cc-session-control 0.6.3__tar.gz → 0.6.4__tar.gz

{cc_session_control-0.6.3/src/cc_session_control.egg-info → cc_session_control-0.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cc-session-control
-Version: 0.6.3
+Version: 0.6.4
 Summary: TUI manager for Claude Code sessions and Remote Control
 Author: dzshzx
 License-Expression: MIT

{cc_session_control-0.6.3 → cc_session_control-0.6.4}/src/cc_session_control/__init__.py

@@ -1,3 +1,3 @@
 """cc-session-control — TUI manager for Claude Code sessions and Remote Control."""
 
-__version__ = "0.6.3"
+__version__ = "0.6.4"

{cc_session_control-0.6.3 → cc_session_control-0.6.4}/src/cc_session_control/actions/agent_ops.py

@@ -23,12 +23,11 @@ from __future__ import annotations
 
 import os
 import shlex
-import signal
-import time
 
 from ..config import cfg
 from ..data import cleanup, liveness, proc, rc, registry
 from ..models import AgentJob, Session
+from . import session_ops
 
 # --- host-pid join (shared by stop_job, remove_job, and the view) -------------
 
@@ -142,11 +141,27 @@ def resume_takeover(job: AgentJob) -> Session:
         pid=pid,
         alive=alive,
         current=current,
+        proc_start=_host_start(pid),
         source="bg",
         agent_short=job.short,
     )
 
 
+def _host_start(pid: int | None) -> str:
+    """`proc_start` of the joined host pid ("" when unknown).
+
+    `job_host` deliberately keeps its small `(pid, alive)` shape; this second
+    lookup feeds `take_over`'s kill-time `pid_alive` recheck so the pid-reuse
+    window is closed on the bg-agent path too, not just for scanned sessions.
+    """
+    if not pid:
+        return ""
+    return next(
+        (sp.proc_start for sp in liveness.live_session_procs() if sp.pid == pid),
+        "",
+    )
+
+
 # --- stop (live workers only) -------------------------------------------------
 
 def stop_job(job: AgentJob) -> bool:
@@ -154,23 +169,15 @@ def stop_job(job: AgentJob) -> bool:
 
     The host pid is JOINed from `sessions/<pid>.json` (`job_host`); only a
     confirmed-live pid is killed — a worker with no sessions file is unstoppable
-    (no-op False, orphan risk). Refuses when "current" can't be determined (no
-    `/proc`, R10). Owns the liveness-cache invalidation (like terminate). Killing
-    does not always fully reap a `--remote-control`/bg worker (orphan risk, see
-    `HELP`).
+    (no-op False, orphan risk). The kill itself is `session_ops.take_over` (the
+    ONE primitive: R10 gate, recheck, SIGTERM, cache invalidation); the early
+    R10 check here just skips the join IO when the answer is already no.
+    Killing does not always fully reap a `--remote-control`/bg worker (orphan
+    risk, see `HELP`).
     """
     if not proc.current_determinable():
         return False
     pid, alive = job_host(job)
     if not alive or not pid:
         return False
-    try:
-        os.kill(pid, signal.SIGTERM)
-    except ProcessLookupError:
-        liveness.invalidate_cache()  # already gone — liveness changed
-        return True
-    except Exception:
-        return False
-    time.sleep(1)
-    liveness.invalidate_cache()
-    return True
+    return session_ops.take_over(pid, _host_start(pid)) in session_ops.TAKE_OVER_OK

{cc_session_control-0.6.3 → cc_session_control-0.6.4}/src/cc_session_control/actions/session_ops.py

@@ -7,39 +7,61 @@ import shlex
 import signal
 import time
 from dataclasses import dataclass
+from typing import Literal
 
 from .. import clipboard
 from ..data import proc, rc
 from ..data.liveness import invalidate_cache
 from ..models import Session
 
+TakeOverResult = Literal["killed", "gone", "refused", "failed"]
+
+#: The results a fail-fast caller counts as success (signalled, or nothing
+#: left to signal) — single-sourced so terminate/stop can't diverge on it.
+TAKE_OVER_OK = ("killed", "gone")
 
-def terminate_session(s: Session) -> bool:
-    """Send SIGTERM and own the liveness-cache invalidation.
 
-    Terminating is the one session op that changes `claude agents` liveness,
-    so it invalidates the alive_map cache itself — callers no longer have to
-    remember to. (delete/cleanup only touch already-dead sessions, so they
-    don't.)
+def take_over(pid: int, proc_start: str = "") -> TakeOverResult:
+    """THE kill primitive behind every takeover/stop: R10 gate → kill-time
+    liveness recheck → SIGTERM → settle → invalidate the liveness cache.
 
-    R10: refuses (returns False) when "current" can't be determined (no
-    `/proc`) — we can't prove `s` is not the launching session, so a SIGTERM
-    here could hit csctl's own session.
+    One implementation so the gate order and the kill semantics cannot fork
+    across the resume/terminate/stop variants (they had already started to:
+    only terminate/stop skipped the settle sleep for an already-gone pid).
+    The recheck (`pid_alive` against `proc_start`; mere existence when the
+    start is unknown) closes the pid-reuse window — a confirm modal can sit
+    open for minutes, and a recycled pid must never be SIGTERMed.
+
+    Results: "killed" (signalled + settled), "gone" (already dead / recycled —
+    nothing to kill), "refused" (R10: current undeterminable), "failed"
+    (signal error, e.g. permissions). Fail-fast callers (terminate/stop) treat
+    "failed" as failure; best-effort callers (the resume family) continue.
     """
     if not proc.current_determinable():
-        return False
-    if not s.pid:
-        return False
+        return "refused"
+    if not proc.pid_alive(pid, proc_start):
+        invalidate_cache()  # already gone — liveness may have changed
+        return "gone"
     try:
-        os.kill(s.pid, signal.SIGTERM)
+        os.kill(pid, signal.SIGTERM)
     except ProcessLookupError:
-        invalidate_cache()  # already gone — liveness changed
-        return True
+        invalidate_cache()
+        return "gone"
     except Exception:
-        return False
+        return "failed"
     time.sleep(1)
     invalidate_cache()
-    return True
+    return "killed"
+
+
+def terminate_session(s: Session) -> bool:
+    """Send SIGTERM via `take_over` (which owns the R10 gate + the
+    liveness-cache invalidation — terminating is the one session op that
+    changes `claude agents` liveness; delete/cleanup only touch already-dead
+    sessions, so they don't invalidate)."""
+    if not s.pid:
+        return False
+    return take_over(s.pid, s.proc_start) in TAKE_OVER_OK
 
 
 def _resume_plan(s: Session, fork: bool = False) -> tuple[str, list[str], bool]:
@@ -90,18 +112,15 @@ def do_resume(s: Session, fork: bool = False) -> None:
     we never SIGTERM the launching session (every pid looks dead off `/proc`).
     """
     cwd, args, should_kill = _resume_plan(s, fork)
-    if should_kill:
-        if not proc.current_determinable():
+    if should_kill and s.pid:
+        if take_over(s.pid, s.proc_start) == "refused":
             print(
                 "Refused: '/proc' unavailable — cannot determine the current "
                 "session, so the old process can't be safely killed (R10)."
             )
             return
-        try:
-            os.kill(s.pid, signal.SIGTERM)
-        except Exception:
-            pass
-        time.sleep(1)
+        # "gone"/"failed" fall through: the kill is best-effort here, the
+        # resume itself must still happen.
     if cwd and os.path.isdir(cwd):
         os.chdir(cwd)
     os.execvp("claude", args)
@@ -121,30 +140,29 @@ def tmux_resume_cmd(s: Session, fork: bool = False) -> str:
     return f"cd {shlex.quote(cwd)} && {line}" if cwd else line
 
 
+def _spawn_in_tmux(s: Session, cmd: str, fork: bool = False) -> str | None:
+    """Kill-if-takeover, then spawn `cmd` in the session's per-project tmux
+    session — the shared skeleton behind `relaunch_in_tmux` (R key, with
+    --remote-control) and `do_tmux_resume` (t key, foreground): the two
+    differed only in the command builder. Returns the exact tmux target,
+    or None on R10 refusal ("refused" from `take_over`) / tmux failure;
+    "gone"/"failed" fall through like `do_resume` (best-effort kill).
+    """
+    _, _, should_kill = _resume_plan(s, fork)
+    if should_kill and s.pid and take_over(s.pid, s.proc_start) == "refused":
+        return None
+    return rc.run_in_tmux(rc.session_name_for(s.cwd), s.sid[:8], cmd)
+
+
 def relaunch_in_tmux(s: Session, fork: bool = False) -> bool:
     """Relaunch a session as `claude --resume … --remote-control …` inside a
     tmux window, so it outlives the terminal and is remotely controllable.
 
-    A live, non-current session is taken over (its old pid is killed first and
-    the liveness cache invalidated, like terminate); a fork leaves the original
-    running. csctl is NOT replaced — it just spawns the tmux window.
-
-    R10: when a takeover kill is required but "current" can't be determined (no
-    `/proc`), refuse (return False, do not kill or relaunch) — we can't prove `s`
-    is not the launching session.
+    A live, non-current session is taken over (old pid killed first, like
+    terminate); a fork leaves the original running. csctl is NOT replaced —
+    it just spawns the tmux window.
     """
-    _, _, should_kill = _resume_plan(s, fork)
-    if should_kill and s.pid:
-        if not proc.current_determinable():
-            return False
-        try:
-            os.kill(s.pid, signal.SIGTERM)
-        except Exception:
-            pass
-        time.sleep(1)
-        invalidate_cache()
-    session = rc.session_name_for(s.cwd)
-    return rc.run_in_tmux(session, s.sid[:8], tmux_resume_cmd(s, fork)) is not None
+    return _spawn_in_tmux(s, tmux_resume_cmd(s, fork), fork=fork) is not None
 
 
 def attach_target(s: Session) -> str | None:
@@ -172,21 +190,8 @@ def tmux_foreground_cmd(s: Session) -> str:
 def do_tmux_resume(s: Session) -> str | None:
     """Kill-if-takeover, spawn the resume window in the session's per-project
     tmux session, and return the exact tmux target to enter; None on failure.
-
-    Mirrors `relaunch_in_tmux`'s kill handling (same `_resume_plan` should_kill
-    + R10 refusal); the caller (cli) then calls `enter_window` on the target."""
-    _, _, should_kill = _resume_plan(s)
-    if should_kill and s.pid:
-        if not proc.current_determinable():
-            return None
-        try:
-            os.kill(s.pid, signal.SIGTERM)
-        except Exception:
-            pass
-        time.sleep(1)
-        invalidate_cache()
-    session = rc.session_name_for(s.cwd)
-    return rc.run_in_tmux(session, s.sid[:8], tmux_foreground_cmd(s))
+    The caller (cli) then calls `enter_window` on the target."""
+    return _spawn_in_tmux(s, tmux_foreground_cmd(s))
 
 
 def do_tmux_new(directory: str) -> str | None:

{cc_session_control-0.6.3 → cc_session_control-0.6.4}/src/cc_session_control/app.py

@@ -45,7 +45,7 @@ class TabView(Protocol):
     def apply_data(self) -> None: ...
     def keyhints(self) -> str: ...
     def handle_key(self, key: str) -> None: ...
-    def deactivate(self) -> None: ...  # tab switch-away: close transient FOOTER modes
+    def captures_text(self) -> bool: ...  # True while a text mode owns EVERY key (incl. tab/q)
 
 # 6-tuple: (name, fg_16, bg_16, mono, fg_256, bg_256)
 # ONE semantic set — views reference these names only (no per-tab duplicates;
@@ -146,10 +146,6 @@ class App:
         self.header.contents[1] = (tab_bar, self.header.options())
 
     def _switch_tab(self) -> None:
-        # Close the outgoing tab's transient footer modes (e.g. the Sessions
-        # filter Edit) — they turn invisible once the next tab's hints replace
-        # the footer, but would keep eating keys after switching back.
-        self.views[self._active].deactivate()
         self._active = (self._active + 1) % len(self.views)
         self.body.original_widget = self.views[self._active].widget
         self._update_tab_bar()
@@ -171,12 +167,19 @@ class App:
             elif key in ("n", "esc"):
                 self._close_confirm()
             return
+        view = self.views[self._active]
+        if view.captures_text():
+            # A text mode (e.g. the Sessions filter Edit) owns EVERY key:
+            # consuming tab/q here would switch tabs / quit mid-typing (the q
+            # in "sql" used to exit csctl).
+            view.handle_key(key)
+            return
         if key == "tab":
             self._switch_tab()
         elif key == "q":
             self._exit()
         else:
-            self.views[self._active].handle_key(key)
+            view.handle_key(key)
 
     def confirm(self, message: str, on_yes: Callable[[], None]) -> None:
         """Show a confirm modal over the active tab; run `on_yes` on Enter/y.
@@ -232,8 +235,13 @@ class App:
         self._exit(intent)
 
     def set_hints(self, hints: str) -> None:
-        """Footer = shared prefix + the active tab's keyhints (D1 single source)."""
-        self.footer_text.set_text(FOOTER_PREFIX + hints)
+        """Footer = shared prefix + the active tab's keyhints (D1 single source).
+
+        While the active view captures text, the prefix's Tab/q/r promises are
+        all false (every key goes to the text widget), so only the mode's own
+        hints are shown."""
+        prefix = "" if self.views[self._active].captures_text() else FOOTER_PREFIX
+        self.footer_text.set_text(prefix + hints)
 
     # --- the view-facing façade (views call these, never App internals) ---
 
@@ -242,14 +250,6 @@ class App:
         may ask about tab state (no peeking at `views`/`_active`)."""
         return self.views[self._active] is view
 
-    def own_footer(self, widget: urwid.Widget) -> None:
-        """Hand the footer to a view's transient widget (e.g. the filter Edit)."""
-        self.frame.footer = widget
-
-    def release_footer(self) -> None:
-        """Give the footer back to the standard hints line."""
-        self._restore_footer()
-
     def notify(self, msg: str, seconds: float = 3) -> None:
         # The newest notification owns the footer: cancel the previous restore
         # alarm so an older timer can't clear this message early.

{cc_session_control-0.6.3 → cc_session_control-0.6.4}/src/cc_session_control/cli.py

@@ -138,10 +138,10 @@ def _cmd_rc(args: argparse.Namespace) -> None:
 def _cmd_prune(args: argparse.Namespace) -> None:
     from .data.cleanup import (
         cleanup_stats,
+        execute_orphan_removals,
+        execute_session_removals,
         list_orphan_dirs,
         prune_sessions,
-        remove_orphan_dirs,
-        remove_session,
     )
     from .data.sessions import scan
 
@@ -155,7 +155,10 @@ def _cmd_prune(args: argparse.Namespace) -> None:
         if not args.apply:
             print("Dry run. Add --apply to execute.")
             return
-        count = remove_orphan_dirs(sessions)
+        # Deletes AT MOST the listed entries, revalidated against fresh
+        # protection data (删除 ⊆ 预览 — same executor as the TUI; `sessions`
+        # feeds the transcript tier of the protection set).
+        count = execute_orphan_removals(orphans, sessions=sessions)
         print(f"Swept {count} orphan dir(s).")
         return
 
@@ -174,9 +177,8 @@ def _cmd_prune(args: argparse.Namespace) -> None:
         print("Dry run. Add --apply to execute.")
         return
 
-    for s in targets:
-        remove_session(s)
-    print(f"Pruned {len(targets)} session(s).")
+    count = execute_session_removals(targets)
+    print(f"Pruned {count} session(s).")
 
 
 def _cmd_prune_zombies(args: argparse.Namespace) -> None:
@@ -184,12 +186,12 @@ def _cmd_prune_zombies(args: argparse.Namespace) -> None:
 
     Reuses the already-gated `data/cleanup` helpers: `select_zombie_pids` keeps
     the current session's pid and any alive pid of a resumed multi-pid sid, and
-    `remove_zombie_session_files` refuses without `/proc`. The dry-run preview is
+    `execute_zombie_removals` refuses without `/proc`. The dry-run preview is
     gated here too — off `/proc` every pid looks dead, so `current` can't be
     determined and we must not even claim the files are sweepable (R10).
     """
     from .data import liveness, proc
-    from .data.cleanup import remove_zombie_session_files, select_zombie_pids
+    from .data.cleanup import execute_zombie_removals, select_zombie_pids
 
     if not proc.current_determinable():
         print("Refused: '/proc' unavailable — cannot determine the current session (R10).")
@@ -201,25 +203,25 @@ def _cmd_prune_zombies(args: argparse.Namespace) -> None:
     if not args.apply:
         print("Dry run. Add --apply to execute.")
         return
-    count = remove_zombie_session_files(procs, cur)
+    count = execute_zombie_removals(zombies, session_procs=procs, cur=cur)
     print(f"Swept {count} zombie session file(s).")
 
 
 def _cmd_prune_aged(args: argparse.Namespace) -> None:
     """Strategy B age sweep of time/global-keyed dirs (R7.2) via the CLI.
 
-    `remove_aged_entries` is mtime-only and session-agnostic, so (unlike the
-    zombie sweep) it is not gated on `/proc`.
+    The age sweep is mtime-only and session-agnostic, so (unlike the zombie
+    sweep) it is not gated on `/proc`.
     """
     from .config import cfg
-    from .data.cleanup import list_aged_entries, remove_aged_entries
+    from .data.cleanup import execute_aged_removals, list_aged_entries
 
     aged = list_aged_entries()
     print(f"Would sweep {len(aged)} aged entr(y/ies) older than {cfg.cleanup_age_days}d")
     if not args.apply:
         print("Dry run. Add --apply to execute.")
         return
-    count = remove_aged_entries()
+    count = execute_aged_removals(aged)
     print(f"Swept {count} aged entr(y/ies).")
 
 
@@ -247,16 +249,15 @@ def _cmd_skill(args: argparse.Namespace) -> None:
 
 
 def _cmd_agents(args: argparse.Namespace) -> None:
-    from .actions.agent_ops import job_host
+    from .data.liveness import enrich_jobs
     from .data.registry import read_agent_jobs
 
-    jobs = read_agent_jobs(max_age=0.0)
+    jobs = enrich_jobs(read_agent_jobs(max_age=0.0))
     if not jobs:
         print("No background agents found.")
         return
     for job in jobs:
-        _pid, alive = job_host(job)
-        state = "live" if alive else (job.state or "settled")
+        state = "live" if job.host_alive else (job.state or "settled")
         tempo = job.tempo or "-"
         name = job.name or job.short
         print(f"  {job.short}  [{state}]  tempo={tempo}  {name}  {job.cwd}")
@@ -266,25 +267,17 @@ def _cmd_env(args: argparse.Namespace) -> None:
     from .data import environments, rc
 
     # Scan RC servers so the env_* namespace is covered too (it has no state
-    # file — only a running server references it).
-    servers = rc.scan_servers()
-    # CURRENT is alive-gated (R3/R6): a zombie session's stale bridge must not be
-    # counted as bound. FILE-REFERENCED is the bridge-truthy membership set.
-    observed = environments.observe_live(rc_servers=servers, max_age=0.0)
-    file_referenced = environments.observe(rc_servers=servers, max_age=0.0)
-    # Record every file-referenced env so a later run (after RC toggled off / a job
-    # removed) reports it as an orphan = ledger − file-referenced (R6 persistence).
-    environments.upsert(file_referenced)
-    current = environments.current_envs(observed)
-    orphans = environments.orphan_envs(file_referenced)
-
-    print(f"Current bridge environments: {len(current)}")
-    for e in current:
+    # file — only a running server references it). The whole observe → upsert →
+    # classify pipeline (and its ordering invariant) lives in reconcile.
+    recon = environments.reconcile(rc_servers=rc.scan_servers(), max_age=0.0)
+
+    print(f"Current bridge environments: {len(recon.current)}")
+    for e in recon.current:
         print(f"  {e.env_id}  sid={e.bound_sid or '-'}")
 
-    print(f"Orphan environments (delete manually on claude.ai/code): {len(orphans)}")
-    for row in environments.manual_delete_list(file_referenced):
-        print(f"  {row['env_id']}  sid={row['bound_sid'] or '-'}")
+    print(f"Orphan environments (delete manually on claude.ai/code): {len(recon.orphans)}")
+    for e in recon.orphans:
+        print(f"  {e.env_id}  sid={e.bound_sid or '-'}")
 
     print(
         "Note: csctl cannot deregister cloud environments; "