tmux-ide 2.9.0-beta.21 → 2.9.0-beta.26

package/packages/daemon/dist/lib/embedded-tmux-server-owners.js

@@ -0,0 +1,147 @@
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { tmuxServerPaneStreamPath } from "@tmux-ide/contracts";
+import { TmuxServerOwners, MAX_TMUX_SERVER_OWNERS, } from "./tmux-server-owners.js";
+import { createTmuxServerProbe, readTmuxServerRegistrations, writeTmuxServerRegistrations, } from "./tmux-server-registration.js";
+import { createNativeTmuxServerOwner } from "./tmux-server-owner.js";
+import { attachPaneStreamWebSocket, } from "../server/pane-stream-upgrade.js";
+/** Adapts the established default owner without duplicating its control clients. */
+export async function createEmbeddedTmuxServerOwners(options) {
+    const path = join(options.stateDirectory, "tmux-servers.json");
+    const persisted = readTmuxServerRegistrations(path);
+    const probe = createTmuxServerProbe(options.defaultAuthority.executablePath);
+    const defaultObservation = await probe(options.defaultAuthority.socketSelector);
+    let established = persisted.find((entry) => JSON.stringify(entry.selector) === JSON.stringify(options.defaultAuthority.socketSelector));
+    if (!established && defaultObservation) {
+        for (const entry of persisted) {
+            const observation = await probe(entry.selector);
+            if (observation?.fingerprint === defaultObservation.fingerprint) {
+                established = entry;
+                break;
+            }
+        }
+    }
+    const defaultRegistration = established ?? {
+        serverId: `tmux-server.${randomUUID().replaceAll("-", "")}`,
+        label: "Default",
+        selector: options.defaultAuthority.socketSelector,
+    };
+    let httpServer = null;
+    const boundaries = new Map();
+    const pending = new Map();
+    const isCurrent = (owner) => {
+        try {
+            return (owners.current({ serverId: owner.serverId, generation: owner.generation })
+                .paneStreamRuntime === owner.paneStreamRuntime);
+        }
+        catch {
+            return false;
+        }
+    };
+    const attachOwner = (route, owner) => {
+        pending.set(route, owner);
+        if (httpServer)
+            boundaries.set(route, attachPaneStreamWebSocket(httpServer, owner.paneStreamRuntime.coordinator, route, () => isCurrent(owner)));
+    };
+    let defaultRetired = false;
+    const retireDefault = async () => {
+        if (defaultRetired)
+            return;
+        defaultRetired = true;
+        await options.defaultOwner.dispose();
+    };
+    const owners = new TmuxServerOwners({
+        probe,
+        persist: (registrations) => writeTmuxServerRegistrations(path, registrations),
+        create: async (registration, scope, observation) => {
+            if (registration.serverId === defaultRegistration.serverId)
+                await retireDefault();
+            const route = tmuxServerPaneStreamPath(scope);
+            const owner = await createNativeTmuxServerOwner({
+                ...scope,
+                tmuxAuthority: observation.authority,
+                nativeServerIdentity: observation.nativeServerIdentity,
+                stateDirectory: join(options.stateDirectory, "server-owners", registration.serverId),
+                webSocketUrl: new URL(route, options.webSocketBaseUrl).href,
+            });
+            attachOwner(route, owner);
+            return {
+                ...owner,
+                dispose: async () => {
+                    const boundary = boundaries.get(route);
+                    boundaries.delete(route);
+                    pending.delete(route);
+                    try {
+                        await boundary?.close();
+                    }
+                    finally {
+                        await owner.dispose();
+                    }
+                },
+            };
+        },
+    });
+    if (defaultObservation && defaultObservation.fingerprint === options.expectedDefaultProofDigest)
+        owners.adopt(defaultRegistration, { serverId: defaultRegistration.serverId, generation: options.defaultGeneration }, defaultObservation, {
+            ...options.defaultOwner,
+            serverId: defaultRegistration.serverId,
+            generation: options.defaultGeneration,
+            dispose: retireDefault,
+        });
+    try {
+        if (!defaultObservation ||
+            defaultObservation.fingerprint !== options.expectedDefaultProofDigest)
+            await owners.register(defaultRegistration);
+        for (const registration of persisted) {
+            if (registration.serverId !== defaultRegistration.serverId)
+                await owners.register(registration);
+        }
+        writeTmuxServerRegistrations(path, owners.registrations());
+    }
+    catch (error) {
+        await owners.dispose();
+        throw error;
+    }
+    const refuseUnknownScope = (request, socket) => {
+        const route = (request.url ?? "").split("?", 1)[0];
+        if (route.startsWith("/v2/tmux-servers/") && !pending.has(route))
+            socket.end("HTTP/1.1 410 Gone\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+    };
+    return {
+        owners,
+        isDefaultCurrent() {
+            if (defaultRetired)
+                return false;
+            if (!defaultObservation ||
+                defaultObservation.fingerprint !== options.expectedDefaultProofDigest)
+                return true;
+            try {
+                owners.current({
+                    serverId: defaultRegistration.serverId,
+                    generation: options.defaultGeneration,
+                });
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        attach(server) {
+            if (httpServer)
+                throw new Error("Server owner transport already attached");
+            httpServer = server;
+            server.on("upgrade", refuseUnknownScope);
+            server.setMaxListeners(Math.max(server.getMaxListeners(), MAX_TMUX_SERVER_OWNERS + server.listenerCount("upgrade") + 4));
+            for (const [route, owner] of pending)
+                boundaries.set(route, attachPaneStreamWebSocket(server, owner.paneStreamRuntime.coordinator, route, () => isCurrent(owner)));
+        },
+        async dispose() {
+            httpServer?.off("upgrade", refuseUnknownScope);
+            await owners.dispose();
+        },
+        /** Legacy default routes remain bound to their original authority; never retarget. */
+        get defaultRetired() {
+            return defaultRetired;
+        },
+    };
+}

package/packages/daemon/dist/lib/fleet-lifecycle-authority.js

@@ -1,3 +1,4 @@
+import { liveSessionIdForNativeIdentity } from "../terminal/protocol/live-session-identity.js";
 import { createHash, randomUUID } from "node:crypto";
 import { isAbsolute, resolve } from "node:path";
 import { realpath, stat } from "node:fs/promises";
@@ -22,6 +23,7 @@ export class FleetLifecycleAuthority {
     #startedAt;
     #registry;
     #runTmux;
+    #ensureChromeUpdater;
     #readFleet;
     #operations = new Map();
     #tail = Promise.resolve();
@@ -30,6 +32,7 @@ export class FleetLifecycleAuthority {
         this.#productVersion = options.productVersion;
         this.#startedAt = options.startedAt;
         this.#registry = options.registry;
+        this.#ensureChromeUpdater = options.ensureChromeUpdater ?? true;
         this.#runTmux = options.runTmux;
         this.#readFleet = options.readFleet ?? (() => readAdoptedFleet(this.#registry));
     }
@@ -77,10 +80,14 @@ export class FleetLifecycleAuthority {
             }
         }
         let created = false;
+        let liveSessionId;
         try {
-            this.#runTmux([
+            const createdId = this.#runTmux([
                 "new-session",
                 "-d",
+                "-P",
+                "-F",
+                "#{pid}\t#{session_id}\t#{session_created}",
                 ...TMUX_TRUECOLOR_ENVIRONMENT_ARGS,
                 "-s",
                 identity.sessionName,
@@ -90,15 +97,25 @@ export class FleetLifecycleAuthority {
                 cwd,
                 TMUX_TRUECOLOR_INTERACTIVE_SHELL_COMMAND,
             ]);
+            const [serverPid, sessionId, sessionCreated] = createdId.trim().split("\t");
+            if (serverPid &&
+                /^\d+$/u.test(serverPid) &&
+                sessionId &&
+                /^\$\d+$/u.test(sessionId) &&
+                sessionCreated &&
+                /^\d+$/u.test(sessionCreated))
+                liveSessionId = liveSessionIdForNativeIdentity(serverPid, sessionId, sessionCreated);
             created = true;
             prepareTmuxTruecolorEnvironment(this.#runTmux, identity.sessionName);
             this.#runTmux(["set-environment", "-t", identity.sessionName, "TMUX_IDE", "1"]);
             this.#runTmux(adoptMarkArgv(identity.sessionName));
-            try {
-                this.#runTmux(updaterProbeArgv());
-            }
-            catch {
-                this.#runTmux(updaterSpawnArgv());
+            if (this.#ensureChromeUpdater) {
+                try {
+                    this.#runTmux(updaterProbeArgv());
+                }
+                catch {
+                    this.#runTmux(updaterSpawnArgv());
+                }
             }
             if (!existing)
                 this.#registry.add({
@@ -125,6 +142,7 @@ export class FleetLifecycleAuthority {
             operationId,
             daemonInstanceId: this.#daemonInstanceId,
             outcome: "created",
+            ...(input.includeLiveSessionId && liveSessionId ? { liveSessionId } : {}),
             fleetSessionId: fleetSessionIdForName(identity.sessionName),
             workspaceName: identity.workspaceName,
             displayName: input.displayName,
@@ -268,11 +286,13 @@ export class FleetLifecycleAuthority {
             this.#runTmux(["set-option", "-p", "-t", paneId, "@agent_launch", input.command]);
             this.#runTmux(["set-option", "-p", "-t", paneId, "@agent_hint", input.harness]);
             this.#runTmux(["select-pane", "-t", paneId, "-T", input.displayTitle]);
-            try {
-                this.#runTmux(updaterProbeArgv());
-            }
-            catch {
-                this.#runTmux(updaterSpawnArgv());
+            if (this.#ensureChromeUpdater) {
+                try {
+                    this.#runTmux(updaterProbeArgv());
+                }
+                catch {
+                    this.#runTmux(updaterSpawnArgv());
+                }
             }
         }
         catch (error) {

package/packages/daemon/dist/lib/headless-daemon.js

@@ -1,3 +1,5 @@
+import { assertCanonicalDaemonServerIntent } from "./canonical-daemon-bootstrap.js";
+import { resolveTmuxServerIntent } from "./runtime-namespace.js";
 import { canonicalDaemonUrl, matchesCanonicalDaemonPredecessor, getCanonicalDaemonInfoPath, prepareCanonicalDaemonInfoForBootstrap, isCanonicalDaemonAlive, isCanonicalDaemonRecordOwnerProvenDead, probeCanonicalDaemonHealth, probeCanonicalDaemonIdentity, warnOnDaemonVersionSkew, } from "./canonical-daemon.js";
 import { DAEMON_WIRE_PROTOCOL_VERSION, isDaemonWireProtocolCompatible, } from "@tmux-ide/contracts";
 import { startEmbeddedDaemon, } from "./daemon-embed.js";
@@ -63,12 +65,15 @@ function assertIdentityMatches(info, identity) {
     }
 }
 async function assertAttachableDaemon(deps, info, options) {
-    const identity = await deps.probeCanonicalDaemonIdentity(info);
+    const identity = await deps.probeCanonicalDaemonIdentity(info, undefined, Boolean(options.tmuxServerIntent));
     if (!identity) {
         throw new IdeError(`Canonical daemon PID ${info.pid} is alive but its identity endpoint is unavailable. ` +
             "Refusing takeover.", { code: "DAEMON_IDENTITY_UNAVAILABLE", exitCode: 1 });
     }
     assertIdentityMatches(info, identity);
+    await assertCanonicalDaemonServerIntent(info, options.tmuxServerIntent ?? null, {
+        identity: async () => identity,
+    });
     const health = await deps.probeCanonicalDaemonHealth(info);
     if (!health) {
         throw new IdeError(`Canonical daemon PID ${info.pid} is alive but its health endpoint is unavailable. ` +
@@ -180,6 +185,10 @@ async function waitForCanonicalWinner(deps, options, timeoutMs = 15_000) {
  * action converge on the same idempotent EmbeddedDaemonHandle.stop() path.
  */
 export async function runHeadlessDaemon(options = {}, deps = defaultDependencies) {
+    options = {
+        ...options,
+        tmuxServerIntent: options.tmuxServerIntent === undefined ? resolveTmuxServerIntent() : options.tmuxServerIntent,
+    };
     let restoreTmuxWorkspaces = false;
     const lifecycle = {};
     while (true) {

package/packages/daemon/dist/lib/runtime-namespace.js

@@ -212,6 +212,7 @@ export function resolveRuntimeNamespace(options = {}) {
         controlSocketPath: join(runtimeDir, "control.sock"),
         eventLogPath: join(stateHome, "events.jsonl"),
         tmuxSocket,
+        tmuxSocketExplicit: Boolean(tmuxSocketName || tmuxSocketPath),
         cleanupToken,
         namespaceId: development?.id ?? (isolated ? cleanupToken : "canonical"),
         persistence: isolated && !development ? "ephemeral" : "durable",
@@ -238,9 +239,11 @@ export function runtimeNamespaceEnvironment(namespace) {
         [STATE_HOME_ENV]: namespace.stateHome,
         [REGISTRY_DIR_ENV]: namespace.registryDir,
         [DAEMON_INFO_DIR_ENV]: namespace.daemonInfoDir,
-        ...(namespace.tmuxSocket.kind === "name"
-            ? { [TMUX_SOCKET_NAME_ENV]: namespace.tmuxSocket.name }
-            : { [TMUX_SOCKET_PATH_ENV]: namespace.tmuxSocket.path }),
+        ...(namespace.tmuxSocketExplicit === false
+            ? {}
+            : namespace.tmuxSocket.kind === "name"
+                ? { [TMUX_SOCKET_NAME_ENV]: namespace.tmuxSocket.name }
+                : { [TMUX_SOCKET_PATH_ENV]: namespace.tmuxSocket.path }),
         ...(namespace.cleanupToken ? { [CLEANUP_TOKEN_ENV]: namespace.cleanupToken } : {}),
     });
 }
@@ -294,3 +297,14 @@ export function assertQualifiedDevelopmentLaunch() {
     if (resolveRuntimeNamespace().development)
         throw new Error("Development launch requires exact build artifacts (D03); installed CLI fallback is disabled");
 }
+/** Caller intent differs from the default used when starting a new owner. */
+export function resolveTmuxServerIntent(options = {}) {
+    const env = options.env ?? process.env;
+    const namespace = resolveRuntimeNamespace(options);
+    if (namespace.isolated ||
+        nonEmpty(env, TMUX_SOCKET_NAME_ENV) ||
+        nonEmpty(env, TMUX_SOCKET_PATH_ENV))
+        return { source: "explicit", selector: namespace.tmuxSocket };
+    const current = /^(.*),[0-9]+,[0-9]+$/u.exec(env.TMUX ?? "")?.[1];
+    return current ? { source: "current", selector: { kind: "path", path: current } } : null;
+}

package/packages/daemon/dist/lib/tmux-client-execution.js

@@ -0,0 +1,59 @@
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { delimiter, isAbsolute, join } from "node:path";
+import { resolveRuntimeNamespace } from "./runtime-namespace.js";
+import { resolveBundledTmux } from "./bundled-tmux.js";
+export function resolveTmuxExecutable() {
+    if (resolveRuntimeNamespace().development)
+        return resolveBundledTmux();
+    const configured = process.env.TMUX_IDE_TMUX_BIN;
+    if (!configured) {
+        const bundled = resolveBundledTmux();
+        if (bundled)
+            return bundled;
+    }
+    const candidates = configured
+        ? [configured]
+        : (process.env.PATH ?? "")
+            .split(delimiter)
+            // Empty and relative PATH entries mean the daemon/project cwd. They
+            // are never executable authority for a privileged tmux mutation.
+            .filter((entry) => entry.length > 0 && isAbsolute(entry))
+            .map((entry) => join(entry, "tmux"));
+    for (const candidate of candidates) {
+        try {
+            if (!isAbsolute(candidate))
+                continue;
+            accessSync(candidate, constants.X_OK);
+            const canonical = realpathSync(candidate);
+            if (statSync(canonical).isFile())
+                return canonical;
+        }
+        catch {
+            // Continue to the next daemon-start candidate.
+        }
+    }
+    throw new Error("tmux_executable_unavailable");
+}
+const SAFE_TERMINAL_VALUE = /^(?:xterm|screen|tmux|rxvt|vt100|ansi)[A-Za-z0-9+._-]{0,58}$/u;
+const SAFE_LOCALE_VALUE = /^[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}$/u;
+/**
+ * The pinned tmux client receives only presentation metadata. Everything else
+ * is denied by omission: PATH/HOME/SHELL, TMUX/TMUX_PANE/TMUX_TMPDIR, shell
+ * startup hooks, dynamic-loader variables, Node options, and project secrets
+ * cannot redirect authority or inject code into this daemon-owned execution.
+ */
+export function tmuxClientEnvironment(source) {
+    const environment = {
+        TERM: SAFE_TERMINAL_VALUE.test(source.TERM ?? "") ? source.TERM : "xterm-256color",
+        // A pinned runner may be the first tmux client and therefore create the
+        // server. Never let a headless parent (`TERM=dumb`, `NO_COLOR=1`) become
+        // the global environment inherited by every later interactive child.
+        COLORTERM: "truecolor",
+    };
+    for (const name of ["LANG", "LC_ALL", "LC_CTYPE"]) {
+        const value = source[name];
+        if (value && SAFE_LOCALE_VALUE.test(value))
+            environment[name] = value;
+    }
+    return environment;
+}

package/packages/daemon/dist/lib/tmux-named-socket-fence.js

@@ -63,3 +63,7 @@ export function createNamedSocketFence(authority, executable, environment) {
         isPinned: () => shared.identity !== null,
     };
 }
+/** True only before this exact authority has observed any live socket. */
+export function isNamedSocketAuthorityUnbound(authority) {
+    return authority.socketSelector.kind === "name" && !states.get(authority)?.identity;
+}

package/packages/daemon/dist/lib/tmux-server-generation-runner.js

@@ -0,0 +1,62 @@
+import { randomUUID } from "node:crypto";
+import { createPinnedWorkspaceTmuxRunner, createPinnedWorkspaceTmuxAsyncRunner, } from "./workspace-pane-creation.js";
+import { shellEscape } from "./shell.js";
+/** Guard each command on the server which actually accepted this connection. */
+export function fenceNativeTmuxCommand(args, expected) {
+    const { pid, startTime } = expected;
+    if (!/^[1-9][0-9]*$/u.test(pid) || !/^[1-9][0-9]*$/u.test(startTime))
+        throw new Error("Invalid native tmux server identity");
+    if (args.length === 0 || args.some((arg) => arg.includes("\0")))
+        throw new Error("Invalid tmux command");
+    const globalFlags = [];
+    let firstCommand = 0;
+    while (args[firstCommand]?.startsWith("-")) {
+        const flag = args[firstCommand];
+        if (flag !== "-N" && flag !== "-u")
+            throw new Error("Unsupported tmux global option in generation-fenced command");
+        globalFlags.push(flag);
+        firstCommand += 1;
+    }
+    if (firstCommand === args.length)
+        throw new Error("Missing tmux command");
+    const condition = `#{&&:#{==:#{pid},${pid}},#{==:#{start_time},${startTime}}}`;
+    // Preserve arbitrary literal payloads; a standalone ; is the native argv
+    // command separator already used by the existing runners.
+    const command = args
+        .slice(firstCommand)
+        .map((arg) => (arg === ";" ? ";" : shellEscape(arg)))
+        .join(" ");
+    const refusal = `tmux-server-stale.${randomUUID()}`;
+    return {
+        argv: [...globalFlags, "if-shell", "-F", condition, command, `display-message -p '${refusal}'`],
+        verify(output) {
+            if (output.trimEnd() === refusal)
+                throw new Error("Tmux server generation changed before command execution");
+            return output;
+        },
+    };
+}
+/** Socket validation alone leaves a validation-to-connect replacement race. */
+export function createServerGenerationFencedTmuxRunner(authority, expected) {
+    const run = createPinnedWorkspaceTmuxRunner(authority, { timeoutMs: 5_000 });
+    const [pid, startTime] = expected
+        ? [expected.pid, expected.startTime]
+        : run(["display-message", "-p", "#{pid}\t#{start_time}"]).split("\t");
+    if (!pid || !startTime)
+        throw new Error("Invalid native tmux server identity");
+    const identity = { pid, startTime };
+    // Validate once before publishing an owner; each command rechecks natively.
+    fenceNativeTmuxCommand(["display-message", "-p", ""], identity);
+    return (args) => {
+        const command = fenceNativeTmuxCommand(args, identity);
+        return command.verify(run(command.argv));
+    };
+}
+export function createServerGenerationFencedTmuxAsyncRunner(authority, expected) {
+    const run = createPinnedWorkspaceTmuxAsyncRunner(authority);
+    fenceNativeTmuxCommand(["display-message", "-p", ""], expected);
+    return async (args, signal) => {
+        const command = fenceNativeTmuxCommand(args, expected);
+        return command.verify(await run(command.argv, signal));
+    };
+}