tmux-ide 2.9.0-beta.21 → 2.9.0-beta.26

package/packages/daemon/dist/lib/tmux-server-session-open.js

@@ -0,0 +1,101 @@
+import { randomUUID } from "node:crypto";
+import { WorkspaceCatalogLiveSessionIdSchemaZ } from "@tmux-ide/contracts";
+import { liveSessionIdForNativeIdentity } from "../terminal/protocol/live-session-identity.js";
+import { fleetSessionIdForName } from "../command-center/resources/fleet-catalog.js";
+import { isVisibleFleetSession } from "../command-center/discovery.js";
+import { WorkspacePromotionAuthority } from "./workspace-promotion.js";
+import { shellEscape } from "./shell.js";
+/** Owner-local bounded admission; all native IO must already fence the server generation. */
+export function createNativeTmuxSessionOpener(options) {
+    let disposed = false;
+    let tail = Promise.resolve();
+    const pending = new Map();
+    const assertOpen = () => {
+        options.assertOpen();
+        if (disposed)
+            throw new Error("Session admission is retired");
+    };
+    const open = async (liveSessionId) => {
+        assertOpen();
+        const records = await options.run([
+            "list-sessions",
+            "-F",
+            "#{pid}\t#{session_id}\t#{session_created}\t#{session_name}",
+        ]);
+        const matches = records
+            .trim()
+            .split("\n")
+            .map((line) => line.split("\t"))
+            .filter(([pid, id, created, name]) => pid &&
+            /^\d+$/.test(pid) &&
+            id &&
+            /^\$\d+$/.test(id) &&
+            created &&
+            /^\d+$/.test(created) &&
+            name &&
+            isVisibleFleetSession(name) &&
+            liveSessionIdForNativeIdentity(pid, id, created) === liveSessionId);
+        if (matches.length !== 1)
+            throw new Error("Selected live tmux session is no longer available");
+        const [, nativeSessionId, created, name] = matches[0];
+        // Each command checks the exact native session on the server accepting it.
+        // A name-only validation followed by stamping would cross a session replacement.
+        const run = async (args) => {
+            assertOpen();
+            const sentinel = `tmux-session-stale.${randomUUID()}`;
+            const condition = `#{&&:#{==:#{session_id},${nativeSessionId}},#{==:#{session_created},${created}}}`;
+            const command = args.map((arg) => (arg === ";" ? ";" : shellEscape(arg))).join(" ");
+            const output = await options.run([
+                "if-shell",
+                "-t",
+                nativeSessionId,
+                "-F",
+                condition,
+                command,
+                `display-message -p '${sentinel}'`,
+            ]);
+            assertOpen();
+            if (output.trim() === sentinel)
+                throw new Error("Selected live tmux session changed during admission");
+            return output;
+        };
+        const promotion = new WorkspacePromotionAuthority({
+            daemonInstanceId: options.generation,
+            registry: options.registry,
+            io: { runTmux: run },
+        });
+        try {
+            const result = await promotion.promote({
+                operationId: randomUUID(),
+                expectedDaemonInstanceId: options.generation,
+                intent: { sessionId: fleetSessionIdForName(name) },
+            });
+            await run(["display-message", "-p", "-t", nativeSessionId, "#{session_id}"]);
+            return { workspaceName: result.resource.workspaceName, liveSessionId };
+        }
+        finally {
+            await promotion.dispose();
+        }
+    };
+    return {
+        openSession(liveSessionId) {
+            WorkspaceCatalogLiveSessionIdSchemaZ.parse(liveSessionId);
+            assertOpen();
+            const previous = pending.get(liveSessionId);
+            if (previous)
+                return previous;
+            if (pending.size >= 16)
+                throw new Error("Session admission capacity reached");
+            const operation = tail
+                .then(() => open(liveSessionId))
+                .finally(() => pending.delete(liveSessionId));
+            pending.set(liveSessionId, operation);
+            tail = operation.catch(() => { });
+            return operation;
+        },
+        async dispose() {
+            disposed = true;
+            await tail;
+        },
+    };
+}

package/packages/daemon/dist/lib/tmux-servers-cli.js

@@ -0,0 +1,134 @@
+import { randomUUID } from "node:crypto";
+import { SavedMachineSchema, TmuxServerIdSchemaZ, TmuxServerRegistrationRequestSchemaZ, WorkspaceSessionCreateArgumentsSchemaZ, } from "@tmux-ide/contracts";
+import { createTmuxServerClient, listTmuxServers, registerTmuxServer, removeTmuxServer, TmuxServerClientError, } from "@tmux-ide/daemon-client/tmux-server-client";
+import { canonicalDaemonUrl } from "./canonical-daemon.js";
+import { ensureCanonicalDaemon } from "./canonical-daemon-bootstrap.js";
+import { openSshDaemonTransport } from "./ssh-daemon-transport.js";
+import { loadSavedMachines } from "./saved-machines.js";
+/** Parse before acquiring a transport; invalid input cannot start a daemon. */
+export function parseTmuxServersOperation(options) {
+    const command = options.command ?? "list";
+    if (options.ssh !== undefined)
+        SavedMachineSchema.shape.sshTarget.parse(options.ssh);
+    if (command === "create") {
+        if (options.socketName !== undefined ||
+            options.socketPath !== undefined ||
+            options.label !== undefined)
+            throw new Error("servers create requires a registered server ID and --session-name NAME");
+        return {
+            command,
+            serverId: TmuxServerIdSchemaZ.parse(options.serverId),
+            input: WorkspaceSessionCreateArgumentsSchemaZ.parse({
+                displayName: options.sessionName,
+                ...(options.cwd ? { cwd: options.cwd } : {}),
+            }),
+        };
+    }
+    if (options.sessionName !== undefined || options.cwd !== undefined)
+        throw new Error("--session-name and --dir are only supported by servers create");
+    if (command === "add") {
+        if (options.serverId ||
+            (options.socketName === undefined) === (options.socketPath === undefined))
+            throw new Error("servers add requires exactly one of --socket-name NAME or --socket-path /PATH");
+        return {
+            command,
+            registration: TmuxServerRegistrationRequestSchemaZ.parse({
+                label: options.label ?? options.socketName ?? "Custom server",
+                selector: options.socketName !== undefined
+                    ? { kind: "name", name: options.socketName }
+                    : { kind: "path", path: options.socketPath },
+            }),
+        };
+    }
+    if (options.socketName !== undefined ||
+        options.socketPath !== undefined ||
+        options.label !== undefined)
+        throw new Error("Socket selectors and --name are only supported by servers add");
+    if (command === "list" && options.serverId === undefined)
+        return { command };
+    if (command === "remove" || command === "sessions")
+        return { command, serverId: TmuxServerIdSchemaZ.parse(options.serverId) };
+    throw new Error("Usage: tmux-ide servers list|add|remove <server-id>|sessions <server-id>|create <server-id> --session-name NAME [--ssh HOST] [--json]");
+}
+export async function connectTmuxServersCli(options) {
+    const hostClientId = randomUUID();
+    if (options.ssh !== undefined) {
+        const transport = await openSshDaemonTransport({ alias: options.ssh });
+        try {
+            const expected = loadSavedMachines().machines.find((machine) => machine.sshTarget === options.ssh)?.expectedEnvironmentId;
+            if (expected && transport.daemon.environmentId !== expected)
+                throw new Error("SSH route reached a different environment than the saved profile");
+            return {
+                client: {
+                    baseUrl: transport.baseUrl,
+                    ownerToken: transport.daemon.authToken,
+                    hostClientId,
+                    origin: transport.baseUrl,
+                },
+                dispose: () => transport.dispose(),
+            };
+        }
+        catch (error) {
+            transport.dispose();
+            throw error;
+        }
+    }
+    // Server registration addresses the daemon, not the invoking shell's tmux server.
+    const { candidate } = await ensureCanonicalDaemon({
+        entryPath: options.entryPath,
+        expectedProductVersion: options.expectedProductVersion,
+        tmuxServerIntent: null,
+    });
+    if (!candidate.authToken)
+        throw new Error("Daemon owner authority is unavailable; update the local daemon");
+    const baseUrl = canonicalDaemonUrl("http", candidate.bindHostname, candidate.port);
+    return {
+        client: { baseUrl, ownerToken: candidate.authToken, hostClientId, origin: baseUrl },
+        dispose() { },
+    };
+}
+export async function runTmuxServersCli(options, connect) {
+    const operation = parseTmuxServersOperation(options);
+    const connection = await connect();
+    try {
+        // Probe the versioned resource before writes. An older daemon is unsupported,
+        // never a reason to execute a raw command against a default server.
+        let catalog;
+        try {
+            catalog = await listTmuxServers(connection.client);
+        }
+        catch (error) {
+            if (error instanceof TmuxServerClientError && [404, 405, 426].includes(error.status ?? 0))
+                throw new Error("This daemon does not support tmux server selection; update the selected machine's daemon", { cause: error });
+            throw error;
+        }
+        if (operation.command === "list")
+            return catalog;
+        if (operation.command === "add")
+            return await registerTmuxServer(connection.client, operation.registration);
+        const server = catalog.servers.find((candidate) => candidate.serverId === operation.serverId);
+        if (!server)
+            throw new Error("Selected tmux server is not registered; run tmux-ide servers list");
+        if (operation.command === "remove") {
+            await removeTmuxServer(connection.client, server.serverId);
+            return { removed: true, serverId: server.serverId };
+        }
+        if (server.state !== "online")
+            throw new Error("Selected tmux server is offline; no session operation was attempted");
+        const client = createTmuxServerClient(connection.client, {
+            serverId: server.serverId,
+            generation: server.generation,
+        });
+        try {
+            return operation.command === "create"
+                ? await client.createSession(randomUUID(), operation.input)
+                : await client.sessions();
+        }
+        finally {
+            client.dispose();
+        }
+    }
+    finally {
+        connection.dispose();
+    }
+}

package/packages/daemon/dist/lib/tmux-session-mutation-fence.js

@@ -0,0 +1,55 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID } from "node:crypto";
+import { WorkspaceCatalogLiveSessionIdSchemaZ } from "@tmux-ide/contracts";
+import { liveSessionIdForNativeIdentity } from "../terminal/protocol/live-session-identity.js";
+import { shellEscape } from "./shell.js";
+/** Session identity travels with the mutation lane, never in global mutable selection. */
+export function createTmuxSessionMutationFence() {
+    const context = new AsyncLocalStorage();
+    return {
+        wrap(run) {
+            return (args) => {
+                const selected = context.getStore();
+                if (!selected)
+                    return run(args);
+                const sentinel = `tmux-session-stale.${randomUUID()}`;
+                const output = run([
+                    "if-shell",
+                    "-t",
+                    `=${selected.name}`,
+                    "-F",
+                    `#{&&:#{==:#{session_id},${selected.id}},#{==:#{session_created},${selected.created}}}`,
+                    args.map((arg) => (arg === ";" ? ";" : shellEscape(arg))).join(" "),
+                    `display-message -p '${sentinel}'`,
+                ]);
+                if (output.trim() === sentinel)
+                    throw new Error("Selected live tmux session changed before mutation");
+                return output;
+            };
+        },
+        async execute(options) {
+            WorkspaceCatalogLiveSessionIdSchemaZ.parse(options.liveSessionId);
+            const raw = await options.run([
+                "list-sessions",
+                "-F",
+                "#{pid}\t#{session_id}\t#{session_created}\t#{session_name}",
+            ]);
+            const rows = raw
+                .trim()
+                .split("\n")
+                .map((line) => line.split("\t"))
+                .filter(([pid, id, created, name]) => pid &&
+                /^\d+$/.test(pid) &&
+                id &&
+                /^\$\d+$/.test(id) &&
+                created &&
+                /^\d+$/.test(created) &&
+                name === options.sessionName &&
+                liveSessionIdForNativeIdentity(pid, id, created) === options.liveSessionId);
+            if (rows.length !== 1)
+                throw new Error("Selected live tmux session is no longer available");
+            const [, id, created] = rows[0];
+            return context.run({ id: id, created: created, name: options.sessionName }, options.mutate);
+        },
+    };
+}

package/packages/daemon/dist/lib/tmux-window-link-guard.js

@@ -0,0 +1,88 @@
+export const WINDOW_LINK_GUARD_APPLIED = "link-guard.ok";
+export const WINDOW_LINK_GUARD_STALE = "link-guard.stale";
+/** if-shell -F and its first branch command do not yield in tmux's command queue.
+ * Keep the mutation first and synchronous. Do not insert run-shell/wait-for/UI.
+ * This checks a current tuple, not an immutable historical winlink (tmux has none).
+ * Use buildNativeWindowLinkPaneSelectGuard for guarded compound pane selection.
+ */
+export function buildNativeWindowLinkGuard(address, action) {
+    const { sessionId, windowIndex, expectedWindowId } = address;
+    if (!/^\$(?:0|[1-9]\d{0,15})$/u.test(sessionId) ||
+        !/^@(?:0|[1-9]\d{0,15})$/u.test(expectedWindowId) ||
+        !Number.isSafeInteger(Number(sessionId.slice(1))) ||
+        !Number.isSafeInteger(Number(expectedWindowId.slice(1))) ||
+        !Number.isSafeInteger(windowIndex) ||
+        windowIndex < 0 ||
+        (address.expectedServerPid !== undefined &&
+            !/^[1-9][0-9]{0,15}$/u.test(address.expectedServerPid)) ||
+        (address.expectedSessionCreated !== undefined &&
+            !/^(?:0|[1-9][0-9]{0,15})$/u.test(address.expectedSessionCreated)) ||
+        (action !== "select" && action !== "unlink")) {
+        throw new Error("Invalid native window link guard address or action");
+    }
+    const target = `${sessionId}:${windowIndex}`;
+    // CANFAIL target lookup makes all three comparisons necessary for missing targets.
+    let condition = `#{&&:#{==:#{session_id},${sessionId}},#{&&:#{==:#{window_index},${windowIndex}},#{==:#{window_id},${expectedWindowId}}}}`;
+    if (address.expectedServerPid !== undefined)
+        condition = `#{&&:#{==:#{pid},${address.expectedServerPid}},${condition}}`;
+    if (address.expectedSessionCreated !== undefined)
+        condition = `#{&&:#{==:#{session_created},${address.expectedSessionCreated}},${condition}}`;
+    const verb = action === "select" ? "select-window" : "unlink-window";
+    // Validated native IDs/index contain no quote, separator, or format syntax.
+    return [
+        "if-shell",
+        "-F",
+        "-t",
+        target,
+        condition,
+        `${verb} -t '${target}' ; display-message -p '${WINDOW_LINK_GUARD_APPLIED}'`,
+        `display-message -p '${WINDOW_LINK_GUARD_STALE}'`,
+    ];
+}
+/** Select an exact link and pane while preserving native user hooks. The window
+ * selection hook may yield or move topology, so revalidate after it. A failed
+ * second check is indeterminate: the window selection may already have happened.
+ */
+export function buildNativeWindowLinkPaneSelectGuard(address, paneId) {
+    const windowGuard = buildNativeWindowLinkGuard(address, "select");
+    if (!/^%(?:0|[1-9]\d{0,15})$/u.test(paneId) || !Number.isSafeInteger(Number(paneId.slice(1)))) {
+        throw new Error("Invalid native pane guard address");
+    }
+    const target = `${address.sessionId}:${address.windowIndex}`;
+    const paneCondition = `#{&&:#{==:#{pane_id},${paneId}},#{==:#{window_id},${address.expectedWindowId}}}`;
+    const stale = `display-message -p '${WINDOW_LINK_GUARD_STALE}'`;
+    const interrupted = "display-message -p 'link-guard.interrupted'";
+    // All interpolated IDs are canonical numeric native identities. Braces are
+    // tmux command groups, not a host shell or a caller-provided command language.
+    const linkCheck = (yes, no) => `if-shell -F -t '${target}' '${windowGuard[4]}' { ${yes} } { ${no} }`;
+    const paneCheck = (yes, no) => `if-shell -F -t '${paneId}' '${paneCondition}' { ${yes} } { ${no} }`;
+    const selectPane = `select-pane -t '${paneId}' ; display-message -p '${WINDOW_LINK_GUARD_APPLIED}'`;
+    const afterHook = paneCheck(linkCheck(selectPane, interrupted), interrupted);
+    return [
+        "if-shell",
+        "-F",
+        "-t",
+        paneId,
+        paneCondition,
+        linkCheck(`select-window -t '${target}' ; ${afterHook}`, stale),
+        stale,
+    ];
+}
+/** Consume only output associated with this request's own native command boundary.
+ * Nonzero completion reports native failure, including last-link unlink refusal.
+ * For compound selection this can follow partial mutation; it is not rollback proof.
+ * Missing/extra output or interrupted completion is indeterminate, never success;
+ * it must not trigger an automatic retry of a potentially completed mutation.
+ */
+export function classifyNativeWindowLinkGuardResult(status, stdout) {
+    if (status === null)
+        return "indeterminate";
+    if (status !== 0)
+        return "native-refused";
+    const output = stdout.trim();
+    if (output === WINDOW_LINK_GUARD_APPLIED)
+        return "applied";
+    if (output === WINDOW_LINK_GUARD_STALE)
+        return "stale";
+    return "indeterminate";
+}

package/packages/daemon/dist/lib/workspace-config-loader.js

@@ -1,3 +1,6 @@
+// Consumers outside the daemon tsconfig need the bundled declaration as well.
+// eslint-disable-next-line @typescript-eslint/triple-slash-reference
+/// <reference path="../js-yaml.d.ts" />
 /**
  * Side-effect-free loader for repository-scoped WorkspaceConfigV1 files.
  *

package/packages/daemon/dist/lib/workspace-multiplexer-verbs.js

@@ -26,6 +26,7 @@ import { getDefaultWorkspaceRegistry } from "./workspace-registry.js";
 import { internalInteractionOperationMarker } from "./tmux-external-interaction-observer.js";
 import { INTERNAL_READ_OPERATION_OPTION, INTERNAL_SEND_OPERATION_OPTION, } from "./tmux-interaction-options.js";
 import { memorablePaneName } from "../terminal/protocol/pane-display-name.js";
+import { WindowLinkResolutionError } from "../terminal/mirror/window-link-authority.js";
 const CREATION_OPTION = "@tmux_ide_creation_id";
 const SEMANTIC_PANE_OPTION = "@tmux_ide_pane_id";
 const SEMANTIC_WINDOW_OPTION = "@tmux_ide_window_id";
@@ -47,6 +48,10 @@ const ERROR_MESSAGES = {
     workspace_unavailable: "The requested workspace is not available for multiplexer verbs.",
     pane_not_found: "No pane in this workspace carries the requested semantic identity.",
     window_not_found: "No window in this workspace carries the requested identity.",
+    window_link_stale: "The window link observation is no longer current.",
+    window_link_ambiguous: "Select an explicit window link for this pane.",
+    window_link_session_mismatch: "The window link belongs to another session generation.",
+    window_link_backing_mismatch: "The window link no longer names the expected window.",
     ambiguous_target: "The requested identity names more than one live tmux object.",
     last_window_refused: "This is the session's last window. Close the session instead if that is what you mean.",
     last_pane_refused: "This is the session's last pane. Close the session instead if that is what you mean.",
@@ -121,7 +126,19 @@ export function parseMultiplexerPaneRows(output) {
             creationId: creationId === "" ? null : creationId,
         });
     }
-    return rows;
+    // list-panes -s repeats each backing for its session links. Identical native
+    // rows are one pane; conflicting observations fail closed.
+    const unique = new Map();
+    for (const row of rows) {
+        const previous = unique.get(row.paneId);
+        if (previous && JSON.stringify(previous) !== JSON.stringify(row)) {
+            throw new WorkspaceMultiplexerError("workspace_unavailable", {
+                reason: "conflicting_linked_pane_observation",
+            });
+        }
+        unique.set(row.paneId, row);
+    }
+    return [...unique.values()];
 }
 /** Distinct windows in a pane listing, in first-seen order. */
 export function windowIdsOf(rows) {
@@ -205,6 +222,61 @@ export class WorkspaceMultiplexerAuthority {
     mutate(raw, timing) {
         return this.#mutate(raw, timing);
     }
+    /** Runs only inside the existing semantic mutation lane; never rediscovers a stale link. */
+    async mutateWindowLink(raw, execute) {
+        if (this.#disposed)
+            throw new WorkspaceMultiplexerError("workspace_unavailable");
+        const request = WorkspaceMultiplexerMutationRequestSchemaZ.parse(raw);
+        if (request.expectedDaemonInstanceId !== this.#daemonInstanceId)
+            throw new WorkspaceMultiplexerError("daemon_instance_mismatch");
+        const intent = request.intent;
+        if (intent.verb !== "workspace.window.link.select" &&
+            intent.verb !== "workspace.window.link.unlink" &&
+            intent.verb !== "workspace.pane.select")
+            throw new TypeError("Expected a window-link selection or unlink intent");
+        const workspace = this.#registry.get(intent.workspaceName);
+        if (!workspace)
+            throw new WorkspaceMultiplexerError("workspace_not_found");
+        const envelope = {
+            operationId: request.operationId,
+            daemonInstanceId: this.#daemonInstanceId,
+            workspaceName: intent.workspaceName,
+        };
+        try {
+            const result = await execute(workspace.sessionName, intent.verb === "workspace.pane.select"
+                ? {
+                    action: "select",
+                    ...(intent.windowLink ? { target: intent.windowLink } : {}),
+                    paneId: intent.semanticPaneId,
+                }
+                : {
+                    action: intent.verb === "workspace.window.link.unlink" ? "unlink" : "select",
+                    target: intent.target,
+                });
+            if (result.outcome !== "applied") {
+                throw new WorkspaceMultiplexerError(result.outcome === "stale"
+                    ? "window_link_stale"
+                    : result.outcome === "native-refused"
+                        ? "mutation_failed"
+                        : "mutation_unverified", { reason: result.outcome });
+            }
+            return WorkspaceMultiplexerMutationResultSchemaZ.parse(intent.verb === "workspace.pane.select"
+                ? {
+                    ...envelope,
+                    verb: intent.verb,
+                    outcome: "applied",
+                    semanticPaneId: intent.semanticPaneId,
+                }
+                : { ...envelope, verb: intent.verb, outcome: "applied", target: intent.target });
+        }
+        catch (error) {
+            if (error instanceof WorkspaceMultiplexerError)
+                throw error;
+            if (error instanceof WindowLinkResolutionError)
+                throw new WorkspaceMultiplexerError(error.reason, { operationId: request.operationId }, error);
+            throw new WorkspaceMultiplexerError("mutation_unverified", { operationId: request.operationId }, error);
+        }
+    }
     /**
      * Capture a semantically addressed pane for an authored read. The tmux
      * after-capture hook is the completion authority; this method only performs
@@ -436,6 +508,11 @@ export class WorkspaceMultiplexerAuthority {
             workspaceName: intent.workspaceName,
         };
         switch (intent.verb) {
+            case "workspace.window.link.select":
+            case "workspace.window.link.unlink":
+                throw new WorkspaceMultiplexerError("workspace_unavailable", {
+                    reason: "window_link_authority_required",
+                });
             case "workspace.window.split":
                 return this.#split(request, workspace, envelope);
             case "workspace.window.kill":
@@ -826,6 +903,10 @@ export class WorkspaceMultiplexerAuthority {
         };
     }
     #select(intent, sessionName, envelope, timing) {
+        if (intent.windowLink)
+            throw new WorkspaceMultiplexerError("workspace_unavailable", {
+                reason: "window_link_authority_required",
+            });
         const timed = (operation, run) => {
             if (!timing)
                 return run();

package/packages/daemon/dist/lib/workspace-pane-creation.js

@@ -1,10 +1,10 @@
 import { boundedTmuxRead } from "./bounded-tmux-read.js";
 import { accessSync, constants, realpathSync, statSync } from "node:fs";
-import { delimiter, isAbsolute, join, relative, sep } from "node:path";
+import { isAbsolute, relative, sep } from "node:path";
 import { WorkspacePaneCreateMutationRequestSchemaZ, WorkspacePaneCreateMutationResultSchemaZ, } from "@tmux-ide/contracts";
 import { runTmuxBinary, TmuxError } from "@tmux-ide/tmux-bridge";
 import { createNamedSocketFence } from "./tmux-named-socket-fence.js";
-import { resolveBundledTmux } from "./bundled-tmux.js";
+import { resolveTmuxExecutable as resolvePinnedTmuxExecutable, tmuxClientEnvironment, } from "./tmux-client-execution.js";
 import { probeProjectReadiness } from "./project-readiness-probe.js";
 import { agentHintForCommand } from "./agent-kind.js";
 import { loadWorkspaceConfig, WorkspaceConfigLoadError, } from "./workspace-config-loader.js";
@@ -12,7 +12,7 @@ import { getDefaultWorkspaceRegistry } from "./workspace-registry.js";
 import { memorablePaneName } from "../terminal/protocol/pane-display-name.js";
 import { shellEscape } from "./shell.js";
 import { MissionRepository } from "./mission-repository.js";
-import { resolveRuntimeNamespace } from "./runtime-namespace.js";
+import { resolveRuntimeNamespace, resolveTmuxServerIntent } from "./runtime-namespace.js";
 import { prepareTmuxTruecolorEnvironment } from "./tmux-terminal-color.js";
 import { captureUnixSocketIdentity, revalidateUnixSocketIdentity, } from "./unix-socket-authority.js";
 const MAX_LIVE_OR_UNSAFE_OPERATIONS = 128;
@@ -102,61 +102,17 @@ function assertEffectiveConfigProvenance(workspace, canonicalRoot, source) {
     }
 }
 function resolveTmuxExecutable() {
+    // Preserve development artifact qualification errors instead of masking them.
     if (resolveRuntimeNamespace().development)
-        return resolveBundledTmux();
-    const configured = process.env.TMUX_IDE_TMUX_BIN;
-    if (!configured) {
-        const bundled = resolveBundledTmux();
-        if (bundled)
-            return bundled;
-    }
-    const candidates = configured
-        ? [configured]
-        : (process.env.PATH ?? "")
-            .split(delimiter)
-            // Empty and relative PATH entries mean the daemon/project cwd. They
-            // are never executable authority for a privileged tmux mutation.
-            .filter((entry) => entry.length > 0 && isAbsolute(entry))
-            .map((entry) => join(entry, "tmux"));
-    for (const candidate of candidates) {
-        try {
-            if (!isAbsolute(candidate))
-                continue;
-            accessSync(candidate, constants.X_OK);
-            const canonical = realpathSync(candidate);
-            if (statSync(canonical).isFile())
-                return canonical;
-        }
-        catch {
-            // Continue to the next daemon-start candidate.
-        }
+        return resolvePinnedTmuxExecutable();
+    try {
+        return resolvePinnedTmuxExecutable();
     }
-    throw new WorkspacePaneCreationError("workspace_unavailable", {
-        reason: "tmux_executable_unavailable",
-    });
-}
-const SAFE_TERMINAL_VALUE = /^(?:xterm|screen|tmux|rxvt|vt100|ansi)[A-Za-z0-9+._-]{0,58}$/u;
-const SAFE_LOCALE_VALUE = /^[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}$/u;
-/**
- * The pinned tmux client receives only presentation metadata. Everything else
- * is denied by omission: PATH/HOME/SHELL, TMUX/TMUX_PANE/TMUX_TMPDIR, shell
- * startup hooks, dynamic-loader variables, Node options, and project secrets
- * cannot redirect authority or inject code into this daemon-owned execution.
- */
-function tmuxClientEnvironment(source) {
-    const environment = {
-        TERM: SAFE_TERMINAL_VALUE.test(source.TERM ?? "") ? source.TERM : "xterm-256color",
-        // A pinned runner may be the first tmux client and therefore create the
-        // server. Never let a headless parent (`TERM=dumb`, `NO_COLOR=1`) become
-        // the global environment inherited by every later interactive child.
-        COLORTERM: "truecolor",
-    };
-    for (const name of ["LANG", "LC_ALL", "LC_CTYPE"]) {
-        const value = source[name];
-        if (value && SAFE_LOCALE_VALUE.test(value))
-            environment[name] = value;
+    catch {
+        throw new WorkspacePaneCreationError("workspace_unavailable", {
+            reason: "tmux_executable_unavailable",
+        });
     }
-    return environment;
 }
 function tmuxSocketFromEnvironment() {
     const match = /^(.*),[0-9]+,[0-9]+$/u.exec(process.env.TMUX ?? "");
@@ -165,7 +121,7 @@ function tmuxSocketFromEnvironment() {
 export function resolveWorkspacePaneTmuxAuthority() {
     const namespace = resolveRuntimeNamespace();
     const executablePath = resolveTmuxExecutable();
-    if (namespace.development)
+    if (resolveTmuxServerIntent()?.source === "explicit")
         return Object.freeze({ executablePath, socketSelector: namespace.tmuxSocket });
     const environmentSocket = tmuxSocketFromEnvironment();
     if (environmentSocket) {
@@ -186,7 +142,7 @@ export function resolveWorkspacePaneTmuxAuthority() {
     // A sessionless daemon may start before the default tmux server exists. Pin
     // the daemon's default socket *name* and captured environment rather than
     // consulting a later request's TMUX/PATH.
-    return Object.freeze({ executablePath, socketSelector: resolveRuntimeNamespace().tmuxSocket });
+    return Object.freeze({ executablePath, socketSelector: namespace.tmuxSocket });
 }
 /** Execute mutations only through the daemon-generation-pinned tmux authority. */
 export function createPinnedWorkspaceTmuxRunner(authority, options = {}) {