tmux-ide 2.9.14 → 2.9.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tmux-ide",
-  "version": "2.9.14",
+  "version": "2.9.15",
   "description": "The open-source workspace for coding agents: run Claude Code, Codex and other agents in tmux with live status",
   "type": "module",
   "bin": {

package/packages/contracts/src/index.ts

@@ -116,6 +116,7 @@ export * from "./visual-terminal-palette.ts";
 
 export * from "./window-split-layout.ts";
 export * from "./pane-editor-context.ts";
+export * from "./native-browser.ts";
 
 export * from "./tmux-agent-open.ts";
 

package/packages/contracts/src/native-browser.ts

@@ -0,0 +1,43 @@
+import { z } from "zod";
+
+const text = (limit: number) =>
+  z
+    .string()
+    .max(limit)
+    // Intentionally reject control characters in display text and navigation input.
+    // eslint-disable-next-line no-control-regex
+    .refine((value) => !/[\x00-\x1f\x7f]/u.test(value));
+const identity = {
+  version: z.literal(1),
+  instance: z.uuid(),
+  pane: z
+    .string()
+    .regex(/^%[0-9]+$/u)
+    .max(32),
+  tab: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  revision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+};
+/** Display state is not authority: every command echoes the exact browser revision. */
+export const NativeBrowserStateSchemaZ = z
+  .object({
+    ...identity,
+    enabled: z.boolean(),
+    url: text(16_384),
+    title: text(512),
+    loading: z.boolean(),
+    canGoBack: z.boolean(),
+    canGoForward: z.boolean(),
+  })
+  .strict();
+export const NativeBrowserCommandSchemaZ = z.discriminatedUnion("action", [
+  z.object({ ...identity, action: z.enum(["back", "forward", "reload", "stop"]) }).strict(),
+  z
+    .object({
+      ...identity,
+      action: z.literal("navigate"),
+      text: text(16_384).refine((value) => value.trim().length > 0),
+    })
+    .strict(),
+]);
+export type NativeBrowserState = z.infer<typeof NativeBrowserStateSchemaZ>;
+export type NativeBrowserCommand = z.infer<typeof NativeBrowserCommandSchemaZ>;

package/packages/daemon/dist/command-center/tmux-servers.js

@@ -107,6 +107,12 @@ export function mountTmuxServerRoutes(app, options) {
         owners: options.owners,
         readBody: (request) => boundedJson(request, 8 * 1024),
     });
+    app.post(`${scoped}/native-browser`, route(async (c) => {
+        const server = scope(c);
+        const input = await boundedJson(c.req.raw, 24 * 1024);
+        const state = await options.owners.withOwner(server, (owner) => owner.nativeBrowser(input, c.req.raw.signal));
+        return c.json({ version: 1, state });
+    }));
     // Structured read only: this never acquires a channel or changes tmux geometry.
     app.post(`${scoped}/split-layout/:workspaceName`, route(async (c) => {
         const server = scope(c);

package/packages/daemon/dist/lib/daemon-embed.js

@@ -6,6 +6,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
+import { createNativeBrowserResolver } from "./tmux-native-browser.js";
 import { createNativeSurfaceContextResolver } from "./native-surface-context.js";
 import { NativeSurfaceProviderRegistry } from "../terminal/graphics/native-surface-provider.js";
 import { TmuxServerVersionSchemaZ } from "@tmux-ide/contracts";
@@ -1397,6 +1398,20 @@ async function startEmbeddedDaemonGeneration(opts) {
                                 throw new Error("Default tmux editor context owner is unavailable");
                         },
                     }),
+                    nativeBrowser: createNativeBrowserResolver({
+                        generation: instanceId,
+                        run: fleetFactsTmuxRunner,
+                        registry: workspaceRegistry,
+                        catalog: createNativeTmuxServerCatalog(workspaceRegistry, fleetFactsTmuxRunner),
+                        inventory: terminalInventoryRuntime,
+                        assertOpen: () => {
+                            if (defaultEditorContextRetired ||
+                                serverOwners?.defaultRetired ||
+                                !initialNativeServerIdentity ||
+                                terminalInventoryRuntime?.lifecycleState() !== "ready")
+                                throw new Error("Default native browser owner is unavailable");
+                        },
+                    }),
                     catalog: createNativeTmuxServerCatalog(workspaceRegistry, fleetFactsTmuxRunner),
                     readWindowSplitLayout: async (workspaceName, input) => {
                         const target = WindowLinkTargetSchemaZ.parse(input);

package/packages/daemon/dist/lib/native-browser-rpc.js

@@ -0,0 +1,110 @@
+import { randomUUID } from "node:crypto";
+import { lstat } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+import { connect } from "node:net";
+import { NativeBrowserCommandSchemaZ, NativeBrowserStateSchemaZ, } from "@tmux-ide/contracts";
+import { z } from "zod";
+export const NativeBrowserEndpointSchema = z
+    .object({
+    version: z.literal(1),
+    pid: z.number().int().positive(),
+    instance: z.uuid(),
+    pane: z
+        .string()
+        .regex(/^%[0-9]+$/u)
+        .max(32),
+    socket: z.string().min(1).max(1024).refine(isAbsolute),
+})
+    .strict();
+export class NativeBrowserUnavailable extends Error {
+    constructor() {
+        super("Native browser controls are unavailable");
+    }
+}
+const responseSchema = z.discriminatedUnion("ok", [
+    z
+        .object({ id: z.string(), ok: z.literal(true), data: NativeBrowserStateSchemaZ.nullable() })
+        .strict(),
+    z.object({ id: z.string(), ok: z.literal(false), error: z.string().max(4096) }).strict(),
+]);
+/** One request, one bounded response. Mutations are never retried or refreshed. */
+export async function nativeBrowserRpc(endpoint, command, signal) {
+    const target = NativeBrowserEndpointSchema.parse(endpoint);
+    const payload = command ? NativeBrowserCommandSchemaZ.parse(command) : null;
+    if (payload && (payload.instance !== target.instance || payload.pane !== target.pane))
+        throw new NativeBrowserUnavailable();
+    signal.throwIfAborted();
+    const info = await lstat(target.socket);
+    if (!info.isSocket() || info.uid !== process.getuid?.() || (info.mode & 0o022) !== 0)
+        throw new NativeBrowserUnavailable();
+    try {
+        process.kill(target.pid, 0);
+    }
+    catch {
+        throw new NativeBrowserUnavailable();
+    }
+    signal.throwIfAborted();
+    const id = randomUUID();
+    const request = JSON.stringify({
+        id,
+        cmd: payload ? "native/1/command" : "native/1/state",
+        ...(payload ? { payload } : {}),
+    }) + "\n";
+    return new Promise((resolve, reject) => {
+        const socket = connect(target.socket);
+        let finished = false;
+        let size = 0;
+        const chunks = [];
+        const finish = (error, state = null) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+            socket.destroy();
+            if (error)
+                reject(error);
+            else
+                resolve(state);
+        };
+        const abort = () => finish(new NativeBrowserUnavailable());
+        const timer = setTimeout(abort, 1500);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted) {
+            abort();
+            return;
+        }
+        socket.once("connect", () => socket.write(request));
+        socket.on("error", abort);
+        socket.once("end", () => {
+            if (!finished)
+                abort();
+        });
+        socket.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > 128 * 1024) {
+                abort();
+                return;
+            }
+            chunks.push(chunk);
+            if (!chunk.includes(10))
+                return;
+            try {
+                const bytes = Buffer.concat(chunks);
+                const newline = bytes.indexOf(10);
+                if (newline !== bytes.length - 1)
+                    throw new NativeBrowserUnavailable();
+                const reply = responseSchema.parse(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, newline))));
+                if (reply.id !== id || !reply.ok)
+                    throw new NativeBrowserUnavailable();
+                if (reply.data &&
+                    (reply.data.instance !== target.instance || reply.data.pane !== target.pane))
+                    throw new NativeBrowserUnavailable();
+                finish(undefined, reply.data);
+            }
+            catch {
+                abort();
+            }
+        });
+    });
+}

package/packages/daemon/dist/lib/tmux-native-browser.js

@@ -0,0 +1,80 @@
+import { PaneEditorContextTargetSchemaZ, NativeBrowserCommandSchemaZ } from "@tmux-ide/contracts";
+import { z } from "zod";
+import { decodeTmuxArgument } from "../terminal/protocol/session-descriptor-discovery.js";
+import { NativeBrowserEndpointSchema, NativeBrowserUnavailable, nativeBrowserRpc, } from "./native-browser-rpc.js";
+export const NativeBrowserRequestSchema = z
+    .object({
+    target: PaneEditorContextTargetSchemaZ,
+    command: NativeBrowserCommandSchemaZ.nullable(),
+})
+    .strict();
+export function createNativeBrowserResolver(options) {
+    let readers = 0;
+    return async (input, cancellation) => {
+        const { target, command } = NativeBrowserRequestSchema.parse(input);
+        const signal = AbortSignal.any([cancellation, AbortSignal.timeout(2500)]);
+        const workspace = options.registry.get(target.workspaceName);
+        const assertCurrent = () => {
+            options.assertOpen();
+            signal.throwIfAborted();
+            if (target.generation !== options.generation ||
+                !workspace ||
+                options.registry.get(target.workspaceName) !== workspace)
+                throw new NativeBrowserUnavailable();
+        };
+        assertCurrent();
+        if (readers >= 8)
+            throw new NativeBrowserUnavailable();
+        readers++;
+        try {
+            const sessions = await options.catalog();
+            assertCurrent();
+            const matching = sessions.filter((s) => s.liveSessionId === target.liveSessionId);
+            if (matching.length !== 1 || matching[0].sessionName !== workspace.sessionName)
+                throw new NativeBrowserUnavailable();
+            const snapshot = await options.inventory.discoverTerminalInventory(signal);
+            assertCurrent();
+            if (snapshot.catalog.invalidRuntimeProof ||
+                snapshot.catalog.duplicateSemanticStamp ||
+                snapshot.catalog.duplicateRuntimePaneBinding)
+                throw new NativeBrowserUnavailable();
+            const matches = snapshot.panes.filter((p) => p.workspaceName === target.workspaceName &&
+                p.semanticPaneId === target.semanticPaneId &&
+                p.sessionName === workspace.sessionName);
+            if (matches.length !== 1)
+                throw new NativeBrowserUnavailable();
+            const pane = { ...matches[0] };
+            if (!pane.nativePaneBirthId || !/^%[0-9]+$/u.test(pane.runtimePaneId))
+                throw new NativeBrowserUnavailable();
+            const observe = async () => {
+                const raw = await options.run([
+                    "display-message",
+                    "-p",
+                    "-t",
+                    pane.runtimePaneId,
+                    "#{qa:@tmux_ide_pane_id}\t#{qa:pane_birth_id}\t#{qa:@tmux_ide_browser_control}",
+                ], signal);
+                assertCurrent();
+                if (raw.length > 8192)
+                    throw new NativeBrowserUnavailable();
+                const [semantic, birth, endpoint] = raw.trimEnd().split("\t").map(decodeTmuxArgument);
+                if (semantic !== target.semanticPaneId || birth !== pane.nativePaneBirthId)
+                    throw new NativeBrowserUnavailable();
+                const parsed = NativeBrowserEndpointSchema.parse(JSON.parse(endpoint ?? "null"));
+                if (parsed.pane !== pane.runtimePaneId)
+                    throw new NativeBrowserUnavailable();
+                return parsed;
+            };
+            const endpoint = await observe();
+            const result = await nativeBrowserRpc(endpoint, command, signal);
+            assertCurrent();
+            const current = await observe();
+            if (JSON.stringify(current) !== JSON.stringify(endpoint))
+                throw new NativeBrowserUnavailable();
+            return result;
+        }
+        finally {
+            readers--;
+        }
+    };
+}

package/packages/daemon/dist/lib/tmux-server-owner.js

@@ -1,3 +1,4 @@
+import { createNativeBrowserResolver } from "./tmux-native-browser.js";
 import { createNativeSurfaceContextResolver } from "./native-surface-context.js";
 import { shellEscape } from "./shell.js";
 import { createNativeSplitCapabilityProbe, createNativeSplitReadiness, } from "./native-split-capability.js";
@@ -505,6 +506,14 @@ export async function createNativeTmuxServerOwner(options) {
             run: (args, signal) => generationRunAsync(args, signal),
         }),
         resolvePaneEditorContext,
+        nativeBrowser: createNativeBrowserResolver({
+            generation,
+            assertOpen,
+            registry: workspaceRegistry,
+            catalog,
+            inventory: terminalInventoryRuntime,
+            run: generationRunAsync,
+        }),
         catalog,
         readWindowSplitLayout: async (workspaceName, input) => {
             assertOpen();

package/packages/daemon/dist/native/TmuxIdeNotifier.app/Contents/Info.plist

@@ -21,9 +21,9 @@
   <key>CFBundlePackageType</key>
   <string>APPL</string>
   <key>CFBundleShortVersionString</key>
-  <string>2.9.14</string>
+  <string>2.9.15</string>
   <key>CFBundleVersion</key>
-  <string>2.9.14</string>
+  <string>2.9.15</string>
   <key>LSMinimumSystemVersion</key>
   <string>11.0</string>
   <key>LSUIElement</key>

package/packages/daemon/dist/native/TmuxIdeNotifier.app/Contents/_CodeSignature/CodeResources

@@ -10,7 +10,7 @@
 		</data>
 		<key>Resources/Assets.car</key>
 		<data>
-		vWBHvsqTbQOxNEIBI9tGJCW1B9s=
+		g6ppKlYeW830G3DwzRm9o0xINW8=
 		</data>
 	</dict>
 	<key>files2</key>
@@ -26,7 +26,7 @@
 		<dict>
 			<key>hash2</key>
 			<data>
-			9TKARXnkH7u4v7AEsGxJfv64Q3jE3NOm+N2tQHYvvIE=
+			lo9t3TSww0mSpC4nN+YoeeUgaXGcFCrv53qBXtKpzEY=
 			</data>
 		</dict>
 	</dict>

package/packages/daemon/dist/open-browser.js

@@ -1,17 +1,29 @@
 import { accessSync, constants, realpathSync, statSync } from "node:fs";
 import { delimiter, isAbsolute, join, resolve } from "node:path";
+import { homedir } from "node:os";
 import { IdeError } from "./lib/errors.js";
 import { resolveRuntimeNamespace, runtimeNamespaceEnvironment } from "./lib/runtime-namespace.js";
 import { createPinnedWorkspaceTmuxRunner, resolveWorkspacePaneTmuxAuthority, } from "./lib/workspace-pane-creation.js";
 /** Resolve once before creating a pane; ignore relative PATH entries. */
-export function resolveTerminalBrowser(environment = process.env) {
+export function resolveTerminalBrowser(environment = process.env, platform = process.platform) {
     const configured = environment.TMUX_IDE_TERMINAL_BROWSER_BIN;
+    const home = environment.HOME ?? homedir();
+    // Resolve the managed alias on every invocation so an app update selects its
+    // matching browser. Native assets remain outside the universal npm package.
+    const bundled = platform === "darwin" && isAbsolute(home)
+        ? [
+            join(home, "Library", "Application Support", "tmux-ide", "native-alpha", "TmuxIDE.app", "Contents", "Resources", "browser", "terminal-browser"),
+        ]
+        : [];
     const candidates = configured
         ? [configured]
-        : (environment.PATH ?? "")
-            .split(delimiter)
-            .filter(isAbsolute)
-            .map((dir) => join(dir, "terminal-browser"));
+        : [
+            ...bundled,
+            ...(environment.PATH ?? "")
+                .split(delimiter)
+                .filter(isAbsolute)
+                .map((dir) => join(dir, "terminal-browser")),
+        ];
     for (const candidate of candidates) {
         try {
             if (!isAbsolute(candidate))

package/packages/daemon/src/command-center/tmux-servers.ts

@@ -150,6 +150,17 @@ export function mountTmuxServerRoutes(app: Hono, options: TmuxServerRoutesOption
     owners: options.owners,
     readBody: (request) => boundedJson(request, 8 * 1024),
   });
+  app.post(
+    `${scoped}/native-browser`,
+    route(async (c) => {
+      const server = scope(c);
+      const input = await boundedJson(c.req.raw, 24 * 1024);
+      const state = await options.owners.withOwner(server, (owner) =>
+        owner.nativeBrowser(input, c.req.raw.signal),
+      );
+      return c.json({ version: 1, state });
+    }),
+  );
   // Structured read only: this never acquires a channel or changes tmux geometry.
   app.post(
     `${scoped}/split-layout/:workspaceName`,

package/packages/daemon/src/lib/daemon-embed.ts

@@ -1,3 +1,4 @@
+import { createNativeBrowserResolver } from "./tmux-native-browser.ts";
 import { createNativeSurfaceContextResolver } from "./native-surface-context.ts";
 import { NativeSurfaceProviderRegistry } from "../terminal/graphics/native-surface-provider.ts";
 import { TmuxServerVersionSchemaZ } from "@tmux-ide/contracts";
@@ -1937,6 +1938,22 @@ async function startEmbeddedDaemonGeneration(
                 throw new Error("Default tmux editor context owner is unavailable");
             },
           }),
+          nativeBrowser: createNativeBrowserResolver({
+            generation: instanceId,
+            run: fleetFactsTmuxRunner,
+            registry: workspaceRegistry,
+            catalog: createNativeTmuxServerCatalog(workspaceRegistry, fleetFactsTmuxRunner),
+            inventory: terminalInventoryRuntime,
+            assertOpen: () => {
+              if (
+                defaultEditorContextRetired ||
+                serverOwners?.defaultRetired ||
+                !initialNativeServerIdentity ||
+                terminalInventoryRuntime?.lifecycleState() !== "ready"
+              )
+                throw new Error("Default native browser owner is unavailable");
+            },
+          }),
           catalog: createNativeTmuxServerCatalog(workspaceRegistry, fleetFactsTmuxRunner),
           readWindowSplitLayout: async (workspaceName, input) => {
             const target = WindowLinkTargetSchemaZ.parse(input);

package/packages/daemon/src/lib/native-browser-rpc.ts

@@ -0,0 +1,118 @@
+import { randomUUID } from "node:crypto";
+import { lstat } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+import { connect } from "node:net";
+import {
+  NativeBrowserCommandSchemaZ,
+  NativeBrowserStateSchemaZ,
+  type NativeBrowserCommand,
+  type NativeBrowserState,
+} from "@tmux-ide/contracts";
+import { z } from "zod";
+
+export const NativeBrowserEndpointSchema = z
+  .object({
+    version: z.literal(1),
+    pid: z.number().int().positive(),
+    instance: z.uuid(),
+    pane: z
+      .string()
+      .regex(/^%[0-9]+$/u)
+      .max(32),
+    socket: z.string().min(1).max(1024).refine(isAbsolute),
+  })
+  .strict();
+export type NativeBrowserEndpoint = z.infer<typeof NativeBrowserEndpointSchema>;
+export class NativeBrowserUnavailable extends Error {
+  constructor() {
+    super("Native browser controls are unavailable");
+  }
+}
+const responseSchema = z.discriminatedUnion("ok", [
+  z
+    .object({ id: z.string(), ok: z.literal(true), data: NativeBrowserStateSchemaZ.nullable() })
+    .strict(),
+  z.object({ id: z.string(), ok: z.literal(false), error: z.string().max(4096) }).strict(),
+]);
+
+/** One request, one bounded response. Mutations are never retried or refreshed. */
+export async function nativeBrowserRpc(
+  endpoint: NativeBrowserEndpoint,
+  command: NativeBrowserCommand | null,
+  signal: AbortSignal,
+): Promise<NativeBrowserState | null> {
+  const target = NativeBrowserEndpointSchema.parse(endpoint);
+  const payload = command ? NativeBrowserCommandSchemaZ.parse(command) : null;
+  if (payload && (payload.instance !== target.instance || payload.pane !== target.pane))
+    throw new NativeBrowserUnavailable();
+  signal.throwIfAborted();
+  const info = await lstat(target.socket);
+  if (!info.isSocket() || info.uid !== process.getuid?.() || (info.mode & 0o022) !== 0)
+    throw new NativeBrowserUnavailable();
+  try {
+    process.kill(target.pid, 0);
+  } catch {
+    throw new NativeBrowserUnavailable();
+  }
+  signal.throwIfAborted();
+  const id = randomUUID();
+  const request =
+    JSON.stringify({
+      id,
+      cmd: payload ? "native/1/command" : "native/1/state",
+      ...(payload ? { payload } : {}),
+    }) + "\n";
+  return new Promise((resolve, reject) => {
+    const socket = connect(target.socket);
+    let finished = false;
+    let size = 0;
+    const chunks: Buffer[] = [];
+    const finish = (error?: Error, state: NativeBrowserState | null = null) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      signal.removeEventListener("abort", abort);
+      socket.destroy();
+      if (error) reject(error);
+      else resolve(state);
+    };
+    const abort = () => finish(new NativeBrowserUnavailable());
+    const timer = setTimeout(abort, 1500);
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) {
+      abort();
+      return;
+    }
+    socket.once("connect", () => socket.write(request));
+    socket.on("error", abort);
+    socket.once("end", () => {
+      if (!finished) abort();
+    });
+    socket.on("data", (chunk: Buffer) => {
+      size += chunk.length;
+      if (size > 128 * 1024) {
+        abort();
+        return;
+      }
+      chunks.push(chunk);
+      if (!chunk.includes(10)) return;
+      try {
+        const bytes = Buffer.concat(chunks);
+        const newline = bytes.indexOf(10);
+        if (newline !== bytes.length - 1) throw new NativeBrowserUnavailable();
+        const reply = responseSchema.parse(
+          JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, newline))),
+        );
+        if (reply.id !== id || !reply.ok) throw new NativeBrowserUnavailable();
+        if (
+          reply.data &&
+          (reply.data.instance !== target.instance || reply.data.pane !== target.pane)
+        )
+          throw new NativeBrowserUnavailable();
+        finish(undefined, reply.data);
+      } catch {
+        abort();
+      }
+    });
+  });
+}

package/packages/daemon/src/lib/tmux-native-browser.ts

@@ -0,0 +1,100 @@
+import { PaneEditorContextTargetSchemaZ, NativeBrowserCommandSchemaZ } from "@tmux-ide/contracts";
+import { z } from "zod";
+import type { LiveSessionSummary } from "../command-center/discovery.ts";
+import type { WorkspaceTerminalInventoryRuntime } from "../terminal/attachments/native-runtime.ts";
+import type { WorkspaceRegistry } from "./workspace-registry.ts";
+import { decodeTmuxArgument } from "../terminal/protocol/session-descriptor-discovery.ts";
+import {
+  NativeBrowserEndpointSchema,
+  NativeBrowserUnavailable,
+  nativeBrowserRpc,
+} from "./native-browser-rpc.ts";
+
+export const NativeBrowserRequestSchema = z
+  .object({
+    target: PaneEditorContextTargetSchemaZ,
+    command: NativeBrowserCommandSchemaZ.nullable(),
+  })
+  .strict();
+export function createNativeBrowserResolver(options: {
+  generation: string;
+  assertOpen(): void;
+  registry: Pick<WorkspaceRegistry, "get">;
+  catalog(): Promise<LiveSessionSummary[]>;
+  inventory: Pick<WorkspaceTerminalInventoryRuntime, "discoverTerminalInventory">;
+  run(args: readonly string[], signal: AbortSignal): Promise<string>;
+}) {
+  let readers = 0;
+  return async (input: unknown, cancellation: AbortSignal) => {
+    const { target, command } = NativeBrowserRequestSchema.parse(input);
+    const signal = AbortSignal.any([cancellation, AbortSignal.timeout(2500)]);
+    const workspace = options.registry.get(target.workspaceName);
+    const assertCurrent = () => {
+      options.assertOpen();
+      signal.throwIfAborted();
+      if (
+        target.generation !== options.generation ||
+        !workspace ||
+        options.registry.get(target.workspaceName) !== workspace
+      )
+        throw new NativeBrowserUnavailable();
+    };
+    assertCurrent();
+    if (readers >= 8) throw new NativeBrowserUnavailable();
+    readers++;
+    try {
+      const sessions = await options.catalog();
+      assertCurrent();
+      const matching = sessions.filter((s) => s.liveSessionId === target.liveSessionId);
+      if (matching.length !== 1 || matching[0]!.sessionName !== workspace!.sessionName)
+        throw new NativeBrowserUnavailable();
+      const snapshot = await options.inventory.discoverTerminalInventory(signal);
+      assertCurrent();
+      if (
+        snapshot.catalog.invalidRuntimeProof ||
+        snapshot.catalog.duplicateSemanticStamp ||
+        snapshot.catalog.duplicateRuntimePaneBinding
+      )
+        throw new NativeBrowserUnavailable();
+      const matches = snapshot.panes.filter(
+        (p) =>
+          p.workspaceName === target.workspaceName &&
+          p.semanticPaneId === target.semanticPaneId &&
+          p.sessionName === workspace!.sessionName,
+      );
+      if (matches.length !== 1) throw new NativeBrowserUnavailable();
+      const pane = { ...matches[0]! };
+      if (!pane.nativePaneBirthId || !/^%[0-9]+$/u.test(pane.runtimePaneId))
+        throw new NativeBrowserUnavailable();
+      const observe = async () => {
+        const raw = await options.run(
+          [
+            "display-message",
+            "-p",
+            "-t",
+            pane.runtimePaneId,
+            "#{qa:@tmux_ide_pane_id}\t#{qa:pane_birth_id}\t#{qa:@tmux_ide_browser_control}",
+          ],
+          signal,
+        );
+        assertCurrent();
+        if (raw.length > 8192) throw new NativeBrowserUnavailable();
+        const [semantic, birth, endpoint] = raw.trimEnd().split("\t").map(decodeTmuxArgument);
+        if (semantic !== target.semanticPaneId || birth !== pane.nativePaneBirthId)
+          throw new NativeBrowserUnavailable();
+        const parsed = NativeBrowserEndpointSchema.parse(JSON.parse(endpoint ?? "null"));
+        if (parsed.pane !== pane.runtimePaneId) throw new NativeBrowserUnavailable();
+        return parsed;
+      };
+      const endpoint = await observe();
+      const result = await nativeBrowserRpc(endpoint, command, signal);
+      assertCurrent();
+      const current = await observe();
+      if (JSON.stringify(current) !== JSON.stringify(endpoint))
+        throw new NativeBrowserUnavailable();
+      return result;
+    } finally {
+      readers--;
+    }
+  };
+}