tmux-ide 2.9.12 → 2.9.13

package/packages/daemon/src/lib/native-surface-context.ts

@@ -0,0 +1,123 @@
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+import {
+  TerminalAttachmentSemanticPaneIdSchemaZ,
+  WorkspaceCatalogLiveSessionIdSchemaZ,
+} from "@tmux-ide/contracts";
+import type { LiveSessionSummary } from "../command-center/discovery.ts";
+import type { WorkspaceTerminalInventoryRuntime } from "../terminal/attachments/native-runtime.ts";
+import type { WorkspaceRegistry } from "./workspace-registry.ts";
+
+export const NativeSurfaceLocationSchema = z
+  .object({
+    socketPath: z
+      .string()
+      .min(1)
+      .max(4096)
+      .refine((p) => isAbsolute(p) && !/[\0\r\n\t]/u.test(p)),
+    serverPid: z
+      .string()
+      .max(16)
+      .regex(/^[1-9][0-9]*$/u),
+    sessionId: z
+      .string()
+      .max(32)
+      .regex(/^\$(?:0|[1-9][0-9]*)$/u),
+    runtimePaneId: z
+      .string()
+      .max(32)
+      .regex(/^%(?:0|[1-9][0-9]*)$/u),
+  })
+  .strict();
+export type NativeSurfaceLocation = z.infer<typeof NativeSurfaceLocationSchema>;
+
+interface Options {
+  generation: string;
+  assertOpen(): void;
+  run(args: readonly string[], signal: AbortSignal): Promise<string>;
+  registry: Pick<WorkspaceRegistry, "get">;
+  catalog(): Promise<LiveSessionSummary[]>;
+  inventory: Pick<WorkspaceTerminalInventoryRuntime, "discoverTerminalInventory">;
+}
+
+/** Resolve inherited tmux location only through the current generation's pinned owner. */
+export function createNativeSurfaceContextResolver(options: Options) {
+  const generation = z.uuid().parse(options.generation);
+  return async (input: NativeSurfaceLocation, cancellation?: AbortSignal) => {
+    const target = NativeSurfaceLocationSchema.parse(input);
+    const signal = AbortSignal.any([
+      AbortSignal.timeout(5000),
+      ...(cancellation ? [cancellation] : []),
+    ]);
+    const assertCurrent = () => {
+      options.assertOpen();
+      signal.throwIfAborted();
+    };
+    const unavailable = (): never => {
+      throw new Error("Native surface source unavailable");
+    };
+    const observe = async () => {
+      assertCurrent();
+      const proof = await options.run(
+        [
+          "display-message",
+          "-p",
+          "-t",
+          target.runtimePaneId,
+          "#{socket_path}\t#{pid}\t#{session_id}\t#{pane_id}",
+        ],
+        signal,
+      );
+      assertCurrent();
+      if (
+        proof.trimEnd() !==
+        [target.socketPath, target.serverPid, target.sessionId, target.runtimePaneId].join("\t")
+      )
+        unavailable();
+      const snapshot = await options.inventory.discoverTerminalInventory(signal);
+      assertCurrent();
+      if (
+        snapshot.catalog.invalidRuntimeProof ||
+        snapshot.catalog.duplicateSemanticStamp ||
+        snapshot.catalog.duplicateRuntimePaneBinding
+      )
+        unavailable();
+      const matches = snapshot.panes.filter(
+        (pane) =>
+          pane.runtimePaneId === target.runtimePaneId && pane.sessionId === target.sessionId,
+      );
+      if (matches.length !== 1) return unavailable();
+      const pane = { ...matches[0]! };
+      const semantic = TerminalAttachmentSemanticPaneIdSchemaZ.parse(pane.semanticPaneId);
+      const workspace = options.registry.get(pane.workspaceName);
+      if (!workspace || workspace.sessionName !== pane.sessionName) return unavailable();
+      const sessions = (await options.catalog()).filter(
+        (row) => row.sessionName === pane.sessionName,
+      );
+      assertCurrent();
+      if (sessions.length !== 1 || options.registry.get(pane.workspaceName) !== workspace)
+        return unavailable();
+      const live = WorkspaceCatalogLiveSessionIdSchemaZ.parse(sessions[0]!.liveSessionId);
+      return {
+        context: {
+          generation,
+          workspaceName: pane.workspaceName,
+          liveSessionId: live,
+          pane: semantic,
+        },
+        identity: [
+          pane.sessionId,
+          pane.windowId,
+          pane.runtimePaneId,
+          pane.windowStamp ?? null,
+          pane.nativePaneBirthId ?? null,
+        ],
+      };
+    };
+    const before = await observe();
+    const after = await observe();
+    if (JSON.stringify(before) !== JSON.stringify(after)) return unavailable();
+    assertCurrent();
+    return Object.freeze(after.context);
+  };
+}

package/packages/daemon/src/lib/tmux-server-owner.ts

@@ -1,3 +1,4 @@
+import { createNativeSurfaceContextResolver } from "./native-surface-context.ts";
 import type { LocalImageOwner } from "../terminal/graphics/local-image-owner.ts";
 import { shellEscape } from "./shell.ts";
 import {
@@ -609,6 +610,14 @@ export async function createNativeTmuxServerOwner(options: NativeTmuxServerOwner
     },
     serverId: options.serverId,
     generation,
+    resolveNativeSurfaceContext: createNativeSurfaceContextResolver({
+      generation,
+      assertOpen,
+      registry: workspaceRegistry,
+      catalog,
+      inventory: terminalInventoryRuntime,
+      run: (args, signal) => generationRunAsync(args, signal),
+    }),
     resolvePaneEditorContext,
     catalog,
     readWindowSplitLayout: async (workspaceName: string, input: WindowLinkTarget) => {

package/packages/daemon/src/server/native-surface-provider-upgrade.ts

@@ -0,0 +1,103 @@
+import type { Server, IncomingMessage } from "node:http";
+import type { Socket } from "node:net";
+import { WebSocket, WebSocketServer } from "ws";
+import { TERMINAL_SURFACE_MAX_CONTROL_BYTES } from "@tmux-ide/contracts";
+import { ownerBearerMatches } from "../command-center/owner-authority.ts";
+import type { NativeSurfaceProviderRegistry } from "../terminal/graphics/native-surface-provider.ts";
+import { NativeSurfaceProviderChannel } from "../terminal/graphics/native-surface-provider-channel.ts";
+
+export const NATIVE_SURFACE_PROVIDER_PATH = "/v1/terminal/native-surface-provider";
+const PROTOCOL = "tmux-ide-native-surface-provider-v1";
+
+/** Separate owner-authenticated producer authority. Loopback, PID and Origin do
+ * not grant access. At most one connection (including registration) is admitted.
+ * Native kernel proof remains required independently of this control channel. */
+export function attachNativeSurfaceProvider(
+  server: Server,
+  registry: NativeSurfaceProviderRegistry,
+  ownerToken: string | null,
+  isCurrent: () => boolean,
+) {
+  const wss = new WebSocketServer({
+    noServer: true,
+    clientTracking: false,
+    perMessageDeflate: false,
+    maxPayload: TERMINAL_SURFACE_MAX_CONTROL_BYTES,
+    handleProtocols: (values) => (values.size === 1 && values.has(PROTOCOL) ? PROTOCOL : false),
+  });
+  let active: WebSocket | null = null;
+  let channel: NativeSurfaceProviderChannel | null = null;
+  let closed = false;
+  const upgrade = (request: IncomingMessage, socket: Socket, head: Buffer) => {
+    if (request.url?.split("?", 1)[0] !== NATIVE_SURFACE_PROVIDER_PATH) return;
+    const headers = (name: string) =>
+      request.rawHeaders.filter((_, i) => i % 2 === 0).filter((key) => key.toLowerCase() === name)
+        .length;
+    const authorized =
+      headers("authorization") === 1 &&
+      ownerBearerMatches(request.headers.authorization, ownerToken);
+    const status = !authorized
+      ? 403
+      : closed || !isCurrent()
+        ? 410
+        : active || registry.available
+          ? 409
+          : request.url !== NATIVE_SURFACE_PROVIDER_PATH ||
+              headers("sec-websocket-protocol") !== 1 ||
+              request.headers["sec-websocket-protocol"] !== PROTOCOL
+            ? 400
+            : 0;
+    if (status) {
+      socket.end(`HTTP/1.1 ${status} Rejected\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+      return;
+    }
+    wss.handleUpgrade(request, socket, head, (ws) => {
+      active = ws;
+      const owner = new NativeSurfaceProviderChannel(
+        registry,
+        (message) => {
+          if (
+            !isCurrent() ||
+            ws.readyState !== WebSocket.OPEN ||
+            ws.bufferedAmount + Buffer.byteLength(message) > 64 * 1024
+          )
+            return false;
+          ws.send(message, (error) => {
+            if (error) owner.close();
+          });
+          return true;
+        },
+        () => ws.terminate(),
+      );
+      channel = owner;
+      const timer = setTimeout(() => owner.close(), 5000);
+      timer.unref();
+      ws.on("message", (data, binary) => {
+        if (binary || !isCurrent()) {
+          owner.close();
+          return;
+        }
+        owner.receive(data.toString());
+        if (registry.available) clearTimeout(timer);
+      });
+      ws.on("error", () => owner.close());
+      ws.on("close", () => {
+        clearTimeout(timer);
+        owner.close();
+        if (active === ws) {
+          active = null;
+          channel = null;
+        }
+      });
+    });
+  };
+  server.on("upgrade", upgrade);
+  return {
+    close: () => {
+      closed = true;
+      server.off("upgrade", upgrade);
+      channel?.close();
+      wss.close();
+    },
+  };
+}

package/packages/daemon/src/terminal/graphics/compress-chunk.ts

@@ -0,0 +1,49 @@
+import { deflate } from "node:zlib";
+import {
+  encodeTerminalGraphicsCompressed,
+  TERMINAL_GRAPHICS_BLOB_CHUNK_BYTES,
+  type TerminalGraphicsBinaryHeader,
+} from "@tmux-ide/contracts";
+
+// Across panes, windows and connections: no queued compression backlog and at
+// most two chunk inputs/outputs retained by libuv. Never compress on the JS loop.
+let active = 0;
+// Prefer flat-color UI chunks. A bounded, spread-out sample avoids spending a
+// libuv job on noisy frames. False negatives only choose the raw fallback.
+function likelyCompressible(bytes: Uint8Array): boolean {
+  const counts = new Uint16Array(256);
+  const samples = 4096;
+  for (let i = 0; i < samples; i++) {
+    const value = bytes[Math.floor((i * (bytes.length - 1)) / (samples - 1))]!;
+    if (++counts[value]! >= samples / 32) return true;
+  }
+  return false;
+}
+export async function compressGraphicsChunk(
+  header: TerminalGraphicsBinaryHeader,
+  bytes: Uint8Array,
+): Promise<Uint8Array | null> {
+  if (
+    active >= 2 ||
+    bytes.length < 4096 ||
+    bytes.length > TERMINAL_GRAPHICS_BLOB_CHUNK_BYTES ||
+    (header.blob.format !== "rgb" && header.blob.format !== "rgba")
+  )
+    return null;
+  if (!likelyCompressible(bytes)) return null;
+  active++;
+  try {
+    const encoded = await new Promise<Buffer | null>((resolve) => {
+      deflate(bytes, { level: 1 }, (error, result) => resolve(error ? null : result));
+    });
+    // Savings must cover metadata and be material; incompressible images retain
+    // the original binary path. PNG/producer-zlib are never recompressed.
+    if (!encoded || encoded.length + 128 > bytes.length * 0.875) return null;
+    return encodeTerminalGraphicsCompressed(
+      { ...header, compression: "zlib", decodedBytes: bytes.length },
+      encoded,
+    );
+  } finally {
+    active--;
+  }
+}

package/packages/daemon/src/terminal/graphics/native-surface-demand.ts

@@ -0,0 +1,88 @@
+/** Bounded daemon-local demand for ordinary terminal image output. Unknown
+ * native-client inventory preserves fallback; only proven absence can suppress it. */
+export interface SurfaceViewerDemand {
+  native(ready: boolean): void;
+  close(): void;
+}
+type Viewer = { session: string; panes: ReadonlySet<string>; native: boolean };
+export class NativeSurfaceDemand {
+  #viewers = new Set<Viewer>();
+  #presence = new Map<string, boolean>();
+  #listeners = new Set<() => void>();
+  #overflow = 0;
+  #closed = false;
+  #queued = false;
+  presence(session: string, present: boolean | null): void {
+    if (this.#closed) return;
+    if (present === null) this.#presence.delete(session);
+    else {
+      if (!this.#presence.has(session) && this.#presence.size >= 256) {
+        const oldest = this.#presence.keys().next().value;
+        if (oldest !== undefined) this.#presence.delete(oldest);
+      }
+      this.#presence.set(session, present);
+    }
+    this.#notify();
+  }
+  viewer(session: string, panes: readonly string[]): SurfaceViewerDemand {
+    const viewer: Viewer = { session, panes: new Set(panes), native: false };
+    const retained = !this.#closed && this.#viewers.size < 256 && panes.length <= 256;
+    if (retained) this.#viewers.add(viewer);
+    else this.#overflow++;
+    this.#notify();
+    let closed = false;
+    return {
+      native: (ready) => {
+        if (closed || viewer.native === ready) return;
+        viewer.native = ready;
+        this.#notify();
+      },
+      close: () => {
+        if (closed) return;
+        closed = true;
+        if (retained) this.#viewers.delete(viewer);
+        else this.#overflow--;
+        this.#notify();
+      },
+    };
+  }
+  required(pane: string): boolean {
+    if (this.#closed || this.#overflow) return true;
+    let known = false;
+    for (const viewer of this.#viewers) {
+      if (!viewer.panes.has(pane)) continue;
+      known = true;
+      if (!viewer.native || this.#presence.get(viewer.session) !== false) return true;
+    }
+    return !known;
+  }
+  watch(listener: () => void): () => void {
+    if (this.#closed || this.#listeners.size >= 256) throw new Error("Surface demand unavailable");
+    this.#listeners.add(listener);
+    this.#notify();
+    return () => this.#listeners.delete(listener);
+  }
+  #notify(): void {
+    if (this.#queued) return;
+    this.#queued = true;
+    queueMicrotask(() => {
+      this.#queued = false;
+      for (const listener of [...this.#listeners]) {
+        if (!this.#listeners.has(listener)) continue;
+        try {
+          listener();
+        } catch {
+          this.#listeners.delete(listener);
+        }
+      }
+      if (this.#closed) this.#listeners.clear();
+    });
+  }
+  close(): void {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#viewers.clear();
+    this.#presence.clear();
+    this.#notify();
+  }
+}

package/packages/daemon/src/terminal/graphics/native-surface-provider-channel.ts

@@ -0,0 +1,161 @@
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+import {
+  TerminalAttachmentSemanticPaneIdSchemaZ,
+  TerminalSurfaceAuditTokenSchemaZ,
+  TerminalSurfaceOfferSchemaZ,
+  TERMINAL_SURFACE_MAX_CONTROL_BYTES,
+} from "@tmux-ide/contracts";
+import {
+  NativeSurfaceProviderRegistry,
+  type NativeSurfaceProvider,
+} from "./native-surface-provider.ts";
+
+const Register = z
+  .object({
+    type: z.literal("register"),
+    version: z.literal(1),
+    generation: z.uuid(),
+    auditToken: TerminalSurfaceAuditTokenSchemaZ,
+  })
+  .strict();
+const Offer = z
+  .object({
+    type: z.literal("offer"),
+    connection: z.uuid(),
+    offer: TerminalSurfaceOfferSchemaZ,
+  })
+  .strict();
+const WatchDemand = z
+  .object({
+    type: z.literal("watch-demand"),
+    panes: z.array(TerminalAttachmentSemanticPaneIdSchemaZ).min(1).max(32),
+  })
+  .strict();
+type Context = Parameters<NativeSurfaceProvider["open"]>[0];
+
+/** Only an authenticated owner connection may construct this channel. Kernel
+ * identity proof is still mandatory at the native receiver. No payload contains
+ * pixel storage, executable paths, or a reusable daemon credential. */
+export class NativeSurfaceProviderChannel {
+  #unregister: (() => void) | null = null;
+  #connections = new Map<string, Context>();
+  #closed = false;
+  #stopDemand: (() => void) | null = null;
+  #demandPanes: string[] | null = null;
+  #lastDemand: string | null = null;
+  constructor(
+    readonly registry: NativeSurfaceProviderRegistry,
+    readonly send: (message: string) => boolean,
+    readonly disconnect: () => void,
+  ) {}
+  receive(text: string): void {
+    if (this.#closed) return;
+    if (Buffer.byteLength(text) > TERMINAL_SURFACE_MAX_CONTROL_BYTES) {
+      this.close();
+      return;
+    }
+    let value: unknown;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      this.close();
+      return;
+    }
+    if (!this.#unregister) {
+      const registration = Register.safeParse(value);
+      if (!registration.success || registration.data.generation !== this.registry.generation) {
+        this.close();
+        return;
+      }
+      try {
+        this.#unregister = this.registry.register({
+          auditToken: registration.data.auditToken,
+          open: (context) => this.#open(context),
+        });
+      } catch {
+        this.close();
+        return;
+      }
+      this.#send({ type: "registered", version: 1, generation: this.registry.generation });
+      return;
+    }
+    const watch = WatchDemand.safeParse(value);
+    if (watch.success) {
+      const panes = [...new Set(watch.data.panes)].sort();
+      if (this.#demandPanes) {
+        if (JSON.stringify(panes) !== JSON.stringify(this.#demandPanes)) this.close();
+        return;
+      }
+      this.#demandPanes = panes;
+      try {
+        this.#stopDemand = this.registry.demand.watch(() => {
+          const required = panes.filter((pane) => this.registry.demand.required(pane));
+          const key = JSON.stringify(required);
+          if (key === this.#lastDemand) return;
+          this.#lastDemand = key;
+          this.#send({ type: "kitty-demand", panes, required });
+        });
+      } catch {
+        this.close();
+      }
+      return;
+    }
+    const parsed = Offer.safeParse(value);
+    if (!parsed.success) {
+      this.close();
+      return;
+    }
+    const { connection, offer } = parsed.data;
+    const context = this.#connections.get(connection);
+    if (!context) {
+      this.close();
+      return;
+    }
+    const accepted = context.offer(offer);
+    // The producer must wait for accepted=true before transferring the matching
+    // native right. A dropped channel or rejected offer grants no transfer.
+    this.#send({ type: "offered", connection, sequence: offer.sequence, accepted });
+  }
+  #open(context: Context) {
+    if (this.#closed || this.#connections.size >= 32)
+      throw new Error("Native provider unavailable");
+    const connection = randomUUID();
+    this.#connections.set(connection, context);
+    return {
+      start: () => {
+        this.#send({ type: "start", connection, receiver: context.receiver, panes: context.panes });
+      },
+      retire: (sequence: number) => {
+        this.#send({ type: "retired", connection, sequence });
+      },
+      fallback: () => {
+        this.#send({ type: "fallback", connection });
+      },
+      close: () => {
+        this.#connections.delete(connection);
+        this.#send({ type: "close", connection });
+      },
+    };
+  }
+  #send(value: unknown): void {
+    if (this.#closed) return;
+    const text = JSON.stringify(value);
+    try {
+      if (Buffer.byteLength(text) <= TERMINAL_SURFACE_MAX_CONTROL_BYTES && this.send(text)) return;
+    } catch {
+      /* A failed sink revokes all further native offers. */
+    }
+    this.close();
+  }
+  close(): void {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#stopDemand?.();
+    this.#stopDemand = null;
+    this.#unregister?.();
+    this.#unregister = null;
+    this.#connections.clear();
+    this.disconnect();
+  }
+}