tmux-ide 2.9.2 → 2.9.3

package/packages/daemon/dist/lib/saved-machines.js

@@ -1,7 +1,7 @@
 import { runtimeOwnedPath } from "./runtime-namespace.js";
 import { randomUUID } from "node:crypto";
-import { closeSync, fstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
-import { dirname, join } from "node:path";
+import { closeSync, fstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, watch, } from "node:fs";
+import { basename, dirname, join } from "node:path";
 import { SavedMachineRegistrySchema } from "@tmux-ide/contracts";
 import { changeSavedMachines } from "@tmux-ide/core";
 import { resolveRuntimeNamespace } from "./runtime-namespace.js";
@@ -29,6 +29,44 @@ export function loadSavedMachines(path = savedMachinesPath()) {
         closeSync(fd);
     }
 }
+/** Watch the directory so atomic registry replacement does not detach the watcher. */
+export function watchSavedMachines(onChange, onError, path = savedMachinesPath()) {
+    let stopped = false;
+    let pending = null;
+    const refresh = () => {
+        pending = null;
+        if (stopped)
+            return;
+        try {
+            onChange(loadSavedMachines(path));
+        }
+        catch {
+            // Keep the last valid routes while an editor is midway through a write.
+            onError();
+        }
+    };
+    // A first-run app can subscribe before the daemon creates its registry.
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const watcher = watch(dirname(path), (_event, file) => {
+        if (stopped || (file !== null && file.toString() !== basename(path)))
+            return;
+        if (pending)
+            clearTimeout(pending);
+        pending = setTimeout(refresh, 50);
+        pending.unref();
+    });
+    watcher.unref();
+    watcher.on("error", onError);
+    // Close the read-before-subscribe race at startup.
+    pending = setTimeout(refresh, 0);
+    pending.unref();
+    return () => {
+        stopped = true;
+        if (pending)
+            clearTimeout(pending);
+        watcher.close();
+    };
+}
 /** The daemon owns writes. Synchronous read/reduce/rename cannot interleave within it. */
 export function updateSavedMachines(change, path = savedMachinesPath()) {
     const registry = changeSavedMachines(loadSavedMachines(path), change);

package/packages/daemon/dist/lib/ssh-daemon-transport.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { createServer } from "node:net";
 import { z } from "zod";
+import { remoteTmuxIdeCommand } from "./remote-tmux-command.js";
 import { createSshDaemonRelay } from "./ssh-daemon-relay.js";
 import { CanonicalDaemonInfoSchema, DAEMON_WIRE_PROTOCOL_VERSION, DaemonIdentitySchema, SavedMachineSchema, DesktopDaemonCapabilitiesResultSchemaZ, } from "@tmux-ide/contracts";
 /** The remote CLI emits this over SSH stdout; it must never be logged or persisted. */
@@ -24,12 +25,29 @@ export class SshConnectionError extends Error {
         this.code = code;
     }
     get retryable() {
-        return this.code === "unavailable";
+        // A supervisor may temporarily remove the record while replacing its daemon.
+        return this.code === "unavailable" || this.code === "daemon-missing";
     }
 }
 function failure(message, code = "unavailable") {
     return new SshConnectionError(message, code);
 }
+/** Classify known OpenSSH errors without publishing remote stderr or credentials. */
+function observeSshFailure(child) {
+    let tail = "";
+    let code = "unavailable";
+    child.stderr?.on("data", (chunk) => {
+        tail = (tail + chunk.toString("utf8")).slice(-4096);
+        if (/Host key verification failed|REMOTE HOST IDENTIFICATION HAS CHANGED/i.test(tail))
+            code = "ssh-host-key";
+        else if (/Permission denied \((?:publickey|password|keyboard-interactive)[^)]*\)/i.test(tail))
+            code = "ssh-authentication";
+    });
+    child.once("close", () => {
+        tail = "";
+    });
+    return () => code;
+}
 const stoppedChildren = new WeakSet();
 function stop(child) {
     if (stoppedChildren.has(child) || child.exitCode !== null || child.signalCode !== null)
@@ -119,6 +137,7 @@ const defaults = {
     probe: probeSshDaemonIdentity,
 };
 function discover(child, signal) {
+    const sshFailure = observeSshFailure(child);
     return new Promise((resolve, reject) => {
         const chunks = [];
         let bytes = 0;
@@ -147,14 +166,12 @@ function discover(child, signal) {
             }
             chunks.push(Buffer.from(chunk));
         });
-        // Drain without capturing: SSH banners/errors may contain confidential remote information.
-        child.stderr?.resume();
         child.once("error", () => finish(failure("could not start OpenSSH")));
         child.once("close", (code) => {
             if (settled)
                 return;
             if (code !== 0) {
-                finish(failure("discovery failed; check SSH authentication, host trust, and remote tmux-ide installation"));
+                finish(failure("discovery failed; check SSH authentication, host trust, and remote tmux-ide installation", code === 127 ? "remote-cli-missing" : sshFailure()));
                 return;
             }
             try {
@@ -234,9 +251,7 @@ export async function openSshDaemonTransport(options, dependencies = defaults) {
             "ForkAfterAuthentication=no",
             "--",
             options.alias,
-            "tmux-ide",
-            "remote-daemon-info",
-            "--json",
+            remoteTmuxIdeCommand("discover"),
         ]);
         const daemon = await discover(child, signal);
         const port = await cancellable(dependencies.allocatePort(), signal);
@@ -276,7 +291,7 @@ export async function openSshDaemonTransport(options, dependencies = defaults) {
             options.alias,
         ]);
         child.stdout?.resume();
-        child.stderr?.resume();
+        const sshFailure = observeSshFailure(child);
         child.once("exit", dispose);
         const tunnelClosed = new Promise((resolve) => {
             child.once("close", () => {
@@ -312,7 +327,7 @@ export async function openSshDaemonTransport(options, dependencies = defaults) {
             }
             await delay(signal);
         }
-        throw failure("tunnel could not authenticate the expected daemon before cancellation or timeout");
+        throw failure("tunnel could not authenticate the expected daemon before cancellation or timeout", sshFailure());
     }
     catch (error) {
         dispose();

package/packages/daemon/dist/lib/tmux-server-owner.js

@@ -198,7 +198,7 @@ export async function createNativeTmuxServerOwner(options) {
                 if (intent.verb === "workspace.window.link.select" ||
                     intent.verb === "workspace.window.link.unlink" ||
                     intent.verb === "workspace.pane.select") {
-                    return multiplexer.mutateWindowLink({ operationId, expectedDaemonInstanceId: generation, intent }, (session, action) => sessionRuntimeRegistry.executeWindowLinkAction(session, action));
+                    return multiplexer.mutateWindowLink({ operationId, expectedDaemonInstanceId: generation, intent }, (session, action) => sessionRuntimeRegistry.executeWindowLinkAction(session, action), timing);
                 }
                 if (intent.verb === "workspace.pane.resize") {
                     return multiplexer.mutateResize({ operationId, expectedDaemonInstanceId: generation, intent }, (session) => {

package/packages/daemon/dist/lib/tmux-server-registration.js

@@ -53,12 +53,30 @@ export function createTmuxServerProbe(executable) {
         const args = selector.kind === "path" ? ["-S", selector.path] : ["-L", selector.name];
         const read = async (selection) => (await exec(executablePath, [...selection, "-N", "display-message", "-p", "#{socket_path}|#{pid}|#{start_time}"], { env, encoding: "utf8", timeout: 500, maxBuffer: 8192 })).stdout.trimEnd();
         try {
-            const first = await read(args);
+            // A direct socket can be pinned before contacting tmux. Named servers
+            // and aliases still need discovery followed by an explicit-path proof.
+            let pinned = null;
+            if (selector.kind === "path") {
+                try {
+                    pinned = captureUnixSocketIdentity(selector.path);
+                }
+                catch {
+                    // Preserve discovery for aliases which are not direct socket paths.
+                }
+            }
+            const first = await read(pinned ? ["-S", pinned.path] : args);
             const match = /^(.*)\|([1-9][0-9]*)\|([1-9][0-9]*)$/u.exec(first);
             if (!match)
                 return null;
-            const socket = captureUnixSocketIdentity(match[1]);
-            if ((await read(["-S", socket.path])) !== first)
+            const reportedSocket = captureUnixSocketIdentity(match[1]);
+            const socket = pinned ?? reportedSocket;
+            if (pinned) {
+                if (reportedSocket.path !== pinned.path ||
+                    reportedSocket.dev !== pinned.dev ||
+                    reportedSocket.ino !== pinned.ino)
+                    return null;
+            }
+            else if ((await read(["-S", socket.path])) !== first)
                 return null;
             revalidateUnixSocketIdentity(socket);
             return {

package/packages/daemon/dist/lib/tui-binary.js

@@ -17,7 +17,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { accessSync, chmodSync, constants as fsConstants, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { gunzipSync } from "node:zlib";
-import { acquireTuiDownloadLock } from "./tui-download-lock.js";
+import { acquirePrivateOperationLock } from "./private-operation-lock.js";
 import { getCurrentVersion } from "./update-check.js";
 /** The GitHub repo the release assets live under. */
 export const RELEASE_REPO = "wavyrai/tmux-ide";
@@ -274,7 +274,7 @@ export async function downloadTuiBinary(opts = {}) {
         timeoutMs: opts.timeoutMs ?? TUI_DOWNLOAD_TIMEOUT_MS,
     };
     mkdirSync(dirname(dest), { recursive: true });
-    const releaseLock = await acquireTuiDownloadLock(downloadLockPath(dest), limits.timeoutMs * 2 + 5_000);
+    const releaseLock = await acquirePrivateOperationLock(downloadLockPath(dest), limits.timeoutMs * 2 + 5_000);
     const suffix = `${process.pid}.${randomUUID()}.tmp`;
     const binaryTmp = `${dest}.${suffix}`;
     const checksumTmp = `${checksumPath(dest)}.${suffix}`;

package/packages/daemon/dist/lib/update.js

@@ -1,3 +1,4 @@
+import { managedInstallerPrefix, runManagedInstallerUpdate, MANAGED_INSTALLER_URL, } from "./managed-installer-update.js";
 import { resolveRuntimeNamespace } from "./runtime-namespace.js";
 import { parseStrictSemver } from "./semver.js";
 /** Origin-aware update planning; unsupported origins never fall back to npm. */
@@ -35,7 +36,20 @@ export function planUpdate(input) {
             reason: `global ${method} layout (${input.cliPath})`,
         };
     }
+    if (method === "installer") {
+        const prefix = managedInstallerPrefix(input.cliPath);
+        if (prefix) {
+            return {
+                method,
+                channel,
+                installerPrefix: prefix,
+                command: `installer ${MANAGED_INSTALLER_URL} --prefix ${JSON.stringify(prefix)} --version ${channel}`,
+                reason: `verified active managed installation (${prefix})`,
+            };
+        }
+    }
     const guidance = {
+        installer: "Rerun https://tmux-ide.com/install.sh with the same --prefix to update atomically and retain rollback. This managed release must not be modified by npm in place.",
         dev: "Update this checkout with git pull, then follow its build instructions.",
         homebrew: "Update with brew upgrade tmux-ide (using the tap/formula you installed).",
         yarn: `Update this Yarn global installation with yarn global add tmux-ide@${channel}.`,
@@ -123,6 +137,10 @@ export function runUpdate({ cliDir, dryRun, json = false }, dependencies = {}) {
         });
         executed = true;
     }
+    if (!dryRun && plan.installerPrefix && plan.channel) {
+        runManagedInstallerUpdate(plan.installerPrefix, plan.channel, json, dependencies.execute);
+        executed = true;
+    }
     if (json)
         output(JSON.stringify({ ...plan, current, latest, dryRun, executed }));
     return plan;

package/packages/daemon/dist/lib/workspace-multiplexer-verbs.js

@@ -286,7 +286,7 @@ export class WorkspaceMultiplexerAuthority {
         }
     }
     /** Runs only inside the existing semantic mutation lane; never rediscovers a stale link. */
-    async mutateWindowLink(raw, execute) {
+    async mutateWindowLink(raw, execute, timing) {
         if (this.#disposed)
             throw new WorkspaceMultiplexerError("workspace_unavailable");
         const request = WorkspaceMultiplexerMutationRequestSchemaZ.parse(raw);
@@ -297,7 +297,28 @@ export class WorkspaceMultiplexerAuthority {
             intent.verb !== "workspace.window.link.unlink" &&
             intent.verb !== "workspace.pane.select")
             throw new TypeError("Expected a window-link selection or unlink intent");
+        const now = () => {
+            try {
+                return timing?.nowMicros() ?? null;
+            }
+            catch {
+                return null;
+            }
+        };
+        const record = (operation, start) => {
+            const end = now();
+            if (start !== null && end !== null) {
+                try {
+                    timing?.record(operation, start, end);
+                }
+                catch {
+                    /* Diagnostics cannot own selection. */
+                }
+            }
+        };
+        const lookupStarted = now();
         const workspace = this.#registry.get(intent.workspaceName);
+        record("semantic-workspace-lookup", lookupStarted);
         if (!workspace)
             throw new WorkspaceMultiplexerError("workspace_not_found");
         const envelope = {
@@ -306,6 +327,7 @@ export class WorkspaceMultiplexerAuthority {
             workspaceName: intent.workspaceName,
         };
         try {
+            const effectStarted = now();
             const result = await execute(workspace.sessionName, intent.verb === "workspace.pane.select"
                 ? {
                     action: "select",
@@ -316,6 +338,7 @@ export class WorkspaceMultiplexerAuthority {
                     action: intent.verb === "workspace.window.link.unlink" ? "unlink" : "select",
                     target: intent.target,
                 });
+            record("window-link-effect-proof", effectStarted);
             if (result.outcome !== "applied") {
                 throw new WorkspaceMultiplexerError(result.outcome === "stale"
                     ? "window_link_stale"

package/packages/daemon/dist/machines.js

@@ -1,17 +1,53 @@
 import { readFileSync, statSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { SavedMachineRegistrySchema, SavedMachineSchema } from "@tmux-ide/contracts/saved-machines";
+import { SavedMachineRegistrySchema, SavedMachineSchema, SavedMachineMutationSchema, } from "@tmux-ide/contracts/saved-machines";
 import { loadSavedMachines, planSavedMachineMerge } from "./lib/saved-machines.js";
 import { loadFleetClientState } from "./lib/fleet-client-state.js";
-import { saveMachineProfiles } from "./lib/local-fleet-request.js";
+import { changeSavedMachines } from "@tmux-ide/core";
+import { saveMachineProfiles, mutateMachineProfile } from "./lib/local-fleet-request.js";
+import { remoteTmuxIdeCommand } from "./lib/remote-tmux-command.js";
 export async function machines(command, argument, options) {
     const current = loadSavedMachines();
+    if ((command === "enable" || command === "disable" || command === "remove" || command === "edit") &&
+        argument) {
+        const key = argument.normalize("NFKC").toLowerCase();
+        const match = current.machines.find((machine) => machine.id === key) ??
+            current.machines.find((machine) => machine.label.normalize("NFKC").toLowerCase() === key);
+        if (!match)
+            throw new Error("Saved machine not found; use machines ls to select its ID or label.");
+        const change = SavedMachineMutationSchema.parse(command === "edit"
+            ? {
+                id: match.id,
+                operation: command,
+                patch: {
+                    ...(options.label !== undefined ? { label: options.label } : {}),
+                    ...(options.sshTarget !== undefined ? { sshTarget: options.sshTarget } : {}),
+                },
+            }
+            : { id: match.id, operation: command });
+        const preview = changeSavedMachines(current, command === "remove"
+            ? { type: "remove", id: match.id }
+            : {
+                type: "update",
+                id: match.id,
+                patch: change.operation === "edit" ? change.patch : { enabled: command === "enable" },
+            });
+        return {
+            written: options.write === true,
+            registry: options.write ? await mutateMachineProfile(change) : preview,
+            ...(!options.write
+                ? {
+                    note: "Repeat with --write to change this saved profile. Remote sessions and daemons are preserved.",
+                }
+                : {}),
+        };
+    }
     if (command === "start" && argument) {
         SavedMachineSchema.shape.sshTarget.parse(argument);
         if (!options.write)
             return {
                 written: false,
-                command: ["ssh", "--", argument, "tmux-ide", "update", "--daemon", "--json"],
+                command: ["ssh", "--", argument, remoteTmuxIdeCommand("start")],
                 note: "Repeat with --write to start the installed daemon. No package installation occurs.",
             };
         await (await import("./lib/remote-daemon-lifecycle.js")).startInstalledRemoteDaemon(argument);
@@ -69,7 +105,7 @@ export async function machines(command, argument, options) {
         };
     }
     else
-        throw new Error("Usage: tmux-ide machines ls|export|import <file>|add <alias> [--write] [--json]");
+        throw new Error("Usage: tmux-ide machines ls|export|import <file>|add <alias>|edit|enable|disable|remove <id-or-label> [--write] [--json]");
     const preview = planSavedMachineMerge(current, incoming);
     if (!options.write)
         return {

package/packages/daemon/dist/native/TmuxIdeNotifier.app/Contents/Info.plist

@@ -21,9 +21,9 @@
   <key>CFBundlePackageType</key>
   <string>APPL</string>
   <key>CFBundleShortVersionString</key>
-  <string>2.9.2</string>
+  <string>2.9.3</string>
   <key>CFBundleVersion</key>
-  <string>2.9.2</string>
+  <string>2.9.3</string>
   <key>LSMinimumSystemVersion</key>
   <string>11.0</string>
   <key>LSUIElement</key>

package/packages/daemon/dist/native/TmuxIdeNotifier.app/Contents/_CodeSignature/CodeResources

@@ -10,7 +10,7 @@
 		</data>
 		<key>Resources/Assets.car</key>
 		<data>
-		1/Kd+BOk3onNhd2X8tbDyMpGtnM=
+		Z5KHrNHvuP0dz4KeTalLvP3ooGE=
 		</data>
 	</dict>
 	<key>files2</key>
@@ -26,7 +26,7 @@
 		<dict>
 			<key>hash2</key>
 			<data>
-			IkaRCLzVQ2gdu2vtvmtL2MtPanLEDl/Dc53vKEcChns=
+			tjo0L6QuhP9jDVHACgzDgf4ZWE5eMPM/btcI9elmdEQ=
 			</data>
 		</dict>
 	</dict>

package/packages/daemon/dist/terminal/attachments/direct-websocket.js

@@ -434,7 +434,10 @@ export class TerminalAttachmentAdmissionCoordinator {
                 let sessionRuntimeBinding = null;
                 let live;
                 try {
-                    sessionRuntimeBinding = this.#bindSessionRuntime?.(activeDescriptor) ?? null;
+                    sessionRuntimeBinding = (await this.#bindSessionRuntime?.(activeDescriptor)) ?? null;
+                    if (!admission.isOpen()) {
+                        throw new TerminalAttachmentAdmissionError("redemption-rejected", "Terminal attachment redemption was rejected.");
+                    }
                     live = new TerminalAttachmentLiveConnection({
                         onRetire: (connection) => this.#trackRetiringRelease(connection),
                         socket,

package/packages/daemon/dist/terminal/attachments/native-runtime.js

@@ -821,6 +821,7 @@ export class WorkspaceTerminalInventoryRuntime {
     #inventoryRead = null;
     #applicationReads = new Map();
     #lifecycle = "initializing";
+    #registeredWindows;
     #disposed = false;
     constructor(options) {
         const authority = canonicalAuthority(options.tmuxAuthority);
@@ -831,6 +832,10 @@ export class WorkspaceTerminalInventoryRuntime {
         });
         this.readRunner = pinnedReadRunner(authority, executeRead);
         this.#registry = options.registry;
+        this.#registeredWindows = options.sessionRuntimeRegistry?.setRegisteredWindowReader?.(async (signal) => {
+            const snapshot = await discoverWorkspaceRegistryTerminalInventory(this.#registry, this.readRunner, signal);
+            return snapshot.panes.map((pane) => ({ session: pane.sessionName, window: pane.windowId }));
+        });
         this.#observability = options.observability ?? DISABLED_SESSION_RUNTIME_OBSERVABILITY;
         this.#resolveInteractionEndpoint = options.resolveInteractionEndpoint;
         this.#nativeServerEpoch = options.nativeServerEpoch;
@@ -929,10 +934,12 @@ export class WorkspaceTerminalInventoryRuntime {
             this.#observeWorkspaceSession = null;
         }
         this.#stopWorkspaceAddedObserver = options.registry.on("workspace.added", (workspace) => {
+            this.#registeredWindows?.invalidate();
             this.invalidate();
             this.#observeWorkspaceSession?.(workspace.name, workspace.sessionName);
         });
         this.#stopWorkspaceRemovedObserver = options.registry.on("workspace.removed", (name) => {
+            this.#registeredWindows?.invalidate();
             this.invalidate();
             if (!options.sessionRuntimeRegistry)
                 return;
@@ -1200,12 +1207,12 @@ export class WorkspaceTerminalInventoryRuntime {
         let catalogIssue = inventory.catalog
             .invalidRuntimeProof
             ? "invalid-runtime-proof"
-            : inventory.catalog.missingSemanticStamp
-                ? "missing-semantic-stamp"
-                : inventory.catalog.duplicateSemanticStamp
-                    ? "duplicate-semantic-stamp"
-                    : inventory.catalog.duplicateRuntimePaneBinding
-                        ? "duplicate-runtime-pane-binding"
+            : inventory.catalog.duplicateRuntimePaneBinding
+                ? "duplicate-runtime-pane-binding"
+                : inventory.catalog.missingSemanticStamp
+                    ? "missing-semantic-stamp"
+                    : inventory.catalog.duplicateSemanticStamp
+                        ? "duplicate-semantic-stamp"
                         : null;
         if (shouldPrewarm &&
             (trustedInventory || allowColdQualification) &&
@@ -1348,6 +1355,7 @@ export class WorkspaceTerminalInventoryRuntime {
             return;
         this.#disposed = true;
         this.#lifecycle = "disposed";
+        this.#registeredWindows?.dispose();
         this.invalidate();
         this.#stopWorkspaceAddedObserver?.();
         this.#stopWorkspaceRemovedObserver?.();
@@ -1460,13 +1468,14 @@ export class NativeTerminalAttachmentRuntime {
             resolveGeometry: (descriptor, client) => geometry.resolve(descriptor, client),
             ...(options.sessionRuntimeRegistry
                 ? {
-                    bindSessionRuntime: (descriptor) => {
+                    bindSessionRuntime: async (descriptor) => {
                         const workspace = options.registry.get(descriptor.target.workspaceName);
                         if (!workspace)
                             throw new Error("Terminal attachment workspace is unavailable");
                         if (!descriptor.hostClientId) {
                             throw new Error("Interactive terminal attachment lacks trusted host identity");
                         }
+                        await options.sessionRuntimeRegistry.verifyWindowOwnership();
                         return new SessionRuntimeTransportBinder(options.sessionRuntimeRegistry).bind({
                             transport: "terminal-attachment",
                             transportLeaseId: descriptor.leaseId,
@@ -1656,12 +1665,12 @@ export class NativeTerminalAttachmentRuntime {
         const catalogIssue = inventory.catalog
             .invalidRuntimeProof
             ? "invalid-runtime-proof"
-            : inventory.catalog.missingSemanticStamp
-                ? "missing-semantic-stamp"
-                : inventory.catalog.duplicateSemanticStamp
-                    ? "duplicate-semantic-stamp"
-                    : inventory.catalog.duplicateRuntimePaneBinding
-                        ? "duplicate-runtime-pane-binding"
+            : inventory.catalog.duplicateRuntimePaneBinding
+                ? "duplicate-runtime-pane-binding"
+                : inventory.catalog.missingSemanticStamp
+                    ? "missing-semantic-stamp"
+                    : inventory.catalog.duplicateSemanticStamp
+                        ? "duplicate-semantic-stamp"
                         : null;
         // Ground-truth agent facts (authority + scrape fallback). All IO stays here;
         // the resource projector composes them purely. Absent probe → no facts →