tmux-ide 2.9.2 → 2.9.4

package/packages/daemon/dist/terminal/mirror/mirror-service.js

@@ -1,3 +1,5 @@
+import { SharedWindowIndex } from "./shared-window-index.js";
+import { RegisteredWindowGuard } from "./registered-window-guard.js";
 import { accessSync, constants, realpathSync, statSync } from "node:fs";
 import { isAbsolute } from "node:path";
 import { resolveTmuxExecutable, tmuxClientEnvironment } from "../../lib/tmux-client-execution.js";
@@ -21,6 +23,45 @@ import { controlModeAuthorityKey, processControlModeOwnershipRegistry, } from ".
 export class MirrorService {
     opts;
     channels = new Map();
+    sharedWindows = new SharedWindowIndex();
+    channelSessions = new Map();
+    registeredWindows = null;
+    registeredConflicts = new Set();
+    setRegisteredWindowReader(reader) {
+        this.registeredWindows?.dispose();
+        const guard = new RegisteredWindowGuard(reader);
+        this.registeredWindows = guard;
+        this.invalidateRegisteredWindows();
+        return {
+            invalidate: () => {
+                if (this.registeredWindows === guard)
+                    this.invalidateRegisteredWindows();
+            },
+            dispose: () => guard.dispose(),
+        };
+    }
+    invalidateRegisteredWindows() {
+        this.registeredWindows?.invalidate();
+    }
+    async verifyRegisteredWindows() {
+        const guard = this.registeredWindows;
+        if (!guard)
+            return;
+        await guard.verify();
+        if (guard !== this.registeredWindows || this.disposed)
+            throw new Error("Window ownership changed during discovery");
+        for (const [channel, session] of this.channelSessions) {
+            if (guard.blocked(session)) {
+                channel.setGeometryParticipation(false);
+                if (!this.registeredConflicts.has(session)) {
+                    this.registeredConflicts.add(session);
+                    this.opts.onSharedWindowConflict?.(session, true);
+                }
+            }
+            else
+                this.registeredConflicts.delete(session);
+        }
+    }
     pendingDisposals = new Set();
     drainingChannels = new Map();
     sessionExitListeners = new Set();
@@ -101,8 +142,14 @@ export class MirrorService {
             reseed: () => handle.reseed(),
             readHistorySize: () => handle.readHistorySize(),
             captureNativeBacking: () => handle.captureNativeBacking(),
-            sendText: (text) => handle.sendText(text),
-            sendKey: (key) => handle.sendKey(key),
+            sendText: (text) => {
+                this.assertWindowOwnership(request.session);
+                handle.sendText(text);
+            },
+            sendKey: (key) => {
+                this.assertWindowOwnership(request.session);
+                handle.sendKey(key);
+            },
             close: async () => {
                 if (closed)
                     return;
@@ -157,6 +204,7 @@ export class MirrorService {
         return (args) => {
             if (entry.retired || this.channels.get(session) !== entry)
                 return Promise.reject(new Error("Resize mirror session retired"));
+            this.assertWindowOwnership(session);
             return run(args);
         };
     }
@@ -164,6 +212,7 @@ export class MirrorService {
         const entry = this.channels.get(session);
         if (!entry || entry.retired)
             throw new Error(`Mirror session ${session} is unavailable`);
+        this.assertWindowOwnership(session);
         return entry.channel.executeWindowLinkAction(request);
     }
     /** Synchronous hot input on an already-retained SessionRuntime channel. */
@@ -171,30 +220,66 @@ export class MirrorService {
         const entry = this.channels.get(session);
         if (!entry || entry.retired)
             throw new Error(`Mirror session ${session} is unavailable`);
+        this.assertWindowOwnership(session);
         entry.channel.sendText(semanticPaneId, text, performanceTraceId, isolated);
     }
     sendBytes(session, semanticPaneId, data, performanceTraceId) {
         const entry = this.channels.get(session);
         if (!entry || entry.retired)
             throw new Error(`Mirror session ${session} is unavailable`);
+        this.assertWindowOwnership(session);
         entry.channel.sendBytes(semanticPaneId, data, performanceTraceId);
     }
     sendKey(session, semanticPaneId, key, performanceTraceId) {
         const entry = this.channels.get(session);
         if (!entry || entry.retired)
             throw new Error(`Mirror session ${session} is unavailable`);
+        this.assertWindowOwnership(session);
         entry.channel.sendKey(semanticPaneId, key, performanceTraceId);
     }
+    assertWindowOwnership(session) {
+        const message = this.windowOwnershipMessage(session);
+        if (message)
+            throw new Error(message);
+    }
+    windowOwnershipMessage(session) {
+        if (this.registeredWindows?.pending())
+            return "Window ownership is being verified. Retry after session discovery completes.";
+        if (this.hasSharedWindowConflict(session))
+            return "Linked windows across registered sessions are unsupported. Unlink the shared window before controlling this session.";
+        return null;
+    }
+    hasSharedWindowConflict(session) {
+        const entry = this.channels.get(session);
+        return ((this.registeredWindows?.blocked(session) ?? false) ||
+            (!!entry && this.sharedWindows.conflicted(entry.channel)));
+    }
+    updateWindowMembership(channel, windows) {
+        // A topology read may finish after retirement. It must not resurrect the
+        // old channel's membership or conflict with its replacement.
+        if (!this.channelSessions.has(channel))
+            return;
+        for (const [peer, conflict] of this.sharedWindows.update(channel, windows)) {
+            const session = this.channelSessions.get(peer);
+            if (session === undefined)
+                continue;
+            if (conflict)
+                peer.setGeometryParticipation(false);
+            this.opts.onSharedWindowConflict?.(session, conflict);
+        }
+    }
     fitViewport(session, cols, rows) {
         const entry = this.channels.get(session);
         if (!entry || entry.retired)
             throw new Error(`Mirror session ${session} is unavailable`);
+        this.assertWindowOwnership(session);
         entry.channel.fitViewport(cols, rows);
     }
     fitWindowViewport(session, semanticWindowId, cols, rows) {
         const entry = this.channels.get(session);
         if (!entry || entry.retired)
             throw new Error(`Mirror session ${session} is unavailable`);
+        this.assertWindowOwnership(session);
         entry.channel.fitWindowViewport(semanticWindowId, cols, rows);
     }
     clearWindowViewports(session) {
@@ -207,7 +292,7 @@ export class MirrorService {
         const entry = this.channels.get(session);
         if (!entry || entry.retired)
             return;
-        entry.channel.setGeometryParticipation(active);
+        entry.channel.setGeometryParticipation(active && !this.hasSharedWindowConflict(session));
     }
     /**
      * Keep one session channel alive independently of renderer subscriptions.
@@ -248,11 +333,14 @@ export class MirrorService {
     }
     async dispose() {
         this.disposed = true;
+        this.registeredWindows?.dispose();
         this.sessionExitListeners.clear();
         const entries = [...this.channels.values()];
         this.channels.clear();
         await Promise.allSettled(entries.map(async (entry) => {
             entry.retired = true;
+            this.updateWindowMembership(entry.channel, []);
+            this.channelSessions.delete(entry.channel);
             try {
                 await entry.channel.dispose();
             }
@@ -297,6 +385,13 @@ export class MirrorService {
                 const environment = Object.freeze(tmuxClientEnvironment(process.env, executable ?? this.opts.executable));
                 const channelOptions = {
                     session,
+                    onWindowMembership: (windows) => this.updateWindowMembership(channel, windows),
+                    hasSharedWindowConflict: () => this.hasSharedWindowConflict(session),
+                    beforeIdentityRepair: () => this.verifyRegisteredWindows(),
+                    onWindowTopologyChanged: () => {
+                        if (this.channelSessions.has(channel))
+                            this.invalidateRegisteredWindows();
+                    },
                     ownedViewer,
                     createIo: (handlers) => this.opts.createIo?.(session, handlers) ??
                         new MirrorControlChannel({
@@ -363,6 +458,7 @@ export class MirrorService {
                 releaseAuthority();
                 throw cause;
             }
+            this.channelSessions.set(channel, session);
             entry = {
                 channel,
                 started: channel.start(),
@@ -400,6 +496,8 @@ export class MirrorService {
         if (entry.retired)
             return;
         entry.retired = true;
+        this.updateWindowMembership(entry.channel, []);
+        this.channelSessions.delete(entry.channel);
         if (this.channels.get(session) === entry)
             this.channels.delete(session);
         const disposal = entry.channel

package/packages/daemon/dist/terminal/mirror/registered-window-guard.js

@@ -0,0 +1,62 @@
+/** A bounded registration/topology proof, shared by all retained channels. */
+export class RegisteredWindowGuard {
+    reader;
+    #epoch = 0;
+    #current = false;
+    #disposed = false;
+    #conflicts = new Set();
+    #read = null;
+    constructor(reader) {
+        this.reader = reader;
+    }
+    blocked(session) {
+        return !this.#current || this.#conflicts.has(session);
+    }
+    pending() {
+        return !this.#current;
+    }
+    invalidate() {
+        this.#epoch++;
+        this.#current = false;
+        this.#read?.abort.abort();
+        this.#read = null;
+    }
+    dispose() {
+        this.#disposed = true;
+        this.invalidate();
+    }
+    async verify() {
+        if (this.#disposed)
+            throw new Error("Registered window inventory is disposed");
+        if (this.#current)
+            return;
+        if (this.#read)
+            return this.#read.promise;
+        const epoch = this.#epoch;
+        const abort = new AbortController();
+        const promise = Promise.resolve()
+            .then(async () => {
+            abort.signal.throwIfAborted();
+            const rows = await this.reader(abort.signal);
+            abort.signal.throwIfAborted();
+            if (epoch !== this.#epoch)
+                throw new Error("Window ownership changed during discovery");
+            const owners = new Map();
+            for (const row of rows) {
+                const sessions = owners.get(row.window) ?? new Set();
+                sessions.add(row.session);
+                owners.set(row.window, sessions);
+            }
+            this.#conflicts = new Set([...owners.values()]
+                .filter((sessions) => sessions.size > 1)
+                .flatMap((sessions) => [...sessions]));
+            this.#current = true;
+        })
+            .finally(() => {
+            if (this.#read?.abort === abort)
+                this.#read = null;
+        });
+        this.#read = { abort, promise };
+        return promise;
+    }
+}

package/packages/daemon/dist/terminal/mirror/session-channel.js

@@ -53,7 +53,10 @@ const STRUCTURAL_NOTIFICATIONS = new Set([
     "window-add",
     "window-close",
     "window-renamed",
+    "unlinked-window-add",
     "unlinked-window-close",
+    "session-renamed",
+    "sessions-changed",
 ]);
 const NATIVE_CLIENT_NOTIFICATIONS = new Set([
     "client-attached",
@@ -193,6 +196,7 @@ export class SessionChannel {
     nativeClientProbePending = false;
     // Native captures fence every geometry event; inventory fences identity only.
     windowAuthorityOrdinal = 0;
+    layoutNotificationOrdinals = new Map();
     windowIdentityOrdinal = 0;
     paneIncarnation = 0;
     recoveryOrdinal = 0;
@@ -764,8 +768,25 @@ export class SessionChannel {
         }
         this.input.flush();
         this.clearWindowViewports();
+        this.restoreWindowSizing(this.attachedIdentity?.runtimeSessionId ?? `=${this.opts.session}`);
         this.io.send(`refresh-client -C ${cols}x${rows}`);
     }
+    restoreWindowSizing(target) {
+        if (!this.geometryParticipating)
+            return;
+        // resize-window pins a window (including through inherited session options).
+        // Evaluate inside the existing control connection: no shell, polling, or extra
+        // request/response round trip. The shell also pre-fits hidden windows;
+        // only the active window may have its manual policy repaired.
+        const quoted = tmuxSingleQuote(target);
+        // if-shell emits its own reply and the selected branch emits another.
+        // Keep both branches at one command so either policy consumes exactly two
+        // FIFO slots; a discard-only send would misroute the next capture replies.
+        this.io.commandListInline(`if-shell -F -t ${quoted} '#{&&:#{window_active},#{==:#{window-size},manual}}' ` +
+            tmuxSingleQuote(`set-option -w -t ${quoted} window-size latest`) +
+            " " +
+            tmuxSingleQuote(`display-message -p -t ${quoted} ''`), 2, 1, () => { });
+    }
     /**
      * Experimental: window-specific overrides stay private to this control client.
      * Native tmux still falls back to the client size for unscoped neighbours;
@@ -788,6 +809,7 @@ export class SessionChannel {
         if (previous?.cols === cols && previous.rows === rows)
             return;
         this.input.flush();
+        this.restoreWindowSizing(window.runtimeId);
         this.io.send(`refresh-client -C ${window.runtimeId}:${cols}x${rows}`);
         this.fittedWindows.set(window.runtimeId, { cols, rows });
     }
@@ -863,6 +885,7 @@ export class SessionChannel {
             pane.subs.clear();
         }
         this.pendingLayoutOutput.clear();
+        this.layoutNotificationOrdinals.clear();
         this.layoutSubscribers.clear();
         this.layoutAuthoritySubscribers.clear();
         await this.io.dispose();
@@ -2303,6 +2326,13 @@ export class SessionChannel {
         pane.scrollOnClear = value === "0" || value === "1" ? value === "1" : undefined;
     }
     onNotify(name, rest) {
+        if (name === "window-add" ||
+            name === "window-close" ||
+            name === "unlinked-window-add" ||
+            name === "unlinked-window-close" ||
+            name === "session-renamed" ||
+            name === "sessions-changed")
+            this.opts.onWindowTopologyChanged?.();
         if (name === "subscription-changed") {
             const policy = /^tmux-ide-scroll-on-clear\s+\$[0-9]+\s+@[0-9]+\s+[0-9]+\s+(%[0-9]+)\s+:\s+([01])\s*$/u.exec(rest);
             if (policy) {
@@ -2420,6 +2450,7 @@ export class SessionChannel {
                 this.scheduleSync(); // never guess from a failed parse
                 return;
             }
+            this.layoutNotificationOrdinals.set(change.windowId, this.windowAuthorityOrdinal);
             const pendingLayout = {
                 ...parsed,
                 zoomed: change.zoomed,
@@ -2715,9 +2746,12 @@ export class SessionChannel {
         const previousCurrentWindow = this.currentWindow;
         const { listed, movedWindowRuntimeIds } = this.applyPaneTruth(truth);
         await this.syncWindows(this.opts.session, movedWindowRuntimeIds, previousCurrentWindow, syncOrdinal);
-        for (const pane of this.panesByRuntime.values())
+        for (const pane of this.panesByRuntime.values()) {
+            if (pane.windowRuntimeId && this.pendingLayoutOutput.has(pane.windowRuntimeId))
+                continue;
             for (const sub of pane.subs)
                 sub.resumeLayoutCapture?.(syncOrdinal);
+        }
         this.discovery.discover(listed);
     }
     applyPaneTruth(truth) {
@@ -2957,6 +2991,27 @@ export class SessionChannel {
         return stage.repairedIdentity;
     }
     commitWindowStage(stage, requiredLayoutEmits = new Set(), previousCurrentWindow = this.currentWindow, syncOrdinal) {
+        // Control notifications in the same read chunk run before a promise-based
+        // inventory read resumes. Preserve newer geometry (and its pending border
+        // query) rather than letting that older inventory erase the notification.
+        const newerLayouts = new Set([...this.layoutNotificationOrdinals]
+            .filter(([, ordinal]) => ordinal > stage.observedAuthorityOrdinal)
+            .map(([runtimeId]) => runtimeId));
+        if (newerLayouts.size > 0) {
+            stage = { ...stage, windows: new Map(stage.windows), layouts: new Map(stage.layouts) };
+            for (const runtimeId of newerLayouts) {
+                const currentLayout = this.layoutByWindow.get(runtimeId);
+                const currentWindow = this.windowsByRuntime.get(runtimeId);
+                const stagedWindow = stage.windows.get(runtimeId);
+                if (currentLayout && currentWindow && stagedWindow) {
+                    stage.layouts.set(runtimeId, currentLayout);
+                    stage.windows.set(runtimeId, {
+                        ...stagedWindow,
+                        paneBorderStatus: currentWindow.paneBorderStatus,
+                    });
+                }
+            }
+        }
         this.windowLinkAuthority?.reconcile(stage.links);
         this.latestWindowStage = stage;
         const changedWindows = new Set();
@@ -3008,10 +3063,14 @@ export class SessionChannel {
             ? new Set(stage.windows.keys())
             : new Set([...changedWindows, ...requiredLayoutEmits, ...this.pendingLayoutOutput.keys()].filter((runtimeId) => stage.windows.has(runtimeId)));
         for (const runtimeId of this.pendingLayoutOutput.keys())
-            if (!stage.windows.has(runtimeId))
+            if (!stage.windows.has(runtimeId) && !newerLayouts.has(runtimeId))
                 this.pendingLayoutOutput.delete(runtimeId);
+        for (const runtimeId of this.layoutNotificationOrdinals.keys())
+            if (!stage.windows.has(runtimeId) && !newerLayouts.has(runtimeId))
+                this.layoutNotificationOrdinals.delete(runtimeId);
         for (const runtimeId of layoutEmits)
-            this.releasePendingLayout(runtimeId, syncOrdinal);
+            if (!newerLayouts.has(runtimeId) || !this.pendingLayoutOutput.has(runtimeId))
+                this.releasePendingLayout(runtimeId, syncOrdinal);
         this.emitLayoutAuthority();
     }
     // Inventory establishes pane/window identity, not a frozen terminal size.
@@ -3043,6 +3102,7 @@ export class SessionChannel {
         return true;
     }
     async stageWindows(target = this.opts.session) {
+        const observedAuthorityOrdinal = this.windowAuthorityOrdinal;
         const lines = await this.io.request(`list-windows -t "${target}" -F "#{window_id}\t#{qa:@tmux_ide_window_id}\t#{qa:window_name}\t#{window_active}\t#{window_visible_layout}\t#{?window_zoomed_flag,1,0}\t#{pane-border-status}\t#{window_layout}\t#{mode-keys}\t#{window_index}"`);
         if (lines.length > WINDOW_LINK_MAX_LINKS)
             throw new Error("Window link observation exceeds bound");
@@ -3115,6 +3175,10 @@ export class SessionChannel {
                 throw new Error(`full window layout for ${this.opts.session} is malformed`);
             nextLayoutByWindow.set(row.runtimeId, { ...parsed, zoomed: row.zoomed, unzoomed });
         }
+        // Publish validated physical membership before any identity repair writes.
+        // The receiving session may introduce duplicate stamps by linking a window.
+        this.opts.onWindowMembership?.([...backingRows.keys()]);
+        await this.opts.beforeIdentityRepair?.();
         // Valid unique stamps are identity; missing/invalid/duplicated stamps are
         // ALL regenerated and stamped back (the pane policy, applied to windows).
         const stampCounts = new Map();
@@ -3133,7 +3197,7 @@ export class SessionChannel {
             if (row.stamp && stampCounts.get(row.stamp) === 1) {
                 semanticId = row.stamp;
             }
-            else {
+            else if (!this.opts.hasSharedWindowConflict?.()) {
                 repairedIdentity = true;
                 let candidate = null;
                 for (let attempt = 0; attempt < 32 && !candidate; attempt += 1) {
@@ -3167,6 +3231,7 @@ export class SessionChannel {
             });
         }
         return {
+            observedAuthorityOrdinal,
             windows: next,
             layouts: nextLayoutByWindow,
             currentWindow: nextCurrentWindow,
@@ -3182,6 +3247,10 @@ export class SessionChannel {
     async reconcileIdentity(descriptors, listed) {
         if (this.disposed)
             return false;
+        if (this.opts.hasSharedWindowConflict?.()) {
+            this.settleFirstJoin();
+            return false;
+        }
         const snapshots = descriptors
             .filter((descriptor) => listed.has(descriptor.runtimePaneId))
             .map((descriptor) => ({
@@ -3309,6 +3378,8 @@ export class SessionChannel {
         return plan.stampEffects.length > 0;
     }
     async repairTrustedPaneIdentity(descriptors, layouts) {
+        if (this.opts.hasSharedWindowConflict?.())
+            throw new Error("Linked windows across controlled sessions are unsupported. Unlink the shared window before controlling this session.");
         const rectForRuntime = (runtimePaneId) => {
             for (const layout of layouts.values()) {
                 const leaf = layout.leaves.find(({ id }) => id === runtimePaneId);

package/packages/daemon/dist/terminal/mirror/shared-window-index.js

@@ -0,0 +1,45 @@
+/** Event-fed physical window membership for one pinned tmux server. */
+export class SharedWindowIndex {
+    #windows = new Map();
+    #owners = new Map();
+    #conflicts = new Set();
+    conflicted(owner) {
+        return this.#conflicts.has(owner);
+    }
+    update(owner, windows) {
+        const previous = this.#owners.get(owner) ?? new Set();
+        const next = new Set(windows);
+        const affected = new Set([owner]);
+        for (const window of new Set([...previous, ...next])) {
+            for (const peer of this.#windows.get(window) ?? [])
+                affected.add(peer);
+            if (previous.has(window) && !next.has(window)) {
+                const peers = this.#windows.get(window);
+                peers.delete(owner);
+                if (!peers.size)
+                    this.#windows.delete(window);
+            }
+            if (next.has(window)) {
+                const peers = this.#windows.get(window) ?? new Set();
+                peers.add(owner);
+                this.#windows.set(window, peers);
+            }
+        }
+        if (next.size)
+            this.#owners.set(owner, next);
+        else
+            this.#owners.delete(owner);
+        const changed = new Map();
+        for (const peer of affected) {
+            const conflict = [...(this.#owners.get(peer) ?? [])].some((window) => (this.#windows.get(window)?.size ?? 0) > 1);
+            if (conflict === this.#conflicts.has(peer))
+                continue;
+            if (conflict)
+                this.#conflicts.add(peer);
+            else
+                this.#conflicts.delete(peer);
+            changed.set(peer, conflict);
+        }
+        return changed;
+    }
+}

package/packages/daemon/dist/terminal/pane-stream/pane-stream-websocket.js

@@ -1691,7 +1691,17 @@ export class PaneStreamLiveConnection {
             if (!this.#sessionRuntimeBinding?.requestAuthority ||
                 !this.#sessionRuntimeBinding.authoritySnapshot)
                 return this.#failProtocol("protocol-error");
-            const lease = this.#sessionRuntimeBinding.requestAuthority(frame.authority);
+            let lease = null;
+            try {
+                lease = this.#sessionRuntimeBinding.requestAuthority(frame.authority);
+            }
+            catch (error) {
+                // Topology changes can temporarily prevent ownership. Reject this
+                // request without letting an expected conflict terminate the daemon.
+                if (!(error instanceof SessionRuntimeControllerLeaseError) ||
+                    error.code !== "controller-conflict")
+                    return this.#failProtocol("input-rejected");
+            }
             if (lease)
                 this.#requestedAuthorities.add(frame.authority);
             this.#sendFrame(null, {

package/packages/daemon/dist/terminal/session-runtime/multiplexer-backend.js

@@ -102,6 +102,7 @@ export function createSessionRuntimeMultiplexerBackend(options) {
             if (!ownerAuthorized) {
                 throw new Error("Semantic mutation requires a live host, pane, or owner principal");
             }
+            await options.registry.verifyWindowOwnership();
             const owner = acquireOwner(session);
             try {
                 let lease;