tmux-ide 2.9.2 → 2.9.4

package/packages/core/src/terminal-replica.ts

@@ -10,12 +10,14 @@ import type {
   TerminalReplicaTombstonePayload,
 } from "@tmux-ide/contracts";
 import { consumeCompactReplicaCapability } from "./terminal-compact-capability.ts";
+import { freezeOwnedTerminalReplicaRow as freezeRow } from "./terminal-replica-owned-row.ts";
 import {
   hashCanonicalTerminalValue,
   hashCanonicalTerminalValueCooperatively,
   hashTerminalReplicaRowCached,
   hashTerminalReplicaRowCooperatively,
   isTerminalReplicaRowDeeplyFrozen,
+  TerminalReplicaRunEncodingCache,
 } from "./terminal-replica-hash-cache.ts";
 
 // Only rows validated and copied by this module can bypass a repeated copy.
@@ -835,27 +837,11 @@ function blankRow(cols: number): TerminalReplicaRow {
   }) as unknown as TerminalReplicaRow;
 }
 
-function freezeRow(row: TerminalReplicaRow): TerminalReplicaRow {
-  return Object.freeze({
-    wrapped: row.wrapped,
-    cells: Object.freeze(
-      row.cells.map((cell) =>
-        Object.freeze({
-          ...cell,
-          foreground: Object.freeze({ ...cell.foreground }),
-          background: Object.freeze({ ...cell.background }),
-        }),
-      ),
-    ),
-  }) as unknown as TerminalReplicaRow;
-}
-
 function validateAndFreezeRow(
   row: TerminalReplicaRow,
   profile?: MutableTerminalReplicaApplyProfile,
 ): TerminalReplicaRow {
   if (VALIDATED_PATCH_ROWS.has(row)) return row;
-  const cells = new Array(row.cells.length);
   for (let index = 0; index < row.cells.length; index += 1) {
     const cell = row.cells[index]!;
     if (profile) profile.counts.validatedCells += 1;
@@ -863,17 +849,11 @@ function validateAndFreezeRow(
       throw new TypeError("Malformed terminal replica row");
     if (cell.width === 0 && (index === 0 || row.cells[index - 1]?.width !== 2))
       throw new TypeError("Malformed terminal replica row");
-    cells[index] = Object.freeze({
-      ...cell,
-      foreground: Object.freeze({ ...cell.foreground }),
-      background: Object.freeze({ ...cell.background }),
-    });
-    if (profile) profile.counts.frozenCells += 1;
   }
-  const frozen = Object.freeze({
-    wrapped: row.wrapped,
-    cells: Object.freeze(cells),
-  }) as unknown as TerminalReplicaRow;
+  // Use the same copy owner as seed admission and encoding. Already owned rows
+  // retain identity; external rows still receive an immutable detached copy.
+  const frozen = freezeRow(row);
+  if (profile && frozen !== row) profile.counts.frozenCells += row.cells.length;
   VALIDATED_PATCH_ROWS.add(frozen);
   return frozen;
 }
@@ -1034,11 +1014,13 @@ function hashTerminalReplicaRow(
   row: TerminalReplicaRow,
   profile?: MutableTerminalReplicaApplyProfile,
   instrumentation?: TerminalReplicaApplyOptions["instrumentation"],
+  encodingCache?: TerminalReplicaRunEncodingCache,
 ): string {
   const started = readProfileClock(instrumentation);
   const hash = hashTerminalReplicaRowCached(
     row,
     profile ? () => (profile.counts.rowHashMisses += 1) : undefined,
+    encodingCache,
   );
   addProfileDuration(profile, "rowHash", started, instrumentation);
   return hash;
@@ -1051,12 +1033,13 @@ function hashTerminalReplicaRows(
 ): string {
   const cached = ROW_ARRAY_HASH_CACHE.get(rows);
   if (cached) return cached.hash.toString(16).padStart(16, "0");
+  const encodingCache = rows.length >= 64 ? new TerminalReplicaRunEncodingCache() : undefined;
   let hash = 0n;
   for (const row of rows)
     hash = BigInt.asUintN(
       64,
       hash * ROW_SEQUENCE_BASE +
-        BigInt(`0x${hashTerminalReplicaRow(row, profile, instrumentation)}`),
+        BigInt(`0x${hashTerminalReplicaRow(row, profile, instrumentation, encodingCache)}`),
     );
   if (Object.isFrozen(rows) && rows.every(isTerminalReplicaRowDeeplyFrozen))
     ROW_ARRAY_HASH_CACHE.set(rows, { hash, length: rows.length });
@@ -1099,10 +1082,12 @@ export function registerTerminalReplicaRowsDeltaHash(
     );
     hash = BigInt.asUintN(64, hash - contribution);
   }
+  const encodingCache = append.length >= 64 ? new TerminalReplicaRunEncodingCache() : undefined;
   for (const row of append)
     hash = BigInt.asUintN(
       64,
-      hash * ROW_SEQUENCE_BASE + BigInt(`0x${hashTerminalReplicaRow(row)}`),
+      hash * ROW_SEQUENCE_BASE +
+        BigInt(`0x${hashTerminalReplicaRow(row, undefined, undefined, encodingCache)}`),
     );
   if (Object.isFrozen(next) && next.every(isTerminalReplicaRowDeeplyFrozen))
     ROW_ARRAY_HASH_CACHE.set(next, { hash, length: next.length });

package/packages/daemon/dist/command-center/daemon-fleet-facts-observer.js

@@ -459,16 +459,7 @@ export function createDefaultFleetFactsReaders() {
             return null;
         }
     };
-    return {
-        readSessions: async (signal) => {
-            const raw = await execute(SESSION_COMPOSITION_TMUX_ARGS, signal);
-            return raw === null ? null : parseSessionCompositionFacts(raw);
-        },
-        readAgents: async (signal) => {
-            const raw = await execute(AGENT_STATE_TMUX_ARGS, signal);
-            return raw === null ? null : parseAgentStateFacts(raw);
-        },
-    };
+    return createSharedFleetFactsReaders(execute);
 }
 export const SESSION_COMPOSITION_TMUX_ARGS = [
     "list-panes",
@@ -500,3 +491,98 @@ export const AGENT_STATE_TMUX_ARGS = [
 export async function readAgentStateFacts(signal) {
     return createDefaultFleetFactsReaders().readAgents(signal);
 }
+/** Agent columns are excluded from the session topology projection. */
+export const FLEET_FACTS_TMUX_ARGS = [
+    "list-panes",
+    "-a",
+    "-F",
+    `${SESSION_COMPOSITION_TMUX_ARGS[3]}\t#{@agent_state}\t#{pane_current_command}`,
+];
+/** Share only an outstanding read; completed snapshots are never cached. */
+export function createSharedFleetFactsReaders(run, isAbsentServer = () => false) {
+    let pending = null;
+    const read = async (signal) => {
+        if (signal?.aborted)
+            return null;
+        if (!pending) {
+            const controller = new AbortController();
+            const entry = {
+                controller,
+                readers: 0,
+                result: Promise.resolve().then(() => run(FLEET_FACTS_TMUX_ARGS, controller.signal)),
+            };
+            entry.result = entry.result.finally(() => {
+                if (pending === entry)
+                    pending = null;
+            });
+            pending = entry;
+        }
+        const entry = pending;
+        entry.readers += 1;
+        let released = false;
+        const release = () => {
+            if (released)
+                return;
+            released = true;
+            entry.readers -= 1;
+            if (entry.readers === 0) {
+                if (pending === entry)
+                    pending = null;
+                entry.controller.abort();
+            }
+        };
+        signal?.addEventListener("abort", release, { once: true });
+        try {
+            // Keep the promise outstanding for a noncooperative runner so the
+            // observer's per-kind quarantine remains effective after cancellation.
+            const raw = await entry.result;
+            return signal?.aborted ? null : raw;
+        }
+        catch (error) {
+            if (signal?.aborted)
+                return null;
+            throw error;
+        }
+        finally {
+            signal?.removeEventListener("abort", release);
+            release();
+        }
+    };
+    return {
+        readSessions: async (signal) => {
+            try {
+                const raw = await read(signal);
+                return raw === null
+                    ? null
+                    : parseSessionCompositionFacts(raw
+                        .split("\n")
+                        .map((line) => line.split("\t").slice(0, 11).join("\t"))
+                        .join("\n"));
+            }
+            catch (error) {
+                // Socket absence is an authoritative empty catalog, but must not
+                // manufacture agent turn completions from a failed agent observation.
+                return isAbsentServer(error) ? parseSessionCompositionFacts("") : null;
+            }
+        },
+        readAgents: async (signal) => {
+            try {
+                const raw = await read(signal);
+                return raw === null
+                    ? null
+                    : parseAgentStateFacts(raw
+                        .split("\n")
+                        .map((line) => {
+                        const fields = line.split("\t");
+                        if (fields.length !== 13)
+                            return "";
+                        return [fields[0], fields[6], fields[9], fields[11], fields[12]].join("\t");
+                    })
+                        .join("\n"));
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}

package/packages/daemon/dist/command-center/resources/saved-machine-route.js

@@ -1,12 +1,17 @@
 import { bodyLimit } from "hono/body-limit";
 import { z } from "zod";
 import { SavedMachineRegistrySchema } from "@tmux-ide/contracts";
-import { loadSavedMachines, mergeSavedMachines } from "../../lib/saved-machines.js";
+import { SavedMachineMutationSchema } from "@tmux-ide/contracts/saved-machines";
+import { loadSavedMachines, mergeSavedMachines, updateSavedMachines, } from "../../lib/saved-machines.js";
 import { ownerAuthorityGate } from "../owner-authority.js";
 const Request = z.strictObject({
     expectedInstanceId: z.uuid(),
     registry: SavedMachineRegistrySchema,
 });
+const MutationRequest = z.strictObject({
+    expectedInstanceId: z.uuid(),
+    change: SavedMachineMutationSchema,
+});
 export function mountSavedMachineRoute(app, options) {
     const authorize = ownerAuthorityGate(options.ownerToken, {
         whenOwnerless: "unavailable",
@@ -47,4 +52,38 @@ export function mountSavedMachineRoute(app, options) {
             }, 409);
         }
     });
+    app.patch("/api/resources/saved-machines", bodyLimit({ maxSize: 1024 }), async (c) => {
+        const gate = authorize(c);
+        if (gate)
+            return gate;
+        c.header("Cache-Control", "no-store");
+        let parsed;
+        try {
+            parsed = MutationRequest.safeParse(await c.req.json());
+        }
+        catch {
+            return c.json({ error: "Invalid machine mutation" }, 400);
+        }
+        if (!parsed.success)
+            return c.json({ error: "Invalid machine mutation" }, 400);
+        if (parsed.data.expectedInstanceId !== options.daemon.instanceId)
+            return c.json({ error: "Daemon generation changed" }, 409);
+        const change = parsed.data.change;
+        const { id, operation } = change;
+        try {
+            const registry = (options.update ?? updateSavedMachines)(operation === "remove"
+                ? { type: "remove", id }
+                : {
+                    type: "update",
+                    id,
+                    patch: change.operation === "edit" ? change.patch : { enabled: operation === "enable" },
+                });
+            return c.json({ daemon: options.daemon, registry });
+        }
+        catch {
+            return c.json({
+                error: "Machine not found, edit conflicts with another profile, or registry unavailable; nothing changed",
+            }, 409);
+        }
+    });
 }

package/packages/daemon/dist/command-center/ws-events.js

@@ -1,6 +1,6 @@
 import { createBoundedControlWriter } from "./bounded-control-writer.js";
 import { discoverSessions, buildOverviews, buildProjectDetail } from "./discovery.js";
-import { DaemonFleetFactsObserver, AGENT_STATE_TMUX_ARGS, parseAgentStateFacts, parseSessionCompositionFacts, createDefaultFleetFactsReaders, SESSION_COMPOSITION_TMUX_ARGS, } from "./daemon-fleet-facts-observer.js";
+import { DaemonFleetFactsObserver, createDefaultFleetFactsReaders, createSharedFleetFactsReaders, } from "./daemon-fleet-facts-observer.js";
 import { agentIdForPaneStamp } from "./resources/application-shell.js";
 import { projectRegistryEmitter } from "../lib/project-registry.js";
 import { getDefaultWorkspaceRegistry, isTmuxServerUnavailableError, } from "../lib/workspace-registry.js";
@@ -256,30 +256,11 @@ export function setFleetFactsObserverDiagnostics(diagnostics) {
 /** Pin fleet invalidations to the same tmux authority as catalog HTTP reads. */
 export function setFleetFactsTmuxRunner(runTmux) {
     stopFleetFactsObserver();
-    sessionCompositionReaderOverride = runTmux
-        ? async (signal) => {
-            try {
-                return parseSessionCompositionFacts(await runTmux(SESSION_COMPOSITION_TMUX_ARGS, signal));
-            }
-            catch (error) {
-                // A daemon may legitimately precede the first tmux server. Socket
-                // absence is an authoritative empty fleet baseline, not a failed
-                // observation: catalog clients must be allowed to render their
-                // actionable first-run state while the observer waits for tmux.
-                return isTmuxServerUnavailableError(error) ? parseSessionCompositionFacts("") : null;
-            }
-        }
-        : null;
-    agentStateReaderOverride = runTmux
-        ? async (signal) => {
-            try {
-                return parseAgentStateFacts(await runTmux(AGENT_STATE_TMUX_ARGS, signal));
-            }
-            catch {
-                return null;
-            }
-        }
+    const readers = runTmux
+        ? createSharedFleetFactsReaders(runTmux, isTmuxServerUnavailableError)
         : null;
+    sessionCompositionReaderOverride = readers?.readSessions ?? null;
+    agentStateReaderOverride = readers?.readAgents ?? null;
 }
 function acquireGlobalObserver(kind) {
     let releaseAuthority;

package/packages/daemon/dist/lib/canonical-daemon-bootstrap.js

@@ -133,6 +133,14 @@ async function replaceOlderCanonicalDaemon(deps, info, timeoutMs, expectedProduc
             reason: "identity-mismatch",
         });
     }
+    const supervisor = latest.info.provenance?.supervisor;
+    if (!latest.info.supervisionId && (supervisor === "systemd" || supervisor === "launchd")) {
+        throw new DaemonBootstrapError("incompatible", `The older canonical daemon is managed by ${supervisor} without a supervisor reservation. ` +
+            "Stop and disable the old service, reserve the stopped namespace with " +
+            "tmux-ide daemon reserve-supervisor <id>, then configure the service to run " +
+            "tmux-ide --headless --supervised <id> before restarting it. " +
+            "The existing daemon has been left running.", { reason: "canonical-record-invalid" });
+    }
     await deps.shutdownOlderOwner(info);
     const deadline = deps.now() + timeoutMs;
     while (deps.now() < deadline) {

package/packages/daemon/dist/lib/canonical-daemon.js

@@ -10,7 +10,12 @@ const MAX_DAEMON_INFO_BYTES = 64 * 1024;
 const MAX_DAEMON_CLAIM_BYTES = 4 * 1024;
 const activeClaims = new Map();
 export function getCanonicalDaemonInfoPath() {
-    return runtimeOwnedPath(join(resolveRuntimeNamespace().daemonInfoDir, DAEMON_INFO_FILE));
+    const namespace = resolveRuntimeNamespace();
+    const path = join(namespace.daemonInfoDir, DAEMON_INFO_FILE);
+    // Resolution already validates ordinary and isolated namespaces. Only
+    // development adds a per-path containment check; do not resolve twice on
+    // every ordinary daemon read. Each call still resolves the current namespace.
+    return namespace.development ? runtimeOwnedPath(path) : path;
 }
 export function getCanonicalDaemonClaimPath() {
     return join(dirname(getCanonicalDaemonInfoPath()), DAEMON_CLAIM_DIR);
@@ -472,10 +477,31 @@ export function assertCanonicalDaemonSupervision(supervisionId) {
         throw new Error("Matching supervisor reservation required before startup");
 }
 /** Explicit installation only; startup never calls this to recreate a reservation. */
+/** Sanitized reservation guidance; never includes credentials or filesystem errors. */
+export class CanonicalDaemonReservationError extends Error {
+    constructor(message) {
+        super(`Supervisor reservation refused: ${message}`);
+        this.name = "CanonicalDaemonReservationError";
+    }
+}
+function reservationRefusal(attempt) {
+    if (attempt.status === "busy")
+        return new CanonicalDaemonReservationError(`another lifecycle operation holds the namespace (PID ${attempt.owner.pid}). Wait for it to finish, then retry.`);
+    const state = inspectCanonicalDaemonInfo();
+    if (state.status === "valid")
+        return new CanonicalDaemonReservationError(`the recorded ${state.info.supervisionId ? "supervised" : "unsupervised"} daemon (PID ${state.info.pid}) has not been released. Inspect it with tmux-ide daemon info --json, then stop it through its owning process or service before reserving.`);
+    if (state.status === "reserved")
+        return new CanonicalDaemonReservationError(`this namespace is reserved for supervisor ${state.reservation.supervisionId}. Remove that service and release its reservation before assigning a different ID.`);
+    if (state.status === "invalid")
+        return new CanonicalDaemonReservationError(`the namespace record cannot be trusted (${state.reason}). Run tmux-ide daemon info --json for diagnosis; repair ownership or permissions before retrying.`);
+    return new CanonicalDaemonReservationError("the namespace changed or its lifecycle claim is unavailable. Run tmux-ide daemon info --json, then retry after the owning operation finishes.");
+}
 export function reserveCanonicalDaemonSupervision(supervisionId) {
+    if (!DaemonSupervisionIdSchema.safeParse(supervisionId).success)
+        throw new CanonicalDaemonReservationError("use a 1–128 character ID starting with a letter or digit and containing only letters, digits, periods, underscores or hyphens.");
     const attempt = tryAcquireCanonicalDaemonClaim({ kind: "reserve", supervisionId });
     if (attempt.status !== "acquired")
-        throw new Error("Cannot reserve supervised daemon namespace");
+        throw reservationRefusal(attempt);
     const claim = attempt.claim;
     try {
         const before = inspectCanonicalDaemonInfo();

package/packages/daemon/dist/lib/daemon-embed.js

@@ -989,7 +989,7 @@ async function startEmbeddedDaemonGeneration(opts) {
                         if (!sessionRuntimeRegistry)
                             throw new Error("Session runtime unavailable");
                         return sessionRuntimeRegistry.executeWindowLinkAction(session, action);
-                    });
+                    }, timing);
                 }
                 if (intent.verb === "workspace.pane.resize") {
                     return workspaceMultiplexer.mutateResize({ operationId, expectedDaemonInstanceId: instanceId, intent }, (session) => {

package/packages/daemon/dist/lib/daemon-service-manager.js

@@ -0,0 +1,122 @@
+import { execFile } from "node:child_process";
+const runCommand = (file, args) => new Promise((resolve) => {
+    execFile(file, [...args], {
+        encoding: "utf8",
+        timeout: 15_000,
+        maxBuffer: 256 * 1024,
+        env: { ...process.env, LC_ALL: "C", LANG: "C" },
+    }, (error, stdout, stderr) => resolve({
+        code: error ? (typeof error.code === "number" ? error.code : null) : 0,
+        stdout,
+        stderr,
+    }));
+});
+export class DaemonServiceManagerError extends Error {
+    operation;
+    manager;
+    code = "DAEMON_SERVICE_MANAGER_FAILED";
+    constructor(operation, manager) {
+        super(`${manager} user service ${operation} failed; check the user manager and service logs`);
+        this.operation = operation;
+        this.manager = manager;
+        this.name = "DaemonServiceManagerError";
+    }
+}
+/** Bounded argv-only OS boundary. Never expose manager output (it may contain environment data). */
+export function createDaemonServiceManager(plan, run = runCommand) {
+    const launchd = plan.manager === "launchd";
+    const file = launchd ? "/bin/launchctl" : "systemctl";
+    const domain = plan.target.slice(0, plan.target.lastIndexOf("/"));
+    const command = async (operation, args) => {
+        const result = await run(file, launchd ? args : ["--user", ...args]);
+        if (result.code !== 0)
+            throw new DaemonServiceManagerError(operation, plan.manager);
+        return result;
+    };
+    return {
+        async available() {
+            await command("availability check", launchd ? ["print-disabled", domain] : ["show-environment"]);
+        },
+        async inspect() {
+            const result = await run(file, launchd
+                ? ["print", plan.target]
+                : [
+                    "--user",
+                    "show",
+                    plan.target,
+                    "--property=LoadState,ActiveState,MainPID,FragmentPath",
+                ]);
+            const absent = { loaded: false, active: false, pid: null, definitionPath: null };
+            if (launchd) {
+                if (result.code === 113 && result.stderr.includes("Could not find service"))
+                    return absent;
+                if (result.code !== 0)
+                    throw new DaemonServiceManagerError("inspection", plan.manager);
+                const field = (name) => result.stdout.match(new RegExp(`^\\t${name} = (.*)$`, "m"))?.[1];
+                const path = field("path");
+                const pidText = field("pid");
+                const state = field("state");
+                if (!path || !state || (pidText !== undefined && !/^[1-9][0-9]*$/u.test(pidText)))
+                    throw new DaemonServiceManagerError("inspection format", plan.manager);
+                return {
+                    loaded: true,
+                    active: state === "running",
+                    pid: pidText ? Number(pidText) : null,
+                    definitionPath: path,
+                };
+            }
+            const fields = new Map();
+            for (const line of result.stdout.trim().split("\n")) {
+                const index = line.indexOf("=");
+                if (index < 1 || fields.has(line.slice(0, index)))
+                    throw new DaemonServiceManagerError("inspection format", plan.manager);
+                fields.set(line.slice(0, index), line.slice(index + 1));
+            }
+            if (fields.get("LoadState") === "not-found" && (result.code === 0 || result.code === 4))
+                return absent;
+            if (result.code !== 0 || fields.get("LoadState") !== "loaded" || !fields.has("ActiveState"))
+                throw new DaemonServiceManagerError("inspection", plan.manager);
+            const pidText = fields.get("MainPID");
+            const path = fields.get("FragmentPath");
+            if (!pidText || !/^(0|[1-9][0-9]*)$/u.test(pidText) || !path)
+                throw new DaemonServiceManagerError("inspection format", plan.manager);
+            return {
+                loaded: true,
+                active: fields.get("ActiveState") === "active",
+                pid: Number(pidText) || null,
+                definitionPath: path,
+            };
+        },
+        async install() {
+            if (launchd)
+                await command("bootstrap", ["bootstrap", domain, plan.unitPath]);
+            else {
+                await command("reload", ["daemon-reload"]);
+                // The manager may have a different XDG_CONFIG_HOME from the invoking
+                // shell. Enable the owned file explicitly so it is linked into its search path.
+                await command("enable/start", ["enable", "--now", plan.unitPath]);
+            }
+        },
+        async restart(hasProcess = true) {
+            // An explicit recovery after a failed launcher must also clear systemd's
+            // start-rate counter. The lifecycle owner has already verified this unit's
+            // private definition and reservation; never reset all user units.
+            if (!launchd && !hasProcess)
+                await command("reset failed state", ["reset-failed", plan.target]);
+            // KeepAlive relaunches after a graceful TERM. kickstart -k would force-kill
+            // the daemon instead of allowing canonical ownership to be released.
+            await command("restart", launchd
+                ? hasProcess
+                    ? ["kill", "SIGTERM", plan.target]
+                    : ["kickstart", plan.target]
+                : ["restart", plan.target]);
+        },
+        async stop() {
+            await command("stop/remove", launchd ? ["bootout", plan.target] : ["disable", "--now", plan.target]);
+        },
+        async reload() {
+            if (!launchd)
+                await command("reload", ["daemon-reload"]);
+        },
+    };
+}

package/packages/daemon/dist/lib/daemon-service-plan.js

@@ -0,0 +1,127 @@
+import { createHash } from "node:crypto";
+import { isAbsolute, join } from "node:path";
+import { runtimeNamespaceEnvironment } from "./runtime-namespace.js";
+function safeValue(value, name) {
+    if (!value || [...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+        throw new TypeError(`${name} must be nonempty and contain no control characters`);
+    return value;
+}
+function absolute(value, name) {
+    safeValue(value, name);
+    if (!isAbsolute(value))
+        throw new TypeError(`${name} must be an absolute path`);
+    return value;
+}
+function xml(value) {
+    return value.replace(/[&<>"']/gu, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[char]);
+}
+// systemd applies specifier expansion to paths, environment values and ExecStart.
+// ExecStart additionally expands dollars unless the ':' executable prefix is used.
+function systemd(value) {
+    return `"${value.replace(/%/gu, "%%").replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`;
+}
+/** Pure rendering only. Reservation and OS-manager mutations belong to the lifecycle owner. */
+export function planDaemonService(options) {
+    const { namespace } = options;
+    if (options.platform !== "darwin" && options.platform !== "linux")
+        throw new TypeError("Daemon services support macOS launchd and Linux systemd user managers");
+    if (!Number.isSafeInteger(options.uid) || options.uid <= 0)
+        throw new TypeError("Daemon services require a non-root user");
+    if (namespace.mode === "development")
+        throw new TypeError("Development instances own their lifecycle; use dev:instance instead");
+    const home = absolute(options.home, "Home directory");
+    const executable = absolute(options.executable, "Stable CLI executable");
+    // Keep the supplied stable launcher path. realpath would pin installer services
+    // to a retired version instead of following the next verified activation.
+    const identity = createHash("sha256")
+        .update(absolute(namespace.daemonInfoDir, "Daemon state directory"))
+        .digest("hex")
+        .slice(0, 24);
+    const supervisionId = `tmux-ide.${identity}`;
+    const stdoutPath = join(namespace.daemonInfoDir, "service.stdout.log");
+    const stderrPath = join(namespace.daemonInfoDir, "service.stderr.log");
+    const environment = {
+        HOME: home,
+        PATH: safeValue(options.path, "Service PATH"),
+        ...runtimeNamespaceEnvironment(namespace),
+        TMUX_IDE_CONFIG: namespace.configPath,
+        TMUX_IDE_SETTINGS_DIR: namespace.settingsDir,
+        TMUX_IDE_CLAUDE_DIR: namespace.claudeDir,
+        TMUX_IDE_CLAUDE_SETTINGS: namespace.claudeSettingsPath,
+        TMUX_IDE_CLAUDE_HOOK_PATH: namespace.claudeHookPath,
+        TMUX_IDE_OPENCODE_DIR: namespace.opencodeDir,
+    };
+    for (const [name, value] of Object.entries(environment))
+        safeValue(value, name);
+    const args = [executable, "--headless", "--supervised", supervisionId];
+    const shared = {
+        supervisionId,
+        executable,
+        recordPath: join(namespace.daemonInfoDir, "service.json"),
+        stdoutPath,
+        stderrPath,
+    };
+    if (options.platform === "darwin") {
+        const label = `com.${supervisionId}`;
+        const string = (value) => `<string>${xml(value)}</string>`;
+        return Object.freeze({
+            ...shared,
+            manager: "launchd",
+            target: `gui/${options.uid}/${label}`,
+            unitPath: join(home, "Library", "LaunchAgents", `${label}.plist`),
+            contents: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key>${string(label)}
+<key>ProgramArguments</key><array>${args.map(string).join("")}</array>
+<key>EnvironmentVariables</key><dict>${Object.entries(environment)
+                .map(([key, value]) => `<key>${xml(key)}</key>${string(value)}`)
+                .join("")}</dict>
+<key>WorkingDirectory</key>${string(home)}
+<key>RunAtLoad</key><true/>
+<key>KeepAlive</key><true/>
+<key>ThrottleInterval</key><integer>3</integer>
+<key>ExitTimeOut</key><integer>30</integer>
+<key>AbandonProcessGroup</key><true/>
+<key>StandardOutPath</key>${string(stdoutPath)}
+<key>StandardErrorPath</key>${string(stderrPath)}
+</dict></plist>
+`,
+        });
+    }
+    const configHome = absolute(options.configHome ?? join(home, ".config"), "Config directory");
+    const target = `${supervisionId}.service`;
+    // WorkingDirectory is a raw path, not an ExecStart-style quoted word.
+    // The equivalent '/.' suffix preserves trailing spaces/backslashes without
+    // allowing the unit parser to trim them or treat them as line continuation.
+    const workingDirectory = `${home.replace(/%/gu, "%%")}/.`;
+    return Object.freeze({
+        ...shared,
+        manager: "systemd",
+        target,
+        unitPath: join(configHome, "systemd", "user", target),
+        contents: `[Unit]
+Description=tmux-ide canonical user daemon
+StartLimitIntervalSec=60
+StartLimitBurst=10
+
+[Service]
+Type=exec
+ExecStart=:${args.map(systemd).join(" ")}
+WorkingDirectory=${workingDirectory}
+${Object.entries(environment)
+            .map(([key, value]) => `Environment=${systemd(`${key}=${value}`)}`)
+            .join("\n")}
+Restart=always
+RestartSec=3
+TimeoutStopSec=30
+# tmux pane work has an independent lifetime; never kill the whole service cgroup.
+KillMode=process
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=default.target
+`,
+    });
+}