tmux-ide 2.9.16 → 2.9.17

package/packages/daemon/src/command-center/discovery.ts

@@ -208,10 +208,16 @@ export function isVisibleFleetSession(name: string): boolean {
 export function readAdoptedSessionNames(runTmux: TmuxRunner = _tmuxRunner): string[] | null {
   let raw: string;
   try {
-    raw = runTmux(["list-sessions", "-F", `#{session_name}\t#{${ADOPTED_OPTION}}`]);
+    raw = runTmux(ADOPTED_SESSIONS_ARGS);
   } catch {
     return null;
   }
+  return parseAdoptedSessionNames(raw);
+}
+
+const ADOPTED_SESSIONS_ARGS = ["list-sessions", "-F", `#{session_name}\t#{${ADOPTED_OPTION}}`];
+
+function parseAdoptedSessionNames(raw: string): string[] {
   const names: string[] = [];
   for (const line of raw.split("\n")) {
     if (!line) continue;
@@ -312,18 +318,77 @@ export function readAdoptedFleet(
   const nativeEpoch = nativeServerEpoch?.() ?? null;
   const adopted = readAdoptedSessionNames(runTmux);
   if (adopted === null) return null;
-  const adoptedSet = new Set(adopted);
-  if (adoptedSet.size === 0) return [];
-
-  const appCreatedSessions = new Set(registry.list().map((workspace) => workspace.sessionName));
+  if (adopted.length === 0) return [];
+  let panesRaw: string;
+  try {
+    panesRaw = runTmux(FLEET_PANES_ARGS);
+  } catch {
+    panesRaw = "";
+  }
+  return assembleAdoptedFleet(
+    adopted,
+    panesRaw,
+    registry,
+    nativeEpoch,
+    resolveInteractionEndpoint,
+    nativeServerEpoch,
+  );
+}
 
-  const panesBySession = new Map<string, FleetPaneFacts[]>();
+/**
+ * {@link readAdoptedFleet} over an asynchronous tmux runner: the same two reads
+ * in the same order, without blocking the event loop while tmux answers (#709).
+ */
+export async function readAdoptedFleetAsync(
+  registry: { list(): { sessionName: string }[] },
+  runTmux: (args: string[]) => Promise<string>,
+  resolveInteractionEndpoint?: (
+    sessionName: string,
+    pane: FleetPaneFacts,
+  ) => Extract<InteractionPaneEndpoint, { kind: "pane" }> | null,
+  nativeServerEpoch?: () => string | null,
+): Promise<FleetSessionFacts[] | null> {
+  const nativeEpoch = nativeServerEpoch?.() ?? null;
+  let sessionsRaw: string;
+  try {
+    sessionsRaw = await runTmux(ADOPTED_SESSIONS_ARGS);
+  } catch {
+    return null;
+  }
+  const adopted = parseAdoptedSessionNames(sessionsRaw);
+  if (adopted.length === 0) return [];
   let panesRaw: string;
   try {
-    panesRaw = runTmux(["list-panes", "-a", "-F", FLEET_PANE_FORMAT]);
+    panesRaw = await runTmux(FLEET_PANES_ARGS);
   } catch {
     panesRaw = "";
   }
+  return assembleAdoptedFleet(
+    adopted,
+    panesRaw,
+    registry,
+    nativeEpoch,
+    resolveInteractionEndpoint,
+    nativeServerEpoch,
+  );
+}
+
+const FLEET_PANES_ARGS = ["list-panes", "-a", "-F", FLEET_PANE_FORMAT];
+
+function assembleAdoptedFleet(
+  adopted: string[],
+  panesRaw: string,
+  registry: { list(): { sessionName: string }[] },
+  nativeEpoch: string | null,
+  resolveInteractionEndpoint?: (
+    sessionName: string,
+    pane: FleetPaneFacts,
+  ) => Extract<InteractionPaneEndpoint, { kind: "pane" }> | null,
+  nativeServerEpoch?: () => string | null,
+): FleetSessionFacts[] {
+  const adoptedSet = new Set(adopted);
+  const appCreatedSessions = new Set(registry.list().map((workspace) => workspace.sessionName));
+  const panesBySession = new Map<string, FleetPaneFacts[]>();
   for (const line of panesRaw.split("\n")) {
     if (!line) continue;
     const fields = line.split(FLEET_FIELD_SEPARATOR);

package/packages/daemon/src/lib/catalog-fleet-read.ts

@@ -0,0 +1,40 @@
+import type { InteractionPaneEndpoint } from "@tmux-ide/contracts";
+import {
+  readAdoptedFleet,
+  readAdoptedFleetAsync,
+  type FleetPaneFacts,
+  type FleetSessionFacts,
+} from "../command-center/discovery.ts";
+
+/** The two runners a catalog fleet read may use; both are fenced to one tmux server generation. */
+export interface CatalogFleetRunners {
+  /** The session-mutation fence; only its `active` state is read here. */
+  readonly fence: { readonly active: boolean };
+  /** Synchronous runner wrapped by that fence: inside a mutation it adds the session check. */
+  readonly fencedSync: (args: string[]) => string;
+  /** Asynchronous runner fenced to the same server generation. */
+  readonly generationFencedAsync: (args: string[]) => Promise<string>;
+}
+
+/**
+ * Read the catalog fleet without blocking the event loop (#709), except inside
+ * a session mutation, where the read keeps the fence's synchronous runner.
+ */
+export async function readCatalogFleet(
+  registry: { list(): { sessionName: string }[] },
+  runners: CatalogFleetRunners,
+  resolveInteractionEndpoint?: (
+    sessionName: string,
+    pane: FleetPaneFacts,
+  ) => Extract<InteractionPaneEndpoint, { kind: "pane" }> | null,
+  nativeServerEpoch?: () => string | null,
+): Promise<FleetSessionFacts[] | null> {
+  return runners.fence.active
+    ? readAdoptedFleet(registry, runners.fencedSync, resolveInteractionEndpoint, nativeServerEpoch)
+    : readAdoptedFleetAsync(
+        registry,
+        runners.generationFencedAsync,
+        resolveInteractionEndpoint,
+        nativeServerEpoch,
+      );
+}

package/packages/daemon/src/lib/daemon-embed.ts

@@ -117,7 +117,12 @@ import {
   resolveWorkspacePaneTmuxAuthority,
   WorkspacePaneCreationAuthority,
 } from "./workspace-pane-creation.ts";
-import { discoverLiveSessionSummaries, readAdoptedFleet } from "../command-center/discovery.ts";
+import {
+  discoverLiveSessionSummaries,
+  readAdoptedFleet,
+  type FleetSessionFacts,
+} from "../command-center/discovery.ts";
+import { readCatalogFleet } from "./catalog-fleet-read.ts";
 import { WorkspaceOpenAuthority } from "./workspace-open.ts";
 import { WorkspacePromotionAuthority } from "./workspace-promotion.ts";
 import { WorkspaceOpenHandoffCoordinator } from "./workspace-open-handoff.ts";
@@ -2103,18 +2108,28 @@ async function startEmbeddedDaemonGeneration(
         paneStreamRuntime,
         catalogLiveSessions: () => discoverLiveSessionSummaries(catalogTmuxRunner),
         catalogFleet: async () => {
-          const fleet = readAdoptedFleet(
+          const endpoint = (sessionName: string, pane: FleetSessionFacts["panes"][number]) =>
+            pane.semanticPaneId
+              ? (interactionEvidence?.captureInventoryEndpoint(
+                  sessionName,
+                  pane.runtimePaneId,
+                  pane.semanticPaneId,
+                ) ?? null)
+              : null;
+          const epoch = () => observationSelector?.nativeServerEpoch ?? null;
+          // Same pinned server generation either way. Outside a session
+          // mutation the read must not block the event loop: every concurrent
+          // catalog request queued behind its spawnSync (#709). Inside one,
+          // keep the fenced synchronous runner the mutation relies on.
+          const fleet = await readCatalogFleet(
             workspaceRegistry,
-            nativeGenerationTmuxRunner,
-            (sessionName, pane) =>
-              pane.semanticPaneId
-                ? (interactionEvidence?.captureInventoryEndpoint(
-                    sessionName,
-                    pane.runtimePaneId,
-                    pane.semanticPaneId,
-                  ) ?? null)
-                : null,
-            () => observationSelector?.nativeServerEpoch ?? null,
+            {
+              fence: sessionMutationFence,
+              fencedSync: nativeGenerationTmuxRunner,
+              generationFencedAsync: (args) => fleetFactsTmuxRunner(args),
+            },
+            endpoint,
+            epoch,
           );
           if (!fleet) return null;
           const names = await readTeamMemberships(

package/packages/daemon/src/lib/daemon-service.ts

@@ -149,13 +149,20 @@ export async function manageDaemonService(
       refused("The service manager loaded a different definition; refusing to control it");
     return state;
   };
-  const ready = async (previousInstance?: string) => {
+  // `retiredPid` is the process this restart terminated. It can publish a record
+  // while it shuts down (a KeepAlive relaunch just before the restart), so it is
+  // never the replacement, whatever its instance id.
+  const ready = async (previousInstance?: string, retiredPid?: number | null) => {
     const deadline = Date.now() + deps.waitMs;
     do {
       const state = deps.inspect();
       if (!boundTo(state, plan.supervisionId))
         refused("Service reservation changed during startup");
-      if (state.status === "valid" && state.info.instanceId !== previousInstance) {
+      if (
+        state.status === "valid" &&
+        state.info.instanceId !== previousInstance &&
+        state.info.pid !== retiredPid
+      ) {
         const identity = await deps.probe(state.info);
         const service = await inspectManager();
         if (
@@ -283,9 +290,15 @@ export async function manageDaemonService(
     }
     const before = deps.inspect();
     if (action === "install" && service.active) return await ready();
-    if (service.loaded) await manager.restart(service.pid !== null);
+    // Read the manager again: a relaunch may have replaced the process while this
+    // waited for the lock, and the restart terminates whichever one runs now.
+    const current = service.loaded ? await inspectManager() : service;
+    if (current.loaded) await manager.restart(current.pid !== null);
     else await manager.install();
-    return await ready(before.status === "valid" ? before.info.instanceId : undefined);
+    return await ready(
+      before.status === "valid" ? before.info.instanceId : undefined,
+      current.loaded ? current.pid : null,
+    );
   } catch (error) {
     // Never discard ownership after an uncertain OS activation. The retained
     // record/reservation gives the explicit remove/restart commands a recovery path.

package/packages/daemon/src/lib/tmux-server-owners.ts

@@ -59,6 +59,8 @@ export class TmuxServerOwners<T extends DisposableTmuxServerOwner> {
   #disposed = false;
   #disposePromise: Promise<void> | null = null;
   constructor(readonly options: TmuxServerOwnersOptions<T>) {}
+  #queuedRefresh: Promise<readonly TmuxServerDescriptor[]> | null = null;
+  #queuedRefreshTail: Promise<unknown> | null = null;
   #serial<R>(work: () => Promise<R>): Promise<R> {
     const run = this.#tail.then(() => {
       if (this.#disposed) throw new TmuxServerScopeError("disposed");
@@ -178,11 +180,25 @@ export class TmuxServerOwners<T extends DisposableTmuxServerOwner> {
     this.#entries.set(scope.serverId, { registration, scope, observation, owner });
   }
   refresh(): Promise<readonly TmuxServerDescriptor[]> {
-    return this.#serial(async () => {
+    // A refresh still waiting its turn has not probed anything yet, so it is
+    // as fresh for a later caller as a new one: share it instead of queuing
+    // another full refresh behind it (#709). Once it starts, callers queue anew.
+    // Share it only while nothing has been queued behind it, so a refresh
+    // stays ordered after any mutation queued before the caller asked.
+    if (this.#queuedRefresh && this.#tail === this.#queuedRefreshTail) return this.#queuedRefresh;
+    const queued = this.#serial(async () => {
+      if (this.#queuedRefresh === queued) this.#queuedRefresh = null;
       // Sequential admission bounds subprocess work and avoids alias races.
       for (const entry of this.#entries.values()) await this.#refresh(entry);
       return this.list();
     });
+    this.#queuedRefresh = queued;
+    this.#queuedRefreshTail = this.#tail;
+    const settle = () => {
+      if (this.#queuedRefresh === queued) this.#queuedRefresh = null;
+    };
+    queued.then(settle, settle);
+    return queued;
   }
   current(scopeInput: TmuxServerScope): T {
     const scope = TmuxServerScopeSchemaZ.parse(scopeInput);

package/packages/daemon/src/lib/tui-binary.ts

@@ -43,9 +43,19 @@ export const MIN_TUI_BINARY_BYTES = 10 * 1024 * 1024;
 /** Hard download/decompression ceilings: release binaries are currently ~70MB. */
 export const MAX_TUI_COMPRESSED_BYTES = 128 * 1024 * 1024;
 export const MAX_TUI_BINARY_BYTES = 256 * 1024 * 1024;
-export const TUI_DOWNLOAD_TIMEOUT_MS = 30_000;
+/** Abort a request when no bytes arrive for this long; a slow transfer never trips it. */
+export const TUI_DOWNLOAD_STALL_TIMEOUT_MS = 30_000;
+/** One budget for the manifest, the binary, and every retry: ~145 KB/s at the size ceiling. */
+export const TUI_DOWNLOAD_TOTAL_TIMEOUT_MS = 15 * 60_000;
+/** Attempts per file; only transient failures are retried. */
+export const TUI_DOWNLOAD_MAX_ATTEMPTS = 3;
+export const TUI_DOWNLOAD_RETRY_DELAY_MS = 1_000;
 
 const MAX_CHECKSUM_MANIFEST_BYTES = 4 * 1024;
+/** A second installer says why it is quiet once the wait is longer than a lock handover. */
+const TUI_DOWNLOAD_LOCK_NOTICE_MS = 2_000;
+/** Lets a lock waiter outlast the holder's verify and install after its download budget. */
+const TUI_DOWNLOAD_LOCK_MARGIN_MS = 5_000;
 
 const SUPPORTED: Record<string, TuiPlatformTag> = {
   "darwin-arm64": "darwin-arm64",
@@ -162,9 +172,19 @@ interface DownloadLimits {
   readonly minBinaryBytes: number;
   readonly maxCompressedBytes: number;
   readonly maxBinaryBytes: number;
-  readonly timeoutMs: number;
 }
 
+interface DownloadPolicy {
+  readonly stallTimeoutMs: number;
+  readonly deadline: number;
+  readonly totalTimeoutMs: number;
+  readonly maxAttempts: number;
+  readonly retryDelayMs: number;
+}
+
+/** A failure a retry cannot fix: the release asset is missing or breaks a hard limit. */
+class PermanentDownloadError extends Error {}
+
 type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 
 function checksumPath(path: string): string {
@@ -269,36 +289,61 @@ function purgeCachedBinary(path: string): void {
   }
 }
 
+function isTransientHttpStatus(status: number): boolean {
+  return status === 408 || status === 429 || status >= 500;
+}
+
 async function readBoundedResponse(
   fetchImpl: FetchLike,
   url: string,
   maxBytes: number,
-  timeoutMs: number,
+  policy: DownloadPolicy,
 ): Promise<Buffer> {
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let total = 0;
+  let timeoutMessage: string | null = null;
+  const abortWith = (message: () => string) => () => {
+    timeoutMessage = message();
+    controller.abort();
+  };
+  const overallTimer = setTimeout(
+    abortWith(() => `download did not finish within ${policy.totalTimeoutMs}ms`),
+    Math.max(0, policy.deadline - Date.now()),
+  );
+  const onStall = abortWith(
+    () => `download stalled: no data for ${policy.stallTimeoutMs}ms after ${total} bytes`,
+  );
+  let stallTimer = setTimeout(onStall, policy.stallTimeoutMs);
+  const markProgress = () => {
+    clearTimeout(stallTimer);
+    stallTimer = setTimeout(onStall, policy.stallTimeoutMs);
+  };
   try {
     const response = await fetchImpl(url, { signal: controller.signal });
     if (!response.ok) {
-      throw new Error(`HTTP ${response.status} ${response.statusText}`);
+      const message = `HTTP ${response.status} ${response.statusText}`;
+      if (isTransientHttpStatus(response.status)) throw new Error(message);
+      throw new PermanentDownloadError(message);
     }
+    markProgress();
     const declaredLength = Number(response.headers.get("content-length"));
     if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
-      throw new Error(`declared size ${declaredLength} exceeds ${maxBytes} bytes`);
+      throw new PermanentDownloadError(`declared size ${declaredLength} exceeds ${maxBytes} bytes`);
     }
     if (!response.body) throw new Error("response has no body");
 
     const chunks: Buffer[] = [];
-    let total = 0;
     const reader = response.body.getReader();
     try {
       while (true) {
         const { done, value } = await reader.read();
         if (done) break;
+        if (value.byteLength === 0) continue;
+        markProgress();
         total += value.byteLength;
         if (total > maxBytes) {
           await reader.cancel();
-          throw new Error(`download exceeds ${maxBytes} bytes`);
+          throw new PermanentDownloadError(`download exceeds ${maxBytes} bytes`);
         }
         chunks.push(Buffer.from(value));
       }
@@ -307,12 +352,39 @@ async function readBoundedResponse(
     }
     return Buffer.concat(chunks, total);
   } catch (error) {
-    if (controller.signal.aborted) {
-      throw new Error(`download timed out after ${timeoutMs}ms`, { cause: error });
-    }
+    if (timeoutMessage) throw new Error(timeoutMessage, { cause: error });
     throw error;
   } finally {
-    clearTimeout(timer);
+    clearTimeout(overallTimer);
+    clearTimeout(stallTimer);
+    // Releases the connection of any response whose body was not fully read.
+    controller.abort();
+  }
+}
+
+async function readWithRetries(
+  fetchImpl: FetchLike,
+  url: string,
+  maxBytes: number,
+  policy: DownloadPolicy,
+  log: (msg: string) => void,
+): Promise<Buffer> {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await readBoundedResponse(fetchImpl, url, maxBytes, policy);
+    } catch (error) {
+      const delayMs = policy.retryDelayMs * attempt;
+      if (
+        error instanceof PermanentDownloadError ||
+        attempt >= policy.maxAttempts ||
+        Date.now() + delayMs >= policy.deadline
+      ) {
+        throw error;
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      log(`download attempt ${attempt}/${policy.maxAttempts} failed (${message}); retrying`);
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
   }
 }
 
@@ -333,8 +405,11 @@ export async function downloadTuiBinary(
     home?: string;
     tag?: TuiPlatformTag | null;
     fetch?: FetchLike;
-    timeoutMs?: number;
-    limits?: Partial<Omit<DownloadLimits, "timeoutMs">>;
+    stallTimeoutMs?: number;
+    totalTimeoutMs?: number;
+    maxAttempts?: number;
+    retryDelayMs?: number;
+    limits?: Partial<DownloadLimits>;
   } = {},
 ): Promise<{ path: string; bytes: number }> {
   if (resolveRuntimeNamespace().development)
@@ -356,13 +431,17 @@ export async function downloadTuiBinary(
     minBinaryBytes: opts.limits?.minBinaryBytes ?? MIN_TUI_BINARY_BYTES,
     maxCompressedBytes: opts.limits?.maxCompressedBytes ?? MAX_TUI_COMPRESSED_BYTES,
     maxBinaryBytes: opts.limits?.maxBinaryBytes ?? MAX_TUI_BINARY_BYTES,
-    timeoutMs: opts.timeoutMs ?? TUI_DOWNLOAD_TIMEOUT_MS,
   };
+  const totalTimeoutMs = opts.totalTimeoutMs ?? TUI_DOWNLOAD_TOTAL_TIMEOUT_MS;
   mkdirSync(dirname(dest), { recursive: true });
+  const lockNotice = setTimeout(
+    () => log("waiting for another tmux-ide download of this version to finish"),
+    TUI_DOWNLOAD_LOCK_NOTICE_MS,
+  );
   const releaseLock = await acquirePrivateOperationLock(
     downloadLockPath(dest),
-    limits.timeoutMs * 2 + 5_000,
-  );
+    totalTimeoutMs + TUI_DOWNLOAD_LOCK_MARGIN_MS,
+  ).finally(() => clearTimeout(lockNotice));
   const suffix = `${process.pid}.${randomUUID()}.tmp`;
   const binaryTmp = `${dest}.${suffix}`;
   const checksumTmp = `${checksumPath(dest)}.${suffix}`;
@@ -372,22 +451,35 @@ export async function downloadTuiBinary(
     purgeCachedBinary(dest);
 
     const fetchImpl = opts.fetch ?? globalThis.fetch;
+    // Starts after the lock so the budget matches what a lock waiter allows for.
+    const policy: DownloadPolicy = {
+      stallTimeoutMs: opts.stallTimeoutMs ?? TUI_DOWNLOAD_STALL_TIMEOUT_MS,
+      deadline: Date.now() + totalTimeoutMs,
+      totalTimeoutMs,
+      maxAttempts: opts.maxAttempts ?? TUI_DOWNLOAD_MAX_ATTEMPTS,
+      retryDelayMs: opts.retryDelayMs ?? TUI_DOWNLOAD_RETRY_DELAY_MS,
+    };
     log(`downloading checksum manifest ${checksumUrl}`);
     let manifestBytes: Buffer;
     let gz: Buffer;
     try {
-      manifestBytes = await readBoundedResponse(
+      manifestBytes = await readWithRetries(
         fetchImpl,
         checksumUrl,
         MAX_CHECKSUM_MANIFEST_BYTES,
-        limits.timeoutMs,
+        policy,
+        log,
       );
-      gz = await readBoundedResponse(fetchImpl, url, limits.maxCompressedBytes, limits.timeoutMs);
+      log(`downloading ${url}`);
+      gz = await readWithRetries(fetchImpl, url, limits.maxCompressedBytes, policy, log);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
+      const hint =
+        error instanceof PermanentDownloadError
+          ? "Check that the release published both exact-version assets."
+          : "Check your network connection, then retry with `tmux-ide update --tui-binary`, or run the installer again if tmux-ide is not installed yet.";
       throw new Error(
-        `could not download the TUI binary and checksum for v${version} (${message}). ` +
-          `Check that the release published both exact-version assets.`,
+        `could not download the TUI binary and checksum for v${version} (${message}). ${hint}`,
         { cause: error },
       );
     }