railmux 0.4.0.dev9__tar.gz → 0.4.0.dev11__tar.gz

{railmux-0.4.0.dev9/src/railmux.egg-info → railmux-0.4.0.dev11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: railmux
-Version: 0.4.0.dev9
+Version: 0.4.0.dev11
 Summary: Terminal UI to navigate, resume, and start Claude Code and Codex sessions
 Author-email: Rightglow <zhang.taian@foxmail.com>
 License-Expression: MIT

railmux-0.4.0.dev11/src/railmux/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.4.0.dev11"

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/cli.py

@@ -20,6 +20,7 @@ from railmux.runtime_config import (
 )
 from railmux import tmux_health
 from railmux import tmux_server
+from railmux import windows_tmux_lifecycle
 from railmux.system_deps import ensure_tmux_available
 from railmux.ssh_args import AppendSshArgument, ExtendSshArguments
 
@@ -126,7 +127,16 @@ def _run_tmux_client_with_watchdog(
                     file=sys.stderr,
                 )
                 return 2
+        # tmux may leave the client TTY in raw mode even after its process
+        # exits. Restore it before a bounded recovery probe or user message.
+        _restore_terminal(attributes)
         returncode = process.returncode or 0
+        if windows_tmux_lifecycle.recover_abandoned_socket():
+            print(
+                "info: cleaned an abandoned Windows tmux socket; Codex and "
+                "Claude session files were not changed",
+                file=sys.stderr,
+            )
         if returncode and expected_target is not None:
             try:
                 current_target = tmux_server.discover_target(timeout=1.0)
@@ -367,6 +377,12 @@ def main(argv: list[str] | None = None) -> int:
         # Validate before any command can address a tmux server. ``tmux -V``
         # above is server-independent.
         tmux_server.socket_label()
+        if windows_tmux_lifecycle.recover_abandoned_socket():
+            print(
+                "info: cleaned an abandoned Windows tmux socket; Codex and "
+                "Claude session files were not changed",
+                file=sys.stderr,
+            )
         dedicated_target = tmux_server.discover_target()
         on_dedicated_server = tmux_server.is_current_server(dedicated_target)
     except tmux_server.TmuxServerError as exc:

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/codex_index.py

@@ -25,7 +25,7 @@ from railmux.models import (
     Project,
     SessionMeta,
 )
-from railmux.provider_paths import provider_path
+from railmux.provider_paths import private_mode_is_safe, provider_path
 from railmux.renames import Renames
 
 # Codex has no reliable provider-neutral signal that distinguishes a long
@@ -461,7 +461,7 @@ class CodexIndex:
             if (
                 not stat.S_ISREG(info.st_mode)
                 or info.st_uid != os.getuid()
-                or info.st_mode & 0o077
+                or not private_mode_is_safe(info.st_mode)
                 or info.st_size > _PERSISTENT_CACHE_MAX_BYTES
             ):
                 return

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/discovery.py

@@ -10,6 +10,7 @@ from pathlib import Path
 from railmux.atomic_file import atomic_write_text
 from railmux.models import Project
 from railmux.path_codec import decode, is_encoded_project_name
+from railmux.provider_paths import private_mode_is_safe
 from railmux.session_index import _looks_like_uuid, _scan_session
 
 
@@ -55,7 +56,7 @@ def _load_persistent_validity(claude_home: Path) -> None:
             not stat.S_ISREG(info.st_mode)
             or info.st_uid != os.getuid()
             or info.st_size > _VALIDITY_CACHE_LIMIT
-            or info.st_mode & 0o077
+            or not private_mode_is_safe(info.st_mode)
         ):
             return
         raw = json.loads(path.read_text(encoding="utf-8"))

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/fast_display_server.py

@@ -1493,7 +1493,7 @@ def _acquire_display_lock(
         if (
             not stat.S_ISREG(info.st_mode)
             or info.st_uid != os.getuid()
-            or info.st_mode & 0o077
+            or not restart_state.private_mode_is_safe(info.st_mode)
         ):
             raise OSError("unsafe display lock")
         deadline = time.monotonic() + max(0.0, timeout)

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/mouse_manager.py

@@ -60,7 +60,7 @@ class RootWheelForwardingManager:
             info = self._state_path.lstat()
             if (not stat.S_ISREG(info.st_mode)
                     or info.st_uid != os.getuid()
-                    or info.st_mode & 0o077
+                    or not restart_state.private_mode_is_safe(info.st_mode)
                     or info.st_size > _MAX_STATE_BYTES):
                 return None
             raw = json.loads(self._state_path.read_text(encoding="utf-8"))

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/orphan_marker.py

@@ -231,7 +231,7 @@ def claim_owner(
         parent = lock_path.parent.stat()
         if (not stat.S_ISDIR(parent.st_mode)
                 or parent.st_uid != os.getuid()
-                or parent.st_mode & 0o077):
+                or not restart_state.private_mode_is_safe(parent.st_mode)):
             return None
         flags = os.O_CREAT | os.O_RDWR
         if hasattr(os, "O_NOFOLLOW"):
@@ -243,7 +243,7 @@ def claim_owner(
         info = os.fstat(fd)
         if (not stat.S_ISREG(info.st_mode)
                 or info.st_uid != os.getuid()
-                or info.st_mode & 0o077):
+                or not restart_state.private_mode_is_safe(info.st_mode)):
             return None
         try:
             fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)

railmux-0.4.0.dev11/src/railmux/provider_paths.py

@@ -0,0 +1,102 @@
+"""Translate provider-owned native Windows paths inside the MSYS2 preview."""
+from __future__ import annotations
+
+import json
+import os
+import re
+import stat
+import sys
+from collections.abc import Mapping
+from pathlib import Path
+
+
+_DRIVE_PATH = re.compile(r"^(?:\\\\\?\\)?([A-Za-z]):[\\/](.*)\Z")
+_MANAGED_BASE_MARKER = Path("/railmux-base.json")
+_MANAGED_APP_ROOT = Path("/opt/railmux/apps")
+_MANAGED_APP_ID = re.compile(
+    r"railmux-[0-9]+(?:\.[0-9]+)*(?:\.dev[0-9]+)?\Z"
+)
+
+
+def running_in_windows_wrapper(environ: Mapping[str, str] = os.environ) -> bool:
+    """Return whether Railmux is running in its native-Windows MSYS2 wrapper."""
+    return environ.get("RAILMUX_WINDOWS_RUNTIME") == "msys2"
+
+
+def running_in_managed_windows_wrapper(
+    environ: Mapping[str, str] = os.environ,
+) -> bool:
+    """Verify the installed MSYS2 runtime, not merely its environment hint."""
+    if sys.platform != "cygwin" or not running_in_windows_wrapper(environ):
+        return False
+    runtime_id = environ.get("RAILMUX_MSYS2_RUNTIME_ID")
+    app_id = environ.get("RAILMUX_MSYS2_APP_ID")
+    if (
+        not isinstance(runtime_id, str)
+        or not runtime_id
+        or not isinstance(app_id, str)
+        or _MANAGED_APP_ID.fullmatch(app_id) is None
+    ):
+        return False
+
+    def read_safe_marker(marker: Path) -> object | None:
+        try:
+            info = marker.lstat()
+            if (
+                not stat.S_ISREG(info.st_mode)
+                or info.st_uid != os.getuid()
+                or info.st_mode & 0o022
+                or info.st_size > 4096
+            ):
+                return None
+            return json.loads(marker.read_text(encoding="utf-8"))
+        except (OSError, UnicodeError, json.JSONDecodeError):
+            return None
+
+    base_payload = read_safe_marker(_MANAGED_BASE_MARKER)
+    app_payload = read_safe_marker(
+        _MANAGED_APP_ROOT / app_id / "railmux-app.json"
+    )
+    from railmux import __version__
+
+    return base_payload == {
+        "schema": 1,
+        "runtime": runtime_id,
+    } and app_payload == {
+        "schema": 1,
+        "runtime": runtime_id,
+        "railmux": __version__,
+    }
+
+
+def private_mode_is_safe(mode: int) -> bool:
+    """Accept strict POSIX modes or the verified MSYS2 noacl projection."""
+    return not mode & 0o077 or (
+        running_in_managed_windows_wrapper() and not mode & 0o022
+    )
+
+
+def provider_path(
+    raw: str,
+    *,
+    environ: Mapping[str, str] = os.environ,
+) -> Path:
+    """Return a POSIX-visible path for provider metadata.
+
+    Native providers write Windows paths into session metadata. Railmux runs
+    under MSYS2, where the same locations are mounted as ``/c/...`` (or
+    ``//server/share/...`` for UNC paths). Outside the wrapper, preserve the
+    existing POSIX behavior exactly.
+    """
+    if not running_in_windows_wrapper(environ):
+        return Path(raw)
+
+    match = _DRIVE_PATH.match(raw)
+    if match is not None:
+        drive, tail = match.groups()
+        return Path(f"/{drive.lower()}/{tail.replace(chr(92), '/')}")
+
+    if raw.startswith("\\\\"):
+        return Path("//" + raw[2:].replace("\\", "/"))
+
+    return Path(raw.replace("\\", "/"))

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/restart_state.py

@@ -17,6 +17,7 @@ from pathlib import Path
 from railmux import tmux_ctl
 from railmux.atomic_file import atomic_write_text
 from railmux.config import default_config_path
+from railmux.provider_paths import private_mode_is_safe
 
 
 SCHEMA_VERSION = 1
@@ -164,10 +165,15 @@ def legacy_state_path() -> Path:
 def _ensure_private_dir(path: Path) -> None:
     """Create and verify a Railmux-owned 0700 runtime directory."""
     path.mkdir(mode=0o700, parents=True, exist_ok=True)
-    info = path.stat()
+    info = path.lstat()
+    # MSYS2's default noacl projection reports user-owned NTFS directories as
+    # 0755 even after chmod(0700). The managed runtime itself lives below the
+    # Windows user's LocalAppData ACL. Accept that projection only on the real
+    # Cygwin/MSYS Python platform, and still reject symlinks, foreign owners,
+    # and any group/world-writable directory. POSIX platforms retain 0700.
     if (not stat.S_ISDIR(info.st_mode)
             or info.st_uid != os.getuid()
-            or info.st_mode & 0o077):
+            or not private_mode_is_safe(info.st_mode)):
         raise OSError("Railmux runtime state directory is not private")
 
 

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/tmux_binding_manager.py

@@ -85,7 +85,7 @@ class SharedTmuxBindingManager:
             info = self._state_path.lstat()
             if (not stat.S_ISREG(info.st_mode)
                     or info.st_uid != os.getuid()
-                    or info.st_mode & 0o077
+                    or not restart_state.private_mode_is_safe(info.st_mode)
                     or info.st_size > _MAX_STATE_BYTES):
                 return None
             raw = json.loads(self._state_path.read_text(encoding="utf-8"))

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/ui/app.py

@@ -25,6 +25,7 @@ from railmux import (
     tmux_ctl,
     tmux_health,
     tmux_server,
+    windows_tmux_lifecycle,
 )
 from railmux.atomic_file import atomic_write_text
 from railmux.background_index import BackgroundCodexIndex
@@ -713,6 +714,9 @@ class App:
         # digest plus immutable pane id namespaces local recovery state across
         # windows, sessions, and private tmux servers.
         self._restart_identity = restart_state.capture_outer_identity()
+        # A newly live UI revokes any cleanup proof from the preceding
+        # lifecycle before it can create provider sessions.
+        windows_tmux_lifecycle.clear_empty_server_exit()
         self._claude_home = claude_home
         self._config = config
         self._auto_launched = auto_launched
@@ -8061,10 +8065,25 @@ class App:
         if defer_outer or getattr(self, "_outer_teardown_done", False):
             return
         self._outer_teardown_done = True
+        identity = getattr(self, "_restart_identity", None)
+        if (
+            self._auto_launched
+            and identity is not None
+            and running_in_windows_wrapper()
+            and tmux_ctl.current_session_name() == "railmux"
+            and tmux_ctl.current_session_id() == identity.session_id
+        ):
+            # MSYS2 can retain an AF_UNIX pathname after its last session
+            # exits. Arm cleanup only when the server-wide immutable-ID
+            # inventory proves that no provider or unknown session exists.
+            windows_tmux_lifecycle.arm_empty_server_exit(
+                server_pid=identity.server_pid,
+                session_id=identity.session_id,
+                pane_id=identity.pane_id,
+            )
         if not self._soft_quit_flag and self._auto_launched:
             session_name = tmux_ctl.current_session_name()
             if session_name == "railmux":
-                identity = getattr(self, "_restart_identity", None)
                 current_id = tmux_ctl.current_session_id()
                 intent = bool(
                     identity is not None
@@ -8080,6 +8099,7 @@ class App:
                     killed = False
                 if intent and not killed:
                     tmux_health.clear_clean_exit()
+                    windows_tmux_lifecycle.clear_empty_server_exit()
 
     def _enter_filter_mode(self) -> None:
         # Borrow the button row (footer index 1) for a filter Edit — both are a

{railmux-0.4.0.dev9 → railmux-0.4.0.dev11}/src/railmux/windows_bootstrap.py

@@ -14,6 +14,7 @@ from railmux.windows_msys2 import (
     find_runtime,
     install_managed_runtime,
     managed_root,
+    reusable_managed_base_candidate,
 )
 
 
@@ -45,7 +46,7 @@ def _runtime_status(
         ownership = "Railmux-managed" if runtime.managed else "user-owned override"
         print(f"Runtime: {ownership} at {runtime.root}")
     else:
-        root = managed_root(environ, version=__version__)
+        root = managed_root(environ)
         if root is not None:
             print(f"Managed location: {root}")
     print("Provider data: shared from the Windows user profile")
@@ -55,7 +56,8 @@ def _runtime_status(
 def _confirm_install(*, input_fn: Callable[[str], str] = input) -> bool:
     try:
         answer = input_fn(
-            "Install the private MSYS2/tmux runtime now? On Windows, Railmux "
+            "No reusable MSYS2 base was found. Install the private MSYS2/tmux "
+            "runtime now? On Windows, Railmux "
             "depends on a complete private MSYS2 compatibility wrapper, "
             "including tmux and Python. This downloads a 50 MB base plus "
             "required updates and packages, "
@@ -74,14 +76,30 @@ def _install(
     verbose: bool = False,
     input_fn: Callable[[str], str] = input,
 ) -> Msys2Runtime | None:
-    if not assume_yes and not _confirm_install(input_fn=input_fn):
-        print("MSYS2 runtime installation cancelled.", file=sys.stderr)
-        return None
+    reuse_only = False
+    if not assume_yes:
+        reusable = reusable_managed_base_candidate(environ)
+        if reusable is None:
+            if not _confirm_install(input_fn=input_fn):
+                print("MSYS2 runtime installation cancelled.", file=sys.stderr)
+                return None
+        else:
+            _root, source_version = reusable
+            detail = (
+                f" from Railmux {source_version}" if source_version else ""
+            )
+            print(
+                f"Reusing the matching MSYS2 {MSYS2_RELEASE} private base"
+                f"{detail}; only the Railmux {__version__} app layer will be "
+                "installed."
+            )
+            reuse_only = True
     try:
         runtime = install_managed_runtime(
             version=__version__,
             environ=environ,
             verbose=verbose,
+            reuse_only=reuse_only,
         )
     except RuntimeInstallError as exc:
         print(f"error: {exc}", file=sys.stderr)
@@ -166,7 +184,7 @@ def main(
         return 0 if runtime is not None else 2
 
     if runtime is None:
-        root = managed_root(environ, version=__version__)
+        root = managed_root(environ)
         print(
             "Railmux for Windows needs its private MSYS2/tmux runtime.\n"
             "The Windows Codex/Claude executables and their existing session "
@@ -175,7 +193,10 @@ def main(
         )
         if root is not None:
             print(f"Managed location: {root}", file=sys.stderr)
-        if not stdin_isatty():
+        if (
+            not stdin_isatty()
+            and reusable_managed_base_candidate(environ) is None
+        ):
             print(
                 "Run 'railmux runtime install' interactively or "
                 "'railmux runtime install --yes' to install it.",