tmux-ide 2.9.2 → 2.9.3

package/packages/daemon/src/lib/daemon-service-manager.ts

@@ -0,0 +1,152 @@
+import { execFile } from "node:child_process";
+import type { DaemonServicePlan } from "./daemon-service-plan.ts";
+
+export interface DaemonServiceState {
+  readonly loaded: boolean;
+  readonly active: boolean;
+  readonly pid: number | null;
+  readonly definitionPath: string | null;
+}
+
+export type ServiceCommand = (
+  file: string,
+  args: readonly string[],
+) => Promise<{ code: number | null; stdout: string; stderr: string }>;
+
+const runCommand: ServiceCommand = (file, args) =>
+  new Promise((resolve) => {
+    execFile(
+      file,
+      [...args],
+      {
+        encoding: "utf8",
+        timeout: 15_000,
+        maxBuffer: 256 * 1024,
+        env: { ...process.env, LC_ALL: "C", LANG: "C" },
+      },
+      (error, stdout, stderr) =>
+        resolve({
+          code: error ? (typeof error.code === "number" ? error.code : null) : 0,
+          stdout,
+          stderr,
+        }),
+    );
+  });
+
+export class DaemonServiceManagerError extends Error {
+  readonly code = "DAEMON_SERVICE_MANAGER_FAILED";
+  constructor(
+    readonly operation: string,
+    readonly manager: string,
+  ) {
+    super(`${manager} user service ${operation} failed; check the user manager and service logs`);
+    this.name = "DaemonServiceManagerError";
+  }
+}
+
+/** Bounded argv-only OS boundary. Never expose manager output (it may contain environment data). */
+export function createDaemonServiceManager(plan: DaemonServicePlan, run = runCommand) {
+  const launchd = plan.manager === "launchd";
+  const file = launchd ? "/bin/launchctl" : "systemctl";
+  const domain = plan.target.slice(0, plan.target.lastIndexOf("/"));
+  const command = async (operation: string, args: readonly string[]) => {
+    const result = await run(file, launchd ? args : ["--user", ...args]);
+    if (result.code !== 0) throw new DaemonServiceManagerError(operation, plan.manager);
+    return result;
+  };
+  return {
+    async available(): Promise<void> {
+      await command(
+        "availability check",
+        launchd ? ["print-disabled", domain] : ["show-environment"],
+      );
+    },
+    async inspect(): Promise<DaemonServiceState> {
+      const result = await run(
+        file,
+        launchd
+          ? ["print", plan.target]
+          : [
+              "--user",
+              "show",
+              plan.target,
+              "--property=LoadState,ActiveState,MainPID,FragmentPath",
+            ],
+      );
+      const absent = { loaded: false, active: false, pid: null, definitionPath: null } as const;
+      if (launchd) {
+        if (result.code === 113 && result.stderr.includes("Could not find service")) return absent;
+        if (result.code !== 0) throw new DaemonServiceManagerError("inspection", plan.manager);
+        const field = (name: string) =>
+          result.stdout.match(new RegExp(`^\\t${name} = (.*)$`, "m"))?.[1];
+        const path = field("path");
+        const pidText = field("pid");
+        const state = field("state");
+        if (!path || !state || (pidText !== undefined && !/^[1-9][0-9]*$/u.test(pidText)))
+          throw new DaemonServiceManagerError("inspection format", plan.manager);
+        return {
+          loaded: true,
+          active: state === "running",
+          pid: pidText ? Number(pidText) : null,
+          definitionPath: path,
+        };
+      }
+      const fields = new Map<string, string>();
+      for (const line of result.stdout.trim().split("\n")) {
+        const index = line.indexOf("=");
+        if (index < 1 || fields.has(line.slice(0, index)))
+          throw new DaemonServiceManagerError("inspection format", plan.manager);
+        fields.set(line.slice(0, index), line.slice(index + 1));
+      }
+      if (fields.get("LoadState") === "not-found" && (result.code === 0 || result.code === 4))
+        return absent;
+      if (result.code !== 0 || fields.get("LoadState") !== "loaded" || !fields.has("ActiveState"))
+        throw new DaemonServiceManagerError("inspection", plan.manager);
+      const pidText = fields.get("MainPID");
+      const path = fields.get("FragmentPath");
+      if (!pidText || !/^(0|[1-9][0-9]*)$/u.test(pidText) || !path)
+        throw new DaemonServiceManagerError("inspection format", plan.manager);
+      return {
+        loaded: true,
+        active: fields.get("ActiveState") === "active",
+        pid: Number(pidText) || null,
+        definitionPath: path,
+      };
+    },
+    async install(): Promise<void> {
+      if (launchd) await command("bootstrap", ["bootstrap", domain, plan.unitPath]);
+      else {
+        await command("reload", ["daemon-reload"]);
+        // The manager may have a different XDG_CONFIG_HOME from the invoking
+        // shell. Enable the owned file explicitly so it is linked into its search path.
+        await command("enable/start", ["enable", "--now", plan.unitPath]);
+      }
+    },
+    async restart(hasProcess = true): Promise<void> {
+      // An explicit recovery after a failed launcher must also clear systemd's
+      // start-rate counter. The lifecycle owner has already verified this unit's
+      // private definition and reservation; never reset all user units.
+      if (!launchd && !hasProcess)
+        await command("reset failed state", ["reset-failed", plan.target]);
+      // KeepAlive relaunches after a graceful TERM. kickstart -k would force-kill
+      // the daemon instead of allowing canonical ownership to be released.
+      await command(
+        "restart",
+        launchd
+          ? hasProcess
+            ? ["kill", "SIGTERM", plan.target]
+            : ["kickstart", plan.target]
+          : ["restart", plan.target],
+      );
+    },
+    async stop(): Promise<void> {
+      await command(
+        "stop/remove",
+        launchd ? ["bootout", plan.target] : ["disable", "--now", plan.target],
+      );
+    },
+    async reload(): Promise<void> {
+      if (!launchd) await command("reload", ["daemon-reload"]);
+    },
+  };
+}

package/packages/daemon/src/lib/daemon-service-plan.ts

@@ -0,0 +1,153 @@
+import { createHash } from "node:crypto";
+import { isAbsolute, join } from "node:path";
+import { runtimeNamespaceEnvironment, type RuntimeNamespace } from "./runtime-namespace.ts";
+
+export interface DaemonServicePlan {
+  readonly manager: "launchd" | "systemd";
+  readonly supervisionId: string;
+  readonly target: string;
+  readonly unitPath: string;
+  readonly recordPath: string;
+  readonly executable: string;
+  readonly contents: string;
+  readonly stdoutPath: string;
+  readonly stderrPath: string;
+}
+
+function safeValue(value: string, name: string): string {
+  if (!value || [...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+    throw new TypeError(`${name} must be nonempty and contain no control characters`);
+  return value;
+}
+
+function absolute(value: string, name: string): string {
+  safeValue(value, name);
+  if (!isAbsolute(value)) throw new TypeError(`${name} must be an absolute path`);
+  return value;
+}
+
+function xml(value: string): string {
+  return value.replace(
+    /[&<>"']/gu,
+    (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[char]!,
+  );
+}
+
+// systemd applies specifier expansion to paths, environment values and ExecStart.
+// ExecStart additionally expands dollars unless the ':' executable prefix is used.
+function systemd(value: string): string {
+  return `"${value.replace(/%/gu, "%%").replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`;
+}
+
+/** Pure rendering only. Reservation and OS-manager mutations belong to the lifecycle owner. */
+export function planDaemonService(options: {
+  platform: string;
+  uid: number;
+  home: string;
+  configHome?: string;
+  executable: string;
+  path: string;
+  namespace: RuntimeNamespace;
+}): DaemonServicePlan {
+  const { namespace } = options;
+  if (options.platform !== "darwin" && options.platform !== "linux")
+    throw new TypeError("Daemon services support macOS launchd and Linux systemd user managers");
+  if (!Number.isSafeInteger(options.uid) || options.uid <= 0)
+    throw new TypeError("Daemon services require a non-root user");
+  if (namespace.mode === "development")
+    throw new TypeError("Development instances own their lifecycle; use dev:instance instead");
+  const home = absolute(options.home, "Home directory");
+  const executable = absolute(options.executable, "Stable CLI executable");
+  // Keep the supplied stable launcher path. realpath would pin installer services
+  // to a retired version instead of following the next verified activation.
+  const identity = createHash("sha256")
+    .update(absolute(namespace.daemonInfoDir, "Daemon state directory"))
+    .digest("hex")
+    .slice(0, 24);
+  const supervisionId = `tmux-ide.${identity}`;
+  const stdoutPath = join(namespace.daemonInfoDir, "service.stdout.log");
+  const stderrPath = join(namespace.daemonInfoDir, "service.stderr.log");
+  const environment = {
+    HOME: home,
+    PATH: safeValue(options.path, "Service PATH"),
+    ...runtimeNamespaceEnvironment(namespace),
+    TMUX_IDE_CONFIG: namespace.configPath,
+    TMUX_IDE_SETTINGS_DIR: namespace.settingsDir,
+    TMUX_IDE_CLAUDE_DIR: namespace.claudeDir,
+    TMUX_IDE_CLAUDE_SETTINGS: namespace.claudeSettingsPath,
+    TMUX_IDE_CLAUDE_HOOK_PATH: namespace.claudeHookPath,
+    TMUX_IDE_OPENCODE_DIR: namespace.opencodeDir,
+  };
+  for (const [name, value] of Object.entries(environment)) safeValue(value, name);
+  const args = [executable, "--headless", "--supervised", supervisionId];
+  const shared = {
+    supervisionId,
+    executable,
+    recordPath: join(namespace.daemonInfoDir, "service.json"),
+    stdoutPath,
+    stderrPath,
+  };
+  if (options.platform === "darwin") {
+    const label = `com.${supervisionId}`;
+    const string = (value: string) => `<string>${xml(value)}</string>`;
+    return Object.freeze({
+      ...shared,
+      manager: "launchd",
+      target: `gui/${options.uid}/${label}`,
+      unitPath: join(home, "Library", "LaunchAgents", `${label}.plist`),
+      contents: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key>${string(label)}
+<key>ProgramArguments</key><array>${args.map(string).join("")}</array>
+<key>EnvironmentVariables</key><dict>${Object.entries(environment)
+        .map(([key, value]) => `<key>${xml(key)}</key>${string(value)}`)
+        .join("")}</dict>
+<key>WorkingDirectory</key>${string(home)}
+<key>RunAtLoad</key><true/>
+<key>KeepAlive</key><true/>
+<key>ThrottleInterval</key><integer>3</integer>
+<key>ExitTimeOut</key><integer>30</integer>
+<key>AbandonProcessGroup</key><true/>
+<key>StandardOutPath</key>${string(stdoutPath)}
+<key>StandardErrorPath</key>${string(stderrPath)}
+</dict></plist>
+`,
+    });
+  }
+  const configHome = absolute(options.configHome ?? join(home, ".config"), "Config directory");
+  const target = `${supervisionId}.service`;
+  // WorkingDirectory is a raw path, not an ExecStart-style quoted word.
+  // The equivalent '/.' suffix preserves trailing spaces/backslashes without
+  // allowing the unit parser to trim them or treat them as line continuation.
+  const workingDirectory = `${home.replace(/%/gu, "%%")}/.`;
+  return Object.freeze({
+    ...shared,
+    manager: "systemd",
+    target,
+    unitPath: join(configHome, "systemd", "user", target),
+    contents: `[Unit]
+Description=tmux-ide canonical user daemon
+StartLimitIntervalSec=60
+StartLimitBurst=10
+
+[Service]
+Type=exec
+ExecStart=:${args.map(systemd).join(" ")}
+WorkingDirectory=${workingDirectory}
+${Object.entries(environment)
+  .map(([key, value]) => `Environment=${systemd(`${key}=${value}`)}`)
+  .join("\n")}
+Restart=always
+RestartSec=3
+TimeoutStopSec=30
+# tmux pane work has an independent lifetime; never kill the whole service cgroup.
+KillMode=process
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=default.target
+`,
+  });
+}

package/packages/daemon/src/lib/daemon-service.ts

@@ -0,0 +1,301 @@
+import {
+  accessSync,
+  constants,
+  openSync,
+  closeSync,
+  fstatSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+  renameSync,
+  rmSync,
+  realpathSync,
+  linkSync,
+} from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { z } from "zod";
+import {
+  getCanonicalDaemonInfoPath,
+  inspectCanonicalDaemonInfo,
+  probeCanonicalDaemonIdentity,
+  releaseCanonicalDaemonSupervision,
+  reserveCanonicalDaemonSupervision,
+  type CanonicalDaemonInfoState,
+} from "./canonical-daemon.ts";
+import { createDaemonServiceManager } from "./daemon-service-manager.ts";
+import { planDaemonService, type DaemonServicePlan } from "./daemon-service-plan.ts";
+import { resolveRuntimeNamespace } from "./runtime-namespace.ts";
+import { IdeError } from "./errors.ts";
+import { acquirePrivateOperationLock } from "./private-operation-lock.ts";
+
+const RecordSchema = z.strictObject({
+  version: z.literal(1),
+  removing: z.boolean().optional(),
+  executable: z.string().min(1),
+  contents: z
+    .string()
+    .min(1)
+    .max(64 * 1024),
+});
+
+export interface DaemonServiceDependencies {
+  plan(executable: string): DaemonServicePlan;
+  manager: typeof createDaemonServiceManager;
+  inspect: typeof inspectCanonicalDaemonInfo;
+  reserve: typeof reserveCanonicalDaemonSupervision;
+  release: typeof releaseCanonicalDaemonSupervision;
+  probe: typeof probeCanonicalDaemonIdentity;
+  recordPath: string;
+  waitMs: number;
+}
+
+function defaults(): DaemonServiceDependencies {
+  const namespace = resolveRuntimeNamespace();
+  return {
+    plan: (executable) =>
+      planDaemonService({
+        platform: process.platform,
+        uid: process.getuid?.() ?? 0,
+        home: homedir(),
+        configHome: process.env.XDG_CONFIG_HOME || undefined,
+        executable,
+        path: process.env.PATH || "/usr/bin:/bin",
+        namespace,
+      }),
+    manager: createDaemonServiceManager,
+    inspect: inspectCanonicalDaemonInfo,
+    reserve: reserveCanonicalDaemonSupervision,
+    release: releaseCanonicalDaemonSupervision,
+    probe: probeCanonicalDaemonIdentity,
+    recordPath: join(dirname(getCanonicalDaemonInfoPath()), "service.json"),
+    waitMs: 30_000,
+  };
+}
+
+function refused(message: string): never {
+  throw new IdeError(message, { code: "DAEMON_SERVICE_REFUSED" });
+}
+
+function ownedFile(path: string): string | null {
+  let descriptor: number | undefined;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const stat = fstatSync(descriptor);
+    if (
+      !stat.isFile() ||
+      stat.uid !== process.getuid?.() ||
+      (stat.mode & 0o022) !== 0 ||
+      stat.size > 128 * 1024
+    )
+      refused(`Service file is not a bounded, user-owned regular file: ${path}`);
+    return readFileSync(descriptor, "utf8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+  }
+}
+
+function boundTo(state: CanonicalDaemonInfoState, id: string): boolean {
+  return state.status === "reserved"
+    ? state.reservation.supervisionId === id
+    : state.status === "valid" && state.info.supervisionId === id;
+}
+
+/** Explicit OS supervision. Never starts a detached daemon or signals a guessed PID. */
+export async function manageDaemonService(
+  action: "install" | "status" | "restart" | "remove",
+  executable?: string,
+  deps: DaemonServiceDependencies = defaults(),
+) {
+  const previousRecord = ownedFile(deps.recordPath);
+  const record = previousRecord === null ? null : RecordSchema.parse(JSON.parse(previousRecord));
+  if (record?.removing && action !== "remove" && action !== "status")
+    refused("Service removal is incomplete; finish remove before installing or restarting");
+  if (!record && action !== "install") {
+    if (action === "status") return { status: "not-installed" as const };
+    refused("No managed service is installed in this daemon namespace");
+  }
+  if (action === "install" && !executable)
+    refused("Service installation requires an absolute stable CLI launcher path");
+  if (record && executable && record.executable !== executable)
+    refused(
+      "A different launcher is already registered; remove the stopped service before changing it",
+    );
+  const plan = deps.plan(record?.executable ?? executable!);
+  if (plan.recordPath !== deps.recordPath) refused("Service namespace changed during resolution");
+  const contents = record?.contents ?? plan.contents;
+  const manager = deps.manager(plan);
+  const assertFiles = (allowMissingUnit = false) => {
+    const unit = ownedFile(plan.unitPath);
+    if (unit !== contents && !((record?.removing || allowMissingUnit) && unit === null))
+      refused("Service definition is missing or modified; refusing to control it");
+    if (record && ownedFile(plan.recordPath) !== previousRecord)
+      refused("Service ownership record changed");
+  };
+  const inspectManager = async () => {
+    const state = await manager.inspect();
+    // systemd reports its generated search-path symlink for units enabled by
+    // absolute path. Resolve that link to the owned definition; the definition
+    // itself still has to pass our no-follow private-file and content checks.
+    if (
+      state.loaded &&
+      (!state.definitionPath || realpathSync(state.definitionPath) !== realpathSync(plan.unitPath))
+    )
+      refused("The service manager loaded a different definition; refusing to control it");
+    return state;
+  };
+  const ready = async (previousInstance?: string) => {
+    const deadline = Date.now() + deps.waitMs;
+    do {
+      const state = deps.inspect();
+      if (!boundTo(state, plan.supervisionId))
+        refused("Service reservation changed during startup");
+      if (state.status === "valid" && state.info.instanceId !== previousInstance) {
+        const identity = await deps.probe(state.info);
+        const service = await inspectManager();
+        if (
+          identity &&
+          service.active &&
+          service.pid === state.info.pid &&
+          identity.pid === state.info.pid &&
+          identity.instanceId === state.info.instanceId &&
+          identity.startedAt === state.info.startedAt &&
+          identity.protocolVersion === state.info.protocolVersion
+        )
+          return {
+            status: "running" as const,
+            manager: plan.manager,
+            target: plan.target,
+            pid: state.info.pid,
+            instanceId: state.info.instanceId,
+          };
+      }
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    } while (Date.now() < deadline);
+    refused(
+      "Service did not publish a verified daemon before the deadline; inspect service logs, then retry restart or remove",
+    );
+  };
+  await manager.available();
+  const service = await inspectManager();
+  const allowMissingUnit = action === "remove" && !service.loaded;
+  if (record) assertFiles(allowMissingUnit);
+  if (action === "status") {
+    const state = deps.inspect();
+    const identity =
+      service.active && state.status === "valid" && boundTo(state, plan.supervisionId)
+        ? await deps.probe(state.info)
+        : null;
+    const verified =
+      identity !== null &&
+      state.status === "valid" &&
+      service.pid === state.info.pid &&
+      identity.pid === state.info.pid &&
+      identity.instanceId === state.info.instanceId &&
+      identity.startedAt === state.info.startedAt &&
+      identity.protocolVersion === state.info.protocolVersion;
+    return {
+      status: verified
+        ? ("running" as const)
+        : service.active
+          ? ("active-unverified" as const)
+          : ("stopped" as const),
+      manager: plan.manager,
+      target: plan.target,
+      pid: service.pid,
+      reservationMatches: boundTo(state, plan.supervisionId),
+      unitPath: plan.unitPath,
+    };
+  }
+  if (!record && (service.loaded || ownedFile(plan.unitPath) !== null))
+    refused("A service definition already exists without this namespace's ownership record");
+  if (
+    record &&
+    !boundTo(deps.inspect(), plan.supervisionId) &&
+    !(record.removing && action === "remove" && deps.inspect().status === "missing")
+  )
+    refused("Service reservation is missing or belongs to another owner");
+  if (!record) {
+    accessSync(plan.executable, constants.X_OK);
+    // Canonical reservation admission rejects live, uncertain and foreign owners.
+    deps.reserve(plan.supervisionId);
+  }
+  const lock = `${plan.recordPath}.lock`;
+  const releaseLock = await acquirePrivateOperationLock(lock, 1000);
+  let wroteRecord = false;
+  let wroteUnit = false;
+  let activationAttempted = false;
+  try {
+    if (record) assertFiles(allowMissingUnit);
+    if (action === "install" && !record) {
+      writeFileSync(
+        plan.recordPath,
+        JSON.stringify({ version: 1, executable: plan.executable, contents }) + "\n",
+        { flag: "wx", mode: 0o600 },
+      );
+      wroteRecord = true;
+      mkdirSync(dirname(plan.unitPath), { recursive: true, mode: 0o700 });
+      const unitStage = `${plan.unitPath}.${randomUUID()}.tmp`;
+      writeFileSync(unitStage, contents, { flag: "wx", mode: 0o600 });
+      try {
+        linkSync(unitStage, plan.unitPath);
+      } finally {
+        unlinkSync(unitStage);
+      }
+      wroteUnit = true;
+      activationAttempted = true;
+      await manager.install();
+      return await ready();
+    }
+    if (action === "remove") {
+      if (service.loaded) await manager.stop();
+      let stopped = await inspectManager();
+      const stopDeadline = Date.now() + deps.waitMs;
+      while ((stopped.active || stopped.pid !== null) && Date.now() < stopDeadline) {
+        await new Promise((resolve) => setTimeout(resolve, 100));
+        stopped = await inspectManager();
+      }
+      if (stopped.active || stopped.pid !== null)
+        refused("Service manager has not confirmed the daemon stopped; reservation retained");
+      assertFiles(allowMissingUnit);
+      const removalRecord = JSON.stringify({ ...record!, removing: true }) + "\n";
+      const temporaryRecord = `${plan.recordPath}.${randomUUID()}.tmp`;
+      writeFileSync(temporaryRecord, removalRecord, { flag: "wx", mode: 0o600 });
+      try {
+        if (ownedFile(plan.recordPath) !== previousRecord)
+          refused("Service ownership record changed during removal");
+        renameSync(temporaryRecord, plan.recordPath);
+      } finally {
+        rmSync(temporaryRecord, { force: true });
+      }
+      if (ownedFile(plan.unitPath) !== null) unlinkSync(plan.unitPath);
+      await manager.reload();
+      if ((await inspectManager()).loaded)
+        refused("Service remains loaded after removal; reservation retained");
+      if (deps.inspect().status !== "missing") deps.release(plan.supervisionId);
+      unlinkSync(plan.recordPath);
+      return { status: "removed" as const, target: plan.target };
+    }
+    const before = deps.inspect();
+    if (action === "install" && service.active) return await ready();
+    if (service.loaded) await manager.restart(service.pid !== null);
+    else await manager.install();
+    return await ready(before.status === "valid" ? before.info.instanceId : undefined);
+  } catch (error) {
+    // Never discard ownership after an uncertain OS activation. The retained
+    // record/reservation gives the explicit remove/restart commands a recovery path.
+    if (!activationAttempted && wroteRecord) {
+      if (wroteUnit && ownedFile(plan.unitPath) === contents) unlinkSync(plan.unitPath);
+      unlinkSync(plan.recordPath);
+      deps.release(plan.supervisionId);
+    }
+    throw error;
+  } finally {
+    releaseLock();
+  }
+}

package/packages/daemon/src/lib/install-origin.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 export type InstallOrigin =
+  | "installer"
   | "npm"
   | "pnpm"
   | "bun"
@@ -12,6 +13,10 @@ export type InstallOrigin =
   | "unknown";
 /** Conservative layout evidence; an arbitrary node_modules directory is not a global install. */
 export function detectPackageManager(path: string): Exclude<InstallOrigin, "dev"> {
+  if (
+    /\/share\/tmux-ide\/releases\/install-[^/]+\/npm\/lib\/node_modules\/tmux-ide\/bin$/.test(path)
+  )
+    return "installer";
   if (/\/(?:Cellar|Caskroom)\//.test(path)) return "homebrew";
   if (/\/_npx\//.test(path)) return "npx";
   if (/\/(?:\.yarn|yarn)\//.test(path)) return "yarn";

package/packages/daemon/src/lib/local-fleet-request.ts

@@ -1,4 +1,9 @@
-import { SavedMachineRegistrySchema, type SavedMachine } from "@tmux-ide/contracts/saved-machines";
+import {
+  SavedMachineRegistrySchema,
+  type SavedMachine,
+  SavedMachineMutationSchema,
+  type SavedMachineMutation,
+} from "@tmux-ide/contracts/saved-machines";
 import {
   canonicalDaemonUrl,
   isCanonicalDaemonAlive,
@@ -8,6 +13,17 @@ import {
 /** Intentional local registry mutation. Never uses selected-machine authority. */
 export async function saveMachineProfiles(machines: readonly SavedMachine[]) {
   const registry = SavedMachineRegistrySchema.parse({ version: 1, machines });
+  return writeLocalMachineRegistry("POST", { registry });
+}
+
+export async function mutateMachineProfile(change: SavedMachineMutation) {
+  return writeLocalMachineRegistry("PATCH", { change: SavedMachineMutationSchema.parse(change) });
+}
+
+async function writeLocalMachineRegistry(
+  method: "POST" | "PATCH",
+  payload: Record<string, unknown>,
+) {
   const daemon = readCanonicalDaemonInfo();
   if (!daemon?.authToken || !(await isCanonicalDaemonAlive(daemon)))
     throw new Error("Start a local tmux-ide daemon to save machine profiles.");
@@ -16,14 +32,14 @@ export async function saveMachineProfiles(machines: readonly SavedMachine[]) {
       canonicalDaemonUrl("http", daemon.bindHostname, daemon.port) +
         "/api/resources/saved-machines",
       {
-        method: "POST",
+        method,
         redirect: "error",
         signal: AbortSignal.timeout(5000),
         headers: {
           Authorization: `Bearer ${daemon.authToken}`,
           "Content-Type": "application/json",
         },
-        body: JSON.stringify({ expectedInstanceId: daemon.instanceId, registry }),
+        body: JSON.stringify({ expectedInstanceId: daemon.instanceId, ...payload }),
       },
     );
     if (!response.ok) {