tmux-ide 2.9.11 → 2.9.13

package/packages/daemon/dist/command-center/tmux-servers.js

@@ -1,3 +1,4 @@
+import { NativeSurfaceLocationSchema } from "../lib/native-surface-context.js";
 import { mountTmuxServerHistoryAnchorRoute } from "./tmux-server-history-anchor.js";
 import { mountTmuxServerDiagnosticsRoute } from "./tmux-server-diagnostics.js";
 import { WindowSplitLayoutUnavailable } from "../terminal/mirror/window-split-authority.js";
@@ -191,6 +192,14 @@ export function mountTmuxServerRoutes(app, options) {
             }),
         }));
     }));
+    app.post(`${scoped}/native-surface-context`, route(async (c) => {
+        const server = scope(c);
+        const target = NativeSurfaceLocationSchema.parse(await boundedJson(c.req.raw, 8192));
+        c.req.raw.signal.throwIfAborted();
+        const context = await options.owners.withOwner(server, (owner) => owner.resolveNativeSurfaceContext(target, c.req.raw.signal));
+        c.req.raw.signal.throwIfAborted();
+        return c.json({ version: 1, server, context });
+    }));
     app.get(`${scoped}/inventory/:workspaceName`, route(async (c) => {
         const server = scope(c);
         const workspaceName = workspaceSchema.parse(c.req.param("workspaceName"));

package/packages/daemon/dist/lib/daemon-embed.js

@@ -6,6 +6,8 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
+import { createNativeSurfaceContextResolver } from "./native-surface-context.js";
+import { NativeSurfaceProviderRegistry } from "../terminal/graphics/native-surface-provider.js";
 import { TmuxServerVersionSchemaZ } from "@tmux-ide/contracts";
 import { createNativeSplitCapabilityProbe, createNativeSplitReadiness, } from "./native-split-capability.js";
 import { executeCanonicalSplitMutation } from "./canonical-split-mutation.js";
@@ -13,7 +15,8 @@ import { createGuardedNativeSplitResize } from "./guarded-native-split-resize.js
 import { WindowLinkTargetSchemaZ } from "@tmux-ide/contracts";
 import { WindowSplitLayoutUnavailable } from "../terminal/mirror/window-split-authority.js";
 import { requireSupportedTmuxVersion } from "./tmux-version.js";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { LocalImageOwner, cleanupLocalImageOwner } from "../terminal/graphics/local-image-owner.js";
 import { createClaudeTeamMembershipReader } from "../terminal/attachments/claude-team-names.js";
 import { PaneSourceDiscovery } from "./pane-source-discovery.js";
 import { createBackgroundNativeCapture } from "./background-native-capture.js";
@@ -79,6 +82,7 @@ import { InteractionEvidenceAuthority } from "./interaction-evidence-authority.j
 import { createNativeTerminalAttachmentRuntime, WorkspaceTerminalInventoryRuntime, } from "../terminal/attachments/native-runtime.js";
 import { createTmuxAgentStatusProbe } from "../terminal/attachments/agent-status-probe.js";
 import { attachTerminalAttachmentWebSocket, } from "../server/terminal-attachment-upgrade.js";
+import { attachNativeSurfaceProvider } from "../server/native-surface-provider-upgrade.js";
 import { attachPaneStreamWebSocket, } from "../server/pane-stream-upgrade.js";
 import { createPaneStreamRuntime, } from "../terminal/pane-stream/runtime.js";
 import { SessionRuntimeRegistry } from "../terminal/session-runtime/registry.js";
@@ -89,7 +93,7 @@ import { setActivationBackend } from "./active-projects.js";
 import { readOrMintEnvironmentId } from "./environment-identity.js";
 import { captureDaemonProvenance } from "./daemon-provenance.js";
 import { registerLogSecret, setLogIdentity } from "./log.js";
-import { canonicalDaemonUrl, clearCanonicalDaemonInfoIfOwned, clearCanonicalDaemonInfoIfUnchanged, inspectCanonicalDaemonInfo, isCanonicalDaemonAlive, isCanonicalDaemonRecordOwnerProvenDead, probeCanonicalDaemonHealth, probeCanonicalDaemonIdentity, releaseCanonicalDaemonClaim, tryAcquireCanonicalDaemonClaim, writeCanonicalDaemonInfo, matchesCanonicalDaemonPredecessor, } from "./canonical-daemon.js";
+import { canonicalDaemonUrl, getCanonicalDaemonInfoPath, clearCanonicalDaemonInfoIfOwned, clearCanonicalDaemonInfoIfUnchanged, inspectCanonicalDaemonInfo, isCanonicalDaemonAlive, isCanonicalDaemonRecordOwnerProvenDead, probeCanonicalDaemonHealth, probeCanonicalDaemonIdentity, releaseCanonicalDaemonClaim, tryAcquireCanonicalDaemonClaim, writeCanonicalDaemonInfo, matchesCanonicalDaemonPredecessor, } from "./canonical-daemon.js";
 const requireFromHere = createRequire(import.meta.url);
 const DEFAULT_HOSTNAME = "127.0.0.1";
 const DEFAULT_GRACEFUL_MS = 2000;
@@ -542,6 +546,8 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
             issue: (request, context) => getTerminalAttachmentRuntime().admission.issue(request, context),
         },
         paneStreamIssueBackend: paneStreamRuntime.coordinator,
+        nativeSurfaceProviderSupported: () => serverOwners.isDefaultCurrent() && paneStreamRuntime.nativeSurfaces !== undefined,
+        nativeSurfaceProviderAvailable: () => serverOwners.isDefaultCurrent() && paneStreamRuntime.nativeSurfaces?.available === true,
         applicationShellInventoryBackend: terminalInventoryRuntime,
         startupReadinessAttachmentBackend: terminalInventoryRuntime,
         catalogLiveSessions,
@@ -585,7 +591,16 @@ async function startHttpServer({ sessionName, requestedPort, bindHostname, dir,
     });
     const terminalAttachmentBoundary = attachTerminalAttachmentWebSocket(server, (create) => (create ? getTerminalAttachmentRuntime() : peekTerminalAttachmentRuntime())?.admission ??
         null);
-    const paneStreamBoundary = attachPaneStreamWebSocket(server, paneStreamRuntime.coordinator, PANE_STREAM_REDEEM_PATH, () => serverOwners.isDefaultCurrent());
+    const paneStreamSocketBoundary = attachPaneStreamWebSocket(server, paneStreamRuntime.coordinator, PANE_STREAM_REDEEM_PATH, () => serverOwners.isDefaultCurrent());
+    const nativeProviderBoundary = paneStreamRuntime.nativeSurfaces
+        ? attachNativeSurfaceProvider(server, paneStreamRuntime.nativeSurfaces, localBypassToken ?? null, () => serverOwners.isDefaultCurrent())
+        : null;
+    const paneStreamBoundary = {
+        async close() {
+            nativeProviderBoundary?.close();
+            await paneStreamSocketBoundary.close();
+        },
+    };
     serverOwners.attach(server);
     try {
         await new Promise((resolve, reject) => {
@@ -955,6 +970,7 @@ async function startEmbeddedDaemonGeneration(opts) {
         };
         let terminalAttachmentRuntime = null;
         let paneStreamRuntime = null;
+        let localImages;
         let serverOwners = null;
         let defaultEditorContextRetired = false;
         const defaultDiagnosticsLifetime = new AbortController();
@@ -1057,6 +1073,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                 externalInteractionObserver.setDiagnostics(diagnostics);
                 setFleetFactsObserverDiagnostics(diagnostics);
             }
+            const nativeSurfaces = process.platform === "darwin" ? new NativeSurfaceProviderRegistry(instanceId) : undefined;
             sessionRuntimeRegistry = new SessionRuntimeRegistry({
                 generation: instanceId,
                 ...(runtimeObservability ? { observability: runtimeObservability } : {}),
@@ -1083,6 +1100,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                     publishResourceChange: (change) => broadcastResourceChanged(change, instanceId),
                 },
                 mirror: {
+                    onNativeClientPresence: (session, present) => nativeSurfaces?.demand.presence(session, present),
                     splitLayoutEpoch: () => observationSelector?.nativeServerEpoch ?? null,
                     splitLayoutPrepare: createNativeSplitReadiness({
                         observation: () => observationSelector ?? null,
@@ -1219,7 +1237,36 @@ async function startEmbeddedDaemonGeneration(opts) {
                 return terminalAttachmentRuntime;
             };
             const peekTerminalAttachmentRuntime = () => terminalAttachmentRuntime;
+            // The held canonical claim has already proven and hardened this private root.
+            // Local images are optional: unavailable storage retains inline graphics.
+            if (process.platform !== "win32") {
+                const root = dirname(getCanonicalDaemonInfoPath());
+                try {
+                    if (existingCanonical.status === "valid") {
+                        await cleanupLocalImageOwner({
+                            root,
+                            owner: {
+                                generation: existingCanonical.info.instanceId,
+                                pid: existingCanonical.info.pid,
+                                startedAt: existingCanonical.info.startedAt,
+                            },
+                            proveDead: () => isCanonicalDaemonRecordOwnerProvenDead(existingCanonical),
+                        });
+                    }
+                    localImages = await LocalImageOwner.create({
+                        root,
+                        generation: instanceId,
+                        pid: process.pid,
+                        startedAt,
+                    });
+                }
+                catch {
+                    localImages = undefined;
+                }
+            }
             paneStreamRuntime = createPaneStreamRuntime({
+                nativeSurfaces,
+                localImages,
                 daemonInstanceId: instanceId,
                 webSocketUrl: paneStreamWebSocketUrl(bindHostname, port),
                 sessionRuntimeRegistry,
@@ -1239,6 +1286,7 @@ async function startEmbeddedDaemonGeneration(opts) {
             });
             await externalInteractionObserver.start();
             serverOwners = await createEmbeddedTmuxServerOwners({
+                localImages,
                 environmentId,
                 onDefaultScope: async (scope) => {
                     interactionEvidence = new InteractionEvidenceAuthority(environmentId, scope);
@@ -1322,6 +1370,20 @@ async function startEmbeddedDaemonGeneration(opts) {
                         return grant ? interactionEvidence.captureSourceBinding(grant) : null;
                     },
                     interactionReceipts,
+                    resolveNativeSurfaceContext: createNativeSurfaceContextResolver({
+                        generation: instanceId,
+                        registry: workspaceRegistry,
+                        catalog: createNativeTmuxServerCatalog(workspaceRegistry, fleetFactsTmuxRunner),
+                        inventory: terminalInventoryRuntime,
+                        run: (args, signal) => fleetFactsTmuxRunner(args, signal),
+                        assertOpen: () => {
+                            if (defaultEditorContextRetired ||
+                                serverOwners?.defaultRetired ||
+                                !initialNativeServerIdentity ||
+                                terminalInventoryRuntime?.lifecycleState() !== "ready")
+                                throw new Error("Default native surface context owner is unavailable");
+                        },
+                    }),
                     resolvePaneEditorContext: createPaneEditorContextResolver({
                         generation: instanceId,
                         registry: workspaceRegistry,
@@ -1514,7 +1576,10 @@ async function startEmbeddedDaemonGeneration(opts) {
             // The pane-stream coordinator may still hold runtime consumers while it
             // drains. Preserve the normal shutdown order on startup rollback too:
             // transports first, then the one session/control authority.
-            await Promise.allSettled([sessionRuntimeRegistry?.dispose() ?? Promise.resolve()]);
+            await Promise.allSettled([
+                sessionRuntimeRegistry?.dispose() ?? Promise.resolve(),
+                localImages?.dispose() ?? Promise.resolve(),
+            ]);
             throw error;
         }
         const { server, sockets, closeClients, closeWsServers, terminalAttachmentBoundary, paneStreamBoundary, } = startedServer;
@@ -1535,6 +1600,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                 ...(await retireTerminalAttachmentTransport(terminalAttachmentRuntime, terminalAttachmentBoundary)),
                 ...(await retirePaneStreamTransport()),
             ];
+            await localImages?.dispose();
             terminalInventoryRuntime.dispose();
             const paneDisposal = Promise.resolve().then(() => workspacePaneCreation.dispose());
             const workspaceOpenDisposal = Promise.resolve().then(() => workspaceOpen.dispose());
@@ -1785,6 +1851,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                         // listener before touching the legacy WS or HTTP surfaces.
                         failures.push(...(await retireTerminalAttachmentTransport(terminalAttachmentRuntime, terminalAttachmentBoundary)));
                         failures.push(...(await retirePaneStreamTransport()));
+                        await capture(() => localImages?.dispose());
                         await capture(() => terminalInventoryRuntime.dispose());
                         await capture(() => workspacePaneCreation.dispose());
                         await capture(() => workspaceOpen.dispose());

package/packages/daemon/dist/lib/embedded-tmux-server-owners.js

@@ -58,6 +58,7 @@ export async function createEmbeddedTmuxServerOwners(options) {
                 await retireDefault();
             const route = tmuxServerPaneStreamPath(scope);
             const owner = await createNativeTmuxServerOwner({
+                localImages: options.localImages,
                 environmentId: options.environmentId,
                 ...scope,
                 tmuxAuthority: observation.authority,

package/packages/daemon/dist/lib/native-surface-context.js

@@ -0,0 +1,96 @@
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+import { TerminalAttachmentSemanticPaneIdSchemaZ, WorkspaceCatalogLiveSessionIdSchemaZ, } from "@tmux-ide/contracts";
+export const NativeSurfaceLocationSchema = z
+    .object({
+    socketPath: z
+        .string()
+        .min(1)
+        .max(4096)
+        .refine((p) => isAbsolute(p) && !/[\0\r\n\t]/u.test(p)),
+    serverPid: z
+        .string()
+        .max(16)
+        .regex(/^[1-9][0-9]*$/u),
+    sessionId: z
+        .string()
+        .max(32)
+        .regex(/^\$(?:0|[1-9][0-9]*)$/u),
+    runtimePaneId: z
+        .string()
+        .max(32)
+        .regex(/^%(?:0|[1-9][0-9]*)$/u),
+})
+    .strict();
+/** Resolve inherited tmux location only through the current generation's pinned owner. */
+export function createNativeSurfaceContextResolver(options) {
+    const generation = z.uuid().parse(options.generation);
+    return async (input, cancellation) => {
+        const target = NativeSurfaceLocationSchema.parse(input);
+        const signal = AbortSignal.any([
+            AbortSignal.timeout(5000),
+            ...(cancellation ? [cancellation] : []),
+        ]);
+        const assertCurrent = () => {
+            options.assertOpen();
+            signal.throwIfAborted();
+        };
+        const unavailable = () => {
+            throw new Error("Native surface source unavailable");
+        };
+        const observe = async () => {
+            assertCurrent();
+            const proof = await options.run([
+                "display-message",
+                "-p",
+                "-t",
+                target.runtimePaneId,
+                "#{socket_path}\t#{pid}\t#{session_id}\t#{pane_id}",
+            ], signal);
+            assertCurrent();
+            if (proof.trimEnd() !==
+                [target.socketPath, target.serverPid, target.sessionId, target.runtimePaneId].join("\t"))
+                unavailable();
+            const snapshot = await options.inventory.discoverTerminalInventory(signal);
+            assertCurrent();
+            if (snapshot.catalog.invalidRuntimeProof ||
+                snapshot.catalog.duplicateSemanticStamp ||
+                snapshot.catalog.duplicateRuntimePaneBinding)
+                unavailable();
+            const matches = snapshot.panes.filter((pane) => pane.runtimePaneId === target.runtimePaneId && pane.sessionId === target.sessionId);
+            if (matches.length !== 1)
+                return unavailable();
+            const pane = { ...matches[0] };
+            const semantic = TerminalAttachmentSemanticPaneIdSchemaZ.parse(pane.semanticPaneId);
+            const workspace = options.registry.get(pane.workspaceName);
+            if (!workspace || workspace.sessionName !== pane.sessionName)
+                return unavailable();
+            const sessions = (await options.catalog()).filter((row) => row.sessionName === pane.sessionName);
+            assertCurrent();
+            if (sessions.length !== 1 || options.registry.get(pane.workspaceName) !== workspace)
+                return unavailable();
+            const live = WorkspaceCatalogLiveSessionIdSchemaZ.parse(sessions[0].liveSessionId);
+            return {
+                context: {
+                    generation,
+                    workspaceName: pane.workspaceName,
+                    liveSessionId: live,
+                    pane: semantic,
+                },
+                identity: [
+                    pane.sessionId,
+                    pane.windowId,
+                    pane.runtimePaneId,
+                    pane.windowStamp ?? null,
+                    pane.nativePaneBirthId ?? null,
+                ],
+            };
+        };
+        const before = await observe();
+        const after = await observe();
+        if (JSON.stringify(before) !== JSON.stringify(after))
+            return unavailable();
+        assertCurrent();
+        return Object.freeze(after.context);
+    };
+}

package/packages/daemon/dist/lib/tmux-server-owner.js

@@ -1,3 +1,4 @@
+import { createNativeSurfaceContextResolver } from "./native-surface-context.js";
 import { shellEscape } from "./shell.js";
 import { createNativeSplitCapabilityProbe, createNativeSplitReadiness, } from "./native-split-capability.js";
 import { executeCanonicalSplitMutation } from "./canonical-split-mutation.js";
@@ -369,6 +370,7 @@ export async function createNativeTmuxServerOwner(options) {
         }),
     });
     const paneStreamRuntime = createPaneStreamRuntime({
+        localImages: options.localImages,
         daemonInstanceId: generation,
         webSocketUrl: options.webSocketUrl,
         sessionRuntimeRegistry,
@@ -494,6 +496,14 @@ export async function createNativeTmuxServerOwner(options) {
         },
         serverId: options.serverId,
         generation,
+        resolveNativeSurfaceContext: createNativeSurfaceContextResolver({
+            generation,
+            assertOpen,
+            registry: workspaceRegistry,
+            catalog,
+            inventory: terminalInventoryRuntime,
+            run: (args, signal) => generationRunAsync(args, signal),
+        }),
         resolvePaneEditorContext,
         catalog,
         readWindowSplitLayout: async (workspaceName, input) => {

package/packages/daemon/dist/native/TmuxIdeNotifier.app/Contents/Info.plist

@@ -21,9 +21,9 @@
   <key>CFBundlePackageType</key>
   <string>APPL</string>
   <key>CFBundleShortVersionString</key>
-  <string>2.9.11</string>
+  <string>2.9.13</string>
   <key>CFBundleVersion</key>
-  <string>2.9.11</string>
+  <string>2.9.13</string>
   <key>LSMinimumSystemVersion</key>
   <string>11.0</string>
   <key>LSUIElement</key>

package/packages/daemon/dist/native/TmuxIdeNotifier.app/Contents/_CodeSignature/CodeResources

@@ -10,7 +10,7 @@
 		</data>
 		<key>Resources/Assets.car</key>
 		<data>
-		nBfyKmj9/xOSU1E6fMrLP0j34to=
+		6Tstp1dls1WRUQD+/DDuIhts8/g=
 		</data>
 	</dict>
 	<key>files2</key>
@@ -26,7 +26,7 @@
 		<dict>
 			<key>hash2</key>
 			<data>
-			BH5ZBbufHUMGSzMRXcEqBgur+e94BeWVItaM9FDWrFA=
+			5CnAgYS5jeHfuf40WhEyRn9BbniU54houDrGdNEkNyI=
 			</data>
 		</dict>
 	</dict>

package/packages/daemon/dist/server/native-surface-provider-upgrade.js

@@ -0,0 +1,88 @@
+import { WebSocket, WebSocketServer } from "ws";
+import { TERMINAL_SURFACE_MAX_CONTROL_BYTES } from "@tmux-ide/contracts";
+import { ownerBearerMatches } from "../command-center/owner-authority.js";
+import { NativeSurfaceProviderChannel } from "../terminal/graphics/native-surface-provider-channel.js";
+export const NATIVE_SURFACE_PROVIDER_PATH = "/v1/terminal/native-surface-provider";
+const PROTOCOL = "tmux-ide-native-surface-provider-v1";
+/** Separate owner-authenticated producer authority. Loopback, PID and Origin do
+ * not grant access. At most one connection (including registration) is admitted.
+ * Native kernel proof remains required independently of this control channel. */
+export function attachNativeSurfaceProvider(server, registry, ownerToken, isCurrent) {
+    const wss = new WebSocketServer({
+        noServer: true,
+        clientTracking: false,
+        perMessageDeflate: false,
+        maxPayload: TERMINAL_SURFACE_MAX_CONTROL_BYTES,
+        handleProtocols: (values) => (values.size === 1 && values.has(PROTOCOL) ? PROTOCOL : false),
+    });
+    let active = null;
+    let channel = null;
+    let closed = false;
+    const upgrade = (request, socket, head) => {
+        if (request.url?.split("?", 1)[0] !== NATIVE_SURFACE_PROVIDER_PATH)
+            return;
+        const headers = (name) => request.rawHeaders.filter((_, i) => i % 2 === 0).filter((key) => key.toLowerCase() === name)
+            .length;
+        const authorized = headers("authorization") === 1 &&
+            ownerBearerMatches(request.headers.authorization, ownerToken);
+        const status = !authorized
+            ? 403
+            : closed || !isCurrent()
+                ? 410
+                : active || registry.available
+                    ? 409
+                    : request.url !== NATIVE_SURFACE_PROVIDER_PATH ||
+                        headers("sec-websocket-protocol") !== 1 ||
+                        request.headers["sec-websocket-protocol"] !== PROTOCOL
+                        ? 400
+                        : 0;
+        if (status) {
+            socket.end(`HTTP/1.1 ${status} Rejected\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+            return;
+        }
+        wss.handleUpgrade(request, socket, head, (ws) => {
+            active = ws;
+            const owner = new NativeSurfaceProviderChannel(registry, (message) => {
+                if (!isCurrent() ||
+                    ws.readyState !== WebSocket.OPEN ||
+                    ws.bufferedAmount + Buffer.byteLength(message) > 64 * 1024)
+                    return false;
+                ws.send(message, (error) => {
+                    if (error)
+                        owner.close();
+                });
+                return true;
+            }, () => ws.terminate());
+            channel = owner;
+            const timer = setTimeout(() => owner.close(), 5000);
+            timer.unref();
+            ws.on("message", (data, binary) => {
+                if (binary || !isCurrent()) {
+                    owner.close();
+                    return;
+                }
+                owner.receive(data.toString());
+                if (registry.available)
+                    clearTimeout(timer);
+            });
+            ws.on("error", () => owner.close());
+            ws.on("close", () => {
+                clearTimeout(timer);
+                owner.close();
+                if (active === ws) {
+                    active = null;
+                    channel = null;
+                }
+            });
+        });
+    };
+    server.on("upgrade", upgrade);
+    return {
+        close: () => {
+            closed = true;
+            server.off("upgrade", upgrade);
+            channel?.close();
+            wss.close();
+        },
+    };
+}

package/packages/daemon/dist/terminal/graphics/compress-chunk.js

@@ -0,0 +1,40 @@
+import { deflate } from "node:zlib";
+import { encodeTerminalGraphicsCompressed, TERMINAL_GRAPHICS_BLOB_CHUNK_BYTES, } from "@tmux-ide/contracts";
+// Across panes, windows and connections: no queued compression backlog and at
+// most two chunk inputs/outputs retained by libuv. Never compress on the JS loop.
+let active = 0;
+// Prefer flat-color UI chunks. A bounded, spread-out sample avoids spending a
+// libuv job on noisy frames. False negatives only choose the raw fallback.
+function likelyCompressible(bytes) {
+    const counts = new Uint16Array(256);
+    const samples = 4096;
+    for (let i = 0; i < samples; i++) {
+        const value = bytes[Math.floor((i * (bytes.length - 1)) / (samples - 1))];
+        if (++counts[value] >= samples / 32)
+            return true;
+    }
+    return false;
+}
+export async function compressGraphicsChunk(header, bytes) {
+    if (active >= 2 ||
+        bytes.length < 4096 ||
+        bytes.length > TERMINAL_GRAPHICS_BLOB_CHUNK_BYTES ||
+        (header.blob.format !== "rgb" && header.blob.format !== "rgba"))
+        return null;
+    if (!likelyCompressible(bytes))
+        return null;
+    active++;
+    try {
+        const encoded = await new Promise((resolve) => {
+            deflate(bytes, { level: 1 }, (error, result) => resolve(error ? null : result));
+        });
+        // Savings must cover metadata and be material; incompressible images retain
+        // the original binary path. PNG/producer-zlib are never recompressed.
+        if (!encoded || encoded.length + 128 > bytes.length * 0.875)
+            return null;
+        return encodeTerminalGraphicsCompressed({ ...header, compression: "zlib", decodedBytes: bytes.length }, encoded);
+    }
+    finally {
+        active--;
+    }
+}