tmux-ide 2.9.11 → 2.9.13

package/packages/daemon/src/terminal/graphics/local-image-store.ts

@@ -0,0 +1,286 @@
+import { randomUUID, webcrypto } from "node:crypto";
+import { constants, type Stats } from "node:fs";
+import { chmod, link, lstat, mkdtemp, open, realpath, rmdir, unlink } from "node:fs/promises";
+import { join } from "node:path";
+
+interface Scope {
+  readonly generation: string;
+  readonly client: string;
+}
+export interface LocalImageLease extends Scope {
+  readonly id: string;
+  readonly digest: string;
+  readonly path: string;
+  readonly bytes: number;
+  readonly expiresAt: number;
+}
+interface Entry {
+  readonly path: string;
+  readonly bytes: number;
+  readonly identity: Stats;
+}
+interface Options {
+  /** Existing private, daemon-owned directory; never an application-provided path. */
+  readonly parent: string;
+  readonly generation: string;
+  readonly maxBytes?: number;
+  readonly maxFiles?: number;
+  readonly maxLeases?: number;
+  readonly ttlMs?: number;
+  readonly now?: () => number;
+}
+const IMAGE_LIMIT = 64 * 1024 * 1024;
+const same = (a: Stats, b: Stats) => a.dev === b.dev && a.ino === b.ino;
+const privateDirectory = (s: Stats) =>
+  s.isDirectory() && s.uid === process.getuid?.() && (s.mode & 0o077) === 0;
+const bounded = (value: number, max: number) =>
+  Number.isSafeInteger(value) && value > 0 && value <= max;
+const identity = (value: string) =>
+  value.length > 0 &&
+  value.length <= 512 &&
+  ![...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127);
+
+/** Immutable copy-reduced transport files, not a persistent asset cache. Only owner
+ * metadata crosses this API. A live daemon expires crashed clients' leases; its
+ * owner must clean abandoned instance directories after a daemon process crash.
+ * The private parent is trusted: Node has no descriptor-relative unlink primitive.
+ */
+export class LocalImageStore {
+  readonly #entries = new Map<string, Entry>();
+  readonly #leases = new Map<string, LocalImageLease>();
+  readonly #maxBytes: number;
+  readonly #maxFiles: number;
+  readonly #maxLeases: number;
+  readonly #ttl: number;
+  readonly #now: () => number;
+  readonly #timer: ReturnType<typeof setInterval>;
+  #tail: Promise<unknown> = Promise.resolve();
+  #bytes = 0;
+  #pendingBytes = 0;
+  #pending = 0;
+  #closed = false;
+  private constructor(
+    readonly directory: string,
+    readonly generation: string,
+    readonly directoryIdentity: Stats,
+    options: Options,
+  ) {
+    this.#maxBytes = options.maxBytes ?? 256 * 1024 * 1024;
+    this.#maxFiles = options.maxFiles ?? 512;
+    this.#maxLeases = options.maxLeases ?? 1024;
+    this.#ttl = options.ttlMs ?? 30_000;
+    this.#now = options.now ?? Date.now;
+    this.#timer = setInterval(() => void this.sweep().catch(() => {}), Math.min(this.#ttl, 1000));
+    this.#timer.unref();
+  }
+  static async create(options: Options): Promise<LocalImageStore> {
+    if (
+      !identity(options.generation) ||
+      !bounded(options.maxBytes ?? 256 * 1024 * 1024, 256 * 1024 * 1024) ||
+      !bounded(options.maxFiles ?? 512, 512) ||
+      !bounded(options.maxLeases ?? 1024, 1024) ||
+      !bounded(options.ttlMs ?? 30_000, 60_000)
+    )
+      throw new Error("Invalid local image store bounds");
+    const parentIdentity = await lstat(options.parent);
+    if (!privateDirectory(parentIdentity)) throw new Error("Local image parent is not private");
+    const parent = await realpath(options.parent);
+    if (!same(parentIdentity, await lstat(parent))) throw new Error("Local image parent replaced");
+    const directory = await mkdtemp(join(parent, "local-images-"));
+    await chmod(directory, 0o700);
+    const stat = await lstat(directory);
+    if (!privateDirectory(stat)) throw new Error("Local image directory is not private");
+    return new LocalImageStore(directory, options.generation, stat, options);
+  }
+  #serial<T>(run: () => Promise<T>): Promise<T> {
+    const result = this.#tail.then(run);
+    this.#tail = result.catch(() => {});
+    return result;
+  }
+  async #checkDirectory(): Promise<void> {
+    const stat = await lstat(this.directory);
+    if (!privateDirectory(stat) || !same(stat, this.directoryIdentity))
+      throw new Error("Local image directory replaced");
+  }
+  #scope(scope: Scope): void {
+    if (scope.generation !== this.generation || !identity(scope.client))
+      throw new Error("Local image scope mismatch");
+  }
+  async #checkFile(entry: Entry): Promise<void> {
+    await this.#checkDirectory();
+    const stat = await lstat(entry.path);
+    if (
+      !stat.isFile() ||
+      !same(stat, entry.identity) ||
+      stat.size !== entry.bytes ||
+      stat.mode !== entry.identity.mode ||
+      stat.mtimeMs !== entry.identity.mtimeMs ||
+      stat.ctimeMs !== entry.identity.ctimeMs
+    )
+      throw new Error("Local image file replaced");
+  }
+  acquire(
+    input: Scope & { readonly digest: string; readonly bytes: Uint8Array },
+  ): Promise<LocalImageLease> {
+    const { generation, client, digest: requestedDigest } = input;
+    this.#scope({ generation, client });
+    if (
+      this.#closed ||
+      !/^[a-f0-9]{32}$/u.test(input.digest) ||
+      !bounded(input.bytes.byteLength, Math.min(IMAGE_LIMIT, this.#maxBytes)) ||
+      this.#pending >= this.#maxLeases ||
+      input.bytes.byteLength > this.#maxBytes - this.#pendingBytes
+    )
+      return Promise.reject(new Error("Local image acquisition unavailable"));
+    // Detach caller memory before the first await; queued acquisition memory is bounded too.
+    const data = Uint8Array.from(input.bytes);
+    this.#pending++;
+    this.#pendingBytes += data.byteLength;
+    return this.#serial(async () => {
+      if (this.#closed) throw new Error("Local image store closed");
+      await this.#expire();
+      await this.#checkDirectory();
+      if (this.#leases.size >= this.#maxLeases) throw new Error("Local image lease bound");
+      const fullDigest = Buffer.from(await webcrypto.subtle.digest("SHA-256", data)).toString(
+        "hex",
+      );
+      const digest = fullDigest.slice(0, 32);
+      if (digest !== requestedDigest) throw new Error("Local image digest mismatch");
+      let entry = this.#entries.get(digest);
+      if (entry) {
+        if (entry.path !== join(this.directory, fullDigest))
+          throw new Error("Local image digest collision");
+        await this.#checkFile(entry);
+      } else {
+        if (this.#entries.size >= this.#maxFiles || data.byteLength > this.#maxBytes - this.#bytes)
+          throw new Error("Local image storage bound");
+        entry = await this.#write(fullDigest, data);
+        this.#entries.set(digest, entry);
+        this.#bytes += entry.bytes;
+      }
+      const lease = Object.freeze({
+        id: randomUUID(),
+        generation: this.generation,
+        client,
+        digest,
+        path: entry.path,
+        bytes: entry.bytes,
+        expiresAt: this.#now() + this.#ttl,
+      });
+      this.#leases.set(lease.id, lease);
+      return lease;
+    }).finally(() => {
+      this.#pending--;
+      this.#pendingBytes -= data.byteLength;
+    });
+  }
+  async #write(digest: string, data: Uint8Array): Promise<Entry> {
+    const path = join(this.directory, digest);
+    const temporary = join(this.directory, `.pending-${randomUUID()}`);
+    const file = await open(
+      temporary,
+      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW,
+      0o600,
+    );
+    let temporaryIdentity = await file.stat();
+    try {
+      await file.writeFile(data);
+      await file.chmod(0o400);
+      temporaryIdentity = await file.stat();
+      await this.#checkDirectory();
+      const current = await lstat(temporary);
+      if (!same(current, temporaryIdentity) || !current.isFile())
+        throw new Error("Local image staging replaced");
+      // link is atomic and fails if a digest path already exists; never overwrite it.
+      await link(temporary, path);
+    } finally {
+      await file.close();
+      await this.#unlinkOwned(temporary, temporaryIdentity);
+    }
+    const stat = await lstat(path);
+    if (!same(stat, temporaryIdentity) || !stat.isFile() || stat.size !== data.byteLength)
+      throw new Error("Local image publication replaced");
+    return { path, bytes: data.byteLength, identity: stat };
+  }
+  async #unlinkOwned(path: string, expected: Stats, immutable = false): Promise<void> {
+    await this.#checkDirectory();
+    let stat: Stats;
+    try {
+      stat = await lstat(path);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+      throw error;
+    }
+    if (
+      !stat.isFile() ||
+      !same(stat, expected) ||
+      (immutable &&
+        (stat.size !== expected.size ||
+          stat.mode !== expected.mode ||
+          stat.uid !== expected.uid ||
+          stat.mtimeMs !== expected.mtimeMs ||
+          stat.ctimeMs !== expected.ctimeMs))
+    )
+      throw new Error("Local image cleanup refused replacement");
+    await unlink(path);
+  }
+  async #collect(): Promise<void> {
+    const referenced = new Set([...this.#leases.values()].map((lease) => lease.digest));
+    for (const [digest, entry] of this.#entries) {
+      if (referenced.has(digest)) continue;
+      // Inodes can be reused after unlink. Published files must retain their
+      // immutable metadata; staging links intentionally change ctime instead.
+      await this.#unlinkOwned(entry.path, entry.identity, true);
+      this.#entries.delete(digest);
+      this.#bytes -= entry.bytes;
+    }
+  }
+  async #expire(): Promise<void> {
+    const now = this.#now();
+    for (const [id, lease] of this.#leases) if (lease.expiresAt <= now) this.#leases.delete(id);
+    await this.#collect();
+  }
+  release(scope: Scope & { readonly id: string }): Promise<boolean> {
+    return this.#serial(async () => {
+      this.#scope(scope);
+      const lease = this.#leases.get(scope.id);
+      if (!lease || lease.client !== scope.client) return false;
+      this.#leases.delete(scope.id);
+      await this.#collect();
+      return true;
+    });
+  }
+  releaseClient(scope: Scope): Promise<void> {
+    return this.#serial(async () => {
+      this.#scope(scope);
+      for (const [id, lease] of this.#leases)
+        if (lease.client === scope.client) this.#leases.delete(id);
+      await this.#collect();
+    });
+  }
+  sweep(): Promise<void> {
+    return this.#serial(() => this.#expire());
+  }
+  /** Bounded lifecycle manifest; no image bytes. Caller persists before publishing a lease. */
+  ownedFiles(): Promise<{ path: string; identity: Stats }[]> {
+    return this.#serial(async () => {
+      await this.#checkDirectory();
+      const files = [];
+      for (const entry of this.#entries.values()) {
+        await this.#checkFile(entry);
+        files.push({ path: entry.path, identity: entry.identity });
+      }
+      return files;
+    });
+  }
+  dispose(): Promise<void> {
+    this.#closed = true;
+    clearInterval(this.#timer);
+    return this.#serial(async () => {
+      this.#leases.clear();
+      await this.#collect();
+      await this.#checkDirectory();
+      await rmdir(this.directory); // Not recursive: unexpected entries must survive.
+    });
+  }
+}

package/packages/daemon/src/terminal/graphics/native-surface-demand.ts

@@ -0,0 +1,88 @@
+/** Bounded daemon-local demand for ordinary terminal image output. Unknown
+ * native-client inventory preserves fallback; only proven absence can suppress it. */
+export interface SurfaceViewerDemand {
+  native(ready: boolean): void;
+  close(): void;
+}
+type Viewer = { session: string; panes: ReadonlySet<string>; native: boolean };
+export class NativeSurfaceDemand {
+  #viewers = new Set<Viewer>();
+  #presence = new Map<string, boolean>();
+  #listeners = new Set<() => void>();
+  #overflow = 0;
+  #closed = false;
+  #queued = false;
+  presence(session: string, present: boolean | null): void {
+    if (this.#closed) return;
+    if (present === null) this.#presence.delete(session);
+    else {
+      if (!this.#presence.has(session) && this.#presence.size >= 256) {
+        const oldest = this.#presence.keys().next().value;
+        if (oldest !== undefined) this.#presence.delete(oldest);
+      }
+      this.#presence.set(session, present);
+    }
+    this.#notify();
+  }
+  viewer(session: string, panes: readonly string[]): SurfaceViewerDemand {
+    const viewer: Viewer = { session, panes: new Set(panes), native: false };
+    const retained = !this.#closed && this.#viewers.size < 256 && panes.length <= 256;
+    if (retained) this.#viewers.add(viewer);
+    else this.#overflow++;
+    this.#notify();
+    let closed = false;
+    return {
+      native: (ready) => {
+        if (closed || viewer.native === ready) return;
+        viewer.native = ready;
+        this.#notify();
+      },
+      close: () => {
+        if (closed) return;
+        closed = true;
+        if (retained) this.#viewers.delete(viewer);
+        else this.#overflow--;
+        this.#notify();
+      },
+    };
+  }
+  required(pane: string): boolean {
+    if (this.#closed || this.#overflow) return true;
+    let known = false;
+    for (const viewer of this.#viewers) {
+      if (!viewer.panes.has(pane)) continue;
+      known = true;
+      if (!viewer.native || this.#presence.get(viewer.session) !== false) return true;
+    }
+    return !known;
+  }
+  watch(listener: () => void): () => void {
+    if (this.#closed || this.#listeners.size >= 256) throw new Error("Surface demand unavailable");
+    this.#listeners.add(listener);
+    this.#notify();
+    return () => this.#listeners.delete(listener);
+  }
+  #notify(): void {
+    if (this.#queued) return;
+    this.#queued = true;
+    queueMicrotask(() => {
+      this.#queued = false;
+      for (const listener of [...this.#listeners]) {
+        if (!this.#listeners.has(listener)) continue;
+        try {
+          listener();
+        } catch {
+          this.#listeners.delete(listener);
+        }
+      }
+      if (this.#closed) this.#listeners.clear();
+    });
+  }
+  close(): void {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#viewers.clear();
+    this.#presence.clear();
+    this.#notify();
+  }
+}

package/packages/daemon/src/terminal/graphics/native-surface-provider-channel.ts

@@ -0,0 +1,161 @@
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+import {
+  TerminalAttachmentSemanticPaneIdSchemaZ,
+  TerminalSurfaceAuditTokenSchemaZ,
+  TerminalSurfaceOfferSchemaZ,
+  TERMINAL_SURFACE_MAX_CONTROL_BYTES,
+} from "@tmux-ide/contracts";
+import {
+  NativeSurfaceProviderRegistry,
+  type NativeSurfaceProvider,
+} from "./native-surface-provider.ts";
+
+const Register = z
+  .object({
+    type: z.literal("register"),
+    version: z.literal(1),
+    generation: z.uuid(),
+    auditToken: TerminalSurfaceAuditTokenSchemaZ,
+  })
+  .strict();
+const Offer = z
+  .object({
+    type: z.literal("offer"),
+    connection: z.uuid(),
+    offer: TerminalSurfaceOfferSchemaZ,
+  })
+  .strict();
+const WatchDemand = z
+  .object({
+    type: z.literal("watch-demand"),
+    panes: z.array(TerminalAttachmentSemanticPaneIdSchemaZ).min(1).max(32),
+  })
+  .strict();
+type Context = Parameters<NativeSurfaceProvider["open"]>[0];
+
+/** Only an authenticated owner connection may construct this channel. Kernel
+ * identity proof is still mandatory at the native receiver. No payload contains
+ * pixel storage, executable paths, or a reusable daemon credential. */
+export class NativeSurfaceProviderChannel {
+  #unregister: (() => void) | null = null;
+  #connections = new Map<string, Context>();
+  #closed = false;
+  #stopDemand: (() => void) | null = null;
+  #demandPanes: string[] | null = null;
+  #lastDemand: string | null = null;
+  constructor(
+    readonly registry: NativeSurfaceProviderRegistry,
+    readonly send: (message: string) => boolean,
+    readonly disconnect: () => void,
+  ) {}
+  receive(text: string): void {
+    if (this.#closed) return;
+    if (Buffer.byteLength(text) > TERMINAL_SURFACE_MAX_CONTROL_BYTES) {
+      this.close();
+      return;
+    }
+    let value: unknown;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      this.close();
+      return;
+    }
+    if (!this.#unregister) {
+      const registration = Register.safeParse(value);
+      if (!registration.success || registration.data.generation !== this.registry.generation) {
+        this.close();
+        return;
+      }
+      try {
+        this.#unregister = this.registry.register({
+          auditToken: registration.data.auditToken,
+          open: (context) => this.#open(context),
+        });
+      } catch {
+        this.close();
+        return;
+      }
+      this.#send({ type: "registered", version: 1, generation: this.registry.generation });
+      return;
+    }
+    const watch = WatchDemand.safeParse(value);
+    if (watch.success) {
+      const panes = [...new Set(watch.data.panes)].sort();
+      if (this.#demandPanes) {
+        if (JSON.stringify(panes) !== JSON.stringify(this.#demandPanes)) this.close();
+        return;
+      }
+      this.#demandPanes = panes;
+      try {
+        this.#stopDemand = this.registry.demand.watch(() => {
+          const required = panes.filter((pane) => this.registry.demand.required(pane));
+          const key = JSON.stringify(required);
+          if (key === this.#lastDemand) return;
+          this.#lastDemand = key;
+          this.#send({ type: "kitty-demand", panes, required });
+        });
+      } catch {
+        this.close();
+      }
+      return;
+    }
+    const parsed = Offer.safeParse(value);
+    if (!parsed.success) {
+      this.close();
+      return;
+    }
+    const { connection, offer } = parsed.data;
+    const context = this.#connections.get(connection);
+    if (!context) {
+      this.close();
+      return;
+    }
+    const accepted = context.offer(offer);
+    // The producer must wait for accepted=true before transferring the matching
+    // native right. A dropped channel or rejected offer grants no transfer.
+    this.#send({ type: "offered", connection, sequence: offer.sequence, accepted });
+  }
+  #open(context: Context) {
+    if (this.#closed || this.#connections.size >= 32)
+      throw new Error("Native provider unavailable");
+    const connection = randomUUID();
+    this.#connections.set(connection, context);
+    return {
+      start: () => {
+        this.#send({ type: "start", connection, receiver: context.receiver, panes: context.panes });
+      },
+      retire: (sequence: number) => {
+        this.#send({ type: "retired", connection, sequence });
+      },
+      fallback: () => {
+        this.#send({ type: "fallback", connection });
+      },
+      close: () => {
+        this.#connections.delete(connection);
+        this.#send({ type: "close", connection });
+      },
+    };
+  }
+  #send(value: unknown): void {
+    if (this.#closed) return;
+    const text = JSON.stringify(value);
+    try {
+      if (Buffer.byteLength(text) <= TERMINAL_SURFACE_MAX_CONTROL_BYTES && this.send(text)) return;
+    } catch {
+      /* A failed sink revokes all further native offers. */
+    }
+    this.close();
+  }
+  close(): void {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#stopDemand?.();
+    this.#stopDemand = null;
+    this.#unregister?.();
+    this.#unregister = null;
+    this.#connections.clear();
+    this.disconnect();
+  }
+}