tmux-ide 2.9.2 → 2.9.3

package/packages/daemon/src/lib/workspace-multiplexer-verbs.ts

@@ -468,6 +468,7 @@ export class WorkspaceMultiplexerAuthority {
       session: string,
       action: AuthoritativeWindowLinkAction,
     ) => Promise<AuthoritativeWindowLinkActionResult>,
+    timing?: WorkspaceMultiplexerOperationTiming,
   ): Promise<WorkspaceMultiplexerMutationResult> {
     if (this.#disposed) throw new WorkspaceMultiplexerError("workspace_unavailable");
     const request = WorkspaceMultiplexerMutationRequestSchemaZ.parse(raw);
@@ -480,7 +481,26 @@ export class WorkspaceMultiplexerAuthority {
       intent.verb !== "workspace.pane.select"
     )
       throw new TypeError("Expected a window-link selection or unlink intent");
+    const now = () => {
+      try {
+        return timing?.nowMicros() ?? null;
+      } catch {
+        return null;
+      }
+    };
+    const record = (operation: string, start: number | null) => {
+      const end = now();
+      if (start !== null && end !== null) {
+        try {
+          timing?.record(operation, start, end);
+        } catch {
+          /* Diagnostics cannot own selection. */
+        }
+      }
+    };
+    const lookupStarted = now();
     const workspace = this.#registry.get(intent.workspaceName);
+    record("semantic-workspace-lookup", lookupStarted);
     if (!workspace) throw new WorkspaceMultiplexerError("workspace_not_found");
     const envelope = {
       operationId: request.operationId,
@@ -488,6 +508,7 @@ export class WorkspaceMultiplexerAuthority {
       workspaceName: intent.workspaceName,
     };
     try {
+      const effectStarted = now();
       const result = await execute(
         workspace.sessionName,
         intent.verb === "workspace.pane.select"
@@ -501,6 +522,7 @@ export class WorkspaceMultiplexerAuthority {
               target: intent.target,
             },
       );
+      record("window-link-effect-proof", effectStarted);
       if (result.outcome !== "applied") {
         throw new WorkspaceMultiplexerError(
           result.outcome === "stale"

package/packages/daemon/src/machines.ts

@@ -1,22 +1,70 @@
 import { readFileSync, statSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { SavedMachineRegistrySchema, SavedMachineSchema } from "@tmux-ide/contracts/saved-machines";
+import {
+  SavedMachineRegistrySchema,
+  SavedMachineSchema,
+  SavedMachineMutationSchema,
+} from "@tmux-ide/contracts/saved-machines";
 import { loadSavedMachines, planSavedMachineMerge } from "./lib/saved-machines.ts";
 import { loadFleetClientState } from "./lib/fleet-client-state.ts";
-import { saveMachineProfiles } from "./lib/local-fleet-request.ts";
+import { changeSavedMachines } from "@tmux-ide/core";
+import { saveMachineProfiles, mutateMachineProfile } from "./lib/local-fleet-request.ts";
+import { remoteTmuxIdeCommand } from "./lib/remote-tmux-command.ts";
 
 export async function machines(
   command: string | undefined,
   argument: string | undefined,
-  options: { write?: boolean; label?: string },
+  options: { write?: boolean; label?: string; sshTarget?: string },
 ) {
   const current = loadSavedMachines();
+  if (
+    (command === "enable" || command === "disable" || command === "remove" || command === "edit") &&
+    argument
+  ) {
+    const key = argument.normalize("NFKC").toLowerCase();
+    const match =
+      current.machines.find((machine) => machine.id === key) ??
+      current.machines.find((machine) => machine.label.normalize("NFKC").toLowerCase() === key);
+    if (!match)
+      throw new Error("Saved machine not found; use machines ls to select its ID or label.");
+    const change = SavedMachineMutationSchema.parse(
+      command === "edit"
+        ? {
+            id: match.id,
+            operation: command,
+            patch: {
+              ...(options.label !== undefined ? { label: options.label } : {}),
+              ...(options.sshTarget !== undefined ? { sshTarget: options.sshTarget } : {}),
+            },
+          }
+        : { id: match.id, operation: command },
+    );
+    const preview = changeSavedMachines(
+      current,
+      command === "remove"
+        ? { type: "remove", id: match.id }
+        : {
+            type: "update",
+            id: match.id,
+            patch: change.operation === "edit" ? change.patch : { enabled: command === "enable" },
+          },
+    );
+    return {
+      written: options.write === true,
+      registry: options.write ? await mutateMachineProfile(change) : preview,
+      ...(!options.write
+        ? {
+            note: "Repeat with --write to change this saved profile. Remote sessions and daemons are preserved.",
+          }
+        : {}),
+    };
+  }
   if (command === "start" && argument) {
     SavedMachineSchema.shape.sshTarget.parse(argument);
     if (!options.write)
       return {
         written: false,
-        command: ["ssh", "--", argument, "tmux-ide", "update", "--daemon", "--json"],
+        command: ["ssh", "--", argument, remoteTmuxIdeCommand("start")],
         note: "Repeat with --write to start the installed daemon. No package installation occurs.",
       };
     await (await import("./lib/remote-daemon-lifecycle.ts")).startInstalledRemoteDaemon(argument);
@@ -74,7 +122,7 @@ export async function machines(
     };
   } else
     throw new Error(
-      "Usage: tmux-ide machines ls|export|import <file>|add <alias> [--write] [--json]",
+      "Usage: tmux-ide machines ls|export|import <file>|add <alias>|edit|enable|disable|remove <id-or-label> [--write] [--json]",
     );
   const preview = planSavedMachineMerge(current, incoming);
   if (!options.write)

package/packages/daemon/src/terminal/attachments/direct-websocket.ts

@@ -210,7 +210,7 @@ export interface TerminalAttachmentAdmissionCoordinatorOptions {
   /** Trusted redemption boundary into the generation's SessionRuntime owner. */
   readonly bindSessionRuntime?: (
     descriptor: AttachmentLeaseDescriptor,
-  ) => SessionRuntimeRedeemedTransportBinding;
+  ) => SessionRuntimeRedeemedTransportBinding | Promise<SessionRuntimeRedeemedTransportBinding>;
   readonly maxPendingTickets?: number;
   readonly maxPreAuthSockets?: number;
   readonly maxLiveConnections?: number;
@@ -765,7 +765,13 @@ export class TerminalAttachmentAdmissionCoordinator {
         let sessionRuntimeBinding: SessionRuntimeRedeemedTransportBinding | null = null;
         let live: TerminalAttachmentLiveConnection;
         try {
-          sessionRuntimeBinding = this.#bindSessionRuntime?.(activeDescriptor) ?? null;
+          sessionRuntimeBinding = (await this.#bindSessionRuntime?.(activeDescriptor)) ?? null;
+          if (!admission.isOpen()) {
+            throw new TerminalAttachmentAdmissionError(
+              "redemption-rejected",
+              "Terminal attachment redemption was rejected.",
+            );
+          }
           live = new TerminalAttachmentLiveConnection({
             onRetire: (connection) => this.#trackRetiringRelease(connection),
             socket,

package/packages/daemon/src/terminal/attachments/native-runtime.ts

@@ -1307,6 +1307,7 @@ export class WorkspaceTerminalInventoryRuntime {
     }
   >();
   #lifecycle: "initializing" | "ready" | "failed" | "disposed" = "initializing";
+  #registeredWindows: { invalidate(): void; dispose(): void } | undefined;
   #disposed = false;
 
   constructor(options: WorkspaceTerminalInventoryRuntimeOptions) {
@@ -1318,6 +1319,16 @@ export class WorkspaceTerminalInventoryRuntime {
     });
     this.readRunner = pinnedReadRunner(authority, executeRead);
     this.#registry = options.registry;
+    this.#registeredWindows = options.sessionRuntimeRegistry?.setRegisteredWindowReader?.(
+      async (signal) => {
+        const snapshot = await discoverWorkspaceRegistryTerminalInventory(
+          this.#registry,
+          this.readRunner,
+          signal,
+        );
+        return snapshot.panes.map((pane) => ({ session: pane.sessionName, window: pane.windowId }));
+      },
+    );
     this.#observability = options.observability ?? DISABLED_SESSION_RUNTIME_OBSERVABILITY;
     this.#resolveInteractionEndpoint = options.resolveInteractionEndpoint;
     this.#nativeServerEpoch = options.nativeServerEpoch;
@@ -1441,10 +1452,12 @@ export class WorkspaceTerminalInventoryRuntime {
       this.#observeWorkspaceSession = null;
     }
     this.#stopWorkspaceAddedObserver = options.registry.on("workspace.added", (workspace) => {
+      this.#registeredWindows?.invalidate();
       this.invalidate();
       this.#observeWorkspaceSession?.(workspace.name, workspace.sessionName);
     });
     this.#stopWorkspaceRemovedObserver = options.registry.on("workspace.removed", (name) => {
+      this.#registeredWindows?.invalidate();
       this.invalidate();
       if (!options.sessionRuntimeRegistry) return;
       const sessionName = sessionsByWorkspace.get(name);
@@ -1749,12 +1762,12 @@ export class WorkspaceTerminalInventoryRuntime {
     let catalogIssue: NativeTerminalInventoryCatalogIssue | null = inventory.catalog
       .invalidRuntimeProof
       ? "invalid-runtime-proof"
-      : inventory.catalog.missingSemanticStamp
-        ? "missing-semantic-stamp"
-        : inventory.catalog.duplicateSemanticStamp
-          ? "duplicate-semantic-stamp"
-          : inventory.catalog.duplicateRuntimePaneBinding
-            ? "duplicate-runtime-pane-binding"
+      : inventory.catalog.duplicateRuntimePaneBinding
+        ? "duplicate-runtime-pane-binding"
+        : inventory.catalog.missingSemanticStamp
+          ? "missing-semantic-stamp"
+          : inventory.catalog.duplicateSemanticStamp
+            ? "duplicate-semantic-stamp"
             : null;
     if (
       shouldPrewarm &&
@@ -1949,6 +1962,7 @@ export class WorkspaceTerminalInventoryRuntime {
     if (this.#disposed) return;
     this.#disposed = true;
     this.#lifecycle = "disposed";
+    this.#registeredWindows?.dispose();
     this.invalidate();
     this.#stopWorkspaceAddedObserver?.();
     this.#stopWorkspaceRemovedObserver?.();
@@ -2128,12 +2142,13 @@ export class NativeTerminalAttachmentRuntime {
       resolveGeometry: (descriptor, client) => geometry.resolve(descriptor, client),
       ...(options.sessionRuntimeRegistry
         ? {
-            bindSessionRuntime: (descriptor: AttachmentLeaseDescriptor) => {
+            bindSessionRuntime: async (descriptor: AttachmentLeaseDescriptor) => {
               const workspace = options.registry.get(descriptor.target.workspaceName);
               if (!workspace) throw new Error("Terminal attachment workspace is unavailable");
               if (!descriptor.hostClientId) {
                 throw new Error("Interactive terminal attachment lacks trusted host identity");
               }
+              await options.sessionRuntimeRegistry!.verifyWindowOwnership();
               return new SessionRuntimeTransportBinder(options.sessionRuntimeRegistry!).bind({
                 transport: "terminal-attachment",
                 transportLeaseId: descriptor.leaseId,
@@ -2357,12 +2372,12 @@ export class NativeTerminalAttachmentRuntime {
     const catalogIssue: NativeTerminalInventoryCatalogIssue | null = inventory.catalog
       .invalidRuntimeProof
       ? "invalid-runtime-proof"
-      : inventory.catalog.missingSemanticStamp
-        ? "missing-semantic-stamp"
-        : inventory.catalog.duplicateSemanticStamp
-          ? "duplicate-semantic-stamp"
-          : inventory.catalog.duplicateRuntimePaneBinding
-            ? "duplicate-runtime-pane-binding"
+      : inventory.catalog.duplicateRuntimePaneBinding
+        ? "duplicate-runtime-pane-binding"
+        : inventory.catalog.missingSemanticStamp
+          ? "missing-semantic-stamp"
+          : inventory.catalog.duplicateSemanticStamp
+            ? "duplicate-semantic-stamp"
             : null;
     // Ground-truth agent facts (authority + scrape fallback). All IO stays here;
     // the resource projector composes them purely. Absent probe → no facts →

package/packages/daemon/src/terminal/mirror/mirror-service.ts

@@ -1,3 +1,5 @@
+import { SharedWindowIndex } from "./shared-window-index.ts";
+import { RegisteredWindowGuard, type RegisteredWindowReader } from "./registered-window-guard.ts";
 import type { OwnedViewerAdapter } from "./owned-viewer-adapter.ts";
 import { accessSync, constants, realpathSync, statSync } from "node:fs";
 import { isAbsolute } from "node:path";
@@ -47,6 +49,7 @@ import {
 } from "./control-mode-ownership.ts";
 
 export interface MirrorServiceOptions {
+  onSharedWindowConflict?: (session: string, conflicted: boolean) => void;
   createOwnedViewerAdapter?: (session: string) => OwnedViewerAdapter | undefined;
   nativeServerIdentity?: import("../../lib/tmux-server-generation-runner.ts").NativeTmuxServerIdentity;
   resolveSocketPath?: () => string;
@@ -148,6 +151,47 @@ interface ChannelEntry {
 export class MirrorService {
   private readonly opts: MirrorServiceOptions;
   private readonly channels = new Map<string, ChannelEntry>();
+  private readonly sharedWindows = new SharedWindowIndex<SessionChannel>();
+  private readonly channelSessions = new Map<SessionChannel, string>();
+  private registeredWindows: RegisteredWindowGuard | null = null;
+  private readonly registeredConflicts = new Set<string>();
+
+  setRegisteredWindowReader(reader: RegisteredWindowReader): {
+    invalidate(): void;
+    dispose(): void;
+  } {
+    this.registeredWindows?.dispose();
+    const guard = new RegisteredWindowGuard(reader);
+    this.registeredWindows = guard;
+    this.invalidateRegisteredWindows();
+    return {
+      invalidate: () => {
+        if (this.registeredWindows === guard) this.invalidateRegisteredWindows();
+      },
+      dispose: () => guard.dispose(),
+    };
+  }
+
+  private invalidateRegisteredWindows(): void {
+    this.registeredWindows?.invalidate();
+  }
+
+  async verifyRegisteredWindows(): Promise<void> {
+    const guard = this.registeredWindows;
+    if (!guard) return;
+    await guard.verify();
+    if (guard !== this.registeredWindows || this.disposed)
+      throw new Error("Window ownership changed during discovery");
+    for (const [channel, session] of this.channelSessions) {
+      if (guard.blocked(session)) {
+        channel.setGeometryParticipation(false);
+        if (!this.registeredConflicts.has(session)) {
+          this.registeredConflicts.add(session);
+          this.opts.onSharedWindowConflict?.(session, true);
+        }
+      } else this.registeredConflicts.delete(session);
+    }
+  }
   private readonly pendingDisposals = new Set<Promise<void>>();
   private readonly drainingChannels = new Map<string, Promise<void>>();
   private readonly sessionExitListeners = new Set<(session: string) => void>();
@@ -239,8 +283,14 @@ export class MirrorService {
       reseed: () => handle.reseed(),
       readHistorySize: () => handle.readHistorySize(),
       captureNativeBacking: () => handle.captureNativeBacking(),
-      sendText: (text) => handle.sendText(text),
-      sendKey: (key) => handle.sendKey(key),
+      sendText: (text) => {
+        this.assertWindowOwnership(request.session);
+        handle.sendText(text);
+      },
+      sendKey: (key) => {
+        this.assertWindowOwnership(request.session);
+        handle.sendKey(key);
+      },
       close: async () => {
         if (closed) return;
         closed = true;
@@ -303,6 +353,7 @@ export class MirrorService {
     return (args: readonly string[]) => {
       if (entry.retired || this.channels.get(session) !== entry)
         return Promise.reject(new Error("Resize mirror session retired"));
+      this.assertWindowOwnership(session);
       return run(args);
     };
   }
@@ -313,6 +364,7 @@ export class MirrorService {
   ) {
     const entry = this.channels.get(session);
     if (!entry || entry.retired) throw new Error(`Mirror session ${session} is unavailable`);
+    this.assertWindowOwnership(session);
     return entry.channel.executeWindowLinkAction(request);
   }
 
@@ -326,6 +378,7 @@ export class MirrorService {
   ): void {
     const entry = this.channels.get(session);
     if (!entry || entry.retired) throw new Error(`Mirror session ${session} is unavailable`);
+    this.assertWindowOwnership(session);
     entry.channel.sendText(semanticPaneId, text, performanceTraceId, isolated);
   }
 
@@ -337,24 +390,61 @@ export class MirrorService {
   ): void {
     const entry = this.channels.get(session);
     if (!entry || entry.retired) throw new Error(`Mirror session ${session} is unavailable`);
+    this.assertWindowOwnership(session);
     entry.channel.sendBytes(semanticPaneId, data, performanceTraceId);
   }
 
   sendKey(session: string, semanticPaneId: string, key: string, performanceTraceId?: string): void {
     const entry = this.channels.get(session);
     if (!entry || entry.retired) throw new Error(`Mirror session ${session} is unavailable`);
+    this.assertWindowOwnership(session);
     entry.channel.sendKey(semanticPaneId, key, performanceTraceId);
   }
 
+  private assertWindowOwnership(session: string): void {
+    const message = this.windowOwnershipMessage(session);
+    if (message) throw new Error(message);
+  }
+
+  windowOwnershipMessage(session: string): string | null {
+    if (this.registeredWindows?.pending())
+      return "Window ownership is being verified. Retry after session discovery completes.";
+    if (this.hasSharedWindowConflict(session))
+      return "Linked windows across registered sessions are unsupported. Unlink the shared window before controlling this session.";
+    return null;
+  }
+
+  hasSharedWindowConflict(session: string): boolean {
+    const entry = this.channels.get(session);
+    return (
+      (this.registeredWindows?.blocked(session) ?? false) ||
+      (!!entry && this.sharedWindows.conflicted(entry.channel))
+    );
+  }
+
+  private updateWindowMembership(channel: SessionChannel, windows: readonly string[]): void {
+    // A topology read may finish after retirement. It must not resurrect the
+    // old channel's membership or conflict with its replacement.
+    if (!this.channelSessions.has(channel)) return;
+    for (const [peer, conflict] of this.sharedWindows.update(channel, windows)) {
+      const session = this.channelSessions.get(peer);
+      if (session === undefined) continue;
+      if (conflict) peer.setGeometryParticipation(false);
+      this.opts.onSharedWindowConflict?.(session, conflict);
+    }
+  }
+
   fitViewport(session: string, cols: number, rows: number): void {
     const entry = this.channels.get(session);
     if (!entry || entry.retired) throw new Error(`Mirror session ${session} is unavailable`);
+    this.assertWindowOwnership(session);
     entry.channel.fitViewport(cols, rows);
   }
 
   fitWindowViewport(session: string, semanticWindowId: string, cols: number, rows: number): void {
     const entry = this.channels.get(session);
     if (!entry || entry.retired) throw new Error(`Mirror session ${session} is unavailable`);
+    this.assertWindowOwnership(session);
     entry.channel.fitWindowViewport(semanticWindowId, cols, rows);
   }
 
@@ -367,7 +457,7 @@ export class MirrorService {
   setGeometryParticipation(session: string, active: boolean): void {
     const entry = this.channels.get(session);
     if (!entry || entry.retired) return;
-    entry.channel.setGeometryParticipation(active);
+    entry.channel.setGeometryParticipation(active && !this.hasSharedWindowConflict(session));
   }
 
   /**
@@ -412,12 +502,15 @@ export class MirrorService {
 
   async dispose(): Promise<void> {
     this.disposed = true;
+    this.registeredWindows?.dispose();
     this.sessionExitListeners.clear();
     const entries = [...this.channels.values()];
     this.channels.clear();
     await Promise.allSettled(
       entries.map(async (entry) => {
         entry.retired = true;
+        this.updateWindowMembership(entry.channel, []);
+        this.channelSessions.delete(entry.channel);
         try {
           await entry.channel.dispose();
         } finally {
@@ -468,6 +561,12 @@ export class MirrorService {
         );
         const channelOptions: SessionChannelOptions = {
           session,
+          onWindowMembership: (windows) => this.updateWindowMembership(channel, windows),
+          hasSharedWindowConflict: () => this.hasSharedWindowConflict(session),
+          beforeIdentityRepair: () => this.verifyRegisteredWindows(),
+          onWindowTopologyChanged: () => {
+            if (this.channelSessions.has(channel)) this.invalidateRegisteredWindows();
+          },
           ownedViewer,
           createIo: (handlers) =>
             this.opts.createIo?.(session, handlers) ??
@@ -547,6 +646,7 @@ export class MirrorService {
         releaseAuthority();
         throw cause;
       }
+      this.channelSessions.set(channel, session);
       entry = {
         channel,
         started: channel.start(),
@@ -583,6 +683,8 @@ export class MirrorService {
   private retire(session: string, entry: ChannelEntry): void {
     if (entry.retired) return;
     entry.retired = true;
+    this.updateWindowMembership(entry.channel, []);
+    this.channelSessions.delete(entry.channel);
     if (this.channels.get(session) === entry) this.channels.delete(session);
     const disposal = entry.channel
       .dispose()

package/packages/daemon/src/terminal/mirror/registered-window-guard.ts

@@ -0,0 +1,66 @@
+export type RegisteredWindowReader = (
+  signal: AbortSignal,
+) => Promise<readonly { session: string; window: string }[]>;
+
+/** A bounded registration/topology proof, shared by all retained channels. */
+export class RegisteredWindowGuard {
+  #epoch = 0;
+  #current = false;
+  #disposed = false;
+  #conflicts = new Set<string>();
+  #read: { abort: AbortController; promise: Promise<void> } | null = null;
+
+  constructor(private readonly reader: RegisteredWindowReader) {}
+
+  blocked(session: string): boolean {
+    return !this.#current || this.#conflicts.has(session);
+  }
+
+  pending(): boolean {
+    return !this.#current;
+  }
+
+  invalidate(): void {
+    this.#epoch++;
+    this.#current = false;
+    this.#read?.abort.abort();
+    this.#read = null;
+  }
+
+  dispose(): void {
+    this.#disposed = true;
+    this.invalidate();
+  }
+
+  async verify(): Promise<void> {
+    if (this.#disposed) throw new Error("Registered window inventory is disposed");
+    if (this.#current) return;
+    if (this.#read) return this.#read.promise;
+    const epoch = this.#epoch;
+    const abort = new AbortController();
+    const promise = Promise.resolve()
+      .then(async () => {
+        abort.signal.throwIfAborted();
+        const rows = await this.reader(abort.signal);
+        abort.signal.throwIfAborted();
+        if (epoch !== this.#epoch) throw new Error("Window ownership changed during discovery");
+        const owners = new Map<string, Set<string>>();
+        for (const row of rows) {
+          const sessions = owners.get(row.window) ?? new Set<string>();
+          sessions.add(row.session);
+          owners.set(row.window, sessions);
+        }
+        this.#conflicts = new Set(
+          [...owners.values()]
+            .filter((sessions) => sessions.size > 1)
+            .flatMap((sessions) => [...sessions]),
+        );
+        this.#current = true;
+      })
+      .finally(() => {
+        if (this.#read?.abort === abort) this.#read = null;
+      });
+    this.#read = { abort, promise };
+    return promise;
+  }
+}