tmux-ide 2.9.2 → 2.9.3

package/packages/daemon/dist/lib/daemon-service.js

@@ -0,0 +1,259 @@
+import { accessSync, constants, openSync, closeSync, fstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, renameSync, rmSync, realpathSync, linkSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { z } from "zod";
+import { getCanonicalDaemonInfoPath, inspectCanonicalDaemonInfo, probeCanonicalDaemonIdentity, releaseCanonicalDaemonSupervision, reserveCanonicalDaemonSupervision, } from "./canonical-daemon.js";
+import { createDaemonServiceManager } from "./daemon-service-manager.js";
+import { planDaemonService } from "./daemon-service-plan.js";
+import { resolveRuntimeNamespace } from "./runtime-namespace.js";
+import { IdeError } from "./errors.js";
+import { acquirePrivateOperationLock } from "./private-operation-lock.js";
+const RecordSchema = z.strictObject({
+    version: z.literal(1),
+    removing: z.boolean().optional(),
+    executable: z.string().min(1),
+    contents: z
+        .string()
+        .min(1)
+        .max(64 * 1024),
+});
+function defaults() {
+    const namespace = resolveRuntimeNamespace();
+    return {
+        plan: (executable) => planDaemonService({
+            platform: process.platform,
+            uid: process.getuid?.() ?? 0,
+            home: homedir(),
+            configHome: process.env.XDG_CONFIG_HOME || undefined,
+            executable,
+            path: process.env.PATH || "/usr/bin:/bin",
+            namespace,
+        }),
+        manager: createDaemonServiceManager,
+        inspect: inspectCanonicalDaemonInfo,
+        reserve: reserveCanonicalDaemonSupervision,
+        release: releaseCanonicalDaemonSupervision,
+        probe: probeCanonicalDaemonIdentity,
+        recordPath: join(dirname(getCanonicalDaemonInfoPath()), "service.json"),
+        waitMs: 30_000,
+    };
+}
+function refused(message) {
+    throw new IdeError(message, { code: "DAEMON_SERVICE_REFUSED" });
+}
+function ownedFile(path) {
+    let descriptor;
+    try {
+        descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const stat = fstatSync(descriptor);
+        if (!stat.isFile() ||
+            stat.uid !== process.getuid?.() ||
+            (stat.mode & 0o022) !== 0 ||
+            stat.size > 128 * 1024)
+            refused(`Service file is not a bounded, user-owned regular file: ${path}`);
+        return readFileSync(descriptor, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+function boundTo(state, id) {
+    return state.status === "reserved"
+        ? state.reservation.supervisionId === id
+        : state.status === "valid" && state.info.supervisionId === id;
+}
+/** Explicit OS supervision. Never starts a detached daemon or signals a guessed PID. */
+export async function manageDaemonService(action, executable, deps = defaults()) {
+    const previousRecord = ownedFile(deps.recordPath);
+    const record = previousRecord === null ? null : RecordSchema.parse(JSON.parse(previousRecord));
+    if (record?.removing && action !== "remove" && action !== "status")
+        refused("Service removal is incomplete; finish remove before installing or restarting");
+    if (!record && action !== "install") {
+        if (action === "status")
+            return { status: "not-installed" };
+        refused("No managed service is installed in this daemon namespace");
+    }
+    if (action === "install" && !executable)
+        refused("Service installation requires an absolute stable CLI launcher path");
+    if (record && executable && record.executable !== executable)
+        refused("A different launcher is already registered; remove the stopped service before changing it");
+    const plan = deps.plan(record?.executable ?? executable);
+    if (plan.recordPath !== deps.recordPath)
+        refused("Service namespace changed during resolution");
+    const contents = record?.contents ?? plan.contents;
+    const manager = deps.manager(plan);
+    const assertFiles = (allowMissingUnit = false) => {
+        const unit = ownedFile(plan.unitPath);
+        if (unit !== contents && !((record?.removing || allowMissingUnit) && unit === null))
+            refused("Service definition is missing or modified; refusing to control it");
+        if (record && ownedFile(plan.recordPath) !== previousRecord)
+            refused("Service ownership record changed");
+    };
+    const inspectManager = async () => {
+        const state = await manager.inspect();
+        // systemd reports its generated search-path symlink for units enabled by
+        // absolute path. Resolve that link to the owned definition; the definition
+        // itself still has to pass our no-follow private-file and content checks.
+        if (state.loaded &&
+            (!state.definitionPath || realpathSync(state.definitionPath) !== realpathSync(plan.unitPath)))
+            refused("The service manager loaded a different definition; refusing to control it");
+        return state;
+    };
+    const ready = async (previousInstance) => {
+        const deadline = Date.now() + deps.waitMs;
+        do {
+            const state = deps.inspect();
+            if (!boundTo(state, plan.supervisionId))
+                refused("Service reservation changed during startup");
+            if (state.status === "valid" && state.info.instanceId !== previousInstance) {
+                const identity = await deps.probe(state.info);
+                const service = await inspectManager();
+                if (identity &&
+                    service.active &&
+                    service.pid === state.info.pid &&
+                    identity.pid === state.info.pid &&
+                    identity.instanceId === state.info.instanceId &&
+                    identity.startedAt === state.info.startedAt &&
+                    identity.protocolVersion === state.info.protocolVersion)
+                    return {
+                        status: "running",
+                        manager: plan.manager,
+                        target: plan.target,
+                        pid: state.info.pid,
+                        instanceId: state.info.instanceId,
+                    };
+            }
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        } while (Date.now() < deadline);
+        refused("Service did not publish a verified daemon before the deadline; inspect service logs, then retry restart or remove");
+    };
+    await manager.available();
+    const service = await inspectManager();
+    const allowMissingUnit = action === "remove" && !service.loaded;
+    if (record)
+        assertFiles(allowMissingUnit);
+    if (action === "status") {
+        const state = deps.inspect();
+        const identity = service.active && state.status === "valid" && boundTo(state, plan.supervisionId)
+            ? await deps.probe(state.info)
+            : null;
+        const verified = identity !== null &&
+            state.status === "valid" &&
+            service.pid === state.info.pid &&
+            identity.pid === state.info.pid &&
+            identity.instanceId === state.info.instanceId &&
+            identity.startedAt === state.info.startedAt &&
+            identity.protocolVersion === state.info.protocolVersion;
+        return {
+            status: verified
+                ? "running"
+                : service.active
+                    ? "active-unverified"
+                    : "stopped",
+            manager: plan.manager,
+            target: plan.target,
+            pid: service.pid,
+            reservationMatches: boundTo(state, plan.supervisionId),
+            unitPath: plan.unitPath,
+        };
+    }
+    if (!record && (service.loaded || ownedFile(plan.unitPath) !== null))
+        refused("A service definition already exists without this namespace's ownership record");
+    if (record &&
+        !boundTo(deps.inspect(), plan.supervisionId) &&
+        !(record.removing && action === "remove" && deps.inspect().status === "missing"))
+        refused("Service reservation is missing or belongs to another owner");
+    if (!record) {
+        accessSync(plan.executable, constants.X_OK);
+        // Canonical reservation admission rejects live, uncertain and foreign owners.
+        deps.reserve(plan.supervisionId);
+    }
+    const lock = `${plan.recordPath}.lock`;
+    const releaseLock = await acquirePrivateOperationLock(lock, 1000);
+    let wroteRecord = false;
+    let wroteUnit = false;
+    let activationAttempted = false;
+    try {
+        if (record)
+            assertFiles(allowMissingUnit);
+        if (action === "install" && !record) {
+            writeFileSync(plan.recordPath, JSON.stringify({ version: 1, executable: plan.executable, contents }) + "\n", { flag: "wx", mode: 0o600 });
+            wroteRecord = true;
+            mkdirSync(dirname(plan.unitPath), { recursive: true, mode: 0o700 });
+            const unitStage = `${plan.unitPath}.${randomUUID()}.tmp`;
+            writeFileSync(unitStage, contents, { flag: "wx", mode: 0o600 });
+            try {
+                linkSync(unitStage, plan.unitPath);
+            }
+            finally {
+                unlinkSync(unitStage);
+            }
+            wroteUnit = true;
+            activationAttempted = true;
+            await manager.install();
+            return await ready();
+        }
+        if (action === "remove") {
+            if (service.loaded)
+                await manager.stop();
+            let stopped = await inspectManager();
+            const stopDeadline = Date.now() + deps.waitMs;
+            while ((stopped.active || stopped.pid !== null) && Date.now() < stopDeadline) {
+                await new Promise((resolve) => setTimeout(resolve, 100));
+                stopped = await inspectManager();
+            }
+            if (stopped.active || stopped.pid !== null)
+                refused("Service manager has not confirmed the daemon stopped; reservation retained");
+            assertFiles(allowMissingUnit);
+            const removalRecord = JSON.stringify({ ...record, removing: true }) + "\n";
+            const temporaryRecord = `${plan.recordPath}.${randomUUID()}.tmp`;
+            writeFileSync(temporaryRecord, removalRecord, { flag: "wx", mode: 0o600 });
+            try {
+                if (ownedFile(plan.recordPath) !== previousRecord)
+                    refused("Service ownership record changed during removal");
+                renameSync(temporaryRecord, plan.recordPath);
+            }
+            finally {
+                rmSync(temporaryRecord, { force: true });
+            }
+            if (ownedFile(plan.unitPath) !== null)
+                unlinkSync(plan.unitPath);
+            await manager.reload();
+            if ((await inspectManager()).loaded)
+                refused("Service remains loaded after removal; reservation retained");
+            if (deps.inspect().status !== "missing")
+                deps.release(plan.supervisionId);
+            unlinkSync(plan.recordPath);
+            return { status: "removed", target: plan.target };
+        }
+        const before = deps.inspect();
+        if (action === "install" && service.active)
+            return await ready();
+        if (service.loaded)
+            await manager.restart(service.pid !== null);
+        else
+            await manager.install();
+        return await ready(before.status === "valid" ? before.info.instanceId : undefined);
+    }
+    catch (error) {
+        // Never discard ownership after an uncertain OS activation. The retained
+        // record/reservation gives the explicit remove/restart commands a recovery path.
+        if (!activationAttempted && wroteRecord) {
+            if (wroteUnit && ownedFile(plan.unitPath) === contents)
+                unlinkSync(plan.unitPath);
+            unlinkSync(plan.recordPath);
+            deps.release(plan.supervisionId);
+        }
+        throw error;
+    }
+    finally {
+        releaseLock();
+    }
+}

package/packages/daemon/dist/lib/install-origin.js

@@ -3,6 +3,8 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 /** Conservative layout evidence; an arbitrary node_modules directory is not a global install. */
 export function detectPackageManager(path) {
+    if (/\/share\/tmux-ide\/releases\/install-[^/]+\/npm\/lib\/node_modules\/tmux-ide\/bin$/.test(path))
+        return "installer";
     if (/\/(?:Cellar|Caskroom)\//.test(path))
         return "homebrew";
     if (/\/_npx\//.test(path))

package/packages/daemon/dist/lib/local-fleet-request.js

@@ -1,22 +1,28 @@
-import { SavedMachineRegistrySchema } from "@tmux-ide/contracts/saved-machines";
+import { SavedMachineRegistrySchema, SavedMachineMutationSchema, } from "@tmux-ide/contracts/saved-machines";
 import { canonicalDaemonUrl, isCanonicalDaemonAlive, readCanonicalDaemonInfo, } from "./canonical-daemon.js";
 /** Intentional local registry mutation. Never uses selected-machine authority. */
 export async function saveMachineProfiles(machines) {
     const registry = SavedMachineRegistrySchema.parse({ version: 1, machines });
+    return writeLocalMachineRegistry("POST", { registry });
+}
+export async function mutateMachineProfile(change) {
+    return writeLocalMachineRegistry("PATCH", { change: SavedMachineMutationSchema.parse(change) });
+}
+async function writeLocalMachineRegistry(method, payload) {
     const daemon = readCanonicalDaemonInfo();
     if (!daemon?.authToken || !(await isCanonicalDaemonAlive(daemon)))
         throw new Error("Start a local tmux-ide daemon to save machine profiles.");
     try {
         const response = await fetch(canonicalDaemonUrl("http", daemon.bindHostname, daemon.port) +
             "/api/resources/saved-machines", {
-            method: "POST",
+            method,
             redirect: "error",
             signal: AbortSignal.timeout(5000),
             headers: {
                 Authorization: `Bearer ${daemon.authToken}`,
                 "Content-Type": "application/json",
             },
-            body: JSON.stringify({ expectedInstanceId: daemon.instanceId, registry }),
+            body: JSON.stringify({ expectedInstanceId: daemon.instanceId, ...payload }),
         });
         if (!response.ok) {
             await response.body?.cancel();

package/packages/daemon/dist/lib/log.js

@@ -86,17 +86,13 @@ function markStreamFailed(name, error) {
     if (streamState[name].failed)
         return;
     streamState[name].failed = true;
-    const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+    const detail = sanitizeLogMessage(error instanceof Error ? `${error.name}: ${error.message}` : String(error), secrets, budget);
     const warning = `[log.ts] ${name} write failed (${detail}); further records are retained in memory only\n`;
     const other = name === "stdout" ? "stderr" : "stdout";
-    if (!streamState[other].failed) {
-        try {
-            process[other].write(warning);
-        }
-        catch {
-            streamState[other].failed = true;
-        }
-    }
+    // The fallback can fail asynchronously too. Install the same error handling
+    // before writing it; failed flags prevent a warning loop if both streams fail.
+    if (!streamState[other].failed)
+        writeToStream(other, warning);
 }
 function writeToStream(name, line) {
     const state = streamState[name];
@@ -150,7 +146,7 @@ function writeStructuredLog(level, component, message, data) {
         }
         catch (err) {
             // Avoid recursion via the logger; write directly to stderr.
-            writeToStream("stderr", `[log.ts] subscriber threw: ${err instanceof Error ? err.message : String(err)}\n`);
+            writeToStream("stderr", `[log.ts] subscriber threw: ${sanitizeLogMessage(err instanceof Error ? err.message : String(err), secrets, budget)}\n`);
         }
     }
     // Stream form for humans tailing the process. The data field is

package/packages/daemon/dist/lib/managed-installer-update.js

@@ -0,0 +1,67 @@
+import { mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+import { execFileSync } from "node:child_process";
+export const MANAGED_INSTALLER_URL = "https://tmux-ide.com/install.sh";
+/** Only the active release of a marked installation may update its prefix. */
+export function managedInstallerPrefix(cliPath) {
+    const match = /^(.*)\/share\/tmux-ide\/releases\/(install-[A-Za-z0-9]{6})\/npm\/lib\/node_modules\/tmux-ide\/bin$/.exec(cliPath);
+    if (!match)
+        return null;
+    const prefix = match[1] || "/";
+    const root = join(prefix, "share/tmux-ide");
+    const release = join(root, "releases", match[2]);
+    try {
+        if (realpathSync(join(root, "current")) !== release)
+            return null;
+        if (realpathSync(release) !== release)
+            return null;
+        if (readFileSync(join(root, "installer-v1"), "utf8") !== "1\n")
+            return null;
+        if (readFileSync(join(release, ".installer-release-v1"), "utf8") !== "1\n")
+            return null;
+        if (!readFileSync(join(prefix, "bin/tmux-ide"), "utf8")
+            .split("\n")
+            .includes("# tmux-ide universal installer v1"))
+            return null;
+        if (JSON.parse(readFileSync(join(dirname(cliPath), "package.json"), "utf8")).name !== "tmux-ide")
+            return null;
+        return prefix;
+    }
+    catch {
+        return null;
+    }
+}
+/** Download completely before execution; the canonical installer owns activation and rollback. */
+export function runManagedInstallerUpdate(prefix, channel, json, execute = execFileSync) {
+    const temporary = mkdtempSync(join(tmpdir(), "tmux-ide-update-"));
+    const script = join(temporary, "install.sh");
+    try {
+        execute("curl", [
+            "--fail",
+            "--location",
+            "--silent",
+            "--show-error",
+            "--proto",
+            "=https",
+            "--proto-redir",
+            "=https",
+            "--connect-timeout",
+            "15",
+            "--max-time",
+            "180",
+            "--output",
+            script,
+            MANAGED_INSTALLER_URL,
+        ], { stdio: ["ignore", 2, 2] });
+        if (!readFileSync(script, "utf8").startsWith("#!/bin/sh\n"))
+            throw new Error("Installer download was not a shell script; installation unchanged");
+        execute("/bin/sh", ["-n", script], { stdio: ["ignore", 2, 2] });
+        execute("/bin/sh", [script, "--prefix", prefix, "--version", channel], {
+            stdio: json ? ["ignore", 2, 2] : "inherit",
+        });
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+}

package/packages/daemon/dist/lib/{tui-download-lock.js → private-operation-lock.js}

@@ -10,7 +10,7 @@ function trusted(path, directory) {
         value.uid !== process.getuid?.() ||
         (value.mode & 0o777) !== (directory ? 0o700 : 0o600) ||
         (!directory && value.nlink !== 1))
-        throw new Error("unsafe TUI download lock");
+        throw new Error("unsafe private operation lock");
     return value;
 }
 function readOwner(path) {
@@ -19,16 +19,16 @@ function readOwner(path) {
     try {
         const actual = fstatSync(fd);
         if (actual.ino !== before.ino || actual.dev !== before.dev || actual.size > 32) {
-            throw new Error("unsafe TUI download lock");
+            throw new Error("unsafe private operation lock");
         }
         const bytes = Buffer.alloc(33);
         const length = readSync(fd, bytes, 0, bytes.length, 0);
         const text = bytes.subarray(0, length).toString("utf8");
         if (!/^[1-9][0-9]*\n$/.test(text))
-            throw new Error("invalid TUI download lock owner");
+            throw new Error("invalid private operation lock owner");
         const pid = Number(text.trim());
         if (!Number.isSafeInteger(pid) || pid > 2147483647)
-            throw new Error("invalid TUI download lock owner");
+            throw new Error("invalid private operation lock owner");
         return { pid, ino: actual.ino, dev: actual.dev };
     }
     finally {
@@ -76,7 +76,7 @@ function cleanStaging(path, name, expected, failed) {
     try {
         const current = trusted(path, true);
         if (current.ino !== expected.ino || current.dev !== expected.dev)
-            throw new Error("TUI download staging lock changed");
+            throw new Error("private operation staging lock changed");
         try {
             unlinkSync(join(path, name));
         }
@@ -93,7 +93,7 @@ function cleanStaging(path, name, expected, failed) {
     }
 }
 /** Publish a populated private directory atomically; age never proves owner death. */
-export async function acquireTuiDownloadLock(lock, waitMs) {
+export async function acquirePrivateOperationLock(lock, waitMs) {
     const deadline = Date.now() + waitMs;
     const nonce = randomUUID();
     const name = `owner-${nonce}`;
@@ -107,7 +107,7 @@ export async function acquireTuiDownloadLock(lock, waitMs) {
         writeFileSync(join(staging, name), `${process.pid}\n`, { flag: "wx", mode: 0o600 });
         while (true) {
             if (attempted && Date.now() >= deadline)
-                throw new Error("timed out waiting for another TUI download");
+                throw new Error("timed out waiting for another private operation");
             attempted = true;
             try {
                 const existing = lstatSync(lock);
@@ -152,7 +152,7 @@ export async function acquireTuiDownloadLock(lock, waitMs) {
                     if (names.length !== 1 || !/^owner-[0-9a-f-]{36}$/.test(names[0])) {
                         // Empty is only a retirement gap; the next atomic rename can claim it.
                         if (names.length !== 0)
-                            throw new Error("invalid TUI download lock inventory");
+                            throw new Error("invalid private operation lock inventory");
                     }
                     else {
                         const owner = readOwner(join(lock, names[0]));
@@ -161,7 +161,7 @@ export async function acquireTuiDownloadLock(lock, waitMs) {
                             if (current.ino !== owner.ino ||
                                 current.dev !== owner.dev ||
                                 current.pid !== owner.pid) {
-                                throw new Error("TUI download lock changed");
+                                throw new Error("private operation lock changed");
                             }
                             retire(lock, names[0], entry);
                         }
@@ -178,7 +178,7 @@ export async function acquireTuiDownloadLock(lock, waitMs) {
                         if (current.ino !== owner.ino ||
                             current.dev !== owner.dev ||
                             current.pid !== owner.pid) {
-                            throw new Error("TUI download lock changed");
+                            throw new Error("private operation lock changed");
                         }
                         try {
                             unlinkSync(lock);
@@ -195,7 +195,7 @@ export async function acquireTuiDownloadLock(lock, waitMs) {
                     throw error;
             }
             if (Date.now() >= deadline)
-                throw new Error("timed out waiting for another TUI download");
+                throw new Error("timed out waiting for another private operation");
             await new Promise((resolve) => setTimeout(resolve, Math.min(50, Math.max(0, deadline - Date.now()))));
         }
     }

package/packages/daemon/dist/lib/remote-daemon-info.js

@@ -1,3 +1,4 @@
+import { DAEMON_WIRE_PROTOCOL_VERSION } from "@tmux-ide/contracts";
 import { canonicalDaemonUrl, isCanonicalDaemonAlive, readCanonicalDaemonInfo, } from "./canonical-daemon.js";
 import { probeSshDaemonIdentity, RemoteDaemonHandshakeSchema, RemoteDaemonHandshakeFailureSchema, } from "./ssh-daemon-transport.js";
 class RemoteDaemonInfoError extends Error {
@@ -13,8 +14,8 @@ export async function readRemoteDaemonHandshake(dependencies = {}) {
     if (!info || !(await (dependencies.isAlive ?? isCanonicalDaemonAlive)(info)))
         throw new RemoteDaemonInfoError("No running tmux-ide daemon. Start tmux-ide on this machine first.", "daemon-missing");
     const parsed = RemoteDaemonHandshakeSchema.safeParse({ version: 1, daemon: info });
-    if (!parsed.success)
-        throw new RemoteDaemonInfoError("The daemon does not support authenticated SSH discovery.", "incompatible");
+    if (!parsed.success || info.protocolVersion !== DAEMON_WIRE_PROTOCOL_VERSION)
+        throw new RemoteDaemonInfoError("The daemon does not support this authenticated SSH discovery protocol.", "incompatible");
     try {
         if (!(await probeSshDaemonIdentity(canonicalDaemonUrl("http", info.bindHostname, info.port), parsed.data.daemon, AbortSignal.timeout(3_000), dependencies.request ?? fetch)))
             throw new Error("Identity changed");

package/packages/daemon/dist/lib/remote-daemon-lifecycle.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { SavedMachineSchema } from "@tmux-ide/contracts/saved-machines";
+import { remoteTmuxIdeCommand } from "./remote-tmux-command.js";
 /** Only explicit user actions call this; catalog discovery and retries never do. */
 export async function startInstalledRemoteDaemon(alias, options = {}) {
     SavedMachineSchema.shape.sshTarget.parse(alias);
@@ -16,12 +17,11 @@ export async function startInstalledRemoteDaemon(alias, options = {}) {
             "BatchMode=yes",
             "-o",
             "ConnectTimeout=10",
+            "-o",
+            "ForkAfterAuthentication=no",
             "--",
             alias,
-            "tmux-ide",
-            "update",
-            "--daemon",
-            "--json",
+            remoteTmuxIdeCommand("start"),
         ], { stdio: ["ignore", "pipe", "pipe"] });
         let settled = false;
         let force;

package/packages/daemon/dist/lib/remote-tmux-command.js

@@ -0,0 +1,10 @@
+import { shellEscape } from "./shell.js";
+/** Fixed commands only. SSH normally omits interactive shell PATH setup. */
+export function remoteTmuxIdeCommand(operation) {
+    const args = operation === "discover" ? "remote-daemon-info --json" : "update --daemon --json";
+    // Respect the host's existing installation preference, then try the installer
+    // and common package-manager prefixes. Never source shell profiles.
+    const script = 'export PATH="${PATH:-/usr/bin:/bin}:$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin:/home/linuxbrew/.linuxbrew/bin:$HOME/.npm-global/bin"; ' +
+        `exec tmux-ide ${args}`;
+    return `/bin/sh -c ${shellEscape(script)}`;
+}

package/packages/daemon/dist/lib/runtime-namespace.js

@@ -37,35 +37,36 @@ function absolutePath(value, cwd, key) {
         throw new TypeError(`${key} must resolve to an absolute path`);
     return path;
 }
-function pathEntryExists(path) {
+function pathEntryStat(path) {
     try {
-        lstatSync(path);
-        return true;
+        return lstatSync(path);
     }
     catch (error) {
         if (error.code === "ENOENT")
-            return false;
+            return undefined;
         throw error;
     }
 }
 function pathIdentity(path) {
     let cursor = resolve(path);
     const suffix = [];
-    while (!pathEntryExists(cursor)) {
+    let stat = pathEntryStat(cursor);
+    while (!stat) {
         const parent = dirname(cursor);
         if (parent === cursor)
             break;
         suffix.unshift(basename(cursor));
         cursor = parent;
+        stat = pathEntryStat(cursor);
     }
-    if (pathEntryExists(cursor) && lstatSync(cursor).isSocket()) {
+    if (stat?.isSocket()) {
         return resolve(captureUnixSocketIdentity(cursor).path, ...suffix);
     }
-    return resolve(pathEntryExists(cursor) ? realpathSync(cursor) : cursor, ...suffix);
+    return resolve(stat ? realpathSync(cursor) : cursor, ...suffix);
 }
-function isInsideOrEqual(path, parent) {
-    const child = pathIdentity(path);
-    const root = pathIdentity(parent);
+function isInsideOrEqual(path, parent, identity = pathIdentity) {
+    const child = identity(path);
+    const root = identity(parent);
     const offset = relative(root, child);
     return offset === "" || (!offset.startsWith(`..${sep}`) && offset !== "..");
 }
@@ -77,6 +78,18 @@ function runtimeMode(env) {
     return raw;
 }
 export function resolveRuntimeNamespace(options = {}) {
+    // Reuse a path's identity only within this synchronous resolution. Every
+    // subsequent resolution must see new ancestors and replaced symlinks.
+    let identities;
+    const identity = (path) => {
+        const cached = identities?.get(path);
+        if (cached !== undefined)
+            return cached;
+        const resolved = pathIdentity(path);
+        (identities ??= new Map()).set(path, resolved);
+        return resolved;
+    };
+    const within = (path, parent) => isInsideOrEqual(path, parent, identity);
     const env = options.env ?? process.env;
     const userHome = options.userHome ?? homedir();
     const cwd = options.cwd ?? process.cwd();
@@ -141,14 +154,13 @@ export function resolveRuntimeNamespace(options = {}) {
     if (isolated && tmuxSocket.kind === "name" && tmuxSocket.name === "default") {
         throw new TypeError(`${mode} runtime requires a non-default ${TMUX_SOCKET_NAME_ENV}`);
     }
-    if (isolated && isInsideOrEqual(stateHome, canonicalHome)) {
+    if (isolated && within(stateHome, canonicalHome)) {
         throw new TypeError(`${mode} runtime cannot use the canonical tmux-ide state home`);
     }
-    if (isolated &&
-        (isInsideOrEqual(registryDir, canonicalHome) || isInsideOrEqual(daemonInfoDir, canonicalHome))) {
+    if (isolated && (within(registryDir, canonicalHome) || within(daemonInfoDir, canonicalHome))) {
         throw new TypeError(`${mode} runtime cannot use canonical registry or daemon state`);
     }
-    if (isolated && tmuxSocket.kind === "path" && isInsideOrEqual(tmuxSocket.path, canonicalHome)) {
+    if (isolated && tmuxSocket.kind === "path" && within(tmuxSocket.path, canonicalHome)) {
         throw new TypeError(`${mode} runtime cannot use a tmux socket inside canonical state`);
     }
     if (isolated && cleanupToken === null) {
@@ -161,7 +173,7 @@ export function resolveRuntimeNamespace(options = {}) {
         const value = (key === "TMUX_IDE_CONFIG" || key === "TMUX_IDE_SETTINGS_DIR"
             ? env[key]
             : nonEmpty(env, key)) ?? fallback;
-        if (development && (!isAbsolute(value) || !isInsideOrEqual(value, development.root)))
+        if (development && (!isAbsolute(value) || !within(value, development.root)))
             throw new TypeError(`development ${key} escapes instance`);
         return value;
     };
@@ -191,7 +203,7 @@ export function resolveRuntimeNamespace(options = {}) {
                 scoped(key, "");
         if (env.TMUX) {
             const socket = /^(.*),[0-9]+,[0-9]+$/u.exec(env.TMUX)?.[1];
-            if (!socket || pathIdentity(socket) !== pathIdentity(join(runtimeDir, "tmux.sock")))
+            if (!socket || identity(socket) !== identity(join(runtimeDir, "tmux.sock")))
                 throw new TypeError("development rejects inherited foreign TMUX authority");
         }
     }