tmux-ide 2.9.2 → 2.9.4

package/packages/daemon/src/command-center/resources/saved-machine-route.ts

@@ -2,13 +2,22 @@ import type { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { z } from "zod";
 import { SavedMachineRegistrySchema, type DaemonInstanceIdentity } from "@tmux-ide/contracts";
-import { loadSavedMachines, mergeSavedMachines } from "../../lib/saved-machines.ts";
+import { SavedMachineMutationSchema } from "@tmux-ide/contracts/saved-machines";
+import {
+  loadSavedMachines,
+  mergeSavedMachines,
+  updateSavedMachines,
+} from "../../lib/saved-machines.ts";
 import { ownerAuthorityGate } from "../owner-authority.ts";
 
 const Request = z.strictObject({
   expectedInstanceId: z.uuid(),
   registry: SavedMachineRegistrySchema,
 });
+const MutationRequest = z.strictObject({
+  expectedInstanceId: z.uuid(),
+  change: SavedMachineMutationSchema,
+});
 export function mountSavedMachineRoute(
   app: Hono,
   options: {
@@ -16,6 +25,7 @@ export function mountSavedMachineRoute(
     ownerToken: string | null;
     read?: typeof loadSavedMachines;
     merge?: typeof mergeSavedMachines;
+    update?: typeof updateSavedMachines;
   },
 ) {
   const authorize = ownerAuthorityGate(options.ownerToken, {
@@ -56,4 +66,41 @@ export function mountSavedMachineRoute(
       );
     }
   });
+  app.patch("/api/resources/saved-machines", bodyLimit({ maxSize: 1024 }), async (c) => {
+    const gate = authorize(c);
+    if (gate) return gate;
+    c.header("Cache-Control", "no-store");
+    let parsed;
+    try {
+      parsed = MutationRequest.safeParse(await c.req.json());
+    } catch {
+      return c.json({ error: "Invalid machine mutation" }, 400);
+    }
+    if (!parsed.success) return c.json({ error: "Invalid machine mutation" }, 400);
+    if (parsed.data.expectedInstanceId !== options.daemon.instanceId)
+      return c.json({ error: "Daemon generation changed" }, 409);
+    const change = parsed.data.change;
+    const { id, operation } = change;
+    try {
+      const registry = (options.update ?? updateSavedMachines)(
+        operation === "remove"
+          ? { type: "remove", id }
+          : {
+              type: "update",
+              id,
+              patch:
+                change.operation === "edit" ? change.patch : { enabled: operation === "enable" },
+            },
+      );
+      return c.json({ daemon: options.daemon, registry });
+    } catch {
+      return c.json(
+        {
+          error:
+            "Machine not found, edit conflicts with another profile, or registry unavailable; nothing changed",
+        },
+        409,
+      );
+    }
+  });
 }

package/packages/daemon/src/command-center/ws-events.ts

@@ -17,11 +17,8 @@ import { discoverSessions, buildOverviews, buildProjectDetail } from "./discover
 import type { AgentTurnCompletion } from "./agent-status-watch.ts";
 import {
   DaemonFleetFactsObserver,
-  AGENT_STATE_TMUX_ARGS,
-  parseAgentStateFacts,
-  parseSessionCompositionFacts,
   createDefaultFleetFactsReaders,
-  SESSION_COMPOSITION_TMUX_ARGS,
+  createSharedFleetFactsReaders,
   type DaemonFleetFactsObserverOptions,
   type DaemonFleetFactsObserverDiagnostic,
 } from "./daemon-fleet-facts-observer.ts";
@@ -431,28 +428,11 @@ export function setFleetFactsTmuxRunner(
   runTmux: ((args: readonly string[], signal?: AbortSignal) => string | Promise<string>) | null,
 ): void {
   stopFleetFactsObserver();
-  sessionCompositionReaderOverride = runTmux
-    ? async (signal) => {
-        try {
-          return parseSessionCompositionFacts(await runTmux(SESSION_COMPOSITION_TMUX_ARGS, signal));
-        } catch (error) {
-          // A daemon may legitimately precede the first tmux server. Socket
-          // absence is an authoritative empty fleet baseline, not a failed
-          // observation: catalog clients must be allowed to render their
-          // actionable first-run state while the observer waits for tmux.
-          return isTmuxServerUnavailableError(error) ? parseSessionCompositionFacts("") : null;
-        }
-      }
-    : null;
-  agentStateReaderOverride = runTmux
-    ? async (signal) => {
-        try {
-          return parseAgentStateFacts(await runTmux(AGENT_STATE_TMUX_ARGS, signal));
-        } catch {
-          return null;
-        }
-      }
+  const readers = runTmux
+    ? createSharedFleetFactsReaders(runTmux, isTmuxServerUnavailableError)
     : null;
+  sessionCompositionReaderOverride = readers?.readSessions ?? null;
+  agentStateReaderOverride = readers?.readAgents ?? null;
 }
 
 interface ResourceObservationHandle {

package/packages/daemon/src/lib/canonical-daemon-bootstrap.ts

@@ -236,6 +236,18 @@ async function replaceOlderCanonicalDaemon(
       reason: "identity-mismatch",
     });
   }
+  const supervisor = latest.info.provenance?.supervisor;
+  if (!latest.info.supervisionId && (supervisor === "systemd" || supervisor === "launchd")) {
+    throw new DaemonBootstrapError(
+      "incompatible",
+      `The older canonical daemon is managed by ${supervisor} without a supervisor reservation. ` +
+        "Stop and disable the old service, reserve the stopped namespace with " +
+        "tmux-ide daemon reserve-supervisor <id>, then configure the service to run " +
+        "tmux-ide --headless --supervised <id> before restarting it. " +
+        "The existing daemon has been left running.",
+      { reason: "canonical-record-invalid" },
+    );
+  }
   await deps.shutdownOlderOwner(info);
   const deadline = deps.now() + timeoutMs;
   while (deps.now() < deadline) {

package/packages/daemon/src/lib/canonical-daemon.ts

@@ -115,7 +115,12 @@ export type CanonicalDaemonInfoState =
     };
 
 export function getCanonicalDaemonInfoPath(): string {
-  return runtimeOwnedPath(join(resolveRuntimeNamespace().daemonInfoDir, DAEMON_INFO_FILE));
+  const namespace = resolveRuntimeNamespace();
+  const path = join(namespace.daemonInfoDir, DAEMON_INFO_FILE);
+  // Resolution already validates ordinary and isolated namespaces. Only
+  // development adds a per-path containment check; do not resolve twice on
+  // every ordinary daemon read. Each call still resolves the current namespace.
+  return namespace.development ? runtimeOwnedPath(path) : path;
 }
 
 export function getCanonicalDaemonClaimPath(): string {
@@ -687,11 +692,48 @@ export function assertCanonicalDaemonSupervision(supervisionId: string): void {
 }
 
 /** Explicit installation only; startup never calls this to recreate a reservation. */
+/** Sanitized reservation guidance; never includes credentials or filesystem errors. */
+export class CanonicalDaemonReservationError extends Error {
+  constructor(message: string) {
+    super(`Supervisor reservation refused: ${message}`);
+    this.name = "CanonicalDaemonReservationError";
+  }
+}
+
+function reservationRefusal(
+  attempt: Exclude<CanonicalDaemonClaimAttempt, { status: "acquired" }>,
+): CanonicalDaemonReservationError {
+  if (attempt.status === "busy")
+    return new CanonicalDaemonReservationError(
+      `another lifecycle operation holds the namespace (PID ${attempt.owner.pid}). Wait for it to finish, then retry.`,
+    );
+  const state = inspectCanonicalDaemonInfo();
+  if (state.status === "valid")
+    return new CanonicalDaemonReservationError(
+      `the recorded ${state.info.supervisionId ? "supervised" : "unsupervised"} daemon (PID ${state.info.pid}) has not been released. Inspect it with tmux-ide daemon info --json, then stop it through its owning process or service before reserving.`,
+    );
+  if (state.status === "reserved")
+    return new CanonicalDaemonReservationError(
+      `this namespace is reserved for supervisor ${state.reservation.supervisionId}. Remove that service and release its reservation before assigning a different ID.`,
+    );
+  if (state.status === "invalid")
+    return new CanonicalDaemonReservationError(
+      `the namespace record cannot be trusted (${state.reason}). Run tmux-ide daemon info --json for diagnosis; repair ownership or permissions before retrying.`,
+    );
+  return new CanonicalDaemonReservationError(
+    "the namespace changed or its lifecycle claim is unavailable. Run tmux-ide daemon info --json, then retry after the owning operation finishes.",
+  );
+}
+
 export function reserveCanonicalDaemonSupervision(
   supervisionId: string,
 ): CanonicalDaemonReservation {
+  if (!DaemonSupervisionIdSchema.safeParse(supervisionId).success)
+    throw new CanonicalDaemonReservationError(
+      "use a 1–128 character ID starting with a letter or digit and containing only letters, digits, periods, underscores or hyphens.",
+    );
   const attempt = tryAcquireCanonicalDaemonClaim({ kind: "reserve", supervisionId });
-  if (attempt.status !== "acquired") throw new Error("Cannot reserve supervised daemon namespace");
+  if (attempt.status !== "acquired") throw reservationRefusal(attempt);
   const claim = attempt.claim;
   try {
     const before = inspectCanonicalDaemonInfo();

package/packages/daemon/src/lib/daemon-embed.ts

@@ -1436,6 +1436,7 @@ async function startEmbeddedDaemonGeneration(
               if (!sessionRuntimeRegistry) throw new Error("Session runtime unavailable");
               return sessionRuntimeRegistry.executeWindowLinkAction(session, action);
             },
+            timing,
           );
         }
         if (intent.verb === "workspace.pane.resize") {

package/packages/daemon/src/lib/daemon-service-manager.ts

@@ -0,0 +1,152 @@
+import { execFile } from "node:child_process";
+import type { DaemonServicePlan } from "./daemon-service-plan.ts";
+
+export interface DaemonServiceState {
+  readonly loaded: boolean;
+  readonly active: boolean;
+  readonly pid: number | null;
+  readonly definitionPath: string | null;
+}
+
+export type ServiceCommand = (
+  file: string,
+  args: readonly string[],
+) => Promise<{ code: number | null; stdout: string; stderr: string }>;
+
+const runCommand: ServiceCommand = (file, args) =>
+  new Promise((resolve) => {
+    execFile(
+      file,
+      [...args],
+      {
+        encoding: "utf8",
+        timeout: 15_000,
+        maxBuffer: 256 * 1024,
+        env: { ...process.env, LC_ALL: "C", LANG: "C" },
+      },
+      (error, stdout, stderr) =>
+        resolve({
+          code: error ? (typeof error.code === "number" ? error.code : null) : 0,
+          stdout,
+          stderr,
+        }),
+    );
+  });
+
+export class DaemonServiceManagerError extends Error {
+  readonly code = "DAEMON_SERVICE_MANAGER_FAILED";
+  constructor(
+    readonly operation: string,
+    readonly manager: string,
+  ) {
+    super(`${manager} user service ${operation} failed; check the user manager and service logs`);
+    this.name = "DaemonServiceManagerError";
+  }
+}
+
+/** Bounded argv-only OS boundary. Never expose manager output (it may contain environment data). */
+export function createDaemonServiceManager(plan: DaemonServicePlan, run = runCommand) {
+  const launchd = plan.manager === "launchd";
+  const file = launchd ? "/bin/launchctl" : "systemctl";
+  const domain = plan.target.slice(0, plan.target.lastIndexOf("/"));
+  const command = async (operation: string, args: readonly string[]) => {
+    const result = await run(file, launchd ? args : ["--user", ...args]);
+    if (result.code !== 0) throw new DaemonServiceManagerError(operation, plan.manager);
+    return result;
+  };
+  return {
+    async available(): Promise<void> {
+      await command(
+        "availability check",
+        launchd ? ["print-disabled", domain] : ["show-environment"],
+      );
+    },
+    async inspect(): Promise<DaemonServiceState> {
+      const result = await run(
+        file,
+        launchd
+          ? ["print", plan.target]
+          : [
+              "--user",
+              "show",
+              plan.target,
+              "--property=LoadState,ActiveState,MainPID,FragmentPath",
+            ],
+      );
+      const absent = { loaded: false, active: false, pid: null, definitionPath: null } as const;
+      if (launchd) {
+        if (result.code === 113 && result.stderr.includes("Could not find service")) return absent;
+        if (result.code !== 0) throw new DaemonServiceManagerError("inspection", plan.manager);
+        const field = (name: string) =>
+          result.stdout.match(new RegExp(`^\\t${name} = (.*)$`, "m"))?.[1];
+        const path = field("path");
+        const pidText = field("pid");
+        const state = field("state");
+        if (!path || !state || (pidText !== undefined && !/^[1-9][0-9]*$/u.test(pidText)))
+          throw new DaemonServiceManagerError("inspection format", plan.manager);
+        return {
+          loaded: true,
+          active: state === "running",
+          pid: pidText ? Number(pidText) : null,
+          definitionPath: path,
+        };
+      }
+      const fields = new Map<string, string>();
+      for (const line of result.stdout.trim().split("\n")) {
+        const index = line.indexOf("=");
+        if (index < 1 || fields.has(line.slice(0, index)))
+          throw new DaemonServiceManagerError("inspection format", plan.manager);
+        fields.set(line.slice(0, index), line.slice(index + 1));
+      }
+      if (fields.get("LoadState") === "not-found" && (result.code === 0 || result.code === 4))
+        return absent;
+      if (result.code !== 0 || fields.get("LoadState") !== "loaded" || !fields.has("ActiveState"))
+        throw new DaemonServiceManagerError("inspection", plan.manager);
+      const pidText = fields.get("MainPID");
+      const path = fields.get("FragmentPath");
+      if (!pidText || !/^(0|[1-9][0-9]*)$/u.test(pidText) || !path)
+        throw new DaemonServiceManagerError("inspection format", plan.manager);
+      return {
+        loaded: true,
+        active: fields.get("ActiveState") === "active",
+        pid: Number(pidText) || null,
+        definitionPath: path,
+      };
+    },
+    async install(): Promise<void> {
+      if (launchd) await command("bootstrap", ["bootstrap", domain, plan.unitPath]);
+      else {
+        await command("reload", ["daemon-reload"]);
+        // The manager may have a different XDG_CONFIG_HOME from the invoking
+        // shell. Enable the owned file explicitly so it is linked into its search path.
+        await command("enable/start", ["enable", "--now", plan.unitPath]);
+      }
+    },
+    async restart(hasProcess = true): Promise<void> {
+      // An explicit recovery after a failed launcher must also clear systemd's
+      // start-rate counter. The lifecycle owner has already verified this unit's
+      // private definition and reservation; never reset all user units.
+      if (!launchd && !hasProcess)
+        await command("reset failed state", ["reset-failed", plan.target]);
+      // KeepAlive relaunches after a graceful TERM. kickstart -k would force-kill
+      // the daemon instead of allowing canonical ownership to be released.
+      await command(
+        "restart",
+        launchd
+          ? hasProcess
+            ? ["kill", "SIGTERM", plan.target]
+            : ["kickstart", plan.target]
+          : ["restart", plan.target],
+      );
+    },
+    async stop(): Promise<void> {
+      await command(
+        "stop/remove",
+        launchd ? ["bootout", plan.target] : ["disable", "--now", plan.target],
+      );
+    },
+    async reload(): Promise<void> {
+      if (!launchd) await command("reload", ["daemon-reload"]);
+    },
+  };
+}

package/packages/daemon/src/lib/daemon-service-plan.ts

@@ -0,0 +1,153 @@
+import { createHash } from "node:crypto";
+import { isAbsolute, join } from "node:path";
+import { runtimeNamespaceEnvironment, type RuntimeNamespace } from "./runtime-namespace.ts";
+
+export interface DaemonServicePlan {
+  readonly manager: "launchd" | "systemd";
+  readonly supervisionId: string;
+  readonly target: string;
+  readonly unitPath: string;
+  readonly recordPath: string;
+  readonly executable: string;
+  readonly contents: string;
+  readonly stdoutPath: string;
+  readonly stderrPath: string;
+}
+
+function safeValue(value: string, name: string): string {
+  if (!value || [...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+    throw new TypeError(`${name} must be nonempty and contain no control characters`);
+  return value;
+}
+
+function absolute(value: string, name: string): string {
+  safeValue(value, name);
+  if (!isAbsolute(value)) throw new TypeError(`${name} must be an absolute path`);
+  return value;
+}
+
+function xml(value: string): string {
+  return value.replace(
+    /[&<>"']/gu,
+    (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[char]!,
+  );
+}
+
+// systemd applies specifier expansion to paths, environment values and ExecStart.
+// ExecStart additionally expands dollars unless the ':' executable prefix is used.
+function systemd(value: string): string {
+  return `"${value.replace(/%/gu, "%%").replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`;
+}
+
+/** Pure rendering only. Reservation and OS-manager mutations belong to the lifecycle owner. */
+export function planDaemonService(options: {
+  platform: string;
+  uid: number;
+  home: string;
+  configHome?: string;
+  executable: string;
+  path: string;
+  namespace: RuntimeNamespace;
+}): DaemonServicePlan {
+  const { namespace } = options;
+  if (options.platform !== "darwin" && options.platform !== "linux")
+    throw new TypeError("Daemon services support macOS launchd and Linux systemd user managers");
+  if (!Number.isSafeInteger(options.uid) || options.uid <= 0)
+    throw new TypeError("Daemon services require a non-root user");
+  if (namespace.mode === "development")
+    throw new TypeError("Development instances own their lifecycle; use dev:instance instead");
+  const home = absolute(options.home, "Home directory");
+  const executable = absolute(options.executable, "Stable CLI executable");
+  // Keep the supplied stable launcher path. realpath would pin installer services
+  // to a retired version instead of following the next verified activation.
+  const identity = createHash("sha256")
+    .update(absolute(namespace.daemonInfoDir, "Daemon state directory"))
+    .digest("hex")
+    .slice(0, 24);
+  const supervisionId = `tmux-ide.${identity}`;
+  const stdoutPath = join(namespace.daemonInfoDir, "service.stdout.log");
+  const stderrPath = join(namespace.daemonInfoDir, "service.stderr.log");
+  const environment = {
+    HOME: home,
+    PATH: safeValue(options.path, "Service PATH"),
+    ...runtimeNamespaceEnvironment(namespace),
+    TMUX_IDE_CONFIG: namespace.configPath,
+    TMUX_IDE_SETTINGS_DIR: namespace.settingsDir,
+    TMUX_IDE_CLAUDE_DIR: namespace.claudeDir,
+    TMUX_IDE_CLAUDE_SETTINGS: namespace.claudeSettingsPath,
+    TMUX_IDE_CLAUDE_HOOK_PATH: namespace.claudeHookPath,
+    TMUX_IDE_OPENCODE_DIR: namespace.opencodeDir,
+  };
+  for (const [name, value] of Object.entries(environment)) safeValue(value, name);
+  const args = [executable, "--headless", "--supervised", supervisionId];
+  const shared = {
+    supervisionId,
+    executable,
+    recordPath: join(namespace.daemonInfoDir, "service.json"),
+    stdoutPath,
+    stderrPath,
+  };
+  if (options.platform === "darwin") {
+    const label = `com.${supervisionId}`;
+    const string = (value: string) => `<string>${xml(value)}</string>`;
+    return Object.freeze({
+      ...shared,
+      manager: "launchd",
+      target: `gui/${options.uid}/${label}`,
+      unitPath: join(home, "Library", "LaunchAgents", `${label}.plist`),
+      contents: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key>${string(label)}
+<key>ProgramArguments</key><array>${args.map(string).join("")}</array>
+<key>EnvironmentVariables</key><dict>${Object.entries(environment)
+        .map(([key, value]) => `<key>${xml(key)}</key>${string(value)}`)
+        .join("")}</dict>
+<key>WorkingDirectory</key>${string(home)}
+<key>RunAtLoad</key><true/>
+<key>KeepAlive</key><true/>
+<key>ThrottleInterval</key><integer>3</integer>
+<key>ExitTimeOut</key><integer>30</integer>
+<key>AbandonProcessGroup</key><true/>
+<key>StandardOutPath</key>${string(stdoutPath)}
+<key>StandardErrorPath</key>${string(stderrPath)}
+</dict></plist>
+`,
+    });
+  }
+  const configHome = absolute(options.configHome ?? join(home, ".config"), "Config directory");
+  const target = `${supervisionId}.service`;
+  // WorkingDirectory is a raw path, not an ExecStart-style quoted word.
+  // The equivalent '/.' suffix preserves trailing spaces/backslashes without
+  // allowing the unit parser to trim them or treat them as line continuation.
+  const workingDirectory = `${home.replace(/%/gu, "%%")}/.`;
+  return Object.freeze({
+    ...shared,
+    manager: "systemd",
+    target,
+    unitPath: join(configHome, "systemd", "user", target),
+    contents: `[Unit]
+Description=tmux-ide canonical user daemon
+StartLimitIntervalSec=60
+StartLimitBurst=10
+
+[Service]
+Type=exec
+ExecStart=:${args.map(systemd).join(" ")}
+WorkingDirectory=${workingDirectory}
+${Object.entries(environment)
+  .map(([key, value]) => `Environment=${systemd(`${key}=${value}`)}`)
+  .join("\n")}
+Restart=always
+RestartSec=3
+TimeoutStopSec=30
+# tmux pane work has an independent lifetime; never kill the whole service cgroup.
+KillMode=process
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=default.target
+`,
+  });
+}