tmux-ide 2.9.2 → 2.9.3

package/packages/daemon/dist/tui/mirror/runtime/bounded-performance-record-writer.js

@@ -2,20 +2,25 @@
 export class BoundedPerformanceRecordWriter {
     #sink;
     #criticalLimit;
-    #pendingCritical = new Map();
+    #pendingCritical = new Set();
+    #pending = [];
+    #pendingByteLimit;
+    #pendingBytes = 0;
+    #flushPromise = null;
+    #resolveFlush = null;
     #saturated = false;
     #failed = false;
     #droppedRecords = 0;
-    constructor(sink, criticalLimit = 16) {
+    constructor(sink, criticalLimit = 16, pendingByteLimit = 64 * 1024) {
         this.#sink = sink;
         this.#criticalLimit = criticalLimit;
+        this.#pendingByteLimit = pendingByteLimit;
     }
     write(record) {
         if (this.#failed)
             return false;
         if (this.#saturated) {
-            this.#droppedRecords += 1;
-            return false;
+            return this.#enqueue(record);
         }
         return this.#writeAccepted(record);
     }
@@ -30,22 +35,57 @@ export class BoundedPerformanceRecordWriter {
             this.#droppedRecords += 1;
             return false;
         }
-        this.#pendingCritical.set(key, record);
-        return true;
+        return this.#enqueue(record, key);
     }
     drain() {
         if (this.#failed)
             return;
         this.#saturated = false;
-        for (const [key, record] of this.#pendingCritical) {
-            this.#pendingCritical.delete(key);
-            if (!this.#writeAccepted(record))
-                break;
+        while (this.#pending.length > 0 && !this.#saturated && !this.#failed) {
+            const next = this.#pending.shift();
+            this.#pendingBytes -= next.bytes;
+            if (next.key !== undefined)
+                this.#pendingCritical.delete(next.key);
+            this.#writeAccepted(next.record);
         }
+        if (this.#pending.length === 0)
+            this.#finishFlush();
+    }
+    /** Wait until retained records reach the stream; its owner then flushes/end()s it. */
+    flush() {
+        if (this.#failed || this.#pending.length === 0)
+            return Promise.resolve();
+        this.#flushPromise ??= new Promise((resolve) => {
+            this.#resolveFlush = resolve;
+        });
+        return this.#flushPromise;
     }
     fail() {
         this.#failed = true;
         this.#pendingCritical.clear();
+        this.#pending.length = 0;
+        this.#pendingBytes = 0;
+        this.#finishFlush();
+    }
+    #enqueue(record, key) {
+        const bytes = Buffer.byteLength(record);
+        // Ordinary bursts get one extra stream-sized buffer. Critical records have
+        // a separate byte reserve as well as their existing key-count limit.
+        const limit = this.#pendingByteLimit + (key === undefined ? 0 : 64 * 1024);
+        if (this.#pending.length >= 1024 || this.#pendingBytes + bytes > limit) {
+            this.#droppedRecords += 1;
+            return false;
+        }
+        if (key !== undefined)
+            this.#pendingCritical.add(key);
+        this.#pending.push({ record, bytes, ...(key === undefined ? {} : { key }) });
+        this.#pendingBytes += bytes;
+        return true;
+    }
+    #finishFlush() {
+        this.#resolveFlush?.();
+        this.#resolveFlush = null;
+        this.#flushPromise = null;
     }
     diagnostics() {
         return Object.freeze({

package/packages/daemon/dist/tui/mirror/runtime/terminal-fast-lane-renderer-adapter.js

@@ -271,12 +271,13 @@ export class TerminalFastLaneRendererAdapter {
             ]);
             if (seen.has(key))
                 continue;
+            // Bound retained de-duplication history, not the renderer's lifetime.
+            // An evicted identity may be reported again only after another real paint.
+            // Pending identities still have their separate per-frame admission limit.
             if (seen.size >= 256)
-                this.#droppedCanonicalHostFrames += 1;
-            else {
-                seen.add(key);
-                identities.push(identity);
-            }
+                seen.delete(seen.values().next().value);
+            seen.add(key);
+            identities.push(identity);
         }
         const dropped = this.#droppedCanonicalHostFrames;
         this.#droppedCanonicalHostFrames = 0;

package/packages/daemon/dist/tui/mirror/runtime/terminal-pane-input-router.js

@@ -13,6 +13,9 @@ export class TerminalPaneInputRouter {
     constructor(options) {
         this.#options = options;
     }
+    get selectionVersion() {
+        return this.#selectionToken;
+    }
     get focusedPane() {
         return this.#focusedPane;
     }

package/packages/daemon/dist/tui/mirror/runtime/workspace-terminal-fast-lane.js

@@ -1,5 +1,7 @@
 import { createTerminalFastLane, createWorkspaceClientTerminalSource, } from "@tmux-ide/daemon-client/terminal-fast-lane";
 import { currentTuiPerformanceEventSink } from "../performance-events.js";
+// Limit outstanding low-water sampling chains, not completed observations over
+// the lifetime of a renderer. Each chain owns at most one pending timeout.
 const TERMINAL_RESOURCE_SAMPLE_LIMIT = 512;
 // The ProductRig idle proof reads after 10.1s. Emit just before that boundary
 // so the operation-scoped sample cannot race the proof read.
@@ -227,7 +229,7 @@ function createOpenTuiTerminalResourceSampler(lane, sink) {
     heartbeatTimer = setTimeout(heartbeat, TERMINAL_RESOURCE_HEARTBEAT_MS);
     heartbeatTimer.unref?.();
     const emit = (operation, identity, expectedAt, sampled) => {
-        if (disposed || resourceEpochIdentity === null || ordinal >= TERMINAL_RESOURCE_SAMPLE_LIMIT)
+        if (disposed || resourceEpochIdentity === null)
             return;
         ordinal += 1;
         const now = readDiagnosticNow();
@@ -373,8 +375,12 @@ function createOpenTuiTerminalResourceSampler(lane, sink) {
     };
     return {
         afterFence(identity) {
-            if (disposed || ordinal >= TERMINAL_RESOURCE_SAMPLE_LIMIT)
+            if (disposed)
+                return;
+            if (pending.size >= TERMINAL_RESOURCE_SAMPLE_LIMIT) {
+                recordSamplingFailure();
                 return;
+            }
             latestIdentity = identity;
             let now;
             if (resourceEpochIdentity === null) {

package/packages/daemon/dist/tui/mirror/terminal-text.js

@@ -50,3 +50,38 @@ function graphemes(text) {
         return [...new Segmenter(undefined, { granularity: "grapheme" }).segment(text)].map((entry) => entry.segment);
     return [...text];
 }
+/** PURE — greedy word-wrap for terminal prose (never returns empty for
+ *  non-empty text; words longer than the width hard-break). */
+export function wrapText(text, width) {
+    if (width <= 0)
+        return [text];
+    const out = [];
+    for (const para of text.split("\n")) {
+        let line = "";
+        for (const word of para.split(/\s+/).filter(Boolean)) {
+            if (line.length === 0) {
+                let w = word;
+                while (w.length > width) {
+                    out.push(w.slice(0, width));
+                    w = w.slice(width);
+                }
+                line = w;
+            }
+            else if (line.length + 1 + word.length <= width) {
+                line += ` ${word}`;
+            }
+            else {
+                out.push(line);
+                let w = word;
+                while (w.length > width) {
+                    out.push(w.slice(0, width));
+                    w = w.slice(width);
+                }
+                line = w;
+            }
+        }
+        if (line.length > 0 || para.length === 0)
+            out.push(line);
+    }
+    return out.length > 0 ? out : [""];
+}

package/packages/daemon/dist/tui/mirror/workspace/connection-feedback.js

@@ -156,9 +156,11 @@ export function createApplicationConnectionFeedback(onPublish = () => undefined)
                     failure,
                     ...(inventory
                         ? {
-                            recovery: missing
-                                ? "A registered session may have been recreated. Choose that session to restore its identity, then retry here. It may be a different session."
-                                : "Terminal identities conflict or cannot be verified. Copy connection details for diagnosis; Retry does not repair identity conflicts.",
+                            recovery: failure.reason === "duplicate-runtime-pane-binding"
+                                ? "A terminal is shared by multiple workspace entries. Unlink shared tmux windows so each belongs to one session, then select Retry."
+                                : missing
+                                    ? "A registered session may have been recreated. Choose that session to restore its identity, then retry here. It may be a different session."
+                                    : "Terminal identities conflict or cannot be verified. Copy connection details for diagnosis; Retry does not repair identity conflicts.",
                         }
                         : {}),
                 };

package/packages/daemon/src/command-center/daemon-fleet-facts-observer.ts

@@ -546,16 +546,7 @@ export function createDefaultFleetFactsReaders(): Pick<
       return null;
     }
   };
-  return {
-    readSessions: async (signal) => {
-      const raw = await execute(SESSION_COMPOSITION_TMUX_ARGS, signal);
-      return raw === null ? null : parseSessionCompositionFacts(raw);
-    },
-    readAgents: async (signal) => {
-      const raw = await execute(AGENT_STATE_TMUX_ARGS, signal);
-      return raw === null ? null : parseAgentStateFacts(raw);
-    },
-  };
+  return createSharedFleetFactsReaders(execute);
 }
 
 export const SESSION_COMPOSITION_TMUX_ARGS = [
@@ -593,3 +584,102 @@ export const AGENT_STATE_TMUX_ARGS = [
 export async function readAgentStateFacts(signal?: AbortSignal): Promise<AgentStateReading | null> {
   return createDefaultFleetFactsReaders().readAgents(signal);
 }
+
+/** Agent columns are excluded from the session topology projection. */
+export const FLEET_FACTS_TMUX_ARGS = [
+  "list-panes",
+  "-a",
+  "-F",
+  `${SESSION_COMPOSITION_TMUX_ARGS[3]}\t#{@agent_state}\t#{pane_current_command}`,
+] as const;
+
+/** Share only an outstanding read; completed snapshots are never cached. */
+export function createSharedFleetFactsReaders(
+  run: (args: readonly string[], signal?: AbortSignal) => string | null | Promise<string | null>,
+  isAbsentServer: (error: unknown) => boolean = () => false,
+): Pick<DaemonFleetFactsObserverOptions, "readSessions" | "readAgents"> {
+  interface Pending {
+    controller: AbortController;
+    result: Promise<string | null>;
+    readers: number;
+  }
+  let pending: Pending | null = null;
+  const read = async (signal?: AbortSignal): Promise<string | null> => {
+    if (signal?.aborted) return null;
+    if (!pending) {
+      const controller = new AbortController();
+      const entry: Pending = {
+        controller,
+        readers: 0,
+        result: Promise.resolve().then(() => run(FLEET_FACTS_TMUX_ARGS, controller.signal)),
+      };
+      entry.result = entry.result.finally(() => {
+        if (pending === entry) pending = null;
+      });
+      pending = entry;
+    }
+    const entry = pending;
+    entry.readers += 1;
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      entry.readers -= 1;
+      if (entry.readers === 0) {
+        if (pending === entry) pending = null;
+        entry.controller.abort();
+      }
+    };
+    signal?.addEventListener("abort", release, { once: true });
+    try {
+      // Keep the promise outstanding for a noncooperative runner so the
+      // observer's per-kind quarantine remains effective after cancellation.
+      const raw = await entry.result;
+      return signal?.aborted ? null : raw;
+    } catch (error) {
+      if (signal?.aborted) return null;
+      throw error;
+    } finally {
+      signal?.removeEventListener("abort", release);
+      release();
+    }
+  };
+  return {
+    readSessions: async (signal) => {
+      try {
+        const raw = await read(signal);
+        return raw === null
+          ? null
+          : parseSessionCompositionFacts(
+              raw
+                .split("\n")
+                .map((line) => line.split("\t").slice(0, 11).join("\t"))
+                .join("\n"),
+            );
+      } catch (error) {
+        // Socket absence is an authoritative empty catalog, but must not
+        // manufacture agent turn completions from a failed agent observation.
+        return isAbsentServer(error) ? parseSessionCompositionFacts("") : null;
+      }
+    },
+    readAgents: async (signal) => {
+      try {
+        const raw = await read(signal);
+        return raw === null
+          ? null
+          : parseAgentStateFacts(
+              raw
+                .split("\n")
+                .map((line) => {
+                  const fields = line.split("\t");
+                  if (fields.length !== 13) return "";
+                  return [fields[0], fields[6], fields[9], fields[11], fields[12]].join("\t");
+                })
+                .join("\n"),
+            );
+      } catch {
+        return null;
+      }
+    },
+  };
+}

package/packages/daemon/src/command-center/resources/saved-machine-route.ts

@@ -2,13 +2,22 @@ import type { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { z } from "zod";
 import { SavedMachineRegistrySchema, type DaemonInstanceIdentity } from "@tmux-ide/contracts";
-import { loadSavedMachines, mergeSavedMachines } from "../../lib/saved-machines.ts";
+import { SavedMachineMutationSchema } from "@tmux-ide/contracts/saved-machines";
+import {
+  loadSavedMachines,
+  mergeSavedMachines,
+  updateSavedMachines,
+} from "../../lib/saved-machines.ts";
 import { ownerAuthorityGate } from "../owner-authority.ts";
 
 const Request = z.strictObject({
   expectedInstanceId: z.uuid(),
   registry: SavedMachineRegistrySchema,
 });
+const MutationRequest = z.strictObject({
+  expectedInstanceId: z.uuid(),
+  change: SavedMachineMutationSchema,
+});
 export function mountSavedMachineRoute(
   app: Hono,
   options: {
@@ -16,6 +25,7 @@ export function mountSavedMachineRoute(
     ownerToken: string | null;
     read?: typeof loadSavedMachines;
     merge?: typeof mergeSavedMachines;
+    update?: typeof updateSavedMachines;
   },
 ) {
   const authorize = ownerAuthorityGate(options.ownerToken, {
@@ -56,4 +66,41 @@ export function mountSavedMachineRoute(
       );
     }
   });
+  app.patch("/api/resources/saved-machines", bodyLimit({ maxSize: 1024 }), async (c) => {
+    const gate = authorize(c);
+    if (gate) return gate;
+    c.header("Cache-Control", "no-store");
+    let parsed;
+    try {
+      parsed = MutationRequest.safeParse(await c.req.json());
+    } catch {
+      return c.json({ error: "Invalid machine mutation" }, 400);
+    }
+    if (!parsed.success) return c.json({ error: "Invalid machine mutation" }, 400);
+    if (parsed.data.expectedInstanceId !== options.daemon.instanceId)
+      return c.json({ error: "Daemon generation changed" }, 409);
+    const change = parsed.data.change;
+    const { id, operation } = change;
+    try {
+      const registry = (options.update ?? updateSavedMachines)(
+        operation === "remove"
+          ? { type: "remove", id }
+          : {
+              type: "update",
+              id,
+              patch:
+                change.operation === "edit" ? change.patch : { enabled: operation === "enable" },
+            },
+      );
+      return c.json({ daemon: options.daemon, registry });
+    } catch {
+      return c.json(
+        {
+          error:
+            "Machine not found, edit conflicts with another profile, or registry unavailable; nothing changed",
+        },
+        409,
+      );
+    }
+  });
 }

package/packages/daemon/src/command-center/ws-events.ts

@@ -17,11 +17,8 @@ import { discoverSessions, buildOverviews, buildProjectDetail } from "./discover
 import type { AgentTurnCompletion } from "./agent-status-watch.ts";
 import {
   DaemonFleetFactsObserver,
-  AGENT_STATE_TMUX_ARGS,
-  parseAgentStateFacts,
-  parseSessionCompositionFacts,
   createDefaultFleetFactsReaders,
-  SESSION_COMPOSITION_TMUX_ARGS,
+  createSharedFleetFactsReaders,
   type DaemonFleetFactsObserverOptions,
   type DaemonFleetFactsObserverDiagnostic,
 } from "./daemon-fleet-facts-observer.ts";
@@ -431,28 +428,11 @@ export function setFleetFactsTmuxRunner(
   runTmux: ((args: readonly string[], signal?: AbortSignal) => string | Promise<string>) | null,
 ): void {
   stopFleetFactsObserver();
-  sessionCompositionReaderOverride = runTmux
-    ? async (signal) => {
-        try {
-          return parseSessionCompositionFacts(await runTmux(SESSION_COMPOSITION_TMUX_ARGS, signal));
-        } catch (error) {
-          // A daemon may legitimately precede the first tmux server. Socket
-          // absence is an authoritative empty fleet baseline, not a failed
-          // observation: catalog clients must be allowed to render their
-          // actionable first-run state while the observer waits for tmux.
-          return isTmuxServerUnavailableError(error) ? parseSessionCompositionFacts("") : null;
-        }
-      }
-    : null;
-  agentStateReaderOverride = runTmux
-    ? async (signal) => {
-        try {
-          return parseAgentStateFacts(await runTmux(AGENT_STATE_TMUX_ARGS, signal));
-        } catch {
-          return null;
-        }
-      }
+  const readers = runTmux
+    ? createSharedFleetFactsReaders(runTmux, isTmuxServerUnavailableError)
     : null;
+  sessionCompositionReaderOverride = readers?.readSessions ?? null;
+  agentStateReaderOverride = readers?.readAgents ?? null;
 }
 
 interface ResourceObservationHandle {

package/packages/daemon/src/lib/canonical-daemon-bootstrap.ts

@@ -236,6 +236,18 @@ async function replaceOlderCanonicalDaemon(
       reason: "identity-mismatch",
     });
   }
+  const supervisor = latest.info.provenance?.supervisor;
+  if (!latest.info.supervisionId && (supervisor === "systemd" || supervisor === "launchd")) {
+    throw new DaemonBootstrapError(
+      "incompatible",
+      `The older canonical daemon is managed by ${supervisor} without a supervisor reservation. ` +
+        "Stop and disable the old service, reserve the stopped namespace with " +
+        "tmux-ide daemon reserve-supervisor <id>, then configure the service to run " +
+        "tmux-ide --headless --supervised <id> before restarting it. " +
+        "The existing daemon has been left running.",
+      { reason: "canonical-record-invalid" },
+    );
+  }
   await deps.shutdownOlderOwner(info);
   const deadline = deps.now() + timeoutMs;
   while (deps.now() < deadline) {

package/packages/daemon/src/lib/canonical-daemon.ts

@@ -115,7 +115,12 @@ export type CanonicalDaemonInfoState =
     };
 
 export function getCanonicalDaemonInfoPath(): string {
-  return runtimeOwnedPath(join(resolveRuntimeNamespace().daemonInfoDir, DAEMON_INFO_FILE));
+  const namespace = resolveRuntimeNamespace();
+  const path = join(namespace.daemonInfoDir, DAEMON_INFO_FILE);
+  // Resolution already validates ordinary and isolated namespaces. Only
+  // development adds a per-path containment check; do not resolve twice on
+  // every ordinary daemon read. Each call still resolves the current namespace.
+  return namespace.development ? runtimeOwnedPath(path) : path;
 }
 
 export function getCanonicalDaemonClaimPath(): string {
@@ -687,11 +692,48 @@ export function assertCanonicalDaemonSupervision(supervisionId: string): void {
 }
 
 /** Explicit installation only; startup never calls this to recreate a reservation. */
+/** Sanitized reservation guidance; never includes credentials or filesystem errors. */
+export class CanonicalDaemonReservationError extends Error {
+  constructor(message: string) {
+    super(`Supervisor reservation refused: ${message}`);
+    this.name = "CanonicalDaemonReservationError";
+  }
+}
+
+function reservationRefusal(
+  attempt: Exclude<CanonicalDaemonClaimAttempt, { status: "acquired" }>,
+): CanonicalDaemonReservationError {
+  if (attempt.status === "busy")
+    return new CanonicalDaemonReservationError(
+      `another lifecycle operation holds the namespace (PID ${attempt.owner.pid}). Wait for it to finish, then retry.`,
+    );
+  const state = inspectCanonicalDaemonInfo();
+  if (state.status === "valid")
+    return new CanonicalDaemonReservationError(
+      `the recorded ${state.info.supervisionId ? "supervised" : "unsupervised"} daemon (PID ${state.info.pid}) has not been released. Inspect it with tmux-ide daemon info --json, then stop it through its owning process or service before reserving.`,
+    );
+  if (state.status === "reserved")
+    return new CanonicalDaemonReservationError(
+      `this namespace is reserved for supervisor ${state.reservation.supervisionId}. Remove that service and release its reservation before assigning a different ID.`,
+    );
+  if (state.status === "invalid")
+    return new CanonicalDaemonReservationError(
+      `the namespace record cannot be trusted (${state.reason}). Run tmux-ide daemon info --json for diagnosis; repair ownership or permissions before retrying.`,
+    );
+  return new CanonicalDaemonReservationError(
+    "the namespace changed or its lifecycle claim is unavailable. Run tmux-ide daemon info --json, then retry after the owning operation finishes.",
+  );
+}
+
 export function reserveCanonicalDaemonSupervision(
   supervisionId: string,
 ): CanonicalDaemonReservation {
+  if (!DaemonSupervisionIdSchema.safeParse(supervisionId).success)
+    throw new CanonicalDaemonReservationError(
+      "use a 1–128 character ID starting with a letter or digit and containing only letters, digits, periods, underscores or hyphens.",
+    );
   const attempt = tryAcquireCanonicalDaemonClaim({ kind: "reserve", supervisionId });
-  if (attempt.status !== "acquired") throw new Error("Cannot reserve supervised daemon namespace");
+  if (attempt.status !== "acquired") throw reservationRefusal(attempt);
   const claim = attempt.claim;
   try {
     const before = inspectCanonicalDaemonInfo();

package/packages/daemon/src/lib/daemon-embed.ts

@@ -1436,6 +1436,7 @@ async function startEmbeddedDaemonGeneration(
               if (!sessionRuntimeRegistry) throw new Error("Session runtime unavailable");
               return sessionRuntimeRegistry.executeWindowLinkAction(session, action);
             },
+            timing,
           );
         }
         if (intent.verb === "workspace.pane.resize") {