tmux-ide 2.9.5 → 2.9.6

package/packages/daemon/dist/terminal/protocol/layout-parse.js

@@ -19,6 +19,24 @@
  * Everything here is unit-tested against layout strings captured from a real
  * tmux 3.7b server (splits, zoom, storms) — no tmux at test time.
  */
+// Internal parsing bound, matching fleet catalog capacity. This is NOT the
+// smaller pane-stream publication limit; future wire callers must enforce that.
+const MAX_TREE_LEAVES = 512;
+/**
+ * Bounded ancestry parser, deliberately stricter than the legacy flat parser.
+ * Up to 512 leaves (fleet catalog bound), 1023 nodes, depth 64 and 64 KiB.
+ * Validates exact ordered tiling with one separator cell, including parent
+ * bounds. The checksum prefix is grammar only, not an authenticity proof.
+ */
+export function parseLayoutTree(layout) {
+    if (layout.length > 64 * 1024 || !/^[0-9a-fA-F]{4},/.test(layout))
+        return null;
+    const s = layout.slice(5);
+    const root = parseCell(s, 0, [], { nodes: 0, ids: new Set() });
+    if (!root?.node || root.pos !== s.length || root.node.left !== 0 || root.node.top !== 0)
+        return null;
+    return root.node;
+}
 /** Parse a tmux layout string (`csum,WxH,X,Y…`). Null on any malformed input
  *  (the caller falls back to the slow list-panes path — never throw here). */
 export function parseLayout(layout) {
@@ -32,11 +50,20 @@ export function parseLayout(layout) {
     return { width: root.width, height: root.height, leaves };
 }
 /** Recursive-descent cell parse from `pos`; appends leaves in layout order. */
-function parseCell(s, pos, leaves) {
+function parseCell(s, pos, leaves, tree, depth = 1) {
+    if (tree && (depth > 64 || ++tree.nodes > MAX_TREE_LEAVES * 2 - 1))
+        return null;
     const dims = readDims(s, pos);
     if (!dims)
         return null;
     const { width, height, left, top } = dims;
+    if (tree &&
+        (![width, height, left, top, left + width, top + height].every(Number.isSafeInteger) ||
+            width <= 0 ||
+            height <= 0 ||
+            left < 0 ||
+            top < 0))
+        return null;
     pos = dims.pos;
     const ch = s[pos];
     if (ch === ",") {
@@ -44,23 +71,46 @@ function parseCell(s, pos, leaves) {
         const id = readInt(s, pos + 1);
         if (!id)
             return null;
-        leaves.push({ id: `%${id.value}`, left, top, width, height });
-        return { width, height, pos: id.pos };
+        const leaf = { id: `%${id.value}`, left, top, width, height };
+        if (tree) {
+            if (!Number.isSafeInteger(id.value) ||
+                tree.ids.has(leaf.id) ||
+                tree.ids.size >= MAX_TREE_LEAVES)
+                return null;
+            tree.ids.add(leaf.id);
+        }
+        leaves.push(leaf);
+        return {
+            width,
+            height,
+            pos: id.pos,
+            ...(tree ? { node: { kind: "leaf", ...leaf } } : {}),
+        };
     }
     if (ch === "{" || ch === "[") {
         const close = ch === "{" ? "}" : "]";
+        const children = [];
         pos++;
         for (;;) {
-            const child = parseCell(s, pos, leaves);
+            const child = parseCell(s, pos, leaves, tree, depth + 1);
             if (!child)
                 return null;
+            if (tree && child.node)
+                children.push(child.node);
             pos = child.pos;
             if (s[pos] === ",") {
                 pos++;
                 continue;
             }
-            if (s[pos] === close)
-                return { width, height, pos: pos + 1 };
+            if (s[pos] === close) {
+                if (!tree)
+                    return { width, height, pos: pos + 1 };
+                const axis = ch === "{" ? "cols" : "rows";
+                const node = { kind: "split", axis, left, top, width, height, children };
+                if (!tilesParent(node))
+                    return null;
+                return { width, height, pos: pos + 1, node };
+            }
             return null;
         }
     }
@@ -68,6 +118,23 @@ function parseCell(s, pos, leaves) {
     // the leaf id was consumed above, so anything else here is malformed.
     return null;
 }
+/** Child ordering and separator widths must describe precisely this parent. */
+function tilesParent(node) {
+    if (node.children.length < 2)
+        return false;
+    const cols = node.axis === "cols";
+    let next = cols ? node.left : node.top;
+    for (const child of node.children) {
+        if ((cols ? child.left : child.top) !== next ||
+            (cols ? child.top : child.left) !== (cols ? node.top : node.left) ||
+            (cols ? child.height : child.width) !== (cols ? node.height : node.width))
+            return false;
+        next += (cols ? child.width : child.height) + 1;
+        if (!Number.isSafeInteger(next))
+            return false;
+    }
+    return next - 1 === (cols ? node.left + node.width : node.top + node.height);
+}
 /** Read `WxH,X,Y` at `pos`. */
 function readDims(s, pos) {
     const w = readInt(s, pos);

package/packages/daemon/dist/terminal/protocol/native-split-resize.js

@@ -0,0 +1,193 @@
+import { parseLayoutTree } from "./layout-parse.js";
+function object(value, keys) {
+    return (value !== null &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        Object.keys(value).length === keys.length &&
+        keys.every((key) => Object.hasOwn(value, key)));
+}
+function json(text, limit) {
+    if (typeof text !== "string" || text.length > limit || Buffer.byteLength(text) > limit)
+        throw new Error("Bounded native response required");
+    return JSON.parse(text);
+}
+function capability(text) {
+    const value = json(text, 1024);
+    return (object(value, [
+        "schemaVersion",
+        "capability",
+        "sessionMembership",
+        "maxDepth",
+        "maxLeaves",
+        "maxGrid",
+    ]) &&
+        value.schemaVersion === 1 &&
+        value.capability === "split-resize-v1" &&
+        value.sessionMembership === "exact-session-link-v1" &&
+        value.maxDepth === 64 &&
+        value.maxLeaves === 512 &&
+        value.maxGrid === 4096);
+}
+/** Read-only, uncached probe; the caller pins and bounds the selected server. */
+export async function supportsNativeSplitResize(runTmux) {
+    try {
+        return capability(await runTmux(["tmux-ide-resize-split", "-V"]));
+    }
+    catch {
+        return false;
+    }
+}
+function validTree(tree) {
+    let budget = 5;
+    const visit = (node) => {
+        if (node.left + node.width > 4096 || node.top + node.height > 4096)
+            return false;
+        budget += 21;
+        if (node.kind === "leaf") {
+            const id = node.id.slice(1);
+            if (!/^(0|[1-9][0-9]*)$/.test(id) || Number(id) > 0xffffffff)
+                return false;
+            budget += id.length;
+        }
+        else if (!node.children.every(visit))
+            return false;
+        return budget <= 8192;
+    };
+    return visit(tree);
+}
+function locate(tree, path) {
+    let node = tree;
+    let parent;
+    for (const index of path) {
+        if (node.kind !== "split" || !node.children[index])
+            return null;
+        parent = node;
+        node = node.children[index];
+    }
+    return parent && path.at(-1) < parent.children.length - 1 ? { parent, node } : null;
+}
+function edge(node, axis) {
+    return axis === "cols" ? node.left + node.width : node.top + node.height;
+}
+function sameRect(a, b) {
+    return a.left === b.left && a.top === b.top && a.width === b.width && a.height === b.height;
+}
+/** Only geometry inside the exact parent may change, along the requested axis.
+ * Native redistribution can affect multiple siblings. This verifies convergence,
+ * not exclusive causation or authentication of the returned layout. */
+function preservesTree(before, after, affected, axis, inside = false) {
+    const begins = before === affected;
+    if (before.kind !== after.kind || ((!inside || begins) && !sameRect(before, after)))
+        return false;
+    inside ||= begins;
+    if (inside &&
+        (axis === "cols"
+            ? before.top !== after.top || before.height !== after.height
+            : before.left !== after.left || before.width !== after.width))
+        return false;
+    if (before.kind === "leaf")
+        return after.kind === "leaf" && before.id === after.id;
+    return (after.kind === "split" &&
+        before.axis === after.axis &&
+        before.children.length === after.children.length &&
+        before.children.every((child, index) => preservesTree(child, after.children[index], affected, axis, inside)));
+}
+/** Internal foundation only; no route or native capability is enabled here.
+ * Capability is checked on every invocation, never cached across generations.
+ * A failed command or invalid post-dispatch receipt is uncertain: do not retry. */
+export async function resizeNativeSplit(request, runTmux) {
+    let captured, before;
+    try {
+        if (!object(request, ["sessionId", "windowId", "expectedLayout", "path", "axis", "boundary"]) ||
+            typeof request.sessionId !== "string" ||
+            !/^\$(0|[1-9][0-9]{0,9})$/.test(request.sessionId) ||
+            Number(request.sessionId.slice(1)) > 0xffffffff ||
+            typeof request.windowId !== "string" ||
+            !/^@(0|[1-9][0-9]{0,9})$/.test(request.windowId) ||
+            Number(request.windowId.slice(1)) > 0xffffffff ||
+            typeof request.expectedLayout !== "string" ||
+            !Array.isArray(request.path) ||
+            request.path.length < 1 ||
+            request.path.length >= 64 ||
+            request.path.some((index) => !Number.isInteger(index) || index < 0 || index > 511) ||
+            request.path.join(".").length > 256 ||
+            (request.axis !== "cols" && request.axis !== "rows") ||
+            !Number.isInteger(request.boundary) ||
+            request.boundary < 0 ||
+            request.boundary > 4096)
+            return { status: "refused", reason: "invalid-request" };
+        const tree = parseLayoutTree(request.expectedLayout);
+        if (!tree || !validTree(tree))
+            return { status: "refused", reason: "invalid-request" };
+        const selected = locate(tree, request.path);
+        if (!selected || selected.parent.axis !== request.axis)
+            return { status: "refused", reason: "invalid-request" };
+        before = tree;
+        // Snapshot all command data before any await or externally supplied callback.
+        captured = { ...request, path: [...request.path] };
+    }
+    catch {
+        return { status: "refused", reason: "invalid-request" };
+    }
+    try {
+        if (!capability(await runTmux(["tmux-ide-resize-split", "-V"])))
+            return { status: "refused", reason: "unsupported" };
+    }
+    catch {
+        return { status: "refused", reason: "unsupported" };
+    }
+    let response;
+    try {
+        response = await runTmux([
+            "tmux-ide-resize-split",
+            "-t",
+            captured.windowId,
+            "-s",
+            captured.sessionId,
+            "-E",
+            captured.expectedLayout,
+            "-p",
+            captured.path.join("."),
+            "-a",
+            captured.axis,
+            "-c",
+            String(captured.boundary),
+        ]);
+    }
+    catch {
+        return { status: "uncertain", reason: "command-failed" };
+    }
+    try {
+        const receipt = json(response, 16 * 1024);
+        if (!object(receipt, ["schemaVersion", "boundary", "layout"]) ||
+            receipt.schemaVersion !== 1 ||
+            typeof receipt.layout !== "string" ||
+            typeof receipt.boundary !== "number" ||
+            !Number.isInteger(receipt.boundary) ||
+            receipt.boundary < 0 ||
+            receipt.boundary > 4096)
+            return { status: "uncertain", reason: "invalid-receipt" };
+        const after = parseLayoutTree(receipt.layout);
+        const original = locate(before, captured.path);
+        const actual = after && locate(after, captured.path);
+        const previous = edge(original.node, captured.axis);
+        if (!after ||
+            !validTree(after) ||
+            !actual ||
+            !preservesTree(before, after, original.parent, captured.axis) ||
+            receipt.boundary !== edge(actual.node, captured.axis) ||
+            receipt.boundary < Math.min(previous, captured.boundary) ||
+            receipt.boundary > Math.max(previous, captured.boundary))
+            return { status: "uncertain", reason: "invalid-receipt" };
+        return {
+            status: "applied",
+            boundary: receipt.boundary,
+            layout: receipt.layout,
+            tree: after,
+            changed: receipt.layout !== captured.expectedLayout,
+        };
+    }
+    catch {
+        return { status: "uncertain", reason: "invalid-receipt" };
+    }
+}

package/packages/daemon/dist/terminal/session-runtime/interaction-receipt-facts.js

@@ -2,6 +2,16 @@ import { SessionRuntimePaneReadResultSchemaZ, WorkspaceMultiplexerMutationResult
 /** Privacy-safe request facts. Literal input and authored names never leave the mutation request. */
 export function sessionRuntimeInteractionFacts(intent) {
     switch (intent.verb) {
+        case "workspace.window.split.resize":
+            return {
+                target: { kind: "window-link", target: intent.target.window },
+                summary: {
+                    operationKind: intent.verb,
+                    layoutId: intent.target.layoutId,
+                    splitId: intent.target.splitId,
+                    boundary: intent.target.boundary,
+                },
+            };
         case "workspace.window.split":
             return {
                 target: { kind: "pane", semanticPaneId: intent.semanticPaneId },
@@ -95,6 +105,18 @@ export function sessionRuntimeObservedProof(intent, rawResult) {
     if (result.verb !== intent.verb)
         throw new TypeError("Mutation result verb does not match intent");
     switch (result.verb) {
+        case "workspace.window.split.resize":
+            if (intent.verb !== result.verb ||
+                JSON.stringify(result.target) !== JSON.stringify(intent.target))
+                throw new TypeError("Split resize result does not match intent");
+            return {
+                operationKind: result.verb,
+                outcome: result.outcome,
+                target: result.target,
+                axis: result.axis,
+                boundary: result.boundary,
+                ...(result.successor === undefined ? {} : { successor: result.successor }),
+            };
         case "workspace.window.link.select":
         case "workspace.window.link.unlink":
             return { operationKind: result.verb, outcome: result.outcome, target: result.target };

package/packages/daemon/dist/terminal/session-runtime/registry.js

@@ -1,5 +1,5 @@
 import { StockCaptureTabUnavailableError } from "./stock-capture-fidelity.js";
-import { SessionRuntimeClientIdSchemaZ, SessionRuntimeAuthorityLeaseSchemaZ, SessionRuntimeControllerLeaseSchemaZ, SessionRuntimeGenerationSchemaZ, SessionRuntimeSemanticIntentSchemaZ, SessionRuntimeTerminalInputSchemaZ, CausalCellProbeV1SchemaZ, } from "@tmux-ide/contracts";
+import { WorkspaceIdSchemaZ, SessionRuntimeClientIdSchemaZ, SessionRuntimeAuthorityLeaseSchemaZ, SessionRuntimeControllerLeaseSchemaZ, SessionRuntimeGenerationSchemaZ, SessionRuntimeSemanticIntentSchemaZ, SessionRuntimeTerminalInputSchemaZ, CausalCellProbeV1SchemaZ, } from "@tmux-ide/contracts";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { MirrorService, } from "../mirror/mirror-service.js";
@@ -308,6 +308,16 @@ export class SessionRuntimeRegistry {
             throw new Error("Session runtime disposed");
         return this.#mirror.paneResizeTransport(session);
     }
+    readWindowSplitLayout(session, target) {
+        if (this.#disposed)
+            return Promise.reject(new Error("Session runtime disposed"));
+        return this.#mirror.readWindowSplitLayout(session, target);
+    }
+    resizeWindowSplit(...args) {
+        if (this.#disposed)
+            return Promise.reject(new Error("Session runtime disposed"));
+        return this.#mirror.resizeWindowSplit(...args);
+    }
     executeWindowLinkAction(session, request) {
         if (this.#disposed)
             return Promise.reject(new Error("Session runtime disposed"));
@@ -329,7 +339,7 @@ export class SessionRuntimeRegistry {
         this.#sessions.delete(session);
         await runtime.dispose();
     }
-    createExecutionHandle(consumer, lease, allowedSourcePaneIds, authorizeLiveScope) {
+    createExecutionHandle(consumer, lease, allowedSourcePaneIds, authorizeLiveScope, authorizeGeometry) {
         const runtime = this.#sessions.get(consumer.session);
         if (!runtime || !runtime.ownsConsumer(consumer)) {
             throw new SessionRuntimeControllerLeaseError("invalid-client-capability", "The execution handle consumer is not owned by this daemon generation.");
@@ -343,6 +353,7 @@ export class SessionRuntimeRegistry {
             allowedSourcePaneIds: new Set(allowedSourcePaneIds),
             sourceSemanticPaneId: null,
             authorizeLiveScope: authorizeLiveScope ?? null,
+            authorizeGeometry: authorizeGeometry ?? null,
         });
         return handle;
     }
@@ -429,7 +440,7 @@ export class SessionRuntimeRegistry {
                 normalizedIntent = sourceLess;
             }
         }
-        return this.#submitAuthorizedIntent(state.runtime, state.lease, operationId, normalizedIntent, authenticatedSourceSemanticPaneId, () => this.#assertExecutionHandle(handle, state.sourceSemanticPaneId ?? undefined), authoredOriginForSurface(state.consumer.surface));
+        return this.#submitAuthorizedIntent(state.runtime, state.lease, operationId, normalizedIntent, authenticatedSourceSemanticPaneId, () => this.#assertExecutionHandle(handle, state.sourceSemanticPaneId ?? undefined), authoredOriginForSurface(state.consumer.surface), state.authorizeGeometry ?? undefined);
     }
     #assertExecutionHandle(handle, semanticPaneId) {
         const state = this.#executionHandles.get(handle);
@@ -541,11 +552,15 @@ export class SessionRuntimeRegistry {
         await runtime.whenReady();
         return await this.#mirror.subscribe(request);
     }
-    #submitAuthorizedIntent(runtime, lease, operationId, rawIntent, authenticatedSourceSemanticPaneId = null, authorizeBeforeEffect, authenticatedOrigin) {
+    #submitAuthorizedIntent(runtime, lease, operationId, rawIntent, authenticatedSourceSemanticPaneId = null, authorizeBeforeEffect, authenticatedOrigin, authorizeGeometry) {
         if (this.#disposed)
             return Promise.reject(new Error("SessionRuntimeRegistry is disposed"));
         runtime.assertController(lease);
         let intent = SessionRuntimeSemanticIntentSchemaZ.parse(rawIntent);
+        const requiresGeometry = intent.verb === "workspace.window.split.resize";
+        if (requiresGeometry && !authorizeGeometry) {
+            return Promise.reject(new SessionRuntimeControllerLeaseError("invalid-client-capability", "Split resize requires explicit geometry authority."));
+        }
         const resolvedSession = intent.verb === "workspace.session.kill" && intent.fleetTarget
             ? intent.fleetTarget.daemonInstanceId === this.generation
                 ? intent.fleetTarget.sessionName
@@ -568,7 +583,12 @@ export class SessionRuntimeRegistry {
         return this.#semanticMutations.submit(operationId, intent, {
             origin: authenticatedOrigin ?? "sdk",
             authenticatedSourceSemanticPaneId,
-            authorizeBeforeEffect,
+            authorizeBeforeEffect: requiresGeometry
+                ? () => {
+                    authorizeBeforeEffect?.();
+                    authorizeGeometry();
+                }
+                : authorizeBeforeEffect,
         });
     }
     observeOwnedNativePlan(proof) {
@@ -940,7 +960,9 @@ class SessionRuntime {
         const releaseKey = this.#leaseKey(candidate);
         if (this.#releasedLeases.has(releaseKey) && candidate.clientId === callerClientId)
             return;
-        this.assertController(candidate, callerClientId);
+        // Surrendering ownership must remain possible while topology is being verified.
+        // Exact lease identity is still required; only use/acquisition needs topology authority.
+        this.#assertControllerIdentity(candidate, callerClientId);
         this.#releasedLeases.add(releaseKey);
         if (this.#releasedLeases.size > 32) {
             this.#releasedLeases.delete(this.#releasedLeases.values().next().value);
@@ -951,6 +973,9 @@ class SessionRuntime {
     }
     assertController(lease, callerClientId) {
         this.assertNoSharedWindow();
+        this.#assertControllerIdentity(lease, callerClientId);
+    }
+    #assertControllerIdentity(lease, callerClientId) {
         const parsedLease = this.#validatedLease(lease);
         if (parsedLease.generation !== this.generation ||
             parsedLease.session !== this.session ||
@@ -1087,7 +1112,9 @@ class SessionRuntime {
         else
             this.#mirror.fitWindowViewport(this.session, semanticWindowId, cols, rows);
     }
-    fitViewportWithAuthority(clientId, lease, cols, rows, semanticWindowId) {
+    assertGeometryAuthority(clientId, lease) {
+        if (this.#disposed)
+            throw new Error(`SessionRuntime ${this.session} is disposed`);
         this.assertNoSharedWindow();
         const parsed = SessionRuntimeAuthorityLeaseSchemaZ.parse(lease);
         let exact;
@@ -1100,6 +1127,9 @@ class SessionRuntime {
         if (exact.clientId !== clientId || exact.authority !== "geometry") {
             throw new SessionRuntimeControllerLeaseError("invalid-client-capability", "The client does not own this geometry authority lease.");
         }
+    }
+    fitViewportWithAuthority(clientId, lease, cols, rows, semanticWindowId) {
+        this.assertGeometryAuthority(clientId, lease);
         this.#mirror.setGeometryParticipation(this.session, true);
         if (semanticWindowId === undefined)
             this.#mirror.fitViewport(this.session, cols, rows);
@@ -1201,7 +1231,8 @@ class SessionRuntime {
             : null;
         return retained ?? (await owner.captureNativeBacking());
     }
-    async openTerminalDelivery(clientId, surface, deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage) {
+    async openTerminalDelivery(clientId, surface, deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage, deliveryWorkspaceName) {
+        const address = WorkspaceIdSchemaZ.parse(deliveryWorkspaceName ?? this.session);
         await this.whenReady();
         await this.#restartBarrier;
         this.#assertConnected(clientId);
@@ -1210,7 +1241,7 @@ class SessionRuntime {
             surface,
             laneId: deliverySubscriberId,
             requestId: deliveryRequestId,
-        }));
+        }), address);
     }
     #terminalReplicaOwner(semanticPaneId) {
         let owner = this.#terminalReplicas.get(semanticPaneId);
@@ -1486,6 +1517,10 @@ class SessionRuntimeConsumerImpl {
         this.#assertOpen();
         return this.#runtime.acquireAuthority(this.clientId, authority);
     }
+    assertGeometryAuthority(lease) {
+        this.#assertOpen();
+        this.#runtime.assertGeometryAuthority(this.clientId, lease);
+    }
     releaseAuthority(authority) {
         this.#assertOpen();
         this.#runtime.releaseAuthority(this.clientId, authority);
@@ -1567,9 +1602,10 @@ class SessionRuntimeConsumerImpl {
         this.#replicaSubscriptions.add(subscription);
         return subscription;
     }
-    async openTerminalDelivery(deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage) {
+    async openTerminalDelivery(deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage, deliveryWorkspaceName) {
+        const address = WorkspaceIdSchemaZ.parse(deliveryWorkspaceName ?? this.session);
         this.#assertOpen();
-        const upstream = await this.#runtime.openTerminalDelivery(this.clientId, this.surface, deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage);
+        const upstream = await this.#runtime.openTerminalDelivery(this.clientId, this.surface, deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage, address);
         if (this.#closed) {
             await upstream.close();
             throw new Error(`SessionRuntime consumer ${this.surface} is closed`);

package/packages/daemon/dist/terminal/session-runtime/semantic-mutation-executor.js

@@ -306,24 +306,37 @@ export class SessionSemanticMutationExecutor {
                 tmuxStarted = null;
             }
         }
+        let executionActive = true;
         try {
             // Admission can wait behind prior work. Revalidate the opaque principal
             // at the last synchronous boundary before tmux receives any effect.
-            if (interactionContext)
-                this.#options.validateInteractionContext?.(interactionContext);
-            authorizeBeforeEffect?.();
+            const revalidateBeforeEffect = () => {
+                if (this.#disposed || !executionActive) {
+                    throw new SessionRuntimeIntentError("rejected", "Semantic execution authority is no longer active");
+                }
+                if (interactionContext)
+                    this.#options.validateInteractionContext?.(interactionContext);
+                authorizeBeforeEffect?.();
+            };
+            revalidateBeforeEffect();
             result = await this.#options.execute(operationId, intent, timing, interactionContext
                 ? { interactionContext, origin, executionId, authoredReceiptAdmissionSequence }
-                : undefined);
+                : undefined, revalidateBeforeEffect);
         }
         catch (cause) {
             if (needsTmuxObservation)
                 this.#deletePending(session, operationId);
-            const error = new SessionRuntimeIntentError("rejected", "tmux rejected the semantic interaction", { cause });
+            const error = new SessionRuntimeIntentError("rejected", cause &&
+                typeof cause === "object" &&
+                "code" in cause &&
+                cause.code === "mutation_unverified"
+                ? "Mutation outcome is uncertain; do not retry with a new operation ID."
+                : "tmux rejected the semantic interaction", { cause });
             this.#publish(operationId, intent, "rejected", null, undefined, origin, interactionContext);
             throw error;
         }
         finally {
+            executionActive = false;
             if (tmuxStarted !== null)
                 try {
                     const tmuxEnded = this.#observability.nowMicros();

package/packages/daemon/dist/terminal/session-runtime/terminal-delivery-hub.js

@@ -1,6 +1,6 @@
 import { StockCaptureTabUnavailableError } from "./stock-capture-fidelity.js";
 import { MAX_RETAINED_NATIVE_BACKING_BYTES, takeNativeSeedBacking, } from "./native-seed-backing.js";
-import { TERMINAL_DELIVERY_PATCH_TO_SEED_BYTES, TERMINAL_DELIVERY_MAX_REPRESENTATION_BYTES, TerminalDeliveryEnvelopeSchemaZ, TerminalDeliveryAckSchemaZ, TerminalDeliveryNackSchemaZ, TerminalDeliveryOfferSchemaZ, TerminalDeliveryVisibilitySchemaZ, } from "@tmux-ide/contracts";
+import { WorkspaceIdSchemaZ, TERMINAL_DELIVERY_PATCH_TO_SEED_BYTES, TERMINAL_DELIVERY_MAX_REPRESENTATION_BYTES, TerminalDeliveryEnvelopeSchemaZ, TerminalDeliveryAckSchemaZ, TerminalDeliveryNackSchemaZ, TerminalDeliveryOfferSchemaZ, TerminalDeliveryVisibilitySchemaZ, } from "@tmux-ide/contracts";
 import { TerminalDeliveryStateTooLargeError, terminalReplicaRowsEqual, TERMINAL_COMPACT_COOPERATIVE_SEED_CELLS, applyTerminalReplicaUpdate, applyTerminalReplicaUpdateCooperatively, terminalReplicaUpdateNeedsCooperativeReduction, encodeCompactSemanticTerminalUpdate, encodeCompactSemanticTerminalUpdateCooperatively, terminalSemanticUpdateNeedsCooperativeEncoding, encodeAnsiTerminalRepresentation, encodeSemanticTerminalUpdate, hashTerminalDeliveryRepresentation, negotiateTerminalDelivery, preaccountSemanticTerminalUpdateBytes, } from "@tmux-ide/core";
 import { SYSTEM_SESSION_RUNTIME_SCHEDULER, } from "./runtime-scheduler.js";
 import { DISABLED_SESSION_RUNTIME_OBSERVABILITY, } from "./runtime-observability.js";
@@ -89,9 +89,11 @@ export class SessionRuntimeTerminalDeliveryHub {
         this.#scheduler = options.scheduler ?? SYSTEM_SESSION_RUNTIME_SCHEDULER;
         this.#observability = options.observability ?? DISABLED_SESSION_RUNTIME_OBSERVABILITY;
     }
-    async open(clientId, semanticPaneId, offerInput, accept, diagnosticIdentity = Object.freeze({ clientId, surface: "direct", laneId: clientId })) {
+    async open(clientId, semanticPaneId, offerInput, accept, diagnosticIdentity = Object.freeze({ clientId, surface: "direct", laneId: clientId }), deliveryWorkspaceName = this.workspaceName) {
         if (this.#closed)
             throw new Error("Terminal delivery hub is closed");
+        // Public delivery identity is independent of the exact native source session.
+        const address = WorkspaceIdSchemaZ.parse(deliveryWorkspaceName);
         const offer = TerminalDeliveryOfferSchemaZ.parse(offerInput);
         const negotiation = negotiateTerminalDelivery(offer, this.generation, this.#scheduler.createId());
         if (!negotiation.accepted)
@@ -120,6 +122,7 @@ export class SessionRuntimeTerminalDeliveryHub {
                 resolveClosed = resolve;
             });
             const client = {
+                deliveryWorkspaceName: address,
                 key,
                 clientId,
                 diagnosticClientId: diagnosticIdentity.clientId,
@@ -685,7 +688,7 @@ export class SessionRuntimeTerminalDeliveryHub {
             const chunkCount = Math.max(1, Math.ceil(representation.bytes.byteLength / (256 * 1024)));
             const envelope = TerminalDeliveryEnvelopeSchemaZ.parse({
                 type: "terminal.delivery",
-                workspaceName: target.update.workspaceName,
+                workspaceName: client.deliveryWorkspaceName,
                 semanticPaneId: target.update.semanticPaneId,
                 generation: target.update.generation,
                 incarnation: target.update.incarnation,
@@ -1302,7 +1305,7 @@ export class SessionRuntimeTerminalDeliveryHub {
                     maxQueueDepth: metrics.maxQueueDepth,
                     inFlight: metrics.inFlight,
                     inFlightBytes: metrics.inFlightBytes,
-                    workspaceName: this.workspaceName,
+                    workspaceName: client.deliveryWorkspaceName,
                     semanticPaneId: client.paneId,
                     faultReason: reason,
                     ...(selectionObservation ? terminalSelectionObservation(selectionObservation) : {}),
@@ -1429,7 +1432,7 @@ export class SessionRuntimeTerminalDeliveryHub {
         try {
             const atMicros = this.#observability.nowMicros();
             this.#observability.recordSpan("transport", "terminal-delivery-subscriber-lifecycle", atMicros, atMicros, null, undefined, Object.freeze({
-                workspaceName: this.workspaceName,
+                workspaceName: client.deliveryWorkspaceName,
                 semanticPaneId: client.paneId,
                 canonicalGeneration: this.generation,
                 canonicalIncarnation: canonical.incarnation,
@@ -1459,7 +1462,7 @@ export class SessionRuntimeTerminalDeliveryHub {
         try {
             const atMicros = this.#observability.nowMicros();
             this.#observability.recordSpan("transport", "terminal-delivery-subscriber-status", atMicros, atMicros, null, undefined, Object.freeze({
-                workspaceName: this.workspaceName,
+                workspaceName: client.deliveryWorkspaceName,
                 semanticPaneId: client.paneId,
                 canonicalGeneration: this.generation,
                 canonicalIncarnation: canonical.incarnation,