tmux-ide 2.9.16 → 2.9.17

package/packages/core/src/terminal-replica-hash-cache.ts

@@ -1,9 +1,15 @@
 import {
+  isOwnedTerminalReplicaRow,
   isSchemaValidProjectedTerminalReplicaRow,
   TERMINAL_REPLICA_DEFAULT_COLOR,
 } from "./terminal-replica-owned-row.ts";
 import type { TerminalReplicaColor, TerminalReplicaRow } from "@tmux-ide/contracts";
-import { createBufferedFnv64, type BufferedFnv64 } from "./terminal-fnv64-wasm.ts";
+import {
+  createBufferedFnv64,
+  FNV64_OFFSET_BASIS,
+  nativeFnv64,
+  type BufferedFnv64,
+} from "./terminal-fnv64-wasm.ts";
 
 const ROW_HASH_CACHE = new WeakMap<object, string>();
 const DEEPLY_FROZEN_ROWS = new WeakSet<object>();
@@ -425,6 +431,12 @@ export function hashTerminalReplicaRowCached(
   const cached = ROW_HASH_CACHE.get(row);
   if (cached) return cached;
   onMiss?.();
+  const native = nativeFnv64();
+  if (native) {
+    const digest = hashRowBytes(row, native);
+    if (isTerminalReplicaRowDeeplyFrozen(row)) ROW_HASH_CACHE.set(row, digest);
+    return digest;
+  }
   const hash = encodingCache?.createHash() ?? new CanonicalFnv64();
   let canonicalBytes = 10 + String(row.cells.length).length;
   hash.ascii("a2:");
@@ -631,6 +643,11 @@ export function primeTerminalReplicaRowHash(row: TerminalReplicaRow, digest: str
 
 export function isTerminalReplicaRowDeeplyFrozen(row: TerminalReplicaRow): boolean {
   if (DEEPLY_FROZEN_ROWS.has(row)) return true;
+  // Every owned-row constructor freezes the row, its cells and their colors.
+  if (isOwnedTerminalReplicaRow(row as unknown)) {
+    DEEPLY_FROZEN_ROWS.add(row);
+    return true;
+  }
   if (!Object.isFrozen(row) || !Object.isFrozen(row.cells)) return false;
   for (const cell of row.cells) {
     if (
@@ -643,3 +660,93 @@ export function isTerminalReplicaRowDeeplyFrozen(row: TerminalReplicaRow): boole
   DEEPLY_FROZEN_ROWS.add(row);
   return true;
 }
+
+// #708: the same canonical row bytes as hashTerminalReplicaRowCached's
+// CanonicalFnv64 path, assembled from per-cell byte strings and hashed in
+// WASM in 4 KiB chunks instead of several small JS writes per cell.
+const ASCII_ENCODER = new TextEncoder();
+const CELL_BYTES_LIMIT = 4_096;
+const PLAIN_CELL_BYTES = new Map<string, Uint8Array>();
+const STYLED_CELL_BYTES = new Map<string, Uint8Array>();
+const ROW_TRAILER = ASCII_ENCODER.encode(";;");
+
+function canonicalNumber(value: number): string {
+  const text = String(value);
+  return `d${text.length}:${text};`;
+}
+
+function canonicalColor(color: TerminalReplicaColor): string {
+  if (color.kind === "default") return "o1:s4:kind;s7:default;;";
+  if (color.kind === "indexed")
+    return `o2:s5:index;${canonicalNumber(color.index)}s4:kind;s7:indexed;;`;
+  return `o2:s4:kind;s3:rgb;s5:value;${canonicalNumber(color.value)};`;
+}
+
+function encodeCell(cell: TerminalReplicaRow["cells"][number]): Uint8Array {
+  const grapheme = cell.grapheme;
+  let length = grapheme.length;
+  for (let index = 0; index < grapheme.length; index += 1)
+    if (grapheme.charCodeAt(index) > 0x7f) {
+      length = UTF8_ENCODER.encode(grapheme).byteLength;
+      break;
+    }
+  return UTF8_ENCODER.encode(
+    `a5:s${length}:${grapheme};${canonicalNumber(cell.width)}${canonicalColor(
+      cell.foreground,
+    )}${canonicalColor(cell.background)}${canonicalNumber(cell.attributes)};`,
+  );
+}
+
+function remember(cache: Map<string, Uint8Array>, key: string, bytes: Uint8Array): Uint8Array {
+  if (cache.size >= CELL_BYTES_LIMIT) cache.clear();
+  cache.set(key, bytes);
+  return bytes;
+}
+
+function cellBytes(cell: TerminalReplicaRow["cells"][number]): Uint8Array {
+  const { grapheme, width, attributes, foreground, background } = cell;
+  if (
+    width === 1 &&
+    attributes === 0 &&
+    foreground.kind === "default" &&
+    background.kind === "default"
+  )
+    return PLAIN_CELL_BYTES.get(grapheme) ?? remember(PLAIN_CELL_BYTES, grapheme, encodeCell(cell));
+  const key = `${width}\u0000${attributes}\u0000${canonicalColor(foreground)}\u0000${canonicalColor(
+    background,
+  )}\u0000${grapheme}`;
+  return STYLED_CELL_BYTES.get(key) ?? remember(STYLED_CELL_BYTES, key, encodeCell(cell));
+}
+
+function hashRowBytes(
+  row: TerminalReplicaRow,
+  native: NonNullable<ReturnType<typeof nativeFnv64>>,
+): string {
+  const scratch = native.scratch;
+  const capacity = scratch.byteLength;
+  let state = FNV64_OFFSET_BASIS;
+  let length = 0;
+  const write = (bytes: Uint8Array) => {
+    if (bytes.byteLength <= capacity - length) {
+      scratch.set(bytes, length);
+      length += bytes.byteLength;
+      return;
+    }
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+      const count = Math.min(capacity - length, bytes.byteLength - offset);
+      scratch.set(bytes.subarray(offset, offset + count), length);
+      length += count;
+      offset += count;
+      if (length === capacity) {
+        state = BigInt.asUintN(64, native.update(state, length));
+        length = 0;
+      }
+    }
+  };
+  write(ASCII_ENCODER.encode(`a2:${row.wrapped ? "b1;" : "b0;"}a${row.cells.length}:`));
+  for (const cell of row.cells) write(cellBytes(cell));
+  write(ROW_TRAILER);
+  state = BigInt.asUintN(64, native.update(state, length));
+  return state.toString(16).padStart(16, "0");
+}

package/packages/core/src/terminal-replica.ts

@@ -1001,6 +1001,20 @@ function resolveFrameHash(
  * seed whose frame hash differs is a protocol conflict, not idempotent.
  */
 function terminalReplicaFrameIdentity(update: CanonicalTerminalReplicaUpdate): unknown {
+  if (update.type === "terminal.patch") {
+    // #708: a flood patch appends many history rows the interpreter has just
+    // hashed; enter them, and the changed screen rows, by their row hashes.
+    const { rows, history, historyDelta, ...rest } = update.patch;
+    return [
+      "terminal-replica-patch-frame-v2",
+      { ...update, patch: rest },
+      rows.map(({ index, row }) => [index, hashTerminalReplicaRow(row)]),
+      history === undefined ? null : hashTerminalReplicaRows(history),
+      historyDelta === undefined
+        ? null
+        : [historyDelta.trim, hashTerminalReplicaRows(historyDelta.append)],
+    ];
+  }
   if (update.type !== "terminal.seed") return update;
   const { grid, history, ...rest } = update.snapshot;
   return [

package/packages/daemon/dist/command-center/discovery.js

@@ -160,11 +160,15 @@ export function isVisibleFleetSession(name) {
 export function readAdoptedSessionNames(runTmux = _tmuxRunner) {
     let raw;
     try {
-        raw = runTmux(["list-sessions", "-F", `#{session_name}\t#{${ADOPTED_OPTION}}`]);
+        raw = runTmux(ADOPTED_SESSIONS_ARGS);
     }
     catch {
         return null;
     }
+    return parseAdoptedSessionNames(raw);
+}
+const ADOPTED_SESSIONS_ARGS = ["list-sessions", "-F", `#{session_name}\t#{${ADOPTED_OPTION}}`];
+function parseAdoptedSessionNames(raw) {
     const names = [];
     for (const line of raw.split("\n")) {
         if (!line)
@@ -223,18 +227,47 @@ export function readAdoptedFleet(registry = getDefaultWorkspaceRegistry(), runTm
     const adopted = readAdoptedSessionNames(runTmux);
     if (adopted === null)
         return null;
-    const adoptedSet = new Set(adopted);
-    if (adoptedSet.size === 0)
+    if (adopted.length === 0)
+        return [];
+    let panesRaw;
+    try {
+        panesRaw = runTmux(FLEET_PANES_ARGS);
+    }
+    catch {
+        panesRaw = "";
+    }
+    return assembleAdoptedFleet(adopted, panesRaw, registry, nativeEpoch, resolveInteractionEndpoint, nativeServerEpoch);
+}
+/**
+ * {@link readAdoptedFleet} over an asynchronous tmux runner: the same two reads
+ * in the same order, without blocking the event loop while tmux answers (#709).
+ */
+export async function readAdoptedFleetAsync(registry, runTmux, resolveInteractionEndpoint, nativeServerEpoch) {
+    const nativeEpoch = nativeServerEpoch?.() ?? null;
+    let sessionsRaw;
+    try {
+        sessionsRaw = await runTmux(ADOPTED_SESSIONS_ARGS);
+    }
+    catch {
+        return null;
+    }
+    const adopted = parseAdoptedSessionNames(sessionsRaw);
+    if (adopted.length === 0)
         return [];
-    const appCreatedSessions = new Set(registry.list().map((workspace) => workspace.sessionName));
-    const panesBySession = new Map();
     let panesRaw;
     try {
-        panesRaw = runTmux(["list-panes", "-a", "-F", FLEET_PANE_FORMAT]);
+        panesRaw = await runTmux(FLEET_PANES_ARGS);
     }
     catch {
         panesRaw = "";
     }
+    return assembleAdoptedFleet(adopted, panesRaw, registry, nativeEpoch, resolveInteractionEndpoint, nativeServerEpoch);
+}
+const FLEET_PANES_ARGS = ["list-panes", "-a", "-F", FLEET_PANE_FORMAT];
+function assembleAdoptedFleet(adopted, panesRaw, registry, nativeEpoch, resolveInteractionEndpoint, nativeServerEpoch) {
+    const adoptedSet = new Set(adopted);
+    const appCreatedSessions = new Set(registry.list().map((workspace) => workspace.sessionName));
+    const panesBySession = new Map();
     for (const line of panesRaw.split("\n")) {
         if (!line)
             continue;

package/packages/daemon/dist/lib/catalog-fleet-read.js

@@ -0,0 +1,10 @@
+import { readAdoptedFleet, readAdoptedFleetAsync, } from "../command-center/discovery.js";
+/**
+ * Read the catalog fleet without blocking the event loop (#709), except inside
+ * a session mutation, where the read keeps the fence's synchronous runner.
+ */
+export async function readCatalogFleet(registry, runners, resolveInteractionEndpoint, nativeServerEpoch) {
+    return runners.fence.active
+        ? readAdoptedFleet(registry, runners.fencedSync, resolveInteractionEndpoint, nativeServerEpoch)
+        : readAdoptedFleetAsync(registry, runners.generationFencedAsync, resolveInteractionEndpoint, nativeServerEpoch);
+}

package/packages/daemon/dist/lib/daemon-embed.js

@@ -68,7 +68,8 @@ import { setDaemonShutdownBackend, setDaemonRestartBackend, } from "../command-c
 import { readAppSettings } from "./app-settings.js";
 import { getDefaultWorkspaceRegistry, readWorkspaceRegistrySessionInventory, WORKSPACE_REGISTRY_TMUX_TIMEOUT_MS, } from "./workspace-registry.js";
 import { createPinnedWorkspaceTmuxRunner, createPinnedWorkspaceTmuxAsyncRunner, resolveWorkspacePaneTmuxAuthority, WorkspacePaneCreationAuthority, } from "./workspace-pane-creation.js";
-import { discoverLiveSessionSummaries, readAdoptedFleet } from "../command-center/discovery.js";
+import { discoverLiveSessionSummaries, readAdoptedFleet, } from "../command-center/discovery.js";
+import { readCatalogFleet } from "./catalog-fleet-read.js";
 import { WorkspaceOpenAuthority } from "./workspace-open.js";
 import { WorkspacePromotionAuthority } from "./workspace-promotion.js";
 import { WorkspaceOpenHandoffCoordinator } from "./workspace-open-handoff.js";
@@ -1542,9 +1543,19 @@ async function startEmbeddedDaemonGeneration(opts) {
                 paneStreamRuntime,
                 catalogLiveSessions: () => discoverLiveSessionSummaries(catalogTmuxRunner),
                 catalogFleet: async () => {
-                    const fleet = readAdoptedFleet(workspaceRegistry, nativeGenerationTmuxRunner, (sessionName, pane) => pane.semanticPaneId
+                    const endpoint = (sessionName, pane) => pane.semanticPaneId
                         ? (interactionEvidence?.captureInventoryEndpoint(sessionName, pane.runtimePaneId, pane.semanticPaneId) ?? null)
-                        : null, () => observationSelector?.nativeServerEpoch ?? null);
+                        : null;
+                    const epoch = () => observationSelector?.nativeServerEpoch ?? null;
+                    // Same pinned server generation either way. Outside a session
+                    // mutation the read must not block the event loop: every concurrent
+                    // catalog request queued behind its spawnSync (#709). Inside one,
+                    // keep the fenced synchronous runner the mutation relies on.
+                    const fleet = await readCatalogFleet(workspaceRegistry, {
+                        fence: sessionMutationFence,
+                        fencedSync: nativeGenerationTmuxRunner,
+                        generationFencedAsync: (args) => fleetFactsTmuxRunner(args),
+                    }, endpoint, epoch);
                     if (!fleet)
                         return null;
                     const names = await readTeamMemberships(fleet.flatMap((session) => session.panes.map((pane) => ({

package/packages/daemon/dist/lib/daemon-service.js

@@ -106,13 +106,18 @@ export async function manageDaemonService(action, executable, deps = defaults())
             refused("The service manager loaded a different definition; refusing to control it");
         return state;
     };
-    const ready = async (previousInstance) => {
+    // `retiredPid` is the process this restart terminated. It can publish a record
+    // while it shuts down (a KeepAlive relaunch just before the restart), so it is
+    // never the replacement, whatever its instance id.
+    const ready = async (previousInstance, retiredPid) => {
         const deadline = Date.now() + deps.waitMs;
         do {
             const state = deps.inspect();
             if (!boundTo(state, plan.supervisionId))
                 refused("Service reservation changed during startup");
-            if (state.status === "valid" && state.info.instanceId !== previousInstance) {
+            if (state.status === "valid" &&
+                state.info.instanceId !== previousInstance &&
+                state.info.pid !== retiredPid) {
                 const identity = await deps.probe(state.info);
                 const service = await inspectManager();
                 if (identity &&
@@ -236,11 +241,14 @@ export async function manageDaemonService(action, executable, deps = defaults())
         const before = deps.inspect();
         if (action === "install" && service.active)
             return await ready();
-        if (service.loaded)
-            await manager.restart(service.pid !== null);
+        // Read the manager again: a relaunch may have replaced the process while this
+        // waited for the lock, and the restart terminates whichever one runs now.
+        const current = service.loaded ? await inspectManager() : service;
+        if (current.loaded)
+            await manager.restart(current.pid !== null);
         else
             await manager.install();
-        return await ready(before.status === "valid" ? before.info.instanceId : undefined);
+        return await ready(before.status === "valid" ? before.info.instanceId : undefined, current.loaded ? current.pid : null);
     }
     catch (error) {
         // Never discard ownership after an uncertain OS activation. The retained

package/packages/daemon/dist/lib/tmux-server-owners.js

@@ -24,6 +24,8 @@ export class TmuxServerOwners {
     constructor(options) {
         this.options = options;
     }
+    #queuedRefresh = null;
+    #queuedRefreshTail = null;
     #serial(work) {
         const run = this.#tail.then(() => {
             if (this.#disposed)
@@ -134,12 +136,29 @@ export class TmuxServerOwners {
         this.#entries.set(scope.serverId, { registration, scope, observation, owner });
     }
     refresh() {
-        return this.#serial(async () => {
+        // A refresh still waiting its turn has not probed anything yet, so it is
+        // as fresh for a later caller as a new one: share it instead of queuing
+        // another full refresh behind it (#709). Once it starts, callers queue anew.
+        // Share it only while nothing has been queued behind it, so a refresh
+        // stays ordered after any mutation queued before the caller asked.
+        if (this.#queuedRefresh && this.#tail === this.#queuedRefreshTail)
+            return this.#queuedRefresh;
+        const queued = this.#serial(async () => {
+            if (this.#queuedRefresh === queued)
+                this.#queuedRefresh = null;
             // Sequential admission bounds subprocess work and avoids alias races.
             for (const entry of this.#entries.values())
                 await this.#refresh(entry);
             return this.list();
         });
+        this.#queuedRefresh = queued;
+        this.#queuedRefreshTail = this.#tail;
+        const settle = () => {
+            if (this.#queuedRefresh === queued)
+                this.#queuedRefresh = null;
+        };
+        queued.then(settle, settle);
+        return queued;
     }
     current(scopeInput) {
         const scope = TmuxServerScopeSchemaZ.parse(scopeInput);

package/packages/daemon/dist/lib/tui-binary.js

@@ -26,8 +26,18 @@ export const MIN_TUI_BINARY_BYTES = 10 * 1024 * 1024;
 /** Hard download/decompression ceilings: release binaries are currently ~70MB. */
 export const MAX_TUI_COMPRESSED_BYTES = 128 * 1024 * 1024;
 export const MAX_TUI_BINARY_BYTES = 256 * 1024 * 1024;
-export const TUI_DOWNLOAD_TIMEOUT_MS = 30_000;
+/** Abort a request when no bytes arrive for this long; a slow transfer never trips it. */
+export const TUI_DOWNLOAD_STALL_TIMEOUT_MS = 30_000;
+/** One budget for the manifest, the binary, and every retry: ~145 KB/s at the size ceiling. */
+export const TUI_DOWNLOAD_TOTAL_TIMEOUT_MS = 15 * 60_000;
+/** Attempts per file; only transient failures are retried. */
+export const TUI_DOWNLOAD_MAX_ATTEMPTS = 3;
+export const TUI_DOWNLOAD_RETRY_DELAY_MS = 1_000;
 const MAX_CHECKSUM_MANIFEST_BYTES = 4 * 1024;
+/** A second installer says why it is quiet once the wait is longer than a lock handover. */
+const TUI_DOWNLOAD_LOCK_NOTICE_MS = 2_000;
+/** Lets a lock waiter outlast the holder's verify and install after its download budget. */
+const TUI_DOWNLOAD_LOCK_MARGIN_MS = 5_000;
 const SUPPORTED = {
     "darwin-arm64": "darwin-arm64",
     "linux-x64": "linux-x64",
@@ -109,6 +119,9 @@ export function findDownloadedTui(version = getCurrentVersion(), options = {}) {
         purgeCachedBinary(path);
     return null;
 }
+/** A failure a retry cannot fix: the release asset is missing or breaks a hard limit. */
+class PermanentDownloadError extends Error {
+}
 function checksumPath(path) {
     return `${path}.sha256`;
 }
@@ -198,32 +211,53 @@ function purgeCachedBinary(path) {
         }
     }
 }
-async function readBoundedResponse(fetchImpl, url, maxBytes, timeoutMs) {
+function isTransientHttpStatus(status) {
+    return status === 408 || status === 429 || status >= 500;
+}
+async function readBoundedResponse(fetchImpl, url, maxBytes, policy) {
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let total = 0;
+    let timeoutMessage = null;
+    const abortWith = (message) => () => {
+        timeoutMessage = message();
+        controller.abort();
+    };
+    const overallTimer = setTimeout(abortWith(() => `download did not finish within ${policy.totalTimeoutMs}ms`), Math.max(0, policy.deadline - Date.now()));
+    const onStall = abortWith(() => `download stalled: no data for ${policy.stallTimeoutMs}ms after ${total} bytes`);
+    let stallTimer = setTimeout(onStall, policy.stallTimeoutMs);
+    const markProgress = () => {
+        clearTimeout(stallTimer);
+        stallTimer = setTimeout(onStall, policy.stallTimeoutMs);
+    };
     try {
         const response = await fetchImpl(url, { signal: controller.signal });
         if (!response.ok) {
-            throw new Error(`HTTP ${response.status} ${response.statusText}`);
+            const message = `HTTP ${response.status} ${response.statusText}`;
+            if (isTransientHttpStatus(response.status))
+                throw new Error(message);
+            throw new PermanentDownloadError(message);
         }
+        markProgress();
         const declaredLength = Number(response.headers.get("content-length"));
         if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
-            throw new Error(`declared size ${declaredLength} exceeds ${maxBytes} bytes`);
+            throw new PermanentDownloadError(`declared size ${declaredLength} exceeds ${maxBytes} bytes`);
         }
         if (!response.body)
             throw new Error("response has no body");
         const chunks = [];
-        let total = 0;
         const reader = response.body.getReader();
         try {
             while (true) {
                 const { done, value } = await reader.read();
                 if (done)
                     break;
+                if (value.byteLength === 0)
+                    continue;
+                markProgress();
                 total += value.byteLength;
                 if (total > maxBytes) {
                     await reader.cancel();
-                    throw new Error(`download exceeds ${maxBytes} bytes`);
+                    throw new PermanentDownloadError(`download exceeds ${maxBytes} bytes`);
                 }
                 chunks.push(Buffer.from(value));
             }
@@ -234,13 +268,33 @@ async function readBoundedResponse(fetchImpl, url, maxBytes, timeoutMs) {
         return Buffer.concat(chunks, total);
     }
     catch (error) {
-        if (controller.signal.aborted) {
-            throw new Error(`download timed out after ${timeoutMs}ms`, { cause: error });
-        }
+        if (timeoutMessage)
+            throw new Error(timeoutMessage, { cause: error });
         throw error;
     }
     finally {
-        clearTimeout(timer);
+        clearTimeout(overallTimer);
+        clearTimeout(stallTimer);
+        // Releases the connection of any response whose body was not fully read.
+        controller.abort();
+    }
+}
+async function readWithRetries(fetchImpl, url, maxBytes, policy, log) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await readBoundedResponse(fetchImpl, url, maxBytes, policy);
+        }
+        catch (error) {
+            const delayMs = policy.retryDelayMs * attempt;
+            if (error instanceof PermanentDownloadError ||
+                attempt >= policy.maxAttempts ||
+                Date.now() + delayMs >= policy.deadline) {
+                throw error;
+            }
+            const message = error instanceof Error ? error.message : String(error);
+            log(`download attempt ${attempt}/${policy.maxAttempts} failed (${message}); retrying`);
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
     }
 }
 /**
@@ -270,10 +324,11 @@ export async function downloadTuiBinary(opts = {}) {
         minBinaryBytes: opts.limits?.minBinaryBytes ?? MIN_TUI_BINARY_BYTES,
         maxCompressedBytes: opts.limits?.maxCompressedBytes ?? MAX_TUI_COMPRESSED_BYTES,
         maxBinaryBytes: opts.limits?.maxBinaryBytes ?? MAX_TUI_BINARY_BYTES,
-        timeoutMs: opts.timeoutMs ?? TUI_DOWNLOAD_TIMEOUT_MS,
     };
+    const totalTimeoutMs = opts.totalTimeoutMs ?? TUI_DOWNLOAD_TOTAL_TIMEOUT_MS;
     mkdirSync(dirname(dest), { recursive: true });
-    const releaseLock = await acquirePrivateOperationLock(downloadLockPath(dest), limits.timeoutMs * 2 + 5_000);
+    const lockNotice = setTimeout(() => log("waiting for another tmux-ide download of this version to finish"), TUI_DOWNLOAD_LOCK_NOTICE_MS);
+    const releaseLock = await acquirePrivateOperationLock(downloadLockPath(dest), totalTimeoutMs + TUI_DOWNLOAD_LOCK_MARGIN_MS).finally(() => clearTimeout(lockNotice));
     const suffix = `${process.pid}.${randomUUID()}.tmp`;
     const binaryTmp = `${dest}.${suffix}`;
     const checksumTmp = `${checksumPath(dest)}.${suffix}`;
@@ -283,17 +338,28 @@ export async function downloadTuiBinary(opts = {}) {
             return { path: dest, bytes: cached.bytes };
         purgeCachedBinary(dest);
         const fetchImpl = opts.fetch ?? globalThis.fetch;
+        // Starts after the lock so the budget matches what a lock waiter allows for.
+        const policy = {
+            stallTimeoutMs: opts.stallTimeoutMs ?? TUI_DOWNLOAD_STALL_TIMEOUT_MS,
+            deadline: Date.now() + totalTimeoutMs,
+            totalTimeoutMs,
+            maxAttempts: opts.maxAttempts ?? TUI_DOWNLOAD_MAX_ATTEMPTS,
+            retryDelayMs: opts.retryDelayMs ?? TUI_DOWNLOAD_RETRY_DELAY_MS,
+        };
         log(`downloading checksum manifest ${checksumUrl}`);
         let manifestBytes;
         let gz;
         try {
-            manifestBytes = await readBoundedResponse(fetchImpl, checksumUrl, MAX_CHECKSUM_MANIFEST_BYTES, limits.timeoutMs);
-            gz = await readBoundedResponse(fetchImpl, url, limits.maxCompressedBytes, limits.timeoutMs);
+            manifestBytes = await readWithRetries(fetchImpl, checksumUrl, MAX_CHECKSUM_MANIFEST_BYTES, policy, log);
+            log(`downloading ${url}`);
+            gz = await readWithRetries(fetchImpl, url, limits.maxCompressedBytes, policy, log);
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            throw new Error(`could not download the TUI binary and checksum for v${version} (${message}). ` +
-                `Check that the release published both exact-version assets.`, { cause: error });
+            const hint = error instanceof PermanentDownloadError
+                ? "Check that the release published both exact-version assets."
+                : "Check your network connection, then retry with `tmux-ide update --tui-binary`, or run the installer again if tmux-ide is not installed yet.";
+            throw new Error(`could not download the TUI binary and checksum for v${version} (${message}). ${hint}`, { cause: error });
         }
         const manifest = parseChecksumManifest(manifestBytes, { version, tag });
         if (sha256(gz) !== manifest.compressedSha256) {

package/packages/daemon/dist/native/TmuxIdeNotifier.app/Contents/Info.plist

@@ -21,9 +21,9 @@
   <key>CFBundlePackageType</key>
   <string>APPL</string>
   <key>CFBundleShortVersionString</key>
-  <string>2.9.16</string>
+  <string>2.9.17</string>
   <key>CFBundleVersion</key>
-  <string>2.9.16</string>
+  <string>2.9.17</string>
   <key>LSMinimumSystemVersion</key>
   <string>11.0</string>
   <key>LSUIElement</key>

package/packages/daemon/dist/native/TmuxIdeNotifier.app/Contents/_CodeSignature/CodeResources

@@ -6,11 +6,11 @@
 	<dict>
 		<key>Resources/AppIcon.icns</key>
 		<data>
-		0kJOhKI63m7RQF/lR1nMjIIiACY=
+		/fan3KhjkAUR40oxTxGrk4b03wY=
 		</data>
 		<key>Resources/Assets.car</key>
 		<data>
-		80sBn8yzZzR4ZHE3L4qFvRPqA+A=
+		YZSYPnzkfPLVemp3jiRDnR5WhhQ=
 		</data>
 	</dict>
 	<key>files2</key>
@@ -19,14 +19,14 @@
 		<dict>
 			<key>hash2</key>
 			<data>
-			YXdi2fa2PvtRaeXueLC7n1If41ofraB5MVZULmdCcC8=
+			zDoKzf7n2cp6cQedgfmNiTPwTj+gON7DS7H8ihtNVCE=
 			</data>
 		</dict>
 		<key>Resources/Assets.car</key>
 		<dict>
 			<key>hash2</key>
 			<data>
-			PKQV15gCKuH8bIwdxGZgHEhWb0Rwq62t/R9Ozfnv/BA=
+			zV9+zCqfvUhHrz90MuHUjqBvx93oA7g6BxgO8hDUlN8=
 			</data>
 		</dict>
 	</dict>