tmux-ide 2.9.5 → 2.9.7

package/packages/daemon/dist/terminal/session-runtime/history-anchor-owner.js

@@ -0,0 +1,171 @@
+import { randomUUID } from "node:crypto";
+const MAX_TOKENS = 32;
+const PROOF_TTL_MS = 5 * 60_000;
+/** Owner-private row ordinals. Never changes terminal v1 payloads or hashes. */
+export class HistoryAnchorOwner {
+    now;
+    #current = null;
+    #first = 0;
+    #length = 0;
+    #proofs = new Map();
+    #tokens = new Map();
+    constructor(now = () => performance.now()) {
+        this.now = now;
+    }
+    invalidate() {
+        this.#current = null;
+        this.#first = 0;
+        this.#length = 0;
+        this.#tokens.clear();
+        this.#proofs.clear();
+    }
+    observe(update) {
+        if (update.type === "terminal.tombstone") {
+            this.invalidate();
+            return;
+        }
+        if (update.type === "terminal.seed") {
+            this.invalidate();
+            this.#length = update.snapshot.history.length;
+            this.#current = {
+                workspaceName: update.workspaceName,
+                semanticPaneId: update.semanticPaneId,
+                generation: update.generation,
+                incarnation: update.incarnation,
+                revision: update.revision,
+                stateHash: update.stateHash,
+                cols: update.cols,
+                rows: update.rows,
+                alternate: update.snapshot.modes.alternateScreen,
+            };
+            this.#remember();
+            return;
+        }
+        const old = this.#current;
+        if (!old ||
+            old.workspaceName !== update.workspaceName ||
+            old.semanticPaneId !== update.semanticPaneId ||
+            old.generation !== update.generation ||
+            old.incarnation !== update.incarnation ||
+            old.revision !== update.baseRevision) {
+            this.invalidate();
+            return;
+        }
+        const delta = update.patch.historyDelta;
+        const alternate = update.patch.modes?.alternateScreen ?? old.alternate;
+        if (delta &&
+            (!Number.isSafeInteger(delta.trim) || delta.trim < 0 || delta.trim > this.#length)) {
+            this.invalidate();
+            return;
+        }
+        const length = update.patch.history?.length ??
+            this.#length - (delta?.trim ?? 0) + (delta?.append.length ?? 0);
+        const reset = update.patch.history !== undefined ||
+            update.cols !== old.cols ||
+            update.rows !== old.rows ||
+            alternate !== old.alternate;
+        if (reset) {
+            this.#tokens.clear();
+            this.#proofs.clear();
+            this.#first = 0;
+        }
+        else
+            this.#first += delta?.trim ?? 0;
+        if (!Number.isSafeInteger(this.#first + length)) {
+            this.invalidate();
+            return;
+        }
+        this.#length = length;
+        this.#current = {
+            workspaceName: update.workspaceName,
+            semanticPaneId: update.semanticPaneId,
+            generation: update.generation,
+            incarnation: update.incarnation,
+            revision: update.revision,
+            stateHash: update.stateHash,
+            cols: update.cols,
+            rows: update.rows,
+            alternate,
+        };
+        this.#prune();
+        this.#remember();
+    }
+    capture(proof, historyIndex) {
+        const failure = this.#admitIdentity(proof);
+        if (failure)
+            return failure;
+        this.#prune();
+        const known = this.#current && this.#key(proof) === this.#key(this.#current)
+            ? { first: this.#first, length: this.#length }
+            : this.#proofs.get(this.#key(proof));
+        if (!known)
+            return { status: "stale" };
+        if (!Number.isSafeInteger(historyIndex) || historyIndex < 0 || historyIndex >= known.length)
+            return { status: "lost" };
+        const ordinal = known.first + historyIndex;
+        if (ordinal < this.#first || ordinal >= this.#first + this.#length)
+            return { status: "lost" };
+        while (this.#tokens.size >= MAX_TOKENS)
+            this.#tokens.delete(this.#tokens.keys().next().value);
+        const token = randomUUID();
+        // Saved tabs retain identity until capacity eviction or actual history loss.
+        this.#tokens.set(token, { ordinal });
+        return { status: "captured", token };
+    }
+    resolve(proof, token) {
+        const failure = this.#admitIdentity(proof);
+        if (failure)
+            return failure;
+        this.#prune();
+        const entry = this.#tokens.get(token);
+        if (!entry)
+            return { status: "lost" };
+        const { workspaceName, semanticPaneId, generation, incarnation, revision, stateHash } = this.#current;
+        return {
+            status: "resolved",
+            proof: { workspaceName, semanticPaneId, generation, incarnation, revision, stateHash },
+            historyIndex: entry.ordinal - this.#first,
+        };
+    }
+    #admitIdentity(proof) {
+        const current = this.#current;
+        if (!current || current.alternate)
+            return { status: "unavailable" };
+        return current.workspaceName === proof.workspaceName &&
+            current.semanticPaneId === proof.semanticPaneId &&
+            current.generation === proof.generation &&
+            current.incarnation === proof.incarnation
+            ? null
+            : { status: "stale" };
+    }
+    #key(proof) {
+        return JSON.stringify([
+            proof.workspaceName,
+            proof.semanticPaneId,
+            proof.generation,
+            proof.incarnation,
+            proof.revision,
+            proof.stateHash,
+        ]);
+    }
+    #remember() {
+        if (!this.#current || this.#current.alternate)
+            return;
+        while (this.#proofs.size >= 64)
+            this.#proofs.delete(this.#proofs.keys().next().value);
+        this.#proofs.set(this.#key(this.#current), {
+            first: this.#first,
+            length: this.#length,
+            expires: this.now() + PROOF_TTL_MS,
+        });
+    }
+    #prune() {
+        const now = this.now();
+        for (const [key, value] of this.#proofs)
+            if (value.expires <= now)
+                this.#proofs.delete(key);
+        for (const [token, entry] of this.#tokens)
+            if (entry.ordinal < this.#first || entry.ordinal >= this.#first + this.#length)
+                this.#tokens.delete(token);
+    }
+}

package/packages/daemon/dist/terminal/session-runtime/interaction-receipt-facts.js

@@ -2,6 +2,16 @@ import { SessionRuntimePaneReadResultSchemaZ, WorkspaceMultiplexerMutationResult
 /** Privacy-safe request facts. Literal input and authored names never leave the mutation request. */
 export function sessionRuntimeInteractionFacts(intent) {
     switch (intent.verb) {
+        case "workspace.window.split.resize":
+            return {
+                target: { kind: "window-link", target: intent.target.window },
+                summary: {
+                    operationKind: intent.verb,
+                    layoutId: intent.target.layoutId,
+                    splitId: intent.target.splitId,
+                    boundary: intent.target.boundary,
+                },
+            };
         case "workspace.window.split":
             return {
                 target: { kind: "pane", semanticPaneId: intent.semanticPaneId },
@@ -95,6 +105,18 @@ export function sessionRuntimeObservedProof(intent, rawResult) {
     if (result.verb !== intent.verb)
         throw new TypeError("Mutation result verb does not match intent");
     switch (result.verb) {
+        case "workspace.window.split.resize":
+            if (intent.verb !== result.verb ||
+                JSON.stringify(result.target) !== JSON.stringify(intent.target))
+                throw new TypeError("Split resize result does not match intent");
+            return {
+                operationKind: result.verb,
+                outcome: result.outcome,
+                target: result.target,
+                axis: result.axis,
+                boundary: result.boundary,
+                ...(result.successor === undefined ? {} : { successor: result.successor }),
+            };
         case "workspace.window.link.select":
         case "workspace.window.link.unlink":
             return { operationKind: result.verb, outcome: result.outcome, target: result.target };

package/packages/daemon/dist/terminal/session-runtime/registry.js

@@ -1,5 +1,5 @@
 import { StockCaptureTabUnavailableError } from "./stock-capture-fidelity.js";
-import { SessionRuntimeClientIdSchemaZ, SessionRuntimeAuthorityLeaseSchemaZ, SessionRuntimeControllerLeaseSchemaZ, SessionRuntimeGenerationSchemaZ, SessionRuntimeSemanticIntentSchemaZ, SessionRuntimeTerminalInputSchemaZ, CausalCellProbeV1SchemaZ, } from "@tmux-ide/contracts";
+import { WorkspaceIdSchemaZ, SessionRuntimeClientIdSchemaZ, SessionRuntimeAuthorityLeaseSchemaZ, SessionRuntimeControllerLeaseSchemaZ, SessionRuntimeGenerationSchemaZ, SessionRuntimeSemanticIntentSchemaZ, SessionRuntimeTerminalInputSchemaZ, CausalCellProbeV1SchemaZ, } from "@tmux-ide/contracts";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { MirrorService, } from "../mirror/mirror-service.js";
@@ -308,6 +308,16 @@ export class SessionRuntimeRegistry {
             throw new Error("Session runtime disposed");
         return this.#mirror.paneResizeTransport(session);
     }
+    readWindowSplitLayout(session, target) {
+        if (this.#disposed)
+            return Promise.reject(new Error("Session runtime disposed"));
+        return this.#mirror.readWindowSplitLayout(session, target);
+    }
+    resizeWindowSplit(...args) {
+        if (this.#disposed)
+            return Promise.reject(new Error("Session runtime disposed"));
+        return this.#mirror.resizeWindowSplit(...args);
+    }
     executeWindowLinkAction(session, request) {
         if (this.#disposed)
             return Promise.reject(new Error("Session runtime disposed"));
@@ -329,7 +339,7 @@ export class SessionRuntimeRegistry {
         this.#sessions.delete(session);
         await runtime.dispose();
     }
-    createExecutionHandle(consumer, lease, allowedSourcePaneIds, authorizeLiveScope) {
+    createExecutionHandle(consumer, lease, allowedSourcePaneIds, authorizeLiveScope, authorizeGeometry) {
         const runtime = this.#sessions.get(consumer.session);
         if (!runtime || !runtime.ownsConsumer(consumer)) {
             throw new SessionRuntimeControllerLeaseError("invalid-client-capability", "The execution handle consumer is not owned by this daemon generation.");
@@ -343,6 +353,7 @@ export class SessionRuntimeRegistry {
             allowedSourcePaneIds: new Set(allowedSourcePaneIds),
             sourceSemanticPaneId: null,
             authorizeLiveScope: authorizeLiveScope ?? null,
+            authorizeGeometry: authorizeGeometry ?? null,
         });
         return handle;
     }
@@ -429,7 +440,7 @@ export class SessionRuntimeRegistry {
                 normalizedIntent = sourceLess;
             }
         }
-        return this.#submitAuthorizedIntent(state.runtime, state.lease, operationId, normalizedIntent, authenticatedSourceSemanticPaneId, () => this.#assertExecutionHandle(handle, state.sourceSemanticPaneId ?? undefined), authoredOriginForSurface(state.consumer.surface));
+        return this.#submitAuthorizedIntent(state.runtime, state.lease, operationId, normalizedIntent, authenticatedSourceSemanticPaneId, () => this.#assertExecutionHandle(handle, state.sourceSemanticPaneId ?? undefined), authoredOriginForSurface(state.consumer.surface), state.authorizeGeometry ?? undefined);
     }
     #assertExecutionHandle(handle, semanticPaneId) {
         const state = this.#executionHandles.get(handle);
@@ -446,6 +457,12 @@ export class SessionRuntimeRegistry {
     async describeSession(session) {
         return await this.#runtime(session).describe();
     }
+    historyAnchor(session, request) {
+        const runtime = this.#sessions.get(session);
+        if (this.#disposed || !runtime)
+            return { status: "unavailable" };
+        return runtime.historyAnchor(request);
+    }
     async captureNativeBacking(session, semanticPaneId, expected) {
         const runtime = this.#sessions.get(session);
         if (this.#disposed || !runtime)
@@ -541,11 +558,15 @@ export class SessionRuntimeRegistry {
         await runtime.whenReady();
         return await this.#mirror.subscribe(request);
     }
-    #submitAuthorizedIntent(runtime, lease, operationId, rawIntent, authenticatedSourceSemanticPaneId = null, authorizeBeforeEffect, authenticatedOrigin) {
+    #submitAuthorizedIntent(runtime, lease, operationId, rawIntent, authenticatedSourceSemanticPaneId = null, authorizeBeforeEffect, authenticatedOrigin, authorizeGeometry) {
         if (this.#disposed)
             return Promise.reject(new Error("SessionRuntimeRegistry is disposed"));
         runtime.assertController(lease);
         let intent = SessionRuntimeSemanticIntentSchemaZ.parse(rawIntent);
+        const requiresGeometry = intent.verb === "workspace.window.split.resize";
+        if (requiresGeometry && !authorizeGeometry) {
+            return Promise.reject(new SessionRuntimeControllerLeaseError("invalid-client-capability", "Split resize requires explicit geometry authority."));
+        }
         const resolvedSession = intent.verb === "workspace.session.kill" && intent.fleetTarget
             ? intent.fleetTarget.daemonInstanceId === this.generation
                 ? intent.fleetTarget.sessionName
@@ -568,7 +589,12 @@ export class SessionRuntimeRegistry {
         return this.#semanticMutations.submit(operationId, intent, {
             origin: authenticatedOrigin ?? "sdk",
             authenticatedSourceSemanticPaneId,
-            authorizeBeforeEffect,
+            authorizeBeforeEffect: requiresGeometry
+                ? () => {
+                    authorizeBeforeEffect?.();
+                    authorizeGeometry();
+                }
+                : authorizeBeforeEffect,
         });
     }
     observeOwnedNativePlan(proof) {
@@ -940,7 +966,9 @@ class SessionRuntime {
         const releaseKey = this.#leaseKey(candidate);
         if (this.#releasedLeases.has(releaseKey) && candidate.clientId === callerClientId)
             return;
-        this.assertController(candidate, callerClientId);
+        // Surrendering ownership must remain possible while topology is being verified.
+        // Exact lease identity is still required; only use/acquisition needs topology authority.
+        this.#assertControllerIdentity(candidate, callerClientId);
         this.#releasedLeases.add(releaseKey);
         if (this.#releasedLeases.size > 32) {
             this.#releasedLeases.delete(this.#releasedLeases.values().next().value);
@@ -951,6 +979,9 @@ class SessionRuntime {
     }
     assertController(lease, callerClientId) {
         this.assertNoSharedWindow();
+        this.#assertControllerIdentity(lease, callerClientId);
+    }
+    #assertControllerIdentity(lease, callerClientId) {
         const parsedLease = this.#validatedLease(lease);
         if (parsedLease.generation !== this.generation ||
             parsedLease.session !== this.session ||
@@ -1087,7 +1118,9 @@ class SessionRuntime {
         else
             this.#mirror.fitWindowViewport(this.session, semanticWindowId, cols, rows);
     }
-    fitViewportWithAuthority(clientId, lease, cols, rows, semanticWindowId) {
+    assertGeometryAuthority(clientId, lease) {
+        if (this.#disposed)
+            throw new Error(`SessionRuntime ${this.session} is disposed`);
         this.assertNoSharedWindow();
         const parsed = SessionRuntimeAuthorityLeaseSchemaZ.parse(lease);
         let exact;
@@ -1100,6 +1133,9 @@ class SessionRuntime {
         if (exact.clientId !== clientId || exact.authority !== "geometry") {
             throw new SessionRuntimeControllerLeaseError("invalid-client-capability", "The client does not own this geometry authority lease.");
         }
+    }
+    fitViewportWithAuthority(clientId, lease, cols, rows, semanticWindowId) {
+        this.assertGeometryAuthority(clientId, lease);
         this.#mirror.setGeometryParticipation(this.session, true);
         if (semanticWindowId === undefined)
             this.#mirror.fitViewport(this.session, cols, rows);
@@ -1192,6 +1228,19 @@ class SessionRuntime {
             throw error;
         }
     }
+    historyAnchor(request) {
+        if (this.#disposed)
+            return { status: "unavailable" };
+        const owner = this.#terminalReplicas.get(request.proof.semanticPaneId);
+        if (!owner)
+            return { status: "unavailable" };
+        if (request.operation.kind === "capture") {
+            if (!("revision" in request.proof) || !("stateHash" in request.proof))
+                return { status: "stale" };
+            return owner.captureHistoryAnchor(request.proof, request.operation.historyIndex);
+        }
+        return owner.resolveHistoryAnchor(request.proof, request.operation.token);
+    }
     async captureNativeBacking(semanticPaneId, expected) {
         const owner = this.#terminalReplicas.get(semanticPaneId);
         if (!owner)
@@ -1201,7 +1250,8 @@ class SessionRuntime {
             : null;
         return retained ?? (await owner.captureNativeBacking());
     }
-    async openTerminalDelivery(clientId, surface, deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage) {
+    async openTerminalDelivery(clientId, surface, deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage, deliveryWorkspaceName) {
+        const address = WorkspaceIdSchemaZ.parse(deliveryWorkspaceName ?? this.session);
         await this.whenReady();
         await this.#restartBarrier;
         this.#assertConnected(clientId);
@@ -1210,7 +1260,7 @@ class SessionRuntime {
             surface,
             laneId: deliverySubscriberId,
             requestId: deliveryRequestId,
-        }));
+        }), address);
     }
     #terminalReplicaOwner(semanticPaneId) {
         let owner = this.#terminalReplicas.get(semanticPaneId);
@@ -1486,6 +1536,10 @@ class SessionRuntimeConsumerImpl {
         this.#assertOpen();
         return this.#runtime.acquireAuthority(this.clientId, authority);
     }
+    assertGeometryAuthority(lease) {
+        this.#assertOpen();
+        this.#runtime.assertGeometryAuthority(this.clientId, lease);
+    }
     releaseAuthority(authority) {
         this.#assertOpen();
         this.#runtime.releaseAuthority(this.clientId, authority);
@@ -1567,9 +1621,10 @@ class SessionRuntimeConsumerImpl {
         this.#replicaSubscriptions.add(subscription);
         return subscription;
     }
-    async openTerminalDelivery(deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage) {
+    async openTerminalDelivery(deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage, deliveryWorkspaceName) {
+        const address = WorkspaceIdSchemaZ.parse(deliveryWorkspaceName ?? this.session);
         this.#assertOpen();
-        const upstream = await this.#runtime.openTerminalDelivery(this.clientId, this.surface, deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage);
+        const upstream = await this.#runtime.openTerminalDelivery(this.clientId, this.surface, deliverySubscriberId, deliveryRequestId, semanticPaneId, offer, onMessage, address);
         if (this.#closed) {
             await upstream.close();
             throw new Error(`SessionRuntime consumer ${this.surface} is closed`);
@@ -1588,6 +1643,7 @@ class SessionRuntimeConsumerImpl {
                 this.#deliveryConnections.delete(connection);
                 await upstream.close();
             },
+            ...(upstream.graphics ? { graphics: upstream.graphics } : {}),
         };
         this.#deliveryConnections.add(connection);
         return connection;

package/packages/daemon/dist/terminal/session-runtime/semantic-mutation-executor.js

@@ -306,24 +306,37 @@ export class SessionSemanticMutationExecutor {
                 tmuxStarted = null;
             }
         }
+        let executionActive = true;
         try {
             // Admission can wait behind prior work. Revalidate the opaque principal
             // at the last synchronous boundary before tmux receives any effect.
-            if (interactionContext)
-                this.#options.validateInteractionContext?.(interactionContext);
-            authorizeBeforeEffect?.();
+            const revalidateBeforeEffect = () => {
+                if (this.#disposed || !executionActive) {
+                    throw new SessionRuntimeIntentError("rejected", "Semantic execution authority is no longer active");
+                }
+                if (interactionContext)
+                    this.#options.validateInteractionContext?.(interactionContext);
+                authorizeBeforeEffect?.();
+            };
+            revalidateBeforeEffect();
             result = await this.#options.execute(operationId, intent, timing, interactionContext
                 ? { interactionContext, origin, executionId, authoredReceiptAdmissionSequence }
-                : undefined);
+                : undefined, revalidateBeforeEffect);
         }
         catch (cause) {
             if (needsTmuxObservation)
                 this.#deletePending(session, operationId);
-            const error = new SessionRuntimeIntentError("rejected", "tmux rejected the semantic interaction", { cause });
+            const error = new SessionRuntimeIntentError("rejected", cause &&
+                typeof cause === "object" &&
+                "code" in cause &&
+                cause.code === "mutation_unverified"
+                ? "Mutation outcome is uncertain; do not retry with a new operation ID."
+                : "tmux rejected the semantic interaction", { cause });
             this.#publish(operationId, intent, "rejected", null, undefined, origin, interactionContext);
             throw error;
         }
         finally {
+            executionActive = false;
             if (tmuxStarted !== null)
                 try {
                     const tmuxEnded = this.#observability.nowMicros();

package/packages/daemon/dist/terminal/session-runtime/terminal-delivery-hub.js

@@ -1,6 +1,6 @@
 import { StockCaptureTabUnavailableError } from "./stock-capture-fidelity.js";
 import { MAX_RETAINED_NATIVE_BACKING_BYTES, takeNativeSeedBacking, } from "./native-seed-backing.js";
-import { TERMINAL_DELIVERY_PATCH_TO_SEED_BYTES, TERMINAL_DELIVERY_MAX_REPRESENTATION_BYTES, TerminalDeliveryEnvelopeSchemaZ, TerminalDeliveryAckSchemaZ, TerminalDeliveryNackSchemaZ, TerminalDeliveryOfferSchemaZ, TerminalDeliveryVisibilitySchemaZ, } from "@tmux-ide/contracts";
+import { WorkspaceIdSchemaZ, TERMINAL_GRAPHICS_CAPABILITY_VERSION, TERMINAL_DELIVERY_PATCH_TO_SEED_BYTES, TERMINAL_DELIVERY_MAX_REPRESENTATION_BYTES, TerminalDeliveryEnvelopeSchemaZ, TerminalDeliveryAckSchemaZ, TerminalDeliveryNackSchemaZ, TerminalDeliveryOfferSchemaZ, TerminalDeliveryVisibilitySchemaZ, } from "@tmux-ide/contracts";
 import { TerminalDeliveryStateTooLargeError, terminalReplicaRowsEqual, TERMINAL_COMPACT_COOPERATIVE_SEED_CELLS, applyTerminalReplicaUpdate, applyTerminalReplicaUpdateCooperatively, terminalReplicaUpdateNeedsCooperativeReduction, encodeCompactSemanticTerminalUpdate, encodeCompactSemanticTerminalUpdateCooperatively, terminalSemanticUpdateNeedsCooperativeEncoding, encodeAnsiTerminalRepresentation, encodeSemanticTerminalUpdate, hashTerminalDeliveryRepresentation, negotiateTerminalDelivery, preaccountSemanticTerminalUpdateBytes, } from "@tmux-ide/core";
 import { SYSTEM_SESSION_RUNTIME_SCHEDULER, } from "./runtime-scheduler.js";
 import { DISABLED_SESSION_RUNTIME_OBSERVABILITY, } from "./runtime-observability.js";
@@ -89,9 +89,11 @@ export class SessionRuntimeTerminalDeliveryHub {
         this.#scheduler = options.scheduler ?? SYSTEM_SESSION_RUNTIME_SCHEDULER;
         this.#observability = options.observability ?? DISABLED_SESSION_RUNTIME_OBSERVABILITY;
     }
-    async open(clientId, semanticPaneId, offerInput, accept, diagnosticIdentity = Object.freeze({ clientId, surface: "direct", laneId: clientId })) {
+    async open(clientId, semanticPaneId, offerInput, accept, diagnosticIdentity = Object.freeze({ clientId, surface: "direct", laneId: clientId }), deliveryWorkspaceName = this.workspaceName) {
         if (this.#closed)
             throw new Error("Terminal delivery hub is closed");
+        // Public delivery identity is independent of the exact native source session.
+        const address = WorkspaceIdSchemaZ.parse(deliveryWorkspaceName);
         const offer = TerminalDeliveryOfferSchemaZ.parse(offerInput);
         const negotiation = negotiateTerminalDelivery(offer, this.generation, this.#scheduler.createId());
         if (!negotiation.accepted)
@@ -120,6 +122,7 @@ export class SessionRuntimeTerminalDeliveryHub {
                 resolveClosed = resolve;
             });
             const client = {
+                deliveryWorkspaceName: address,
                 key,
                 clientId,
                 diagnosticClientId: diagnosticIdentity.clientId,
@@ -168,6 +171,9 @@ export class SessionRuntimeTerminalDeliveryHub {
                     this.#recordDeliveryStatus(client, this.#panes.get(client.paneId));
                 },
                 close: async () => this.#closeClient(client),
+                ...(offer.protocolVersions.includes(TERMINAL_GRAPHICS_CAPABILITY_VERSION)
+                    ? { graphics: this.#graphicsFor(semanticPaneId, client, closed) }
+                    : {}),
             };
         }
         catch (error) {
@@ -193,6 +199,22 @@ export class SessionRuntimeTerminalDeliveryHub {
             this.#pendingClients.delete(key);
         }
     }
+    #graphicsFor(semanticPaneId, client, closed) {
+        const owner = this.#ownerForPane(semanticPaneId);
+        return {
+            subscribe: (listener) => {
+                if (client.closed || !owner.subscribeGraphics)
+                    return () => { };
+                const unsubscribe = owner.subscribeGraphics((state) => {
+                    if (!client.closed)
+                        listener(state);
+                });
+                void closed.then(unsubscribe);
+                return unsubscribe;
+            },
+            image: (digest) => (client.closed ? null : (owner.graphicsImage?.(digest) ?? null)),
+        };
+    }
     /** Retire only this pane's delivery owners before its canonical owner is disposed. */
     failPaneCapture(semanticPaneId, error) {
         for (const client of this.#clients.values())
@@ -685,7 +707,7 @@ export class SessionRuntimeTerminalDeliveryHub {
             const chunkCount = Math.max(1, Math.ceil(representation.bytes.byteLength / (256 * 1024)));
             const envelope = TerminalDeliveryEnvelopeSchemaZ.parse({
                 type: "terminal.delivery",
-                workspaceName: target.update.workspaceName,
+                workspaceName: client.deliveryWorkspaceName,
                 semanticPaneId: target.update.semanticPaneId,
                 generation: target.update.generation,
                 incarnation: target.update.incarnation,
@@ -1302,7 +1324,7 @@ export class SessionRuntimeTerminalDeliveryHub {
                     maxQueueDepth: metrics.maxQueueDepth,
                     inFlight: metrics.inFlight,
                     inFlightBytes: metrics.inFlightBytes,
-                    workspaceName: this.workspaceName,
+                    workspaceName: client.deliveryWorkspaceName,
                     semanticPaneId: client.paneId,
                     faultReason: reason,
                     ...(selectionObservation ? terminalSelectionObservation(selectionObservation) : {}),
@@ -1429,7 +1451,7 @@ export class SessionRuntimeTerminalDeliveryHub {
         try {
             const atMicros = this.#observability.nowMicros();
             this.#observability.recordSpan("transport", "terminal-delivery-subscriber-lifecycle", atMicros, atMicros, null, undefined, Object.freeze({
-                workspaceName: this.workspaceName,
+                workspaceName: client.deliveryWorkspaceName,
                 semanticPaneId: client.paneId,
                 canonicalGeneration: this.generation,
                 canonicalIncarnation: canonical.incarnation,
@@ -1459,7 +1481,7 @@ export class SessionRuntimeTerminalDeliveryHub {
         try {
             const atMicros = this.#observability.nowMicros();
             this.#observability.recordSpan("transport", "terminal-delivery-subscriber-status", atMicros, atMicros, null, undefined, Object.freeze({
-                workspaceName: this.workspaceName,
+                workspaceName: client.deliveryWorkspaceName,
                 semanticPaneId: client.paneId,
                 canonicalGeneration: this.generation,
                 canonicalIncarnation: canonical.incarnation,