tmux-ide 2.9.10 → 2.9.12

package/packages/daemon/dist/terminal/mirror/session-channel.js

@@ -177,6 +177,8 @@ export class SessionChannel {
     fittedWindows = new Map();
     cancelSync = null;
     syncOrdinal = 0;
+    identityJoinOrdinal = 0;
+    trustedInventoryJoinsMissing = false;
     completedSyncOrdinal = 0;
     lastDisplayNameSyncAtMs = 0;
     disposed = false;
@@ -412,20 +414,28 @@ export class SessionChannel {
     }
     /**
      * Strict daemon-internal inventory from this channel's current tmux truth.
-     * Unlike the background discovery path, this query awaits descriptor
-     * reconciliation before projecting and rejects incomplete identity rather
-     * than returning the previous descriptor snapshot.
+     * Unlike background discovery, this query verifies current native membership
+     * before projecting and rejects incomplete identity. Stream admission may
+     * explicitly join missing pane records after that verification; ordinary
+     * inventory readers retain their existing fail-closed no-join contract.
      */
-    describeTrustedInventory(expectedRuntimeSessionId) {
+    describeTrustedInventory(expectedRuntimeSessionId, joinMissingPanes = false) {
         if (this.disposed) {
             return Promise.reject(new Error(`mirror session ${this.opts.session} is disposed`));
         }
         if (this.trustedInventoryFlight) {
+            // A default read can fail precisely because it does not join new panes.
+            // Preserve that failure for its caller, then qualify admission separately.
+            if (joinMissingPanes &&
+                !this.trustedInventoryJoinsMissing &&
+                this.trustedInventoryFlightSessionId === expectedRuntimeSessionId)
+                return this.trustedInventoryFlight.then(() => this.describeTrustedInventory(expectedRuntimeSessionId, true), () => this.describeTrustedInventory(expectedRuntimeSessionId, true));
             return this.trustedInventoryFlightSessionId === expectedRuntimeSessionId
                 ? this.trustedInventoryFlight
                 : Promise.reject(new Error(`trusted inventory identity changed for ${this.opts.session}`));
         }
-        const flight = this.refreshTrustedInventory(expectedRuntimeSessionId)
+        this.trustedInventoryJoinsMissing = joinMissingPanes;
+        const flight = this.refreshTrustedInventory(expectedRuntimeSessionId, 0, joinMissingPanes)
             .catch((error) => {
             this.windowLinkAuthority?.invalidate();
             this.latestWindowStage = null;
@@ -2723,7 +2733,7 @@ export class SessionChannel {
         }
         return { listed, movedWindowRuntimeIds };
     }
-    async refreshTrustedInventory(expectedRuntimeSessionId, attempt = 0) {
+    async refreshTrustedInventory(expectedRuntimeSessionId, attempt = 0, joinMissingPanes = false) {
         const authorityOrdinal = this.windowIdentityOrdinal;
         const beforeLines = await this.io.request(`list-panes -s -t "${expectedRuntimeSessionId}" -F "${SESSION_PANE_DESCRIPTOR_FORMAT}"`);
         if (this.disposed)
@@ -2800,7 +2810,7 @@ export class SessionChannel {
             authorityOrdinal !== this.windowIdentityOrdinal) {
             if (attempt >= 1)
                 throw new Error(`trusted inventory for ${this.opts.session} did not settle`);
-            return await this.refreshTrustedInventory(expectedRuntimeSessionId, attempt + 1);
+            return await this.refreshTrustedInventory(expectedRuntimeSessionId, attempt + 1, joinMissingPanes);
         }
         if (this.disposed)
             throw new Error(`mirror session ${this.opts.session} is disposed`);
@@ -2832,17 +2842,27 @@ export class SessionChannel {
             !stagedPaneMembershipExact ||
             stagedPaneCount !== descriptors.length ||
             stagedPaneIds.size !== descriptors.length ||
-            [...computedWindowCounts.keys()].some((runtimeWindowId) => !confirmedWindowStage.windows.has(runtimeWindowId)) ||
-            descriptors.some((descriptor) => {
-                const pane = this.panesByRuntime.get(descriptor.runtimePaneId);
-                const window = confirmedWindowStage.windows.get(descriptor.windowId);
-                return (!pane ||
-                    !window?.semanticId ||
-                    descriptor.semanticPaneId !== pane.semanticId ||
-                    descriptor.semanticWindowId !== window.semanticId ||
-                    !WorkspaceIdSchemaZ.safeParse(pane.semanticId).success ||
-                    !WorkspaceIdSchemaZ.safeParse(window.semanticId).success);
-            })) {
+            [...computedWindowCounts.keys()].some((runtimeWindowId) => !confirmedWindowStage.windows.has(runtimeWindowId)))
+            throw new Error(`trusted inventory for ${this.opts.session} lacks verified identity`);
+        // Fresh native inventory can beat background discovery after window creation.
+        // Join verified stable membership before projecting semantic records.
+        if (joinMissingPanes &&
+            descriptors.some((pane) => this.panesByRuntime.get(pane.runtimePaneId)?.semanticId !== pane.semanticPaneId)) {
+            this.discovery.invalidate();
+            await this.reconcileIdentity(descriptors, runtimePaneIds, () => authorityOrdinal === this.windowIdentityOrdinal, false);
+        }
+        if (this.disposed || authorityOrdinal !== this.windowIdentityOrdinal)
+            throw new Error(`trusted inventory for ${this.opts.session} changed during identity join`);
+        if (descriptors.some((descriptor) => {
+            const pane = this.panesByRuntime.get(descriptor.runtimePaneId);
+            const window = confirmedWindowStage.windows.get(descriptor.windowId);
+            return (!pane ||
+                !window?.semanticId ||
+                descriptor.semanticPaneId !== pane.semanticId ||
+                descriptor.semanticWindowId !== window.semanticId ||
+                !WorkspaceIdSchemaZ.safeParse(pane.semanticId).success ||
+                !WorkspaceIdSchemaZ.safeParse(window.semanticId).success);
+        })) {
             throw new Error(`trusted inventory for ${this.opts.session} lacks verified identity`);
         }
         const previousCurrentWindow = this.currentWindow;
@@ -3174,7 +3194,8 @@ export class SessionChannel {
             })),
         };
     }
-    async reconcileIdentity(descriptors, listed) {
+    async reconcileIdentity(descriptors, listed, current = () => true, publish = true) {
+        const joinOrdinal = ++this.identityJoinOrdinal;
         if (this.disposed)
             return false;
         if (this.opts.hasSharedWindowConflict?.()) {
@@ -3205,7 +3226,7 @@ export class SessionChannel {
             ok: false,
             error: cause instanceof Error ? cause.message : String(cause),
         }))));
-        if (this.disposed)
+        if (this.disposed || !current() || joinOrdinal !== this.identityJoinOrdinal)
             return plan.stampEffects.length > 0;
         const reconciliation = finalizeWorkspaceTmuxReconciliation(plan, outcomes);
         const descriptorByRuntime = new Map(descriptors.map((d) => [d.runtimePaneId, d]));
@@ -3311,9 +3332,11 @@ export class SessionChannel {
          * without this the new pane stays invisible until something else happens to
          * move a layout, and a split looks like it did not reach the view.
          */
-        for (const runtimeId of this.layoutByWindow.keys())
-            this.emitLayout(runtimeId);
-        this.emitLayoutAuthority();
+        if (publish) {
+            for (const runtimeId of this.layoutByWindow.keys())
+                this.emitLayout(runtimeId);
+            this.emitLayoutAuthority();
+        }
         this.settleFirstJoin();
         return plan.stampEffects.length > 0;
     }

package/packages/daemon/dist/terminal/pane-stream/pane-stream-websocket.js

@@ -1,7 +1,9 @@
+import { TERMINAL_PROJECTION_CAPABILITY_VERSION, TERMINAL_PROJECTION_LOCAL_CAPABILITY_VERSION, } from "@tmux-ide/contracts";
+import { PANE_STREAM_INPUT_LIFETIME_CAPABILITY_VERSION, PANE_STREAM_INPUT_BYTES_CAPABILITY_VERSION, } from "@tmux-ide/contracts";
 import { inflateSync } from "node:zlib";
 import { PaneStreamLayoutSnapshotFrameSchemaZ } from "@tmux-ide/contracts";
 import { z } from "zod";
-import { PANE_STREAM_MAX_HELD_DELTAS, PANE_STREAM_MAX_OUTPUT_BYTES, PANE_STREAM_MAX_PANES, PANE_STREAM_MAX_SEED_BYTES, PANE_STREAM_PROTOCOL_VERSION, PANE_STREAM_REDEEM_PATH, PANE_STREAM_WEBSOCKET_SUBPROTOCOL, TERMINAL_GRAPHICS_BLOB_CHUNK_BYTES, TERMINAL_GRAPHICS_CELL_PIXELS_CAPABILITY_VERSION, TERMINAL_GRAPHICS_PRECISE_PIXELS_CAPABILITY_VERSION, TERMINAL_GRAPHICS_LEGACY_MAX_IMAGE_BYTES, TERMINAL_GRAPHICS_ZLIB_CAPABILITY_VERSION, PaneStreamClientFrameSchemaZ, PaneStreamLoopbackWebSocketUrlSchemaZ, PaneStreamRedeemFrameSchemaZ, PaneStreamServerFrameSchemaZ, sharedMonotonicMicros, } from "@tmux-ide/contracts";
+import { PANE_STREAM_MAX_HELD_DELTAS, PANE_STREAM_MAX_OUTPUT_BYTES, PANE_STREAM_MAX_PANES, PANE_STREAM_MAX_SEED_BYTES, PANE_STREAM_PROTOCOL_VERSION, PANE_STREAM_REDEEM_PATH, PANE_STREAM_WEBSOCKET_SUBPROTOCOL, TERMINAL_GRAPHICS_BLOB_CHUNK_BYTES, TERMINAL_DELIVERY_BINARY_CAPABILITY_VERSION, TERMINAL_DELIVERY_BINARY_LOCAL_CAPABILITY_VERSION, TERMINAL_GRAPHICS_BINARY_CAPABILITY_VERSION, TERMINAL_GRAPHICS_LOCAL_CAPABILITY_VERSION, encodeTerminalGraphicsBinary, encodeTerminalDeliveryBinaryChunk, TERMINAL_GRAPHICS_CELL_PIXELS_CAPABILITY_VERSION, TERMINAL_GRAPHICS_PRECISE_PIXELS_CAPABILITY_VERSION, TERMINAL_GRAPHICS_LEGACY_MAX_IMAGE_BYTES, TERMINAL_GRAPHICS_ZLIB_CAPABILITY_VERSION, PaneStreamClientFrameSchemaZ, PaneStreamLoopbackWebSocketUrlSchemaZ, PaneStreamRedeemFrameSchemaZ, PaneStreamServerFrameSchemaZ, sharedMonotonicMicros, } from "@tmux-ide/contracts";
 import { canonicalOriginOrNull, digestSecret, digestsEqual, rawDataByteLength, rawDataToBuffer, safeCloseSocket, strictJsonParse, } from "../attachments/admission-util.js";
 import { SessionRuntimeControllerLeaseError } from "../session-runtime/registry.js";
 import { terminalDeliveryObservationOrdinal } from "../session-runtime/terminal-delivery-observation-identity.js";
@@ -114,6 +116,7 @@ function errorFrameCode(error) {
  * ticket digests; a daemon restart makes every prior descriptor inert.
  */
 export class PaneStreamAdmissionCoordinator {
+    #localImages;
     #instanceId;
     #webSocketUrl;
     #leaseManager;
@@ -144,6 +147,7 @@ export class PaneStreamAdmissionCoordinator {
     #shuttingDown = false;
     #shutdownPromise = null;
     constructor(options) {
+        this.#localImages = options.localImages;
         this.#instanceId = BindingIdSchemaZ.parse(options.daemonInstanceId);
         this.#webSocketUrl = PaneStreamLoopbackWebSocketUrlSchemaZ.parse(options.webSocketUrl);
         this.#leaseManager = options.leaseManager;
@@ -193,7 +197,7 @@ export class PaneStreamAdmissionCoordinator {
             try {
                 const describeStartedAtMicros = trace ? this.#observability.nowMicros() : 0;
                 if (this.#mirror.describeSessionAuthority) {
-                    const authority = await this.#mirror.describeSessionAuthority(context.sessionName);
+                    const authority = await this.#mirror.describeSessionAuthority(context.sessionName, request.panes);
                     described = authority.description;
                     runtimeSessionId = authority.runtimeSessionId;
                 }
@@ -406,6 +410,7 @@ export class PaneStreamAdmissionCoordinator {
                 let live;
                 try {
                     live = new PaneStreamLiveConnection({
+                        localImages: this.#localImages,
                         clientId: `psc-${this.#clientCounter}`,
                         socket,
                         descriptor: structuredClone(descriptor),
@@ -613,6 +618,8 @@ export function rawGraphicsState(state) {
 }
 const GRAPHICS_SEND_WINDOW_BYTES = 2 * 1024 * 1024;
 export class PaneStreamLiveConnection {
+    #localImages;
+    #localLeases = new Map();
     #clientId;
     #socket;
     #descriptor;
@@ -700,6 +707,7 @@ export class PaneStreamLiveConnection {
         return elapsed;
     }
     constructor(options) {
+        this.#localImages = options.localImages;
         this.#clientId = options.clientId;
         this.#socket = options.socket;
         this.#descriptor = options.descriptor;
@@ -765,6 +773,14 @@ export class PaneStreamLiveConnection {
         try {
             sendControl(this.#socket, {
                 type: "ready",
+                ...(this.#sessionRuntimeBinding &&
+                    this.#descriptor.terminalDelivery?.protocolVersions.includes(PANE_STREAM_INPUT_LIFETIME_CAPABILITY_VERSION)
+                    ? { inputLifetime: true }
+                    : {}),
+                ...(this.#sessionRuntimeBinding &&
+                    this.#descriptor.terminalDelivery?.protocolVersions.includes(PANE_STREAM_INPUT_BYTES_CAPABILITY_VERSION)
+                    ? { inputBytes: true }
+                    : {}),
                 protocolVersion: PANE_STREAM_PROTOCOL_VERSION,
                 daemonInstanceId: this.#binding.daemonInstanceId,
                 requestId: this.#binding.requestId,
@@ -807,6 +823,12 @@ export class PaneStreamLiveConnection {
         this.#stopAuthoritySnapshots?.();
         this.#stopAuthoritySnapshots = null;
         const closures = [];
+        this.#localLeases.clear();
+        if (this.#localImages)
+            closures.push(this.#localImages.releaseClient({
+                generation: this.#localImages.identity.generation,
+                client: this.#descriptor.leaseId,
+            }));
         const layoutSubscription = this.#layoutSubscription;
         this.#layoutSubscription = null;
         if (layoutSubscription)
@@ -1019,7 +1041,7 @@ export class PaneStreamLiveConnection {
                 return true;
             let incarnation = null;
             for (const message of pending) {
-                if (message.type !== "terminal.delivery")
+                if (message.type !== "terminal.delivery" && message.type !== "terminal.projection")
                     continue;
                 if (message.workspaceName !== this.#descriptor.workspaceName ||
                     message.semanticPaneId !== channel.semanticPaneId ||
@@ -1127,7 +1149,15 @@ export class PaneStreamLiveConnection {
         this.#closeIfAllPanesGone();
     }
     async #sendTerminalDelivery(pane, message) {
-        if (message.type === "terminal.delivery") {
+        if (message.type === "terminal.projection") {
+            const channel = this.#panes.get(pane);
+            if (channel?.deliveryAddress)
+                channel.deliveryAddress.incarnation = message.incarnation;
+            if (channel)
+                channel.binaryCells = true;
+            this.#sendFrame(pane, { type: "terminal-projection-envelope", pane, envelope: message });
+        }
+        else if (message.type === "terminal.delivery") {
             if (!this.#diagnosticFirstSeedObserved) {
                 this.#diagnosticFirstSeedObserved = true;
                 this.#recordDiagnosticLifecycle("pane-stream-first-seed");
@@ -1135,6 +1165,8 @@ export class PaneStreamLiveConnection {
             const channel = this.#panes.get(pane);
             if (channel?.deliveryAddress)
                 channel.deliveryAddress.incarnation = message.incarnation;
+            if (channel)
+                channel.binaryCells = message.encoding === "semantic-binary-v1";
             // The trusted lease address was fixed at delivery admission; preserve the
             // exact envelope and its observation identity through transmission.
             const detailedDeliveryObservation = this.#observability?.enabled === true;
@@ -1210,13 +1242,18 @@ export class PaneStreamLiveConnection {
             }
         }
         else if (message.type === "terminal.delivery.chunk") {
-            this.#sendFrame(pane, {
-                type: "terminal-delivery-chunk",
-                pane,
-                transactionId: message.transactionId,
-                index: message.index,
-                data: Buffer.from(message.bytes).toString("base64"),
-            });
+            if (this.#panes.get(pane)?.binaryCells) {
+                this.#sendEncoded(pane, Buffer.from(encodeTerminalDeliveryBinaryChunk({ pane, transactionId: message.transactionId, index: message.index }, message.bytes)), true);
+            }
+            else {
+                this.#sendFrame(pane, {
+                    type: "terminal-delivery-chunk",
+                    pane,
+                    transactionId: message.transactionId,
+                    index: message.index,
+                    data: Buffer.from(message.bytes).toString("base64"),
+                });
+            }
         }
         else {
             this.#sendFrame(pane, { type: "terminal-delivery-fault", pane, fault: message });
@@ -1236,6 +1273,19 @@ export class PaneStreamLiveConnection {
         // when served.
         const zlib = this.#descriptor.terminalDelivery?.protocolVersions.includes(TERMINAL_GRAPHICS_ZLIB_CAPABILITY_VERSION) === true;
         channel.graphicsZlib = zlib;
+        channel.graphicsLocal =
+            !!this.#localImages &&
+                this.#descriptor.terminalDelivery?.protocolVersions.some((version) => version === TERMINAL_GRAPHICS_LOCAL_CAPABILITY_VERSION ||
+                    version === TERMINAL_DELIVERY_BINARY_LOCAL_CAPABILITY_VERSION ||
+                    version === TERMINAL_PROJECTION_LOCAL_CAPABILITY_VERSION) === true;
+        channel.graphicsInline = new Set();
+        channel.graphicsBinary =
+            this.#descriptor.terminalDelivery?.protocolVersions.some((version) => version === TERMINAL_GRAPHICS_BINARY_CAPABILITY_VERSION ||
+                version === TERMINAL_GRAPHICS_LOCAL_CAPABILITY_VERSION ||
+                version === TERMINAL_DELIVERY_BINARY_CAPABILITY_VERSION ||
+                version === TERMINAL_PROJECTION_CAPABILITY_VERSION ||
+                version === TERMINAL_DELIVERY_BINARY_LOCAL_CAPABILITY_VERSION ||
+                version === TERMINAL_PROJECTION_LOCAL_CAPABILITY_VERSION) === true;
         // Renderers that report cell pixels learn up front that this daemon
         // accepts them, before any image exists.
         const cellPixels = this.#descriptor.terminalDelivery?.protocolVersions.includes(TERMINAL_GRAPHICS_CELL_PIXELS_CAPABILITY_VERSION) === true;
@@ -1263,6 +1313,8 @@ export class PaneStreamLiveConnection {
                     ...(zlib ? state : rawGraphicsState(state)),
                     ...(cellPixels ? { cellPixels: true } : {}),
                     ...(preciseCellPixels ? { preciseCellPixels: true } : {}),
+                    ...(channel.graphicsBinary ? { binaryBlobs: true } : {}),
+                    ...(channel.graphicsLocal ? { localFiles: true } : {}),
                 },
             });
             if (pushed.length > 0)
@@ -1279,15 +1331,23 @@ export class PaneStreamLiveConnection {
                     placements: [],
                     cellPixels: true,
                     ...(preciseCellPixels ? { preciseCellPixels: true } : {}),
+                    ...(channel.graphicsBinary ? { binaryBlobs: true } : {}),
+                    ...(channel.graphicsLocal ? { localFiles: true } : {}),
                 },
             });
         }
     }
-    #requestGraphics(pane, digests) {
+    #requestGraphics(pane, digests, preferInline = false) {
         const channel = this.#panes.get(pane);
         // Requests are only meaningful after an announcement; ignore stray ones.
         if (!channel || channel.closed || !channel.graphicsAnnounced)
             return;
+        if (preferInline && channel.graphicsLocal) {
+            for (const digest of digests) {
+                if ((channel.graphicsInline?.size ?? 0) < GRAPHICS_MAX_QUEUED_DIGESTS)
+                    channel.graphicsInline?.add(digest);
+            }
+        }
         this.#queueGraphics(channel, digests);
     }
     #queueGraphics(channel, digests) {
@@ -1308,6 +1368,7 @@ export class PaneStreamLiveConnection {
         try {
             while (!this.#closed && !channel.closed && channel.graphicsQueue.length > 0) {
                 const digest = channel.graphicsQueue.shift();
+                const inline = channel.graphicsInline?.delete(digest) ?? false;
                 const graphics = channel.delivery?.graphics;
                 const image = graphics?.image(digest);
                 if (!graphics || !image)
@@ -1334,6 +1395,49 @@ export class PaneStreamLiveConnection {
                     continue;
                 const format = raw ? (image.format === "rgba-zlib" ? "rgba" : "rgb") : image.format;
                 const total = data.byteLength;
+                if (!inline && channel.graphicsLocal && !raw && this.#localImages) {
+                    for (const [id, lease] of this.#localLeases)
+                        if (lease.expiresAt <= Date.now())
+                            this.#localLeases.delete(id);
+                    if (this.#localLeases.size < 64) {
+                        try {
+                            const lease = await this.#localImages.acquire({
+                                generation: this.#localImages.identity.generation,
+                                client: this.#descriptor.leaseId,
+                                digest,
+                                bytes: data,
+                            });
+                            if (this.#closed || channel.closed || graphics.image(digest) !== image) {
+                                await this.#localImages.release(lease);
+                                continue;
+                            }
+                            this.#localLeases.set(lease.id, {
+                                pane: channel.semanticPaneId,
+                                expiresAt: lease.expiresAt,
+                            });
+                            this.#sendFrame(null, {
+                                type: "terminal-graphics-local",
+                                pane: channel.semanticPaneId,
+                                generation: lease.generation,
+                                leaseId: lease.id,
+                                path: lease.path,
+                                expiresAt: lease.expiresAt,
+                                blob: {
+                                    digest,
+                                    format,
+                                    width: image.width,
+                                    height: image.height,
+                                    total,
+                                    offset: 0,
+                                },
+                            });
+                            continue;
+                        }
+                        catch {
+                            /* Optional transport: retain the negotiated inline fallback. */
+                        }
+                    }
+                }
                 for (let offset = 0; offset < total; offset += TERMINAL_GRAPHICS_BLOB_CHUNK_BYTES) {
                     while ((this.#socket.bufferedAmount ?? 0) > GRAPHICS_SEND_WINDOW_BYTES) {
                         if (this.#closed || channel.closed)
@@ -1347,6 +1451,20 @@ export class PaneStreamLiveConnection {
                     if (offset > 0 && graphics.image(digest) !== image)
                         break;
                     const end = Math.min(total, offset + TERMINAL_GRAPHICS_BLOB_CHUNK_BYTES);
+                    if (channel.graphicsBinary) {
+                        this.#sendEncoded(null, Buffer.from(encodeTerminalGraphicsBinary({
+                            pane: channel.semanticPaneId,
+                            blob: {
+                                digest,
+                                format,
+                                width: image.width,
+                                height: image.height,
+                                total,
+                                offset,
+                            },
+                        }, data.subarray(offset, end))), true);
+                        continue;
+                    }
                     this.#sendFrame(null, {
                         type: "terminal-graphics-blob",
                         pane: channel.semanticPaneId,
@@ -1666,7 +1784,12 @@ export class PaneStreamLiveConnection {
         if (this.#closed || this.#socket.readyState !== WS_OPEN)
             return;
         const encoded = JSON.stringify(frame);
-        const bytes = Buffer.byteLength(encoded, "utf8");
+        this.#sendEncoded(pane, encoded, false);
+    }
+    #sendEncoded(pane, encoded, binary) {
+        if (this.#closed || this.#socket.readyState !== WS_OPEN)
+            return;
+        const bytes = Buffer.byteLength(encoded);
         if (pane !== null) {
             this.#ledger.take(this.#clientId, pane, "ws-send-buffer", bytes);
             if (this.#deliveryAcks)
@@ -1675,7 +1798,7 @@ export class PaneStreamLiveConnection {
         this.#sendQueue.push({ pane, remaining: bytes });
         this.#sentBytesTotal += bytes;
         try {
-            this.#socket.send(encoded, { binary: false });
+            this.#socket.send(encoded, { binary });
         }
         catch {
             this.close(1011, "stream-unavailable");
@@ -1909,6 +2032,24 @@ export class PaneStreamLiveConnection {
             });
             return;
         }
+        if (frame.type === "terminal-projection-receipt") {
+            const channel = this.#deliveryChannel(frame.receipt);
+            if (!channel)
+                return;
+            if (!channel.delivery?.projectionReceipt)
+                return this.#failProtocol("protocol-error");
+            channel.delivery.projectionReceipt(frame.receipt);
+            return;
+        }
+        if (frame.type === "terminal-projection-materialize") {
+            const channel = this.#deliveryChannel(frame.request);
+            if (!channel)
+                return;
+            if (!channel.delivery?.materialize)
+                return this.#failProtocol("protocol-error");
+            channel.delivery.materialize(frame.request);
+            return;
+        }
         if (frame.type === "terminal-delivery-ack") {
             const channel = this.#deliveryChannel(frame.ack);
             if (!channel)
@@ -1941,7 +2082,23 @@ export class PaneStreamLiveConnection {
             return;
         }
         if (frame.type === "terminal-graphics-request") {
-            this.#requestGraphics(frame.pane, frame.digests);
+            this.#requestGraphics(frame.pane, frame.digests, frame.preferInline === true);
+            return;
+        }
+        if (frame.type === "terminal-graphics-local-release") {
+            const lease = this.#localLeases.get(frame.leaseId);
+            if (lease &&
+                lease.pane === frame.pane &&
+                frame.generation === this.#localImages?.identity.generation) {
+                this.#localLeases.delete(frame.leaseId);
+                void this.#localImages
+                    ?.release({
+                    generation: frame.generation,
+                    client: this.#descriptor.leaseId,
+                    id: frame.leaseId,
+                })
+                    .catch(() => { });
+            }
             return;
         }
         if (frame.type === "terminal-cell-pixels") {
@@ -1995,7 +2152,7 @@ export class PaneStreamLiveConnection {
             }
             return;
         }
-        this.#acceptInput(frame.pane, frame.seq, frame.kind, frame.data, byteLength, frame.performanceTraceId, frame.causalProbe, ingressAtMicros, callbackAtSharedMicros, ingressAtSharedMicros);
+        this.#acceptInput(frame.pane, frame.seq, frame.kind, frame.data, byteLength, frame.performanceTraceId, frame.causalProbe, ingressAtMicros, callbackAtSharedMicros, ingressAtSharedMicros, frame.expectedLifetime);
     };
     #acceptAuthorityGeneration(generation) {
         if (!this.#sessionRuntimeBinding || generation !== this.#sessionRuntimeBinding.generation) {
@@ -2121,7 +2278,19 @@ export class PaneStreamLiveConnection {
         this.#ledger.give(this.#clientId, pane, "renderer-backlog", returned);
         this.#evaluateResume(pane);
     }
-    #acceptInput(pane, seq, kind, data, frameBytes, performanceTraceId, causalProbe, ingressAtMicros = null, callbackAtSharedMicros = null, ingressAtSharedMicros = null) {
+    #acceptInput(pane, seq, kind, data, frameBytes, performanceTraceId, causalProbe, ingressAtMicros = null, callbackAtSharedMicros = null, ingressAtSharedMicros = null, expectedLifetime) {
+        if (kind === "bytes" &&
+            (!this.#sessionRuntimeBinding ||
+                !this.#descriptor.terminalDelivery?.protocolVersions.includes(PANE_STREAM_INPUT_BYTES_CAPABILITY_VERSION))) {
+            this.#failProtocol("input-rejected");
+            return;
+        }
+        if (expectedLifetime &&
+            (!this.#sessionRuntimeBinding ||
+                !this.#descriptor.terminalDelivery?.protocolVersions.includes(PANE_STREAM_INPUT_LIFETIME_CAPABILITY_VERSION))) {
+            this.#failProtocol("input-rejected");
+            return;
+        }
         if (this.#descriptor.viewerMode !== "interactive") {
             this.#failProtocol("input-rejected");
             return;
@@ -2213,11 +2382,13 @@ export class PaneStreamLiveConnection {
                             });
                         }
                     }
-                    : undefined);
+                    : undefined, expectedLifetime);
             else if (kind === "text")
                 channel.sub.sendText(data);
-            else
+            else if (kind === "key")
                 channel.sub.sendKey(data);
+            else
+                throw new Error("Byte input requires semantic runtime");
             let ackStartedAtMicros = null;
             let ackStartedAtSharedMicros = null;
             if (trace) {

package/packages/daemon/dist/terminal/pane-stream/runtime.js

@@ -16,6 +16,7 @@ export class PaneStreamRuntime {
         const transportBinder = new SessionRuntimeTransportBinder(options.sessionRuntimeRegistry);
         this.coordinator = new PaneStreamAdmissionCoordinator({
             ...options.admission,
+            localImages: options.localImages,
             daemonInstanceId: options.daemonInstanceId,
             webSocketUrl: options.webSocketUrl,
             leaseManager,

package/packages/daemon/dist/terminal/session-runtime/registry.js

@@ -472,10 +472,10 @@ export class SessionRuntimeRegistry {
             return { status: "retired" };
         return result;
     }
-    async describeSessionAuthority(session) {
+    async describeSessionAuthority(session, expectedSemanticPaneIds) {
         const runtime = this.#runtime(session);
         await runtime.whenReady();
-        const authority = await this.#mirror.describeSessionAuthority(session);
+        const authority = await this.#mirror.describeSessionAuthority(session, expectedSemanticPaneIds);
         if (this.#disposed || this.#sessions.get(session) !== runtime) {
             const error = new Error(`session runtime ${session} changed topology`);
             error.name = "MirrorTopologyChangedError";
@@ -1003,7 +1003,7 @@ class SessionRuntime {
             return Promise.reject(error);
         }
     }
-    sendInput(clientId, lease, semanticPaneId, rawInput, performanceTraceId, rawCausalProbe, onCausalResult) {
+    sendInput(clientId, lease, semanticPaneId, rawInput, performanceTraceId, rawCausalProbe, onCausalResult, expectedLifetime) {
         this.assertController(lease, clientId);
         const inputLease = this.#authority.leaseFor(clientId, "input");
         if (!inputLease) {
@@ -1037,7 +1037,11 @@ class SessionRuntime {
                 })
                 : null;
         const started = this.#observability.enabled ? this.#observability.nowMicros() : 0;
-        const replicaOwner = this.#terminalReplicaOwner(semanticPaneId);
+        const replicaOwner = expectedLifetime
+            ? this.#terminalReplicas.get(semanticPaneId)
+            : this.#terminalReplicaOwner(semanticPaneId);
+        if (!replicaOwner)
+            throw new Error("Input target lifetime unavailable");
         if (causalProbe) {
             this.#activeCausalCellProbes += 1;
             let settled = false;
@@ -1061,6 +1065,13 @@ class SessionRuntime {
             this.#outputTraces.arm(semanticPaneId, trace);
         }
         try {
+            // Synchronous final admission: never create a new owner to satisfy a stale
+            // held-input fence, and never await between this check and mirror dispatch.
+            if (expectedLifetime &&
+                (expectedLifetime.generation !== this.generation ||
+                    this.#terminalReplicas.get(semanticPaneId) !== replicaOwner ||
+                    replicaOwner.inputAdmissionIncarnation() !== expectedLifetime.incarnation))
+                throw new Error("Input target lifetime changed");
             if (input.kind === "text")
                 this.#mirror.sendText(this.session, semanticPaneId, input.data, performanceTraceId, causalProbe !== null);
             else if (input.kind === "bytes")
@@ -1564,9 +1575,9 @@ class SessionRuntimeConsumerImpl {
         this.#assertOpen();
         return this.#runtime.submitIntent(this.clientId, lease, operationId, intent);
     }
-    sendInput(lease, semanticPaneId, input, performanceTraceId, causalProbe, onCausalResult) {
+    sendInput(lease, semanticPaneId, input, performanceTraceId, causalProbe, onCausalResult, expectedLifetime) {
         this.#assertOpen();
-        this.#runtime.sendInput(this.clientId, lease, semanticPaneId, input, performanceTraceId, causalProbe, onCausalResult);
+        this.#runtime.sendInput(this.clientId, lease, semanticPaneId, input, performanceTraceId, causalProbe, onCausalResult, expectedLifetime);
     }
     failCausalCellProbe(semanticPaneId, traceId, reason) {
         this.#runtime.failCausalCellProbe(semanticPaneId, traceId, reason);
@@ -1642,6 +1653,8 @@ class SessionRuntimeConsumerImpl {
             negotiation: upstream.negotiation,
             closed: upstream.closed,
             ack: (ack) => upstream.ack(ack),
+            ...(upstream.projectionReceipt ? { projectionReceipt: upstream.projectionReceipt } : {}),
+            ...(upstream.materialize ? { materialize: upstream.materialize } : {}),
             nack: (nack) => upstream.nack(nack),
             setVisibility: (visibility) => upstream.setVisibility(visibility),
             close: async () => {