railmux 0.4.0.dev8__tar.gz → 0.4.0.dev10__tar.gz

{railmux-0.4.0.dev8/src/railmux.egg-info → railmux-0.4.0.dev10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: railmux
-Version: 0.4.0.dev8
+Version: 0.4.0.dev10
 Summary: Terminal UI to navigate, resume, and start Claude Code and Codex sessions
 Author-email: Rightglow <zhang.taian@foxmail.com>
 License-Expression: MIT

railmux-0.4.0.dev10/src/railmux/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.4.0.dev10"

{railmux-0.4.0.dev8 → railmux-0.4.0.dev10}/src/railmux/cli.py

@@ -20,16 +20,20 @@ from railmux.runtime_config import (
 )
 from railmux import tmux_health
 from railmux import tmux_server
+from railmux import windows_tmux_lifecycle
 from railmux.system_deps import ensure_tmux_available
 from railmux.ssh_args import AppendSshArgument, ExtendSshArguments
 
 
-def _show_startup_message() -> None:
+def _show_startup_message(
+    detail: str = "Reconnecting sessions and panes…",
+) -> None:
     """Paint immediate feedback before App performs its initial discovery."""
     if not sys.stdout.isatty():
         return
     size = shutil.get_terminal_size((80, 24))
-    sys.stdout.write(render_startup_surface(size.columns, size.lines))
+    sys.stdout.write(render_startup_surface(
+        size.columns, size.lines, detail=detail))
     sys.stdout.flush()
 
 
@@ -123,7 +127,16 @@ def _run_tmux_client_with_watchdog(
                     file=sys.stderr,
                 )
                 return 2
+        # tmux may leave the client TTY in raw mode even after its process
+        # exits. Restore it before a bounded recovery probe or user message.
+        _restore_terminal(attributes)
         returncode = process.returncode or 0
+        if windows_tmux_lifecycle.recover_abandoned_socket():
+            print(
+                "info: cleaned an abandoned Windows tmux socket; Codex and "
+                "Claude session files were not changed",
+                file=sys.stderr,
+            )
         if returncode and expected_target is not None:
             try:
                 current_target = tmux_server.discover_target(timeout=1.0)
@@ -364,6 +377,12 @@ def main(argv: list[str] | None = None) -> int:
         # Validate before any command can address a tmux server. ``tmux -V``
         # above is server-independent.
         tmux_server.socket_label()
+        if windows_tmux_lifecycle.recover_abandoned_socket():
+            print(
+                "info: cleaned an abandoned Windows tmux socket; Codex and "
+                "Claude session files were not changed",
+                file=sys.stderr,
+            )
         dedicated_target = tmux_server.discover_target()
         on_dedicated_server = tmux_server.is_current_server(dedicated_target)
     except tmux_server.TmuxServerError as exc:
@@ -441,6 +460,7 @@ def main(argv: list[str] | None = None) -> int:
     _show_startup_message()
     # Lazy import so non-TUI invocations (--version etc) don't pull urwid.
     from railmux.ui.app import App
+    from railmux.provider_paths import running_in_windows_wrapper
     app = App(
         claude_home=Path(args.claude_home),
         config=config,
@@ -451,6 +471,10 @@ def main(argv: list[str] | None = None) -> int:
             is_ssh_session() if args.scroll_coalescing is None
             else args.scroll_coalescing
         ),
+        startup_progress=(
+            _show_startup_message
+            if running_in_windows_wrapper() else None
+        ),
     )
     app.run()
     return 0

{railmux-0.4.0.dev8 → railmux-0.4.0.dev10}/src/railmux/codex_index.py

@@ -25,7 +25,7 @@ from railmux.models import (
     Project,
     SessionMeta,
 )
-from railmux.provider_paths import provider_path
+from railmux.provider_paths import private_mode_is_safe, provider_path
 from railmux.renames import Renames
 
 # Codex has no reliable provider-neutral signal that distinguishes a long
@@ -461,7 +461,7 @@ class CodexIndex:
             if (
                 not stat.S_ISREG(info.st_mode)
                 or info.st_uid != os.getuid()
-                or info.st_mode & 0o077
+                or not private_mode_is_safe(info.st_mode)
                 or info.st_size > _PERSISTENT_CACHE_MAX_BYTES
             ):
                 return

{railmux-0.4.0.dev8 → railmux-0.4.0.dev10}/src/railmux/discovery.py

@@ -1,13 +1,16 @@
 """Enumerate Claude project directories from ~/.claude/projects/."""
 from __future__ import annotations
 
+import hashlib
 import json
 import os
+import stat
 from pathlib import Path
 
 from railmux.atomic_file import atomic_write_text
 from railmux.models import Project
 from railmux.path_codec import decode, is_encoded_project_name
+from railmux.provider_paths import private_mode_is_safe
 from railmux.session_index import _looks_like_uuid, _scan_session
 
 
@@ -19,6 +22,134 @@ _cache: dict[Path, tuple[int, list[Project]]] = {}
 _session_validity: dict[
     Path, dict[Path, tuple[tuple[int, int, int], bool]]
 ] = {}
+_persistent_validity_loaded: set[Path] = set()
+_persistent_validity_exact_only: set[Path] = set()
+_persistent_validity_dirty: set[Path] = set()
+_VALIDITY_CACHE_SCHEMA = 1
+_VALIDITY_CACHE_LIMIT = 16 * 1024 * 1024
+_VALIDITY_RECORD_LIMIT = 100_000
+
+
+def _windows_validity_cache_enabled() -> bool:
+    return os.environ.get("RAILMUX_WINDOWS_RUNTIME") == "msys2"
+
+
+def _validity_cache_file(claude_home: Path) -> Path:
+    base = Path(os.environ.get("XDG_CACHE_HOME", Path.home() / ".cache"))
+    identity = hashlib.sha256(
+        os.fsencode(os.path.abspath(claude_home))
+    ).hexdigest()[:16]
+    return base / "railmux" / f"claude-validity-{identity}.json"
+
+
+def _load_persistent_validity(claude_home: Path) -> None:
+    if (
+        not _windows_validity_cache_enabled()
+        or claude_home in _persistent_validity_loaded
+    ):
+        return
+    _persistent_validity_loaded.add(claude_home)
+    path = _validity_cache_file(claude_home)
+    try:
+        info = path.lstat()
+        if (
+            not stat.S_ISREG(info.st_mode)
+            or info.st_uid != os.getuid()
+            or info.st_size > _VALIDITY_CACHE_LIMIT
+            or not private_mode_is_safe(info.st_mode)
+        ):
+            return
+        raw = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, json.JSONDecodeError):
+        return
+    if not isinstance(raw, dict) or raw.get("schema") != _VALIDITY_CACHE_SCHEMA:
+        return
+    records = raw.get("records")
+    if not isinstance(records, list) or len(records) > _VALIDITY_RECORD_LIMIT:
+        return
+    projects_dir = claude_home / "projects"
+    loaded: list[Path] = []
+    try:
+        for record in records:
+            if not isinstance(record, list) or len(record) != 6:
+                raise ValueError("invalid validity record")
+            project, filename, inode, mtime_ns, size, valid = record
+            if (
+                not isinstance(project, str)
+                or not is_encoded_project_name(project)
+                or not isinstance(filename, str)
+                or Path(filename).name != filename
+                or not filename.endswith(".jsonl")
+                or not _looks_like_uuid(Path(filename).stem)
+                or not all(isinstance(value, int) and value >= 0
+                           for value in (inode, mtime_ns, size))
+                or not isinstance(valid, bool)
+            ):
+                raise ValueError("invalid validity record")
+            project_dir = projects_dir / project
+            session_path = project_dir / filename
+            _session_validity.setdefault(project_dir, {})[session_path] = (
+                (inode, mtime_ns, size), valid,
+            )
+            loaded.append(session_path)
+    except ValueError:
+        for session_path in loaded:
+            cached = _session_validity.get(session_path.parent)
+            if cached is not None:
+                cached.pop(session_path, None)
+                if not cached:
+                    _session_validity.pop(session_path.parent, None)
+        return
+    _persistent_validity_exact_only.update(loaded)
+
+
+def _mark_persistent_validity_dirty(claude_dir: Path) -> None:
+    if _windows_validity_cache_enabled():
+        _persistent_validity_dirty.add(claude_dir.parent.parent)
+
+
+def _save_persistent_validity(claude_home: Path) -> None:
+    if (
+        not _windows_validity_cache_enabled()
+        or claude_home not in _persistent_validity_dirty
+    ):
+        return
+    projects_dir = claude_home / "projects"
+    records: list[list[object]] = []
+    for project_dir, values in _session_validity.items():
+        if (
+            project_dir.parent != projects_dir
+            or not is_encoded_project_name(project_dir.name)
+        ):
+            continue
+        for session_path, (signature, valid) in values.items():
+            if session_path.parent != project_dir:
+                continue
+            inode, mtime_ns, size = signature
+            records.append([
+                project_dir.name,
+                session_path.name,
+                inode,
+                mtime_ns,
+                size,
+                valid,
+            ])
+    records.sort(key=lambda item: int(item[3]), reverse=True)
+    records = records[:_VALIDITY_RECORD_LIMIT]
+    path = _validity_cache_file(claude_home)
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        atomic_write_text(
+            path,
+            json.dumps(
+                {"schema": _VALIDITY_CACHE_SCHEMA, "records": records},
+                separators=(",", ":"),
+            ),
+        )
+        os.chmod(path, 0o600)
+    except OSError:
+        return
+    _persistent_validity_dirty.discard(claude_home)
 
 
 def invalidate_session(path: Path) -> None:
@@ -27,6 +158,8 @@ def invalidate_session(path: Path) -> None:
     if cached is None:
         return
     cached.pop(path, None)
+    _persistent_validity_exact_only.discard(path)
+    _mark_persistent_validity_dirty(path.parent)
     if not cached:
         _session_validity.pop(path.parent, None)
 
@@ -64,6 +197,7 @@ def list_projects(claude_home: Path) -> list[Project]:
     session counts and recency track files created, changed, or removed below
     the cached top-level directory.
     """
+    _load_persistent_validity(claude_home)
     projects_dir = claude_home / "projects"
     if not projects_dir.is_dir():
         return []
@@ -79,6 +213,7 @@ def list_projects(claude_home: Path) -> list[Project]:
         # without re-decoding every project name.
         refreshed = _refresh_activity(cached[1])
         _cache[claude_home] = (parent_mtime, refreshed)
+        _save_persistent_validity(claude_home)
         return refreshed
 
     # Full scan needed.
@@ -153,6 +288,7 @@ def list_projects(claude_home: Path) -> list[Project]:
 
     results.sort(key=lambda p: p.last_activity_ts, reverse=True)
     _cache[claude_home] = (parent_mtime, results)
+    _save_persistent_validity(claude_home)
     return results
 
 
@@ -198,6 +334,7 @@ def _count_and_latest_mtime(claude_dir: Path, real_path: Path) -> tuple[int, flo
             if cached is not None and cached[0] == signature:
                 valid = cached[1]
             elif (cached is not None and cached[1]
+                  and path not in _persistent_validity_exact_only
                   and cached[0][0] == stat.st_ino
                   and stat.st_size > cached[0][2]):
                 # Claude session JSONLs are append-only. Once a file is valid,
@@ -208,9 +345,12 @@ def _count_and_latest_mtime(claude_dir: Path, real_path: Path) -> tuple[int, flo
                 # explicitly via ``invalidate_session``).
                 valid = True
                 validity[path] = (signature, True)
+                _mark_persistent_validity_dirty(claude_dir)
             else:
                 valid = _scan_session(temp_project, path) is not None
                 validity[path] = (signature, valid)
+                _persistent_validity_exact_only.discard(path)
+                _mark_persistent_validity_dirty(claude_dir)
             if not valid:
                 continue
             count += 1
@@ -219,6 +359,8 @@ def _count_and_latest_mtime(claude_dir: Path, real_path: Path) -> tuple[int, flo
                 latest = m
     for stale in set(validity) - current_paths:
         del validity[stale]
+        _persistent_validity_exact_only.discard(stale)
+        _mark_persistent_validity_dirty(claude_dir)
     if not validity:
         _session_validity.pop(claude_dir, None)
     return count, latest

{railmux-0.4.0.dev8 → railmux-0.4.0.dev10}/src/railmux/fast_display_server.py

@@ -1493,7 +1493,7 @@ def _acquire_display_lock(
         if (
             not stat.S_ISREG(info.st_mode)
             or info.st_uid != os.getuid()
-            or info.st_mode & 0o077
+            or not restart_state.private_mode_is_safe(info.st_mode)
         ):
             raise OSError("unsafe display lock")
         deadline = time.monotonic() + max(0.0, timeout)

{railmux-0.4.0.dev8 → railmux-0.4.0.dev10}/src/railmux/mouse_manager.py

@@ -60,7 +60,7 @@ class RootWheelForwardingManager:
             info = self._state_path.lstat()
             if (not stat.S_ISREG(info.st_mode)
                     or info.st_uid != os.getuid()
-                    or info.st_mode & 0o077
+                    or not restart_state.private_mode_is_safe(info.st_mode)
                     or info.st_size > _MAX_STATE_BYTES):
                 return None
             raw = json.loads(self._state_path.read_text(encoding="utf-8"))

{railmux-0.4.0.dev8 → railmux-0.4.0.dev10}/src/railmux/orphan_marker.py

@@ -231,7 +231,7 @@ def claim_owner(
         parent = lock_path.parent.stat()
         if (not stat.S_ISDIR(parent.st_mode)
                 or parent.st_uid != os.getuid()
-                or parent.st_mode & 0o077):
+                or not restart_state.private_mode_is_safe(parent.st_mode)):
             return None
         flags = os.O_CREAT | os.O_RDWR
         if hasattr(os, "O_NOFOLLOW"):
@@ -243,7 +243,7 @@ def claim_owner(
         info = os.fstat(fd)
         if (not stat.S_ISREG(info.st_mode)
                 or info.st_uid != os.getuid()
-                or info.st_mode & 0o077):
+                or not restart_state.private_mode_is_safe(info.st_mode)):
             return None
         try:
             fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)

{railmux-0.4.0.dev8 → railmux-0.4.0.dev10}/src/railmux/provider_paths.py

@@ -1,13 +1,17 @@
 """Translate provider-owned native Windows paths inside the MSYS2 preview."""
 from __future__ import annotations
 
+import json
 import os
 import re
+import stat
+import sys
 from collections.abc import Mapping
 from pathlib import Path
 
 
 _DRIVE_PATH = re.compile(r"^(?:\\\\\?\\)?([A-Za-z]):[\\/](.*)\Z")
+_MANAGED_RUNTIME_MARKER = Path("/railmux-runtime.json")
 
 
 def running_in_windows_wrapper(environ: Mapping[str, str] = os.environ) -> bool:
@@ -15,6 +19,41 @@ def running_in_windows_wrapper(environ: Mapping[str, str] = os.environ) -> bool:
     return environ.get("RAILMUX_WINDOWS_RUNTIME") == "msys2"
 
 
+def running_in_managed_windows_wrapper(
+    environ: Mapping[str, str] = os.environ,
+) -> bool:
+    """Verify the installed MSYS2 runtime, not merely its environment hint."""
+    if sys.platform != "cygwin" or not running_in_windows_wrapper(environ):
+        return False
+    marker = _MANAGED_RUNTIME_MARKER
+    try:
+        info = marker.lstat()
+        if (
+            not stat.S_ISREG(info.st_mode)
+            or info.st_uid != os.getuid()
+            or info.st_mode & 0o022
+            or info.st_size > 4096
+        ):
+            return False
+        payload = json.loads(marker.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, json.JSONDecodeError):
+        return False
+    from railmux import __version__
+    runtime_id = environ.get("RAILMUX_MSYS2_RUNTIME_ID")
+    return isinstance(runtime_id, str) and bool(runtime_id) and payload == {
+        "schema": 1,
+        "runtime": runtime_id,
+        "railmux": __version__,
+    }
+
+
+def private_mode_is_safe(mode: int) -> bool:
+    """Accept strict POSIX modes or the verified MSYS2 noacl projection."""
+    return not mode & 0o077 or (
+        running_in_managed_windows_wrapper() and not mode & 0o022
+    )
+
+
 def provider_path(
     raw: str,
     *,

{railmux-0.4.0.dev8 → railmux-0.4.0.dev10}/src/railmux/restart_state.py

@@ -17,6 +17,7 @@ from pathlib import Path
 from railmux import tmux_ctl
 from railmux.atomic_file import atomic_write_text
 from railmux.config import default_config_path
+from railmux.provider_paths import private_mode_is_safe
 
 
 SCHEMA_VERSION = 1
@@ -164,10 +165,15 @@ def legacy_state_path() -> Path:
 def _ensure_private_dir(path: Path) -> None:
     """Create and verify a Railmux-owned 0700 runtime directory."""
     path.mkdir(mode=0o700, parents=True, exist_ok=True)
-    info = path.stat()
+    info = path.lstat()
+    # MSYS2's default noacl projection reports user-owned NTFS directories as
+    # 0755 even after chmod(0700). The managed runtime itself lives below the
+    # Windows user's LocalAppData ACL. Accept that projection only on the real
+    # Cygwin/MSYS Python platform, and still reject symlinks, foreign owners,
+    # and any group/world-writable directory. POSIX platforms retain 0700.
     if (not stat.S_ISDIR(info.st_mode)
             or info.st_uid != os.getuid()
-            or info.st_mode & 0o077):
+            or not private_mode_is_safe(info.st_mode)):
         raise OSError("Railmux runtime state directory is not private")
 
 

{railmux-0.4.0.dev8 → railmux-0.4.0.dev10}/src/railmux/tmux_binding_manager.py

@@ -14,8 +14,14 @@ from railmux import restart_state, tmux_ctl
 from railmux.atomic_file import atomic_write_text
 
 
-_VERSION = 8
+_VERSION = 9
 _KEYS = ("F8", "F9")
+_STATUS_CLICK_KEYS = (
+    "MouseDown1Status",
+    "MouseDown1Control0",
+    "MouseDown1Control1",
+    "MouseDown1Control2",
+)
 _MAX_STATE_BYTES = 64 * 1024
 
 
@@ -79,7 +85,7 @@ class SharedTmuxBindingManager:
             info = self._state_path.lstat()
             if (not stat.S_ISREG(info.st_mode)
                     or info.st_uid != os.getuid()
-                    or info.st_mode & 0o077
+                    or not restart_state.private_mode_is_safe(info.st_mode)
                     or info.st_size > _MAX_STATE_BYTES):
                 return None
             raw = json.loads(self._state_path.read_text(encoding="utf-8"))
@@ -114,12 +120,18 @@ class SharedTmuxBindingManager:
             and all(value is None or isinstance(value, str)
                     for value in right_click_backup.values())
         )
-        status_click_valid = (
+        legacy_status_click_valid = (
             isinstance(status_click_backup, dict)
             and set(status_click_backup) == {"MouseDown1Status"}
             and all(value is None or isinstance(value, str)
                     for value in status_click_backup.values())
         )
+        status_click_valid = (
+            isinstance(status_click_backup, dict)
+            and set(status_click_backup) == set(_STATUS_CLICK_KEYS)
+            and all(value is None or isinstance(value, str)
+                    for value in status_click_backup.values())
+        )
         termux_tap_valid = (
             isinstance(termux_tap_backup, dict)
             and set(termux_tap_backup) == {"MouseDown1Pane"}
@@ -149,7 +161,13 @@ class SharedTmuxBindingManager:
                          or (not selection_hook_managed
                              and selection_hook_index is not None)))
                 or (raw["version"] >= 5
-                    and (not status_click_valid
+                    and ((raw["version"] < 9
+                          and not (
+                              legacy_status_click_valid
+                              or status_click_valid
+                          ))
+                         or (raw["version"] >= 9
+                             and not status_click_valid)
                          or not isinstance(status_click_managed, bool)))
                 or (raw["version"] >= 8
                     and (not termux_tap_valid
@@ -293,6 +311,29 @@ class SharedTmuxBindingManager:
                             or {"MouseDown1Pane": None}
                         )
                         upgraded = True
+                    if state["version"] < 9:
+                        if state["status_click_managed"]:
+                            if set(state["status_click_backup"]) != set(
+                                _STATUS_CLICK_KEYS
+                            ):
+                                status_click_backup = (
+                                    tmux_ctl.upgrade_root_status_click_binding(
+                                        state["status_click_backup"],
+                                        state["token"],
+                                    )
+                                )
+                                if status_click_backup is None:
+                                    return False
+                                state["status_click_backup"] = (
+                                    status_click_backup)
+                        else:
+                            state["status_click_backup"] = {
+                                key: None for key in _STATUS_CLICK_KEYS
+                            }
+                        # tmux 3.7 routes control ranges through dedicated
+                        # MouseDown1ControlN keys. Capture all originals before
+                        # reinstalling the shared status-click lease.
+                        upgraded = True
                     if upgraded:
                         state["version"] = _VERSION
                         state["phase"] = "installing"
@@ -341,17 +382,14 @@ class SharedTmuxBindingManager:
                             )
                         if state["status_click_managed"]:
                             current_status = (
-                                tmux_ctl.read_root_status_click_binding()
-                                ["MouseDown1Status"]
-                            )
-                            safe = (
-                                safe
-                                and tmux_ctl.root_status_click_binding_is_original_or_owned(
-                                    current_status,
-                                    state["status_click_backup"].get(
-                                        "MouseDown1Status"),
+                                tmux_ctl.read_root_status_click_binding())
+                            safe = safe and all(
+                                tmux_ctl.root_status_click_binding_is_original_or_owned(
+                                    current_status.get(key),
+                                    state["status_click_backup"].get(key),
                                     token,
                                 )
+                                for key in _STATUS_CLICK_KEYS
                             )
                         if state["termux_tap_managed"]:
                             current_tap = (
@@ -543,7 +581,8 @@ class SharedTmuxBindingManager:
                     "selection_hook_index": selection_hook_index,
                     "status_click_managed": status_click_backup is not None,
                     "status_click_backup": (
-                        status_click_backup or {"MouseDown1Status": None}),
+                        status_click_backup
+                        or {key: None for key in _STATUS_CLICK_KEYS}),
                     "termux_tap_managed": termux_tap_backup is not None,
                     "termux_tap_backup": (
                         termux_tap_backup or {"MouseDown1Pane": None}),