespace.js";
+import { createNativeTmuxSessionCreator } from "./tmux-server-session-create.js";
+import { createTmuxSessionMutationFence } from "./tmux-session-mutation-fence.js";
+import { createNativeTmuxSessionOpener } from "./tmux-server-session-open.js";
+import { createServerGenerationFencedTmuxRunner, createServerGenerationFencedTmuxAsyncRunner, } from "./tmux-server-generation-runner.js";
+import { createNativeTmuxServerCatalog } from "./tmux-server-owner.js";
+import { createEmbeddedTmuxServerOwners } from "./embedded-tmux-server-owners.js";
+import { captureTmuxServerProofAsync, captureTmuxServerProof, captureUnboundTmuxSelectorProof, } from "./tmux-server-proof.js";
+import { assertCanonicalDaemonServerIntent } from "./canonical-daemon-bootstrap.js";
+import { runtimeTmuxArgs, resolveTmuxServerIntent, resolveRuntimeNamespace, } from "./runtime-namespace.js";
 import { createFleetPreviewCapture } from "../command-center/resources/fleet-preview-route.js";
 import { mountTerminalNativeBackingRoute } from "../command-center/resources/terminal-native-backing-route.js";
 import { startOwnedEmbeddedDaemon } from "./embedded-daemon-lifecycle.js";
@@ -28,7 +36,7 @@ import { createTmuxAuthorityReplacementProbe } from "./tmux-authority-replacemen
 import { createNamedSocketFence } from "./tmux-named-socket-fence.js";
 import { fleetSessionIdForName } from "../command-center/resources/fleet-catalog.js";
 import { DAEMON_WIRE_PROTOCOL_VERSION, DaemonInstanceIdentitySchemaZ, PANE_STREAM_REDEEM_PATH, PaneStreamLoopbackWebSocketUrlSchemaZ, TERMINAL_ATTACHMENT_REDEEM_PATH, TerminalAttachmentLoopbackWebSocketUrlSchemaZ, } from "@tmux-ide/contracts";
-import { classifySessionInspectionError, DaemonSessionMonitor, execTmuxAsync, isConfirmedMissingTmuxTarget, parseDaemonMonitorPanes, readPortProcessFactsAsync, } from "./daemon-session-monitor.js";
+import { classifySessionInspectionError, DaemonSessionMonitor, isConfirmedMissingTmuxTarget, parseDaemonMonitorPanes, readPortProcessFactsAsync, } from "./daemon-session-monitor.js";
 import { DaemonShutdownError, DaemonStartupError } from "./errors.js";
 import { handlePtyWebSocket, shutdownPtyBridges } from "../server/ws-route.js";
 import { broadcastInteractionReceipt, broadcastResourceChanged, handleWsEventsConnection, setFleetFactsObserverDiagnostics, setFleetFactsTmuxRunner, shutdownWsEventObservation, } from "../command-center/ws-events.js";
@@ -101,14 +109,6 @@ function tmux(...args) {
         timeout: 2_000,
     }).trim();
 }
-function tmuxSilent(...args) {
-    try {
-        return tmux(...args);
-    }
-    catch {
-        return "";
-    }
-}
 function assertTmuxSession(sessionName, runTmux = (args) => tmux(...args)) {
     try {
         runTmux(["has-session", "-t", sessionName]);
@@ -353,7 +353,7 @@ function sameCanonicalInstance(left, right) {
         left.startedAt === right.startedAt &&
         left.bindHostname === right.bindHostname);
 }
-async function requestValidatedDaemonShutdown(info, deadline) {
+async function requestValidatedDaemonShutdown(info, deadline, intent) {
     if (info.supervisionId)
         throw new DaemonStartupError("A supervised daemon cannot be taken over", "canonical_takeover_refused");
     const identity = await probeCanonicalDaemonIdentity(info, deadline.signal);
@@ -366,6 +366,8 @@ async function requestValidatedDaemonShutdown(info, deadline) {
         identity.startedAt !== info.startedAt) {
         throw new DaemonStartupError("Canonical daemon identity changed before takeover", "canonical_takeover_identity_mismatch");
     }
+    await assertCanonicalDaemonServerIntent(info, intent);
+    assertTakeoverDeadline(deadline, "Tmux server intent proof exceeded the takeover deadline");
     const health = await probeCanonicalDaemonHealth(info, deadline.signal);
     assertTakeoverDeadline(deadline, "Canonical daemon did not answer the takeover request before the takeover deadline");
     if (!health ||
@@ -471,7 +473,7 @@ function closeWsGoingAway(ws) {
     }
     ws.close(1001, reason);
 }
-async function startHttpServer({ sessionName, requestedPort, bindHostname, dir, authToken, localBypassToken, silent, readProjectAuth, daemonIdentity, workspacePaneCreationBackend, workspaceOpenBackend, workspaceOpenHandoffBackend, fleetLifecycleBackend, workspacePromotionBackend, appWindowMutationBackend, workspaceMultiplexerBackend, workspaceRegistry, terminalInventoryRuntime, getTerminalAttachmentRuntime, peekTerminalAttachmentRuntime, paneStreamRuntime, catalogLiveSessions, catalogFleet, fleetPreviewCapture, sessionRuntimeRegistry, }) {
+async function startHttpServer({ sessionName, requestedPort, bindHostname, dir, authToken, localBypassToken, silent, readProjectAuth, tmuxServerProof, daemonIdentity, workspacePaneCreationBackend, workspaceOpenBackend, workspaceOpenHandoffBackend, fleetLifecycleBackend, workspacePromotionBackend, appWindowMutationBackend, workspaceMultiplexerBackend, workspaceRegistry, terminalInventoryRuntime, getTerminalAttachmentRuntime, peekTerminalAttachmentRuntime, paneStreamRuntime, catalogLiveSessions, catalogFleet, fleetPreviewCapture, sessionRuntimeRegistry, serverOwners, }) {
     const { createApp } = await import("../command-center/server.js");
     const { getRequestListener } = await import(__rewriteRelativeImportExtension(requireFromHere.resolve("@hono/node-server"), true));
     const { AuthService } = await import("./auth/auth-service.js");
@@ -490,6 +492,7 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
     }
     const authService = new AuthService(authConfig.secret);
     const app = createApp({
+        tmuxServerOwners: serverOwners.owners,
         authService,
         authConfig,
         remoteAccess: {
@@ -499,6 +502,7 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
             ownerToken: localBypassToken ?? null,
         },
         daemonIdentity,
+        tmuxServerProof,
         workspacePaneCreationBackend,
         workspaceOpenBackend,
         workspaceOpenHandoffBackend,
@@ -558,7 +562,8 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
     });
     const terminalAttachmentBoundary = attachTerminalAttachmentWebSocket(server, (create) => (create ? getTerminalAttachmentRuntime() : peekTerminalAttachmentRuntime())?.admission ??
         null);
-    const paneStreamBoundary = attachPaneStreamWebSocket(server, paneStreamRuntime.coordinator);
+    const paneStreamBoundary = attachPaneStreamWebSocket(server, paneStreamRuntime.coordinator, PANE_STREAM_REDEEM_PATH, () => serverOwners.isDefaultCurrent());
+    serverOwners.attach(server);
     try {
         await new Promise((resolve, reject) => {
             const onError = (err) => {
@@ -612,6 +617,7 @@ export async function startEmbeddedDaemon(opts) {
         : startOwnedEmbeddedDaemon(opts, startEmbeddedDaemonGeneration);
 }
 async function startEmbeddedDaemonGeneration(opts) {
+    const tmuxServerIntent = resolveTmuxServerIntent();
     const sessionName = opts.sessionName ?? EMBEDDED_SESSION_NAME;
     const sessionless = opts.sessionName == null;
     const appSettings = readAppSettings();
@@ -645,7 +651,7 @@ async function startEmbeddedDaemonGeneration(opts) {
         if (state.status === "valid" && (await isCanonicalDaemonAlive(state.info))) {
             const takeoverDeadline = createTakeoverDeadline(takeoverTimeoutMs());
             try {
-                await requestValidatedDaemonShutdown(state.info, takeoverDeadline);
+                await requestValidatedDaemonShutdown(state.info, takeoverDeadline, tmuxServerIntent);
                 claim = await acquireCanonicalDaemonClaimAfterTakeover(state.info, takeoverDeadline);
             }
             finally {
@@ -691,7 +697,20 @@ async function startEmbeddedDaemonGeneration(opts) {
         // caller's ambient TMUX/PATH happens to select.
         const tmuxAuthority = resolveWorkspacePaneTmuxAuthority();
         const catalogTmuxRunner = createPinnedWorkspaceTmuxRunner(tmuxAuthority);
-        const fleetFactsTmuxRunner = createPinnedWorkspaceTmuxAsyncRunner(tmuxAuthority);
+        const initialTmuxProof = captureTmuxServerProof(catalogTmuxRunner);
+        const initialNativeIdentityParts = initialTmuxProof
+            ? catalogTmuxRunner(["display-message", "-p", "#{pid}\t#{start_time}"]).split("\t")
+            : null;
+        const initialNativeServerIdentity = initialNativeIdentityParts
+            ? { pid: initialNativeIdentityParts[0], startTime: initialNativeIdentityParts[1] }
+            : undefined;
+        const sessionMutationFence = createTmuxSessionMutationFence();
+        const nativeGenerationTmuxRunner = sessionMutationFence.wrap(initialNativeServerIdentity
+            ? createServerGenerationFencedTmuxRunner(tmuxAuthority, initialNativeServerIdentity)
+            : catalogTmuxRunner);
+        const fleetFactsTmuxRunner = initialNativeServerIdentity
+            ? createServerGenerationFencedTmuxAsyncRunner(tmuxAuthority, initialNativeServerIdentity)
+            : createPinnedWorkspaceTmuxAsyncRunner(tmuxAuthority);
         const tmuxAuthorityReplaced = createTmuxAuthorityReplacementProbe(tmuxAuthority, catalogTmuxRunner);
         const registryTmuxRunner = createPinnedWorkspaceTmuxRunner(tmuxAuthority, {
             timeoutMs: WORKSPACE_REGISTRY_TMUX_TIMEOUT_MS,
@@ -714,8 +733,8 @@ async function startEmbeddedDaemonGeneration(opts) {
         const workspaceRegistry = getDefaultWorkspaceRegistry();
         await workspaceRegistry.load(() => readWorkspaceRegistrySessionInventory(registryTmuxRunner));
         const paneSourceCredentials = new PaneSourceCredentialAuthority({
-            run: (args) => tmuxSilent(...args),
-            runAsync: (args, signal) => execTmuxAsync(args, signal),
+            run: (args) => nativeGenerationTmuxRunner(args),
+            runAsync: (args, signal) => fleetFactsTmuxRunner(args, signal),
         });
         const legacySession = process.env.TMUX_IDE_SESSION;
         if (legacySession && !workspaceRegistry.has(legacySession)) {
@@ -754,16 +773,19 @@ async function startEmbeddedDaemonGeneration(opts) {
             daemonInstanceId: instanceId,
             registry: workspaceRegistry,
             tmuxAuthority,
+            io: { runTmux: nativeGenerationTmuxRunner },
         });
         const workspaceOpen = new WorkspaceOpenAuthority({
             daemonInstanceId: instanceId,
             registry: workspaceRegistry,
             tmuxAuthority,
+            io: { runTmux: nativeGenerationTmuxRunner },
         });
         const workspacePromotion = new WorkspacePromotionAuthority({
             daemonInstanceId: instanceId,
             registry: workspaceRegistry,
             tmuxAuthority,
+            io: { runTmux: fleetFactsTmuxRunner },
         });
         if (opts.restoreTmuxWorkspaces) {
             for (const workspace of workspaceRegistry.list()) {
@@ -779,7 +801,7 @@ async function startEmbeddedDaemonGeneration(opts) {
             productVersion,
             startedAt,
             registry: workspaceRegistry,
-            runTmux: catalogTmuxRunner,
+            runTmux: nativeGenerationTmuxRunner,
             readFleet: () => readAdoptedFleet(workspaceRegistry, catalogTmuxRunner),
         });
         const appWindowMutation = new AppWindowMutationAuthority({
@@ -790,13 +812,22 @@ async function startEmbeddedDaemonGeneration(opts) {
             daemonInstanceId: instanceId,
             registry: workspaceRegistry,
             tmuxAuthority,
+            ...(initialTmuxProof
+                ? {
+                    io: {
+                        runTmux: nativeGenerationTmuxRunner,
+                    },
+                }
+                : {}),
         });
         let sessionRuntimeRegistry = null;
         let workspaceOpenHandoff = null;
         let terminalInventoryRuntime = null;
+        let sessionMonitor = null;
         const externalInteractionObserver = new TmuxExternalInteractionObserver({
             daemonInstanceId: instanceId,
             internalReadOwnerToken: localBypassToken,
+            io: { runTmux: fleetFactsTmuxRunner },
             registry: workspaceRegistry,
             tmuxAuthority,
             // A gap cannot reconstruct historical interactions. Refresh inventory
@@ -838,6 +869,25 @@ async function startEmbeddedDaemonGeneration(opts) {
         });
         let terminalAttachmentRuntime = null;
         let paneStreamRuntime = null;
+        let serverOwners = null;
+        const defaultSessionCreator = createNativeTmuxSessionCreator({
+            generation: instanceId,
+            registry: workspaceRegistry,
+            run: nativeGenerationTmuxRunner,
+            assertOpen: () => {
+                if (serverOwners?.defaultRetired)
+                    throw new Error("Default tmux owner is retired");
+            },
+        });
+        const defaultSessionOpener = createNativeTmuxSessionOpener({
+            generation: instanceId,
+            registry: workspaceRegistry,
+            run: fleetFactsTmuxRunner,
+            assertOpen: () => {
+                if (serverOwners?.defaultRetired)
+                    throw new Error("Default tmux owner is retired");
+            },
+        });
         let runtimeTraceStream = null;
         const closeRuntimeTraceStream = async () => {
             externalInteractionObserver.setDiagnostics(null);
@@ -856,6 +906,15 @@ async function startEmbeddedDaemonGeneration(opts) {
                     workspaceMultiplexer.readPane(operationId, intent);
                     return;
                 }
+                if (intent.verb === "workspace.window.link.select" ||
+                    intent.verb === "workspace.window.link.unlink" ||
+                    intent.verb === "workspace.pane.select") {
+                    return workspaceMultiplexer.mutateWindowLink({ operationId, expectedDaemonInstanceId: instanceId, intent }, (session, action) => {
+                        if (!sessionRuntimeRegistry)
+                            throw new Error("Session runtime unavailable");
+                        return sessionRuntimeRegistry.executeWindowLinkAction(session, action);
+                    });
+                }
                 return workspaceMultiplexer.mutate({ operationId, expectedDaemonInstanceId: instanceId, intent }, timing);
             };
             const runtimeTracePath = process.env.TMUX_IDE_SESSION_RUNTIME_TRACE_LOG;
@@ -918,8 +977,9 @@ async function startEmbeddedDaemonGeneration(opts) {
                     publishResourceChange: (change) => broadcastResourceChanged(change, instanceId),
                 },
                 mirror: {
+                    nativeServerIdentity: initialNativeServerIdentity,
                     executable: tmuxAuthority.executablePath,
-                    resolveSocketPath: () => catalogTmuxRunner(["display-message", "-p", "#{socket_path}"]),
+                    resolveSocketPath: () => nativeGenerationTmuxRunner(["display-message", "-p", "#{socket_path}"]),
                     internalReadHookEmission: (runtimePaneId, marker) => externalInteractionObserver.internalReadHookEmission(runtimePaneId, marker),
                     ...(selector.kind === "path" ? { socketPath: selector.path } : {}),
                     ...(selector.kind === "name" && selector.name !== "default"
@@ -982,6 +1042,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                 sessionRuntimeRegistry,
                 tmuxAuthority: {
                     executablePath: tmuxAuthority.executablePath,
+                    nativeServerIdentity: initialNativeServerIdentity,
                     socketSelector: tmuxAuthority.socketSelector,
                     trustedCwd: dir,
                     ...(tmuxAuthority.socketSelector.kind === "name"
@@ -1026,8 +1087,81 @@ async function startEmbeddedDaemonGeneration(opts) {
                 resolvePaneSourceCredential: (credential, resolvedSession, claimedSource) => paneSourceCredentials.resolve(credential, resolvedSession, claimedSource),
             });
             await externalInteractionObserver.start();
+            serverOwners = await createEmbeddedTmuxServerOwners({
+                defaultAuthority: tmuxAuthority,
+                defaultGeneration: instanceId,
+                expectedDefaultProofDigest: initialTmuxProof?.digest ?? null,
+                stateDirectory: resolveRuntimeNamespace().runtimeDir,
+                webSocketBaseUrl: canonicalDaemonUrl("ws", bindHostname, port),
+                defaultOwner: {
+                    catalog: createNativeTmuxServerCatalog(workspaceRegistry, fleetFactsTmuxRunner),
+                    openSession: async (liveSessionId) => {
+                        await createNativeTmuxServerCatalog(workspaceRegistry, fleetFactsTmuxRunner)();
+                        const result = await defaultSessionOpener.openSession(liveSessionId);
+                        terminalInventoryRuntime.invalidate();
+                        return result;
+                    },
+                    workspaceRegistry,
+                    multiplexerBackend: orderedMultiplexerBackend,
+                    createSession: defaultSessionCreator.createSession,
+                    createSessionPane: async (liveSessionId, request) => {
+                        const selectedSession = workspaceRegistry.get(request.intent.workspaceName)?.sessionName;
+                        if (!selectedSession)
+                            throw new Error("Selected workspace is unavailable");
+                        const result = await sessionMutationFence.execute({
+                            liveSessionId,
+                            sessionName: selectedSession,
+                            run: fleetFactsTmuxRunner,
+                            mutate: () => workspacePaneCreation.create(request),
+                        });
+                        terminalInventoryRuntime.invalidate();
+                        return result;
+                    },
+                    mutateSession: async (liveSessionId, request, authenticatedHostClientId) => {
+                        const selectedSession = workspaceRegistry.get(request.intent.workspaceName)?.sessionName;
+                        if (!selectedSession)
+                            throw new Error("Selected workspace is unavailable");
+                        return sessionMutationFence.execute({
+                            liveSessionId,
+                            sessionName: selectedSession,
+                            run: fleetFactsTmuxRunner,
+                            mutate: () => orderedMultiplexerBackend.mutate(request, authenticatedHostClientId, undefined, true),
+                        });
+                    },
+                    sessionRuntimeRegistry,
+                    terminalInventoryRuntime,
+                    paneStreamRuntime,
+                    dispose: async () => {
+                        sessionMonitor?.stop();
+                        paneSourceCredentials.dispose();
+                        const transportResults = await Promise.allSettled([
+                            Promise.resolve().then(() => terminalAttachmentRuntime?.dispose()),
+                            Promise.resolve().then(() => paneStreamRuntime.dispose()),
+                        ]);
+                        const authorityResults = await Promise.allSettled([
+                            Promise.resolve().then(() => terminalInventoryRuntime.dispose()),
+                            Promise.resolve().then(() => workspacePaneCreation.dispose()),
+                            Promise.resolve().then(() => workspaceOpen.dispose()),
+                            Promise.resolve().then(() => workspaceOpenHandoff?.dispose()),
+                            Promise.resolve().then(() => Promise.all([
+                                workspacePromotion.dispose(),
+                                defaultSessionOpener.dispose(),
+                                defaultSessionCreator.dispose(),
+                            ]).then(() => { })),
+                            Promise.resolve().then(() => appWindowMutation.dispose()),
+                            Promise.resolve().then(() => workspaceMultiplexer.dispose()),
+                            Promise.resolve().then(() => externalInteractionObserver.dispose()),
+                        ]);
+                        await sessionRuntimeRegistry.dispose();
+                        const failures = [...transportResults, ...authorityResults].flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+                        if (failures.length)
+                            throw new AggregateError(failures, "Default tmux owner retirement failed");
+                    },
+                },
+            });
             setFleetFactsTmuxRunner(fleetFactsTmuxRunner);
             startedServer = await startHttpServer({
+                serverOwners,
                 sessionName,
                 requestedPort: port,
                 bindHostname,
@@ -1037,6 +1171,11 @@ async function startEmbeddedDaemonGeneration(opts) {
                 silent: opts.silent,
                 readProjectAuth: !sessionless,
                 daemonIdentity: { productVersion, instanceId, startedAt, environmentId },
+                tmuxServerProof: async () => {
+                    const deadline = AbortSignal.timeout(500);
+                    return ((await captureTmuxServerProofAsync((args) => fleetFactsTmuxRunner(args, deadline))) ??
+                        captureUnboundTmuxSelectorProof(tmuxAuthority));
+                },
                 workspacePaneCreationBackend: workspacePaneCreation,
                 workspaceOpenBackend: workspaceOpen,
                 workspaceOpenHandoffBackend: workspaceOpenHandoff,
@@ -1056,6 +1195,7 @@ async function startEmbeddedDaemonGeneration(opts) {
             });
         }
         catch (error) {
+            await serverOwners?.dispose();
             setFleetFactsTmuxRunner(null);
             await Promise.allSettled([
                 Promise.resolve().then(() => terminalAttachmentRuntime?.dispose()),
@@ -1064,7 +1204,11 @@ async function startEmbeddedDaemonGeneration(opts) {
                 workspacePaneCreation.dispose(),
                 workspaceOpen.dispose(),
                 Promise.resolve().then(() => workspaceOpenHandoff?.dispose()),
-                workspacePromotion.dispose(),
+                Promise.all([
+                    workspacePromotion.dispose(),
+                    defaultSessionOpener.dispose(),
+                    defaultSessionCreator.dispose(),
+                ]).then(() => { }),
                 appWindowMutation.dispose(),
                 workspaceMultiplexer.dispose(),
                 externalInteractionObserver.dispose(),
@@ -1088,6 +1232,7 @@ async function startEmbeddedDaemonGeneration(opts) {
             return [...transportResults, ...runtimeResults].flatMap((result) => result.status === "rejected" ? [result.reason] : []);
         };
         const abortStartedServer = async () => {
+            await serverOwners?.dispose();
             setFleetFactsTmuxRunner(null);
             const terminalFailures = [
                 ...(await retireTerminalAttachmentTransport(terminalAttachmentRuntime, terminalAttachmentBoundary)),
@@ -1097,7 +1242,11 @@ async function startEmbeddedDaemonGeneration(opts) {
             const paneDisposal = Promise.resolve().then(() => workspacePaneCreation.dispose());
             const workspaceOpenDisposal = Promise.resolve().then(() => workspaceOpen.dispose());
             const workspaceOpenHandoffDisposal = Promise.resolve().then(() => workspaceOpenHandoff?.dispose());
-            const workspacePromotionDisposal = Promise.resolve().then(() => workspacePromotion.dispose());
+            const workspacePromotionDisposal = Promise.resolve().then(() => Promise.all([
+                workspacePromotion.dispose(),
+                defaultSessionOpener.dispose(),
+                defaultSessionCreator.dispose(),
+            ]).then(() => { }));
             const appWindowMutationDisposal = Promise.resolve().then(() => appWindowMutation.dispose());
             const workspaceMultiplexerDisposal = Promise.resolve().then(() => workspaceMultiplexer.dispose());
             const externalInteractionDisposal = Promise.resolve().then(() => externalInteractionObserver.dispose());
@@ -1152,6 +1301,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                 environmentId,
                 bindHostname,
                 authToken: localBypassToken,
+                tmuxServerProofVersion: 1,
                 provenance,
             }, claim);
             const published = inspectCanonicalDaemonInfo();
@@ -1199,14 +1349,14 @@ async function startEmbeddedDaemonGeneration(opts) {
                 stop.stop();
             },
         });
-        const sessionMonitor = sessionless
+        sessionMonitor = sessionless
             ? null
             : new DaemonSessionMonitor({
                 sessionName,
                 backend: {
                     inspectSession: async (candidate, signal) => {
                         try {
-                            await execTmuxAsync(["has-session", "-t", candidate], signal);
+                            await fleetFactsTmuxRunner(["has-session", "-t", candidate], signal);
                             return "yes";
                         }
                         catch (error) {
@@ -1229,7 +1379,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     hasClients: async (signal) => {
                         try {
-                            return (await execTmuxAsync(["list-clients"], signal)).length > 0;
+                            return (await fleetFactsTmuxRunner(["list-clients"], signal)).length > 0;
                         }
                         catch {
                             return null;
@@ -1237,7 +1387,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     listPanes: async (candidate, signal) => {
                         try {
-                            const raw = await execTmuxAsync([
+                            const raw = await fleetFactsTmuxRunner([
                                 "list-panes",
                                 "-t",
                                 candidate,
@@ -1260,7 +1410,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     setPaneOption: async (paneId, option, value, signal) => {
                         try {
-                            await execTmuxAsync(["set-option", "-pt", paneId, option, value], signal);
+                            await fleetFactsTmuxRunner(["set-option", "-pt", paneId, option, value], signal);
                         }
                         catch (error) {
                             if (!isConfirmedMissingTmuxTarget(error))
@@ -1269,7 +1419,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     setPaneTitle: async (paneId, title, signal) => {
                         try {
-                            await execTmuxAsync(["select-pane", "-t", paneId, "-T", title], signal);
+                            await fleetFactsTmuxRunner(["select-pane", "-t", paneId, "-T", title], signal);
                         }
                         catch (error) {
                             if (!isConfirmedMissingTmuxTarget(error))
@@ -1278,7 +1428,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     },
                     refreshClients: async (signal) => {
                         try {
-                            await execTmuxAsync(["refresh-client", "-S"], signal);
+                            await fleetFactsTmuxRunner(["refresh-client", "-S"], signal);
                         }
                         catch (error) {
                             if (!isConfirmedMissingTmuxTarget(error))
@@ -1292,7 +1442,20 @@ async function startEmbeddedDaemonGeneration(opts) {
         const apiBaseUrl = canonicalDaemonUrl("http", bindHostname, port);
         const wsUrl = canonicalDaemonUrl("ws", bindHostname, port, "/ws/events");
         const handle = {
-            tmuxAuthorityReplaced,
+            tmuxAuthorityReplaced: async () => {
+                if (serverOwners?.defaultRetired)
+                    return false;
+                const replaced = await tmuxAuthorityReplaced();
+                // A native server replacement cannot restart unrelated server owners.
+                // Legacy default-only callers retain the established restart adapter.
+                if (replaced &&
+                    serverOwners &&
+                    (serverOwners.owners.list().length > 1 || serverOwners.defaultRetired)) {
+                    await serverOwners.owners.refresh();
+                    return false;
+                }
+                return replaced;
+            },
             instanceId,
             pid: process.pid,
             port,
@@ -1320,6 +1483,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                         await capture(() => setActivationBackend(null));
                         await capture(() => sessionMonitor?.stop());
                         paneSourceCredentials.dispose();
+                        await capture(() => serverOwners?.dispose());
                         // Retire direct-ticket admission, live PTYs, and the direct upgrade
                         // listener before touching the legacy WS or HTTP surfaces.
                         failures.push(...(await retireTerminalAttachmentTransport(terminalAttachmentRuntime, terminalAttachmentBoundary)));
@@ -1328,7 +1492,11 @@ async function startEmbeddedDaemonGeneration(opts) {
                         await capture(() => workspacePaneCreation.dispose());
                         await capture(() => workspaceOpen.dispose());
                         await capture(() => workspaceOpenHandoff?.dispose());
-                        await capture(() => workspacePromotion.dispose());
+                        await capture(() => Promise.all([
+                            workspacePromotion.dispose(),
+                            defaultSessionOpener.dispose(),
+                            defaultSessionCreator.dispose(),
+                        ]).then(() => { }));
                         await capture(() => appWindowMutation.dispose());
                         await capture(() => workspaceMultiplexer.dispose());
                         await capture(() => externalInteractionObserver.dispose());