tmux-ide 2.9.6 → 2.9.7

package/packages/daemon/dist/terminal/session-runtime/transport-binding.js

@@ -29,6 +29,13 @@ function assertLiveControllerPrincipal(shared, lease) {
         throw new SessionRuntimeControllerLeaseError("stale-controller-lease", "The host no longer owns session controller authority.");
     }
 }
+function holdsCurrentLease(shared) {
+    const lease = shared.lease;
+    if (!lease)
+        return false;
+    const snapshot = shared.consumer.controllerSnapshot();
+    return snapshot.controllerClientId === lease.clientId && snapshot.revision === lease.revision;
+}
 const clientsByRegistry = new WeakMap();
 function authenticatedSurface(transport, hostClientId) {
     // The production host and development gateway mint these principals
@@ -471,18 +478,33 @@ export class SessionRuntimeTransportBinder {
             : this.registry.bindExecutionSource(base, sourceSemanticPaneId);
     }
     activateController(target) {
-        if (target.lease)
+        if (target.lease && holdsCurrentLease(target))
             return;
-        const current = [...this.#clients.values()].find((candidate) => candidate !== target &&
-            candidate.consumer.session === target.consumer.session &&
-            candidate.lease);
-        if (current?.lease) {
-            const previous = current.lease;
-            current.lease = null;
-            target.lease = current.consumer.handoffController(previous, target.consumer.clientId);
+        target.lease = null;
+        const controllerClientId = target.consumer.controllerSnapshot().controllerClientId;
+        const current = controllerClientId === null || controllerClientId === target.consumer.clientId
+            ? undefined
+            : [...this.#clients.values()].find((candidate) => candidate !== target &&
+                candidate.consumer.session === target.consumer.session &&
+                candidate.consumer.clientId === controllerClientId);
+        if (!current) {
+            // Free, already ours, or held by a principal outside this binder (for
+            // example the command-center owner route): plain acquisition decides.
+            target.lease = target.consumer.acquireController();
             return;
         }
-        target.lease = target.consumer.acquireController();
+        // A transport-bound holder whose binding lost its executable lease can
+        // never type again, yet it would keep every other viewer locked out. Re-
+        // derive its exact current lease so the handoff below reclaims it; a live
+        // holder simply hands off as before. Either way only one client can type.
+        const previous = current.lease && holdsCurrentLease(current)
+            ? current.lease
+            : current.consumer.acquireController();
+        const handedOff = current.consumer.handoffController(previous, target.consumer.clientId);
+        // Drop the holder's lease only after the runtime accepted the handoff; a
+        // refusal (e.g. during topology verification) must leave it executable.
+        current.lease = null;
+        target.lease = handedOff;
     }
     async release(shared, grants, interactive) {
         if (shared.refs <= 0)
@@ -500,19 +522,25 @@ export class SessionRuntimeTransportBinder {
         shared.refs -= 1;
         if (shared.refs > 0)
             return;
-        if (shared.lease) {
-            // A same-host passive session channel keeps the controller PRINCIPAL
-            // continuous across interactive pane retargeting. It contributes no
-            // source-pane grant and cannot type; the lease retires with the last
-            // host/session ref, while a passive-only host never acquires one.
-            const retired = shared.lease;
-            shared.lease = null;
-            shared.consumer.releaseController(retired);
+        try {
+            if (shared.lease) {
+                // A same-host passive session channel keeps the controller PRINCIPAL
+                // continuous across interactive pane retargeting. It contributes no
+                // source-pane grant and cannot type; the lease retires with the last
+                // host/session ref, while a passive-only host never acquires one.
+                const retired = shared.lease;
+                shared.lease = null;
+                shared.consumer.releaseController(retired);
+            }
         }
-        for (const [key, candidate] of this.#clients) {
-            if (candidate === shared)
-                this.#clients.delete(key);
+        finally {
+            // A refused surrender must never strand the controller on a client with
+            // no transport: closing the consumer retires whatever it still owns.
+            for (const [key, candidate] of this.#clients) {
+                if (candidate === shared)
+                    this.#clients.delete(key);
+            }
+            await shared.consumer.close();
         }
-        await shared.consumer.close();
     }
 }

package/packages/daemon/dist/terminal/session-runtime/xterm-terminal-interpreter-backend.js

@@ -82,6 +82,17 @@ export class XtermTerminalInterpreterBackend {
     get rows() {
         return this.#terminal.rows;
     }
+    graphicsCursor() {
+        const buffer = this.#terminal.buffer.active;
+        return {
+            x: Math.min(buffer.cursorX, this.#terminal.cols - 1),
+            line: buffer.baseY + buffer.cursorY,
+            alternate: buffer.type === "alternate",
+        };
+    }
+    graphicsViewportTop() {
+        return this.#terminal.buffer.active.baseY;
+    }
     write(data) {
         return new Promise((resolve) => this.#terminal.write(data, resolve));
     }

package/packages/daemon/dist/tui/mirror/runtime/application-home-agents-owner.js

@@ -232,8 +232,14 @@ export function createApplicationHomeNavigationOwner(options) {
                 command === "whats-new" ||
                 command === "switch-session")
                 return null;
-            if (options.sessionOwner()?.snapshot()?.status !== "live")
+            const status = options.sessionOwner()?.snapshot()?.status;
+            if (status !== "live") {
+                if (status === "rebinding")
+                    return "Terminal is updating. Try again shortly.";
+                if (status === "connecting")
+                    return "Opening terminal…";
                 return "Open a live session first";
+            }
             return command !== "new-window" && command !== "new-agent" && !options.focusedPane()
                 ? "Select a live pane first"
                 : null;

package/packages/daemon/dist/tui/mirror/runtime/application-terminal-input-ingress.js

@@ -103,7 +103,14 @@ export function createApplicationTerminalInputIngress(interaction, generation, s
             }
             : undefined;
         recovery.inputs.push(async () => {
-            for (const [index, input] of inputs.entries()) {
+            if (version !== recoveryVersion ||
+                !sameScope(target, scope()) ||
+                generation()?.status !== "live")
+                return false;
+            const framed = typeof inputs === "function" ? inputs() : inputs;
+            if (framed === null)
+                return false;
+            for (const [index, input] of framed.entries()) {
                 if (version !== recoveryVersion ||
                     !sameScope(target, scope()) ||
                     generation()?.status !== "live" ||
@@ -155,6 +162,24 @@ export function createApplicationTerminalInputIngress(interaction, generation, s
             }
         })();
     };
+    const pasteMode = () => {
+        const active = generation();
+        const pane = focusedPane();
+        if (active?.status !== "live" || !active.fastLane || !pane)
+            return null;
+        const mode = active.fastLane.lane.paneState(pane)?.snapshot?.modes.bracketedPaste;
+        return typeof mode === "boolean" ? mode : null;
+    };
+    const deliverPaste = (bytes) => {
+        const mode = pasteMode();
+        if (mode === null) {
+            // Do not let the successful drain of the surrounding FIFO hide refusal.
+            ownsNote = false;
+            setNote("terminal unavailable · paste was not sent");
+            return;
+        }
+        sendApplicationTerminalPaste(interaction, bytes, captureOrigin(), mode);
+    };
     const captureOrigin = () => Boolean(currentTuiPerformanceEventSink()?.terminalInputOrigin);
     const flush = () => {
         const owner = sessionOwner();
@@ -243,7 +268,7 @@ export function createApplicationTerminalInputIngress(interaction, generation, s
                 return;
             const copy = Uint8Array.from(bytes);
             try {
-                terminalInputsForPaste(Buffer.from(copy).toString("utf8"));
+                terminalInputsForPaste(Buffer.from(copy).toString("utf8"), false);
             }
             catch {
                 setNote("terminal unavailable · paste was rejected");
@@ -255,12 +280,17 @@ export function createApplicationTerminalInputIngress(interaction, generation, s
                 active?.status === "live" &&
                 active.fastLane &&
                 focusedPane()) {
-                sendApplicationTerminalPaste(interaction, copy, captureOrigin());
+                deliverPaste(copy);
                 return;
             }
-            if (recover(terminalInputsForPaste(Buffer.from(copy).toString("utf8")), copy, "paste"))
+            if (recover(() => {
+                const mode = pasteMode();
+                return mode === null
+                    ? null
+                    : terminalInputsForPaste(Buffer.from(copy).toString("utf8"), mode);
+            }, copy, "paste"))
                 return;
-            noteAdmission(pending.enqueue(() => sendApplicationTerminalPaste(interaction, copy, captureOrigin()), copy.byteLength), "paste");
+            noteAdmission(pending.enqueue(() => deliverPaste(copy), copy.byteLength), "paste");
         },
         dispose() {
             cancelInteractionInput();

package/packages/daemon/dist/tui/mirror/runtime/application-terminal-paste.js

@@ -10,9 +10,9 @@ export function sendApplicationTerminalKey(interaction, event, captureOrigin) {
     void interaction.sendInput(input, parserOrigin);
     return true;
 }
-export function sendApplicationTerminalPaste(interaction, bytes, captureOrigin) {
+export function sendApplicationTerminalPaste(interaction, bytes, captureOrigin, bracketedPaste) {
     const text = Buffer.from(bytes).toString("utf8");
-    const inputs = terminalInputsForPaste(text);
+    const inputs = terminalInputsForPaste(text, bracketedPaste);
     for (let index = 0; index < inputs.length; index += 1) {
         const parserOrigin = index === 0 && captureOrigin
             ? { origin: "bracketed-paste", payload: Buffer.from(bytes) }

package/packages/daemon/dist/tui/mirror/runtime/terminal-input-adapter.js

@@ -33,12 +33,12 @@ export function terminalInputForOpenTuiKey(event) {
     return SessionRuntimeTerminalInputSchemaZ.parse({ kind: "text", data });
 }
 /** Preserve paste ordering and bracketed-paste semantics without an unbounded frame. */
-export function terminalInputsForPaste(text) {
+export function terminalInputsForPaste(text, bracketedPaste) {
     if (text.length === 0)
         return [];
     if (text.includes("\0"))
         throw new TypeError("terminal paste must not contain NUL");
-    const framed = `\u001b[200~${text}\u001b[201~`;
+    const framed = bracketedPaste ? `\u001b[200~${text}\u001b[201~` : text;
     const inputs = [];
     for (let offset = 0; offset < framed.length;) {
         let end = Math.min(offset + SESSION_RUNTIME_MAX_TERMINAL_INPUT_TEXT_CHARS, framed.length);

package/packages/daemon/src/command-center/tmux-server-diagnostics.ts

@@ -0,0 +1,38 @@
+import type { Hono } from "hono";
+import { TmuxServerScopeSchemaZ, TmuxServerDiagnosticsSchemaZ } from "@tmux-ide/contracts";
+import { TmuxServerScopeError, type TmuxServerOwners } from "../lib/tmux-server-owners.ts";
+import type { NativeTmuxServerOwner } from "../lib/tmux-server-owner.ts";
+
+/** Mount beneath the existing owner-authenticated, no-store server router. */
+export function mountTmuxServerDiagnosticsRoute(
+  app: Hono,
+  options: {
+    scopedPath: string;
+    owners: TmuxServerOwners<NativeTmuxServerOwner>;
+  },
+) {
+  app.get(`${options.scopedPath}/diagnostics`, async (c) => {
+    const scope = TmuxServerScopeSchemaZ.safeParse({
+      serverId: c.req.param("serverId"),
+      generation: c.req.param("generation"),
+    });
+    if (!scope.success) return c.json({ error: { code: "invalid-request" } }, 400);
+    try {
+      c.req.raw.signal.throwIfAborted();
+      const tmuxVersion = await options.owners.withOwner(scope.data, (owner) =>
+        owner.readServerVersion(c.req.raw.signal),
+      );
+      c.req.raw.signal.throwIfAborted();
+      return c.json(
+        TmuxServerDiagnosticsSchemaZ.parse({ version: 1, server: scope.data, tmuxVersion }),
+      );
+    } catch (error) {
+      if (error instanceof TmuxServerScopeError)
+        return c.json(
+          { error: { code: "scope-unavailable" } },
+          error.code === "not-found" ? 404 : 409,
+        );
+      return c.json({ error: { code: "diagnostics-unavailable" } }, 503);
+    }
+  });
+}

package/packages/daemon/src/command-center/tmux-server-history-anchor.ts

@@ -0,0 +1,69 @@
+import type { Hono } from "hono";
+import {
+  HistoryAnchorRequestSchemaZ,
+  HistoryAnchorResponseSchemaZ,
+  TmuxServerScopeSchemaZ,
+} from "@tmux-ide/contracts";
+import { TmuxServerScopeError, type TmuxServerOwners } from "../lib/tmux-server-owners.ts";
+import type { NativeTmuxServerOwner } from "../lib/tmux-server-owner.ts";
+/** Mounted below owner-authenticated no-store middleware. Never opens a runtime. */
+export function mountTmuxServerHistoryAnchorRoute(
+  app: Hono,
+  options: {
+    scopedPath: string;
+    owners: TmuxServerOwners<NativeTmuxServerOwner>;
+    readBody: (request: Request) => Promise<unknown>;
+  },
+) {
+  app.post(`${options.scopedPath}/history-anchor`, async (c) => {
+    const scope = TmuxServerScopeSchemaZ.safeParse({
+      serverId: c.req.param("serverId"),
+      generation: c.req.param("generation"),
+    });
+    if (!scope.success) return c.json({ error: { code: "invalid-request" } }, 400);
+    let body;
+    try {
+      body = HistoryAnchorRequestSchemaZ.parse(await options.readBody(c.req.raw));
+    } catch {
+      return c.json({ error: { code: "invalid-request" } }, 400);
+    }
+    if (body.proof.generation !== scope.data.generation)
+      return c.json({ error: { code: "stale-generation" } }, 409);
+    try {
+      c.req.raw.signal.throwIfAborted();
+      const result = await options.owners.withOwner(scope.data, async (owner) => {
+        const sessions = await owner.catalog();
+        c.req.raw.signal.throwIfAborted();
+        const workspace = owner.workspaceRegistry.get(body.proof.workspaceName);
+        if (
+          !workspace ||
+          !sessions.some(
+            (row) =>
+              row.sessionName === workspace.sessionName && row.liveSessionId === body.liveSessionId,
+          )
+        )
+          return { status: "stale" as const };
+        const result = owner.sessionRuntimeRegistry.historyAnchor(
+          workspace.sessionName,
+          HistoryAnchorRequestSchemaZ.parse({
+            ...body,
+            proof: { ...body.proof, workspaceName: workspace.sessionName },
+          }),
+        );
+        // Delivery aliases are transport addresses, not canonical session names.
+        return result.status === "resolved"
+          ? { ...result, proof: { ...result.proof, workspaceName: body.proof.workspaceName } }
+          : result;
+      });
+      c.req.raw.signal.throwIfAborted();
+      return c.json(HistoryAnchorResponseSchemaZ.parse({ version: 1, server: scope.data, result }));
+    } catch (error) {
+      if (error instanceof TmuxServerScopeError)
+        return c.json(
+          { error: { code: "scope-unavailable" } },
+          error.code === "not-found" ? 404 : 409,
+        );
+      return c.json({ error: { code: "history-unavailable" } }, 503);
+    }
+  });
+}

package/packages/daemon/src/command-center/tmux-servers.ts

@@ -1,3 +1,5 @@
+import { mountTmuxServerHistoryAnchorRoute } from "./tmux-server-history-anchor.ts";
+import { mountTmuxServerDiagnosticsRoute } from "./tmux-server-diagnostics.ts";
 import { WindowSplitLayoutUnavailable } from "../terminal/mirror/window-split-authority.ts";
 import { streamTmuxInteractions } from "./tmux-server-interaction-events.ts";
 import { mountTmuxServerNativeBackingRoute } from "./tmux-server-native-backing.ts";
@@ -30,6 +32,7 @@ import {
 } from "../lib/tmux-server-owners.ts";
 import type { NativeTmuxServerOwner } from "../lib/tmux-server-owner.ts";
 import { WorkspaceMultiplexerError } from "../lib/workspace-multiplexer-verbs.ts";
+import { WorkspacePaneCreationError } from "../lib/workspace-pane-creation.ts";
 import { ownerBearerMatches } from "./owner-authority.ts";
 import { mountPaneStreamIssueRoute } from "./pane-stream-issue.ts";
 import { projectTerminalRuntimeInventory } from "./resources/terminal-runtime-inventory.ts";
@@ -79,6 +82,8 @@ function failure(c: Context, error: unknown): Response {
       { error: { code: error.code } },
       error.code === "not-found" ? 404 : error.code === "capacity" ? 429 : 409,
     );
+  if (error instanceof WorkspacePaneCreationError && error.code === "harness_unavailable")
+    return c.json({ error: { code: "harness_unavailable" } }, 409);
   if (error instanceof WorkspaceMultiplexerError)
     return c.json({ error: { code: error.code } }, 409);
   if (error instanceof z.ZodError || error instanceof SyntaxError || error instanceof TypeError)
@@ -133,6 +138,12 @@ export function mountTmuxServerRoutes(app: Hono, options: TmuxServerRoutesOption
     }),
   );
   const scoped = `${base}/:serverId/:generation`;
+  mountTmuxServerHistoryAnchorRoute(app, {
+    scopedPath: scoped,
+    owners: options.owners,
+    readBody: (request) => boundedJson(request, 4096),
+  });
+  mountTmuxServerDiagnosticsRoute(app, { scopedPath: scoped, owners: options.owners });
   mountTmuxServerEditorContextRoute(app, {
     scopedPath: scoped,
     owners: options.owners,

package/packages/daemon/src/lib/canonical-daemon-bootstrap.ts

@@ -100,6 +100,12 @@ function spawnOwner(entryPath: string, cwd: string): Promise<void> {
   });
 }
 
+class ShutdownTransportError extends Error {
+  constructor(readonly original: unknown) {
+    super("Canonical daemon shutdown transport failed.", { cause: original });
+  }
+}
+
 async function shutdownOlderOwner(info: CanonicalDaemonInfo): Promise<void> {
   const headers: Record<string, string> = { "content-type": "application/json" };
   if (info.authToken) headers.authorization = `Bearer ${info.authToken}`;
@@ -115,7 +121,9 @@ async function shutdownOlderOwner(info: CanonicalDaemonInfo): Promise<void> {
       }),
       signal: AbortSignal.timeout(2_000),
     },
-  );
+  ).catch((error: unknown) => {
+    throw new ShutdownTransportError(error);
+  });
   const envelope = (await response.json().catch(() => null)) as {
     ok?: unknown;
     result?: { stopping?: unknown };
@@ -248,7 +256,16 @@ async function replaceOlderCanonicalDaemon(
       { reason: "canonical-record-invalid" },
     );
   }
-  await deps.shutdownOlderOwner(info);
+  let transportFailure: ShutdownTransportError | undefined;
+  try {
+    await deps.shutdownOlderOwner(info);
+  } catch (error) {
+    if (!(error instanceof ShutdownTransportError)) throw error;
+    transportFailure = error;
+  }
+  // A competing upgrader may close the authenticated owner's listener before
+  // removing its record. Observe retirement, without repeating the mutation.
+  // A transport failure alone never authorizes starting a replacement.
   const deadline = deps.now() + timeoutMs;
   while (deps.now() < deadline) {
     const state = deps.inspect();
@@ -257,6 +274,7 @@ async function replaceOlderCanonicalDaemon(
     if (!(await deps.alive(info))) return;
     await deps.sleep(25);
   }
+  if (transportFailure) throw transportFailure.original;
   throw new DaemonBootstrapError(
     "control-timeout",
     "The older canonical daemon did not retire after accepting the version upgrade.",

package/packages/daemon/src/lib/daemon-embed.ts

@@ -1,3 +1,4 @@
+import { TmuxServerVersionSchemaZ } from "@tmux-ide/contracts";
 import {
   createNativeSplitCapabilityProbe,
   createNativeSplitReadiness,
@@ -1400,6 +1401,7 @@ async function startEmbeddedDaemonGeneration(
     let paneStreamRuntime: PaneStreamRuntime | null = null;
     let serverOwners: Awaited<ReturnType<typeof createEmbeddedTmuxServerOwners>> | null = null;
     let defaultEditorContextRetired = false;
+    const defaultDiagnosticsLifetime = new AbortController();
     const defaultSessionCreator = createNativeTmuxSessionCreator({
       generation: instanceId,
       registry: workspaceRegistry,
@@ -1805,6 +1807,29 @@ async function startEmbeddedDaemonGeneration(
         stateDirectory: resolveRuntimeNamespace().runtimeDir,
         webSocketBaseUrl: canonicalDaemonUrl("ws", bindHostname, port),
         defaultOwner: {
+          readServerVersion: async (signal?: AbortSignal) => {
+            const assertCurrent = () => {
+              if (
+                defaultEditorContextRetired ||
+                serverOwners?.defaultRetired ||
+                !initialNativeServerIdentity
+              )
+                throw new Error("Default tmux diagnostics owner is unavailable");
+            };
+            assertCurrent();
+            const combined = AbortSignal.any([
+              defaultDiagnosticsLifetime.signal,
+              ...(signal ? [signal] : []),
+            ]);
+            combined.throwIfAborted();
+            const output = await fleetFactsTmuxRunner(
+              ["display-message", "-p", "#{version}"],
+              combined,
+            );
+            combined.throwIfAborted();
+            assertCurrent();
+            return TmuxServerVersionSchemaZ.parse(output.trim());
+          },
           get interactionObservation() {
             return interactionObservation;
           },
@@ -1913,6 +1938,7 @@ async function startEmbeddedDaemonGeneration(
           paneStreamRuntime,
           dispose: async () => {
             defaultEditorContextRetired = true;
+            defaultDiagnosticsLifetime.abort();
             sessionMonitor?.stop();
             paneSourceCredentials.dispose();
             const transportResults = await Promise.allSettled([

package/packages/daemon/src/lib/tmux-server-owner.ts

@@ -30,6 +30,7 @@ import { observedAgentSchema } from "./tmux-server-agent-admission.ts";
 import { createPaneEditorContextResolver } from "./tmux-pane-editor-context.ts";
 import { createHash, randomUUID } from "node:crypto";
 import {
+  TmuxServerVersionSchemaZ,
   WorkspaceIdSchemaZ,
   WindowLinkTargetSchemaZ,
   type WindowLinkTarget,
@@ -594,6 +595,15 @@ export async function createNativeTmuxServerOwner(options: NativeTmuxServerOwner
     throw error;
   }
   return {
+    readServerVersion: async (signal?: AbortSignal) => {
+      assertOpen();
+      const combined = AbortSignal.any([credentialLifetime.signal, ...(signal ? [signal] : [])]);
+      combined.throwIfAborted();
+      const output = await generationRunAsync(["display-message", "-p", "#{version}"], combined);
+      combined.throwIfAborted();
+      assertOpen();
+      return TmuxServerVersionSchemaZ.parse(output.trim());
+    },
     serverId: options.serverId,
     generation,
     resolvePaneEditorContext,

package/packages/daemon/src/lib/tmux-session-mutation-fence.ts

@@ -23,7 +23,8 @@ export function createTmuxSessionMutationFence() {
         const output = run([
           "if-shell",
           "-t",
-          `=${selected.name}`,
+          // if-shell resolves a pane target: the colon selects this exact session.
+          `=${selected.name}:`,
           "-F",
           `#{&&:#{==:#{session_id},${selected.id}},#{==:#{session_created},${selected.created}}}`,
           args.map((arg) => (arg === ";" ? ";" : shellEscape(arg))).join(" "),